arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2209.02442cs.CRcs.AIcs.LGcs.PLcs.SE
收藏

SimCLF:一种用于函数级二进制嵌入的简单对比学习框架

SimCLF: A Simple Contrastive Learning Framework for Function-level Binary Embeddings

Army Engineering University of PLA(中国人民解放军陆军工程大学);National Computer Network and Information Security Management Center(国家计算机网络与信息安全管理中心);Shanghai Jiao Tong University(上海交通大学);University Of Science & Technology Beijing(北京科技大学)

Sun RuiJin, Guo Shize, Guo Jinhong, Li Wei, Zhan Dazhi, Sun Meng, Pan Zhisong

AI总结:

SimCLF提出无监督对比学习框架,直接处理反汇编函数,利用编译器优化和混淆生成增强数据,实现函数级二进制相似性检测,在准确性和少样本场景下超越现有方法。

摘要:

函数级二进制代码相似性检测是网络安全的一个关键方面。它能够检测已发布软件中的漏洞和专利侵权,并在防止供应链攻击中发挥关键作用。一个实用的嵌入学习框架依赖于汇编代码表示的鲁棒性和函数对标注的准确性,这传统上是通过基于监督学习的框架来实现的。然而,为不同的函数对标注准确的标签带来了相当大的挑战。这些监督学习方法容易过训练,并遭受表示鲁棒性问题。为了应对这些挑战,我们提出了SimCLF:一种用于函数级二进制嵌入的简单对比学习框架。我们采用无监督学习方法,将二进制代码相似性检测表述为实例判别。SimCLF直接对反汇编的二进制函数进行操作,并可与任何编码器实现。它不需要手动标注的信息,只需要增强数据。增强数据是使用编译器优化选项和代码混淆技术生成的。实验结果表明,SimCLF在准确性上超越了现有最先进的方法,并在少样本设置中具有显著优势。

英文摘要:

Function-level binary code similarity detection is a crucial aspect of cybersecurity. It enables the detection of bugs and patent infringements in released software and plays a pivotal role in preventing supply chain attacks. A practical embedding learning framework relies on the robustness of the assembly code representation and the accuracy of function-pair annotation, which is traditionally accomplished using supervised learning-based frameworks. However, annotating different function pairs with accurate labels poses considerable challenges. These supervised learning methods can be easily overtrained and suffer from representation robustness problems. To address these challenges, we propose SimCLF: A Simple Contrastive Learning Framework for Function-level Binary Embeddings. We take an unsupervised learning approach and formulate binary code similarity detection as instance discrimination. SimCLF directly operates on disassembled binary functions and could be implemented with any encoder. It does not require manually annotated information but only augmented data. Augmented data is generated using compiler optimization options and code obfuscation techniques. The experimental results demonstrate that SimCLF surpasses the state-of-the-art in accuracy and has a significant advantage in few-shot settings.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑