AI 中文总结
N2NMatcher是抗内联的二进制分解与模块匹配框架，通过分层图神经网络学习锚点函数，提升了程序级二进制代码相似度分析的分解质量与匹配准确率。
AI 中文摘要
程序级二进制代码相似度分析（BCSA）旨在识别二进制程序中语义相似的代码区域，是软件抄袭检测、漏洞搜索和恶意代码分析的基础技术。现有方法通常按照函数调用图（FCG）的结构将二进制分解为模块，再通过模块包含的函数进行匹配。然而，函数内联会改变FCG结构和二进制函数语义，导致现有分解和模块匹配方法效果不佳。本研究提出N2NMatcher，一种抗内联的二进制分解与模块匹配框架。首先开展实证研究，探究二进制是否仍包含跨编译设置提供稳定模块边界的函数；N2NMatcher使用分层图神经网络，对由操作码序列、控制流结构和FCG调用上下文构建的二进制ACFG-FCG表示进行编码，学习预测此类函数作为锚点；随后执行锚点约束的分解，并使用学习到的模块图嵌入匹配生成的模块。实验结果表明，与现有工作相比，N2NMatcher提升了分解质量和模块匹配准确率，实现了更有效的程序级BCSA。
英文摘要
Program-level Binary Code Similarity Analysis (BCSA) aims to identify semantically similar code regions across binary programs, serving as a fundamental technique for software plagiarism detection, vulnerability search, and malware analysis. Existing approaches often decompose binaries into modules following the structure of function call graphs (FCGs) and then match these modules by their contained functions. However, function inlining changes both FCG structures and binary function semantics, making existing decomposition and module matching methods less effective. In this work, we propose N2NMatcher, an inlining-resilient framework for binary decomposition and module matching. We first conduct an empirical study to examine whether binaries still contain functions that provide stable module boundaries across compilation settings. N2NMatcher learns to predict such functions as anchors using a hierarchical graph neural network that encodes binary ACFG-FCG representations built from opcode sequences, control-flow structures, and FCG calling context. It then performs anchor-bounded decomposition and matches the generated modules using learned module graph embeddings. Experimental results show that N2NMatcher improves both the decomposition quality and module matching accuracy compared to existing works, enabling more effective program-level BCSA.
