arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 1812.09652cs.CRcs.AIcs.CL
收藏

一种面向自然语言处理的跨体系结构指令嵌入模型

A Cross-Architecture Instruction Embedding Model for Natural Language Processing-Inspired Binary Code Analysis

University of South Carolina(南卡罗来纳大学)

Kimberly Redmond, Lannan Luo, Qiang Zeng

摘要:

给定一个闭源程序,如大多数的专有软件和病毒,二进制代码分析是必不可少的许多任务,如代码剽窃检测和恶意软件分析。今天,源代码经常被编译用于各种体系结构,使得跨体系结构的二进制代码分析变得越来越重要。一个二进制文件在反汇编后,用汇编语言表示。因此,最近的工作开始探索自然语言处理(NLP)启发的二进制代码分析。在NLP中,单词通常以高维向量表示(即,嵌入)以促进进一步处理,这是许多NLP任务中最常见和最关键的步骤之一。我们把指令看作是NLP启发的二进制代码分析中的单词,并旨在将指令表示为嵌入。为了便于跨架构的二进制代码分析,我们的目标是,类似的指令,无论其架构,有嵌入彼此接近。为此,我们提出了一种联合学习的方法来生成指令嵌入,捕捉不仅在一个架构内的指令的语义,但它们的语义关系跨架构。据我们所知,这是第一个跨体系结构的指令嵌入模型的建立工作。作为一个展示,我们应用该模型来解决二进制代码相似性比较的最基本的问题之一-基于语义的基本块比较,解决方案优于基于代码统计的方法。实验结果表明,该模型在其他跨体系结构的二进制代码分析任务中具有广阔的应用前景。

英文摘要:

Given a closed-source program, such as most of proprietary software and viruses, binary code analysis is indispensable for many tasks, such as code plagiarism detection and malware analysis. Today, source code is very often compiled for various architectures, making cross-architecture binary code analysis increasingly important. A binary, after being disassembled, is expressed in an assembly languages. Thus, recent work starts exploring Natural Language Processing (NLP) inspired binary code analysis. In NLP, words are usually represented in high-dimensional vectors (i.e., embeddings) to facilitate further processing, which is one of the most common and critical steps in many NLP tasks. We regard instructions as words in NLP-inspired binary code analysis, and aim to represent instructions as embeddings as well. To facilitate cross-architecture binary code analysis, our goal is that similar instructions, regardless of their architectures, have embeddings close to each other. To this end, we propose a joint learning approach to generating instruction embeddings that capture not only the semantics of instructions within an architecture, but also their semantic relationships across architectures. To the best of our knowledge, this is the first work on building cross-architecture instruction embedding model. As a showcase, we apply the model to resolving one of the most fundamental problems for binary code similarity comparison---semantics-based basic block comparison, and the solution outperforms the code statistics based approach. It demonstrates that it is promising to apply the model to other cross-architecture binary code analysis tasks.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑