一句话：CEBin 融合嵌入与比较方法，低成本高精度地实现大规模二进制代码相似性检测与漏洞发现。
二进制代码相似性检测（BCSD）应用广泛，但现有方法多基于嵌入，在大规模目标二进制搜索场景下精度和效率有限。本文提出成本高效的 BCSD 框架 CEBin，融合基于嵌入和基于比较的两类方法：先用精炼的嵌入方法提取目标代码特征，快速缩小候选相似代码范围；再对候选进行成对比较，捕捉更细微复杂的相似关系，从而显著提高检测精度。作者在三个知名数据集上验证 CEBin 优于现有 SOTA 基线，并构建大规模漏洞基准，首次为 1-day 漏洞检测任务提供精确评估方案。CEBin 可在数秒内从数百万候选函数中识别相似函数，在该更具挑战的任务上达到 85.46% 的召回率，比最佳 SOTA 基线快几个数量级且提升 4.07 倍。
Binary code similarity detection (BCSD) is a fundamental technique for various applications. Many BCSD solutions have been proposed recently, which mostly are embedding-based, but have shown limited accuracy and efficiency especially when the volume of target binaries to search is large. To address this issue, we propose a cost-effective BCSD framework, CEBin, which fuses embedding-based and comparison-based approaches to significantly improve accuracy while minimizing overheads. Specifically, CEBin utilizes a refined embedding-based approach to extract features of target code, which efficiently narrows down the scope of candidate similar code and boosts performance. Then, it utilizes a comparison-based approach that performs a pairwise comparison on the candidates to capture more nuanced and complex relationships, which greatly improves the accuracy of similarity detection. By bridging the gap between embedding-based and comparison-based approaches, CEBin is able to provide an effective and efficient solution for detecting similar code (including vulnerable ones) in large-scale software ecosystems. Experimental results on three well-known datasets demonstrate the superiority of CEBin over existing state-of-the-art (SOTA) baselines. To further evaluate the usefulness of BCSD in real world, we construct a large-scale benchmark of vulnerability, offering the first precise evaluation scheme to assess BCSD methods for the 1-day vulnerability detection task. CEBin could identify the similar function from millions of candidate functions in just a few seconds and achieves an impressive recall rate of 85.46% on this more practical but challenging task, which are several order of magnitudes faster and 4.07× better than the best SOTA baseline.
@inproceedings{paperbot8554,
title = {CEBin: A Cost-Effective Framework for Large-Scale Binary Code Similarity Detection},
author = {Hao Wang and Zeyu Gao and Chao Zhang and Mingyang Sun and Yuchen Zhou and Han Qiu and Xi Xiao},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3652117}
}