Cross-platform Binary Code Association Analysis Based On Deep Learning

Nowadays,more and more IOT vendors use the similar code to compile firmware for devices based on various CPU architectures.Due to the extensive code reuse,it is of great practical value to perform homology detection on cross-platform binary code.The problem of cross-platform binary code similarity detection aims at detecting whether two binary functions coming from different platforms are similar or not.It has many security applications,including plagiarism detection,malware detection,vulnerability search,etc.The existing platform-based binary code association method cannot be directly applied to the cross-platform scenario: the bit stream comparison technology analysis object is the bit stream,which is related to the coding mode adopted by the platform;the instruction sequence comparison technical analysis object is The instruction sequence,which is related to the instruction set used by the platform;the dynamic instrumentation technique analyzes the intermediate results in the dynamic analysis process that is limited by the platform compatibility of the analysis tool.The existing cross-platform binary code association analysis relies on approximate pattern matching algorithms,which are inevitably slow in speed,and the accuracy isn't high and it is difficult to adapt to new tasks.In recent years,deep learning technology has been widely used in various fields,including binary function analysis,and it has shown its advantages of high precision and speed.This paper mainly studies the homology of binary function pairs based on neural network.This paper will use the binary function code attribute to control the cross-platformity of the flow graph,and extract the corresponding attribute control flow graph for each function in the pair to be detected.Then,an embedding vector is generated for each attribute control flow graph by using the graph embedded neural network.Finally,the homology similarity of the pair to be detected is measured by calculating the distance between the corresponding numerical vectors of a pair of functions.In this paper,two graph embedding algorithms based on fully connected neural network and GRU cyclic neural network are proposed.Based on the existing attribute control flow graph vertex embedding algorithm,the fully connected neural network and GRU cyclic neural network are used to generate graphs.Embedding,the end-toend training of the entire twin map embedded neural network is finally carried out.The experimental results show that the similarity detection accuracy of the two graph embedding algorithms presented in this paper is better than the existing deep learningbased correlation techniques,and the two algorithms are used in the case of using the same training and verification dataset.The effect on non-homologous binary code detection is more significant.