Semantic-Based Representation Binary Clone Detection for Cross-Architectures in the Internet of Things

Abstract

Code reuse is widespread in software development as well as internet of things (IoT) devices. However, code reuse introduces many problems, e.g., software plagiarism and known vulnerabilities. Solving these problems requires extensive manual reverse analysis. Fortunately, binary clone detection can help analysts mitigate manual work by matching reusable code and known parts. However, many binary clone detection methods are not robust to various compiler optimization options and different architectures. While some clone detection methods can be applied across different architectures, they rely on manual features based on human prior knowledge to generate feature vectors for assembly functions and fail to consider the internal associations between features from a semantic perspective. To address this problem, we propose and implement a prototype GeneDiff, a semantic-based representation binary clone detection approach for cross-architectures. GeneDiff utilizes a representation model based on natural language processing (NLP) to generate high-dimensional numeric vectors for each function based on the Valgrind intermediate representation (VEX) representation. This is the first work that translates assembly instructions into an intermediate representation and uses a semantic representation model to implement clone detection for cross-architectures. GeneDiff is robust to various compiler optimization options and different architectures. Compared to approaches using symbolic execution, GeneDiff is significantly more efficient and accurate. The area under the curve (AUC) of the receiver operating characteristic (ROC) of GeneDiff reaches 92.35%, which is considerably higher than the approaches that use symbolic execution. Extensive experiments indicate that GeneDiff can detect similarity with high accuracy even when the code has been compiled with different optimization options and targeted to different architectures. We also use real-world IoT firmware across different architectures as targets, therein proving the practicality of GeneDiff in being able to detect known vulnerabilities.

FUSION: Measuring Binary Function Similarity with Code-Specific Embedding and Order-Sensitive GNN

“…This limits the benefit of NSP. Some recent methods also adopted PTT, predicting the similarities between two instructions [11,25]. However, they still treat the individual instruction as the unit to mine semantic information, which may also be less effective.…”

A Survey of Software Clone Detection From Security Perspective

“…The consequent clone attacks need more efficient corresponding detection approaches. To detect code clones in IoT applications, Tekchandani et al [53], and Luo et al [54] provided good results based on semanticlevel source code analysis; however, their studies were not primarily on cloned vulnerability detection. Sachidananda et al [55] proposed a framework to detect various vulnerabilities located in IoT devices using the static analysis method.…”

Formal Analysis and Verification of Airborne Software Based on DO-333

“…The Hex-Rays Decompiler, which is one of its well-known plug-ins for automatic decompilation, was used to decompile the assembly instructions into C files. More importantly, it supports the compiler-generated code for the x86, x64, ARM32, ARM64 and PowerPC processors, satisfying the needs of most airborne software decompilations [62]. The Hex-Rays Decompiler was used to decompile the object code of the ADC software to acquire the decompiled source code, as displayed in Figure 10.…”