Abstract:While third-party libraries are extensively reused to enhance productivity during software development, they can also introduce potential security risks such as vulnerability propagation. Software composition analysis, proposed to identify reused TPLs for reducing such risks, has become an essential procedure within modern DevSecOps. As one of the mainstream SCA techniques, binary-to-source SCA identifies the third-party source projects contained in binary files via binary source code matching, which is a major challenge in reverse engineering since binary and source code exhibit substantial disparities after compilation. The existing binary-to-source SCA techniques leverage basic syntactic features that suffer from redundancy and lack robustness in the large-scale TPL dataset, leading to inevitable false positives and compromised recall. To mitigate these limitations, we introduce BinaryAI, a novel binary-to-source SCA technique with two-phase binary source code matching to capture both syntactic and semantic code features. First, BinaryAI trains a transformer-based model to produce function-level embeddings and obtain similar source functions for each binary function accordingly. Then by applying the link-time locality to facilitate function matching, BinaryAI detects the reused TPLs based on the ratio of matched source functions. Our experimental results demonstrate the superior performance of BinaryAI in terms of binary source code matching and the downstream SCA task. Specifically, our embedding model outperforms the state-of-the-art model CodeCMR, i.e., achieving 22.54% recall@1 and 0.34 MRR compared with 10.75% and 0.17 respectively. Additionally, BinaryAI outperforms all existing binary-to-source SCA tools in TPL detection, increasing the precision from 73.36% to 85.84% and recall from 59.81% to 64.98% compared with the well-recognized commercial SCA product.

Source Code Foundation Models are Transferable Binary Analysis Knowledge Bases

How Far Have We Gone in Binary Code Understanding Using Large Language Models

Leveraging Artificial Intelligence on Binary Code Comprehension

How Far Have We Gone in Stripped Binary Code Understanding Using Large Language Models

A Progressive Transformer for Unifying Binary Code Embedding and Knowledge Transfer

Semantic-aware Binary Code Representation with BERT

CP-BCS: Binary Code Summarization Guided by Control Flow Graph and Pseudo Code

SepBIN: Binary Feature Separation for Better Semantic Comparison and Authorship Verification

Modeling Source Code in Bimodal for Program Comprehension

Pre-Training Representations of Binary Code Using Contrastive Learning

BinaryAI: Binary Software Composition Analysis via Intelligent Binary Source Code Matching

Improving Binary Code Similarity Transformer Models by Semantics-Driven Instruction Deemphasis.

DeepCodeProbe: Towards Understanding What Models Trained on Code Learn

SROBR: Semantic Representation of Obfuscation-Resilient Binary Code

Binary Code Traceability of Multigranularity Information Fusion from the Perspective of Software Genes

kTrans: Knowledge-Aware Transformer for Binary Code Embedding

BinProv: Binary Code Provenance Identification Without Disassembly.

Semantic aware-based instruction embedding for binary code similarity detection

Bridge and Hint: Extending Pre-trained Language Models for Long-Range Code

Cross-Language Binary-Source Code Matching with Intermediate Representations

HexT5: Unified Pre-Training for Stripped Binary Code Information Inference.