Binary code similarity detection (BCSD) has various applications, including but not limited to vulnerability detection, plagiarism detection, and malware detection. Previous research efforts mainly focus on transforming binary code to assembly code strings using reverse compilation and then using pre-trained deep learning models with large parameters to obtain feature representation vector of binary code. While these models have proven to be effective in representing binary code, their large parameter size leads to considerable computational expenses during both training and inference. In this paper, we present a lightweight neural network, called FastBCSD, that employs a dynamic instruction vector encoding method and takes only assembly code as input feature to achieve comparable accuracy to the pre-training models while reducing the computational resources and time cost. On the BinaryCorp dataset, our method achieves a similar average MRR score to the state-of-the-art pre-training-based method (jTrans), while on the BinaryCorp 3M dataset, our method even outperforms the latest technology by 0.01. Notably, FastBCSD has a much smaller parameter size (13.4M) compared to jTrans (87.88M), and its latency time is 1/5 of jTrans on NVIDIA GTX 1080Ti.
翻译:二进制代码相似性检测(BCSD)具有广泛的应用,包括但不限于漏洞检测、抄袭检测和恶意软件检测。以往的研究主要集中于通过反编译将二进制代码转换为汇编代码字符串,然后利用参数规模庞大的预训练深度学习模型获取二进制代码的特征表示向量。尽管这些模型在表示二进制代码方面已被证明有效,但其庞大的参数量在训练和推理过程中导致了显著的计算开销。本文提出一种轻量级神经网络FastBCSD,该网络采用动态指令向量编码方法,仅以汇编代码作为输入特征,在显著降低计算资源和时间成本的同时,实现了与预训练模型相当的准确性。在BinaryCorp数据集上,本方法取得了与当前最先进的基于预训练的方法(jTrans)相近的平均MRR分数;而在BinaryCorp 3M数据集上,本方法甚至以0.01的优势超越了最新技术。值得注意的是,FastBCSD的参数量(13.4M)远小于jTrans(87.88M),且在NVIDIA GTX 1080Ti上的延迟时间仅为jTrans的1/5。