Asteria-Pro：通过引入领域知识增强基于深度学习的二进制代码相似性检测
Asteria-Pro: Enhancing Deep-Learning Based Binary Code Similarity Detection by Incorporating Domain Knowledge
AI总结：
本文提出Asteria-Pro，通过引入基于领域知识的预过滤和重排序模块增强深度学习二进制代码相似性检测，大幅降低计算时间并提升MRR和Recall，在大规模真实固件漏洞搜索中实现91.65%的高精度。
摘要：
广泛的代码复用导致漏洞在各种固件中大量扩散，迫切需要有效且高效地检测这些漏洞代码。基于AI的二进制代码相似性检测通过衡量代码相似性，被应用于大规模检测漏洞代码。现有研究提出了多种函数特征来捕获相似性检测的共性。然而，IoT硬件架构的多样性引起的显著代码语法变异性降低了二进制代码相似性检测的准确性。在我们早期的研究和工具Asteria中，我们采用Tree-LSTM网络将函数语义概括为函数共性，评估结果表明其具有先进的性能。然而，在搜索大规模固件漏洞时，由于过高的时间成本和精度不足，它仍存在实用性问题。为此，我们提出了一种新型深度学习增强架构，通过引入基于领域知识的预过滤和重排序模块，并基于Asteria开发了一个名为Asteria-Pro的原型。预过滤模块旨在剔除不相似的函数以加速后续深度学习模型计算，而重排序模块旨在提升深度学习模型生成的候选结果中漏洞函数的排名。我们的评估表明，预过滤模块将计算时间减少了96.9%，重排序模块使MRR和Recall分别提升了23.71%和36.4%。通过结合预过滤和重排序模块，Asteria-Pro在漏洞搜索任务中以显著优势超越了现有最先进的方法。我们进行了大规模真实世界固件漏洞搜索，Asteria-Pro成功检测出1,482个漏洞函数，精度高达91.65%。
英文摘要：
The widespread code reuse allows vulnerabilities to proliferate among a vast variety of firmware. There is an urgent need to detect these vulnerable code effectively and efficiently. By measuring code similarities, AI-based binary code similarity detection is applied to detecting vulnerable code at scale. Existing studies have proposed various function features to capture the commonality for similarity detection. Nevertheless, the significant code syntactic variability induced by the diversity of IoT hardware architectures diminishes the accuracy of binary code similarity detection. In our earlier study and the tool Asteria, we adopt a Tree-LSTM network to summarize function semantics as function commonality and the evaluation result indicates an advanced performance. However, it still has utility concerns due to excessive time costs and inadequate precision while searching for large-scale firmware bugs. To this end, we propose a novel deep learning enhancement architecture by incorporating domain knowledge-based pre-filtration and re-ranking modules, and we develop a prototype based on Asteria called Asteria-Pro. Pre-filtration module seeks to eliminates dissimilar functions to boost subsequent deep learning model calculations, while re-ranking module aims to raises the rankings of vulnerable functions among candidates generated by deep learning model. Our evaluation indicates that pre-filtration module cuts the calculation time by 96.9% and re-ranking improves MRR and Recall by 23.71% and 36.4%. By incorporating the pre-filtration and re-ranking modules, Asteria-Pro outperforms existing state-of-the-art approaches in bug search task, by a significant large margin. We conduct a large-scale real-world firmware bug search and Asteria-Pro manages to detect 1,482 vulnerable functions with a high precision 91.65%.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
