While third-party libraries are extensively reused to enhance productivity during software development, they can also introduce potential security risks such as vulnerability propagation. Software composition analysis, proposed to identify reused TPLs for reducing such risks, has become an essential procedure within modern DevSecOps. As one of the mainstream SCA techniques, binary-to-source SCA identifies the third-party source projects contained in binary files via binary source code matching, which is a major challenge in reverse engineering since binary and source code exhibit substantial disparities after compilation. The existing binary-to-source SCA techniques leverage basic syntactic features that suffer from redundancy and lack robustness in the large-scale TPL dataset, leading to inevitable false positives and compromised recall. To mitigate these limitations, we introduce BinaryAI, a novel binary-to-source SCA technique with two-phase binary source code matching to capture both syntactic and semantic code features. First, BinaryAI trains a transformer-based model to produce function-level embeddings and obtain similar source functions for each binary function accordingly. Then by applying the link-time locality to facilitate function matching, BinaryAI detects the reused TPLs based on the ratio of matched source functions. Our experimental results demonstrate the superior performance of BinaryAI in terms of binary source code matching and the downstream SCA task. Specifically, our embedding model outperforms the state-of-the-art model CodeCMR, i.e., achieving 22.54% recall@1 and 0.34 MRR compared with 10.75% and 0.17 respectively. Additionally, BinaryAI outperforms all existing binary-to-source SCA tools in TPL detection, increasing the precision from 73.36% to 85.84% and recall from 59.81% to 64.98% compared with the well-recognized commercial SCA product.

翻译：尽管第三方库在软件开发中被广泛复用以提高生产力，但它们也可能引入潜在的安全风险，例如漏洞传播。为识别被复用的第三方库以降低此类风险而提出的软件成分分析，已成为现代DevSecOps中不可或缺的环节。作为主流的SCA技术之一，二进制到源代码的SCA通过二进制源代码匹配来识别二进制文件中包含的第三方源码项目，这是逆向工程中的一项主要挑战，因为二进制文件与源代码在编译后表现出显著差异。现有的二进制到源代码SCA技术利用基本的语法特征，这些特征在大规模第三方库数据集中存在冗余且缺乏鲁棒性，导致不可避免的误报并损害了召回率。为缓解这些局限性，我们提出了BinaryAI，一种新颖的二进制到源代码SCA技术，采用两阶段二进制源代码匹配以同时捕获语法和语义代码特征。首先，BinaryAI训练一个基于Transformer的模型以生成函数级嵌入，并据此为每个二进制函数获取相似的源代码函数。随后，通过应用链接时局部性来促进函数匹配，BinaryAI基于匹配到的源代码函数比例来检测被复用的第三方库。我们的实验结果证明了BinaryAI在二进制源代码匹配及下游SCA任务上的卓越性能。具体而言，我们的嵌入模型优于当前最先进的模型CodeCMR，即在Recall@1上达到22.54%且MRR为0.34，而CodeCMR分别为10.75%和0.17。此外，在第三方库检测方面，BinaryAI优于所有现有的二进制到源代码SCA工具，与公认的商业SCA产品相比，将精确率从73.36%提升至85.84%，召回率从59.81%提升至64.98%。