Abstract:Binary similarity detection is a critical technique that has been applied in many real-world scenarios where source code is not available, e.g., bug search, malware analysis, and code plagiarism detection. Existing works are ineffective in detecting similar binaries in cases where different compiling optimizations, compilers, source code versions, or obfuscation are deployed. We observe that all the cases do not change a binary's key code behaviors although they significantly modify its syntax and structure. With this key observation, we extract a set of key instructions from a binary to capture its key code behaviors. By detecting the similarity between two binaries' key instructions, we can address well the ineffectiveness limitation of existing works. Specifically, we translate each extracted key instruction into a self-defined key expression, generating a key-semantics graph based on the binary's control flow. Each node in the key-semantics graph denotes a key instruction, and the node attribute is the key expression. To quantify the similarity between two given key-semantics graphs, we first serialize each graph into a sequence of key expressions by topological sort. Then, we tokenize and concatenate key expressions to generate token lists. We calculate the locality-sensitive hash value for all token lists and quantify their similarity. %We implement a prototype, called SemDiff, consisting of two modules: graph generation and graph diffing. The first module generates a pair of key-semantics graphs and the second module diffs the graphs. Our evaluation results show that overall, SemDiff outperforms state-of-the-art tools when detecting the similarity of binaries generated from different optimization levels, compilers, and obfuscations. SemDiff is also effective for library version search and finding similar vulnerabilities in firmware.

A binary analysis method for protocol deviation discovery from implementations

ABInfer: A Novel Field Boundaries Inference Approach for Protocol Reverse Engineering

A Network Protocol Reverse Engineering Method Based On Dynamic Taint Propagation Similarity

Protocol vulnerability detection based on network traffic analysis and binary reverse engineering

Protocol reverse engineering through dynamic and static binary analysis

Analyze Network Protocol's Hidden Behavior

Biprominer: Automatic Mining of Binary Protocol Features

Reverse analysis of secure communication protocol based on taint analysis

Inspector: A Semantics-Driven Approach to Automatic Protocol Reverse Engineering

PBDiff: Neural Network Based Program-Wide Diffing Method for Binaries.

SemDiff: Binary Similarity Detection by Diffing Key-Semantics Graphs

A Vulnerability Exploits Detection Method Based on Binary Program Behavior Analysis

Differential analysis on dynamic binary and its application in malicious code analysis

Towards Practical Binary Code Similarity Detection: Vulnerability Verification via Patch Semantic Analysis

A Semantics Aware Approach to Automated Reverse Engineering Unknown Protocols

Arbiter: Bridging the Static and Dynamic Divide in Vulnerability Discovery on Binary Programs

A New Method to Analyze the Security of Protocol Implementations Based on Ideal Trace

A New Analysis Method of Cryptographic Protocols

A Semantics-Based Approach on Binary Function Similarity Detection

A Format Reverse Method for Binary Protocol from Communication Data

Dynamic Analysis and Debugging of Binary Code for Security Applications