一句话：提出概率执行模型 PEM，通过对输入与路径空间的可比采样来表征二进制程序语义，提升二进制相似性分析效果。
二进制相似性分析旨在判断两个可执行文件是否来自同一源程序。现有方法利用静态与动态程序特征，甚至采用深度学习技术，虽展现出潜力，但学界认为更有效的程序语义表示仍能进一步提升分析效果。本文提出一种新的二进制程序语义表示方法 PEM，其核心是一个新颖的概率执行引擎，能够有效采样目标二进制的输入空间与程序路径空间。更重要的是，PEM 保证所采集的样本在不同二进制之间具有可比性，从而应对输入规格的巨大差异。作者在 9 个真实项目、约 3.5 万个函数上进行了评估，并与 6 种最先进技术对比。结果表明，在常见设置下 PEM 可达到 96% 的精度，比基线方法高出 10% 至 20%。
Binary similarity analysis determines if two binary executables are from the same source program. Existing techniques leverage static and dynamic program features and may utilize advanced Deep Learning techniques. Although they have demonstrated great potential, the community believes that a more effective representation of program semantics can further improve similarity analysis. In this paper, we propose a new method to represent binary program semantics. It is based on a novel probabilistic execution engine that can effectively sample the input space and the program path space of subject binaries. More importantly, it ensures that the collected samples are comparable across binaries, addressing the substantial variations of input specifications. Our evaluation on 9 real-world projects with 35k functions, and comparison with 6 state-of-the-art techniques show that PEM can achieve a precision of 96% with common settings, outperforming the baselines by 10-20%.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{XuX0CYS0Y0023,
title = {PEM: Representing Binary Program Semantics for Similarity Analysis via a Probabilistic Execution Model},
author = {Xiangzhe Xu and Zhou Xuan and Shiwei Feng and Siyuan Cheng and Yapeng Ye and Qingkai Shi and Guanhong Tao and Le Yu and Zhuo Zhang and Xiangyu Zhang},
booktitle = {FSE},
year = {2023},
doi = {10.1145/3611643.3616301}
}