一句话：提出 ISRD，用函数/基本块/指令三级胎记与最小分支路径、归一化和锚点搜索，实现可解释、高效、跨编译鲁棒的二进制复用检测。
软件复用尤其部分复用带来法律与安全风险，源代码常不可得，现有二进制复用检测受跨编译混淆影响，准确率与效率不足。本文提出 ISRD，基于多级软件胎记模型的可解释复用检测方法，覆盖函数级、基本块级与指令级。为应对跨编译混淆，用最小分支路径（MBP）表示函数语义，并归一化提取指令核心语义；检测时采用“基于锚点识别的意图搜索”，先以严格指令匹配和相同库调用检查定位锚函数，再遍历邻居探索潜在匹配函数对以加速检测。两个真实世界二进制数据集实验表明，ISRD 可解释、有效且高效，达到 97.2% 精度和 94.8% 召回，对跨编译鲁棒并优于当前最优方法。
Software reuse, especially partial reuse, poses legal and security threats to software development. Since its source codes are usually unavailable, software reuse is hard to be detected with interpretation. On the other hand, current approaches suffer from poor detection accuracy and efficiency, far from satisfying practical demands. To tackle these problems, in this paper, we propose ISRD, an interpretation-enabled software reuse detection approach based on a multi-level birthmark model that contains function level, basic block level, and instruction level. To overcome obfuscation caused by cross-compilation, we represent function semantics with Minimum Branch Path (MBP) and perform normalization to extract core semantics of instructions. For efficiently detecting reused functions, a process for "intent search based on anchor recognition" is designed to speed up reuse detection. It uses strict instruction match and identical library call invocation check to find anchor functions (in short anchors) and then traverses neighbors of the anchors to explore potentially matched function pairs. Extensive experiments based on two real-world binary datasets reveal that ISRD is interpretable, effective, and efficient, which achieves 97.2% precision and 94.8% recall. Moreover, it is resilient to cross-compilation, outperforming state-of-the-art approaches.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{abs-2103-10126,
title = {Interpretation-Enabled Software Reuse Detection Based on a Multi-level Birthmark Model},
author = {Xi Xu and Qinghua Zheng and Zheng Yan and Ming Fan and Ang Jia and Ting Liu},
booktitle = {ICSE},
year = {2021},
doi = {10.1109/icse43902.2021.00084}
}