再论使用可解释特征工程的二进制代码相似性分析及其经验教训
Revisiting Binary Code Similarity Analysis using Interpretable Feature Engineering and Lessons Learned
摘要：
二进制代码相似性分析（BCSA）被广泛用于各种安全应用，包括剽窃检测，软件许可证违规检测和漏洞发现。尽管BCSA的研究兴趣激增，但由于几个原因，在这一领域进行新的研究具有重大挑战性。首先，大多数现有的方法只关注最终结果，即通过采用不可解释的机器学习来提高BCSA的成功率。此外，它们使用自己的基准，既不共享源代码，也不共享整个数据集。最后，研究人员经常使用不同的术语，甚至使用相同的技术，而没有正确引用以前的文献，这使得很难复制或扩展以前的工作。为了解决这些问题，我们从主流中退一步，思考BCSA的基本研究问题。为什么某项技术或某项功能比其他技术显示出更好的结果？具体来说，我们进行了第一次系统的研究，在BCSA中使用的基本功能，利用可解释的功能工程的大规模基准。我们的研究揭示了各种有用的见解BCSA。例如，我们展示了一个简单的可解释模型，具有一些基本特征，可以实现与最近基于深度学习的方法相当的结果。此外，我们表明，我们编译二进制文件或底层二进制分析工具的正确性的方式可以显着影响BCSA的性能。最后，我们公开了所有的源代码和基准测试，并提出了该领域未来的发展方向，以帮助进一步的研究。
英文摘要：
Binary code similarity analysis (BCSA) is widely used for diverse security applications, including plagiarism detection, software license violation detection, and vulnerability discovery. Despite the surging research interest in BCSA, it is significantly challenging to perform new research in this field for several reasons. First, most existing approaches focus only on the end results, namely, increasing the success rate of BCSA, by adopting uninterpretable machine learning. Moreover, they utilize their own benchmark, sharing neither the source code nor the entire dataset. Finally, researchers often use different terminologies or even use the same technique without citing the previous literature properly, which makes it difficult to reproduce or extend previous work. To address these problems, we take a step back from the mainstream and contemplate fundamental research questions for BCSA. Why does a certain technique or a certain feature show better results than the others? Specifically, we conduct the first systematic study on the basic features used in BCSA by leveraging interpretable feature engineering on a large-scale benchmark. Our study reveals various useful insights on BCSA. For example, we show that a simple interpretable model with a few basic features can achieve a comparable result to that of recent deep learning-based approaches. Furthermore, we show that the way we compile binaries or the correctness of underlying binary analysis tools can significantly affect the performance of BCSA. Lastly, we make all our source code and benchmark public and suggest future directions in this field to help further research.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
