Abstract:Binary similarity detection is a critical technique that has been applied in many real-world scenarios where source code is not available, e.g., bug search, malware analysis, and code plagiarism detection. Existing works are ineffective in detecting similar binaries in cases where different compiling optimizations, compilers, source code versions, or obfuscation are deployed. We observe that all the cases do not change a binary's key code behaviors although they significantly modify its syntax and structure. With this key observation, we extract a set of key instructions from a binary to capture its key code behaviors. By detecting the similarity between two binaries' key instructions, we can address well the ineffectiveness limitation of existing works. Specifically, we translate each extracted key instruction into a self-defined key expression, generating a key-semantics graph based on the binary's control flow. Each node in the key-semantics graph denotes a key instruction, and the node attribute is the key expression. To quantify the similarity between two given key-semantics graphs, we first serialize each graph into a sequence of key expressions by topological sort. Then, we tokenize and concatenate key expressions to generate token lists. We calculate the locality-sensitive hash value for all token lists and quantify their similarity. %We implement a prototype, called SemDiff, consisting of two modules: graph generation and graph diffing. The first module generates a pair of key-semantics graphs and the second module diffs the graphs. Our evaluation results show that overall, SemDiff outperforms state-of-the-art tools when detecting the similarity of binaries generated from different optimization levels, compilers, and obfuscations. SemDiff is also effective for library version search and finding similar vulnerabilities in firmware.

Comprehensive Similarity Measurement Model Based on Three Algorithms

Code Clone Detection: A Literature Review

D2 Distribution and 3D Model Similarity Assessment Algorithm

Finding Plagiarism Based on Common Semantic Sequence Model

A Code Similarity Detection Tool and Its Case Study

Code Similarity in Clone Detection

A Differential Testing Approach for Evaluating Abstract Syntax Tree Mapping Algorithms

Source Code Clone Detection Using Unsupervised Similarity Measures

A Survey of Binary Code Similarity Detection Techniques

Semantics-based obfuscation-resilient binary code similarity comparison with applications to software plagiarism detection

A Comparison of Document Similarity Algorithms

An Empirical Study to Evaluate Structural Similarity for Source Code Translation

Detecting Similar Repositories On Github

A Similarity Computing Algorithm for Proteins

A Method for Assessing Patent Similarity Using Direct and Indirect Citation Links

An Open Source Software Defect Detection Technique Based on Homology Detection and Pre-identification Vulnerabilitys

Measurement of Text Similarity: A Survey

SemDiff: Binary Similarity Detection by Diffing Key-Semantics Graphs

Using Link-Based Content Analysis to Measure Document Similarity Effectively

A Proposed Model for Source Code Reuse Detection in Computer Programs

A Novel Approach for Patent Similarity Measurement Based on Sequence Alignment.