一句话：提出 BinaryAI，用两阶段二进制源码匹配融合句法与语义特征，提升第三方库检测精度与召回。
第三方库复用会带来漏洞传播风险，二进制到源码的软件成分分析（SCA）因编译后二进制与源码差异显著而困难。现有方法依赖冗余且不鲁棒的语法特征，在大规模第三方库数据集中易产生误报并损害召回。BinaryAI 采用两阶段二进制源码匹配：先用 transformer 模型生成函数级嵌入，为每个二进制函数检索相似源码函数；再利用链接时局部性辅助函数匹配，根据匹配源码函数比例检测复用第三方库。实验表明，其嵌入模型优于 CodeCMR，recall@1 从 10.75% 提升至 22.54%，MRR 从 0.17 提升至 0.34；下游第三方库检测也优于现有工具，相比 Black Duck 将精度从 73.36% 提升至 85.84%，召回从 59.81% 提升至 64.98%。
While third-party libraries (TPLs) are extensively reused to enhance productivity during software development, they can also introduce potential security risks such as vulnerability propagation. Software composition analysis (SCA), proposed to identify reused TPLs for reducing such risks, has become an essential procedure within modern DevSecOps. As one of the mainstream SCA techniques, binary-to-source SCA identifies the third-party source projects contained in binary files via binary source code matching, which is a major challenge in reverse engineering since binary and source code exhibit substantial disparities after compilation. The existing binary-to-source SCA techniques leverage basic syntactic features that suffer from redundancy and lack robustness in the large-scale TPL dataset, leading to inevitable false positives and compromised recall. To mitigate these limitations, we introduce BinaryAI, a novel binary-to-source SCA technique with two-phase binary source code matching to capture both syntactic and semantic code features. First, BinaryAI trains a transformer-based model to produce function-level embeddings and obtain similar source functions for each binary function accordingly. Then by applying the link-time locality to facilitate function matching, BinaryAI detects the reused TPLs based on the ratio of matched source functions. Our experimental results demonstrate the superior performance of BinaryAI in terms of binary source code matching and the downstream SCA task. Specifically, our embedding model outperforms the state-of-the-art model CodeCMR, i.e., achieving 22.54% recall@1 and 0.34 MRR compared with 10.75% and 0.17 respectively. Additionally, BinaryAI outperforms all existing binary-to-source SCA tools in TPL detection, increasing the precision from 73.36% to 85.84% and recall from 59.81% to 64.98% compared with the well-recognized commercial SCA product Black Duck.
@inproceedings{paperbot11414,
title = {BinaryAI: Binary Software Composition Analysis via Intelligent Binary Source Code Matching},
author = {Ling Jiang and Junwen An and Huihui Huang and Qiyi Tang and Sen Nie and Shi Wu and Yuqun Zhang},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639100}
}