IFAttn: Binary code similarity analysis based on interpretable features with attention. Issue 120 (September 2022)

• Record Type: Journal Article
• Authors: Jiang, Shuai; Fu, Cai; Qian, Yekui; He, Shuai; Lv, Jianqiang; Han, Lansheng
• Is Part Of: Computers & security. Issue 120(2022)
• Publication Date: 2022-09
• Subjects: Binary code similarity analysis -- Attention mechanism -- Siamese network -- Feature fusion -- Code semantic; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2022.102804
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Binary code similarity analysis (BCSA 1 ) is meaningful in various software security applications, including vulnerability discovery, clone detection, and malware detection. Although many BCSA studies have been based on neural networks in recent years, some significant problems are challenging to solve. First, most existing methods focus more on the function pair similarity detection task (FPSDT 2 ) while ignoring the function search task (FST 3 ), which is more major in vulnerability discovery. Moreover, they care more about the final result, which is to improve the success rate of FPSDT by using unexplainable neural networks. Finally, in practice, most methods are difficult to resist cross-optimization and cross-obfuscation in BCSA. We first proposed an adaptive BCSA architecture combining interpretable feature engineering and learnable attention mechanism to solve these problems. We design an adaptive model with rich interpretable features, and the experimental results on FPSDT and FST are better than the state-of-the-art methods. In addition, we also found that the attention mechanism has outstanding advantages in functional semantic expression. Finally, the evaluation shows that our approach can significantly improve FST performance between cross-architecture, cross-optimization, cross-obfuscation and cross-compiler binaries.