Abstract:Binary similarity detection is a critical technique that has been applied in many real-world scenarios where source code is not available, e.g., bug search, malware analysis, and code plagiarism detection. Existing works are ineffective in detecting similar binaries in cases where different compiling optimizations, compilers, source code versions, or obfuscation are deployed. We observe that all the cases do not change a binary's key code behaviors although they significantly modify its syntax and structure. With this key observation, we extract a set of key instructions from a binary to capture its key code behaviors. By detecting the similarity between two binaries' key instructions, we can address well the ineffectiveness limitation of existing works. Specifically, we translate each extracted key instruction into a self-defined key expression, generating a key-semantics graph based on the binary's control flow. Each node in the key-semantics graph denotes a key instruction, and the node attribute is the key expression. To quantify the similarity between two given key-semantics graphs, we first serialize each graph into a sequence of key expressions by topological sort. Then, we tokenize and concatenate key expressions to generate token lists. We calculate the locality-sensitive hash value for all token lists and quantify their similarity. %We implement a prototype, called SemDiff, consisting of two modules: graph generation and graph diffing. The first module generates a pair of key-semantics graphs and the second module diffs the graphs. Our evaluation results show that overall, SemDiff outperforms state-of-the-art tools when detecting the similarity of binaries generated from different optimization levels, compilers, and obfuscations. SemDiff is also effective for library version search and finding similar vulnerabilities in firmware.

ProDiff: A Process Difference Detection Method Based on Hierarchical Decomposition

Efficient Syntactic Process Difference Detection And Its Application To Process Similarity Search

Automated Analysis of Differences in the Functionality and Performance of 3D CAD Systems for Collaborative Design

Efficient Syntactic Process Difference Detection Using Flexible Feature Matching.

Efficient Behavioral-Difference Detection between Business Process Models.

DesignDiff: Continuously Modeling Software Design Difference from Code Revisions.

A Maximal Common Subgraph Based Method for Process Retrieval

Detection Of Consistent Patterns From Process Enactment Data

Distributed Model Projection Based Transition Processes Recognition and Quality-Related Fault Detection

Complexity Analysis for Hybrid Differentiation in Process System Optimization

Discovering Hierarchical Multi-Instance Business Processes from Event Logs

Process model storage mechanism based on Petri net edit distance

CFS: A Behavioral Similarity Algorithm for Process Models Based on Complete Firing Sequences

Multi-objective Binary Differential Approach with Parameter Tuning for Discovering Business Process Models: MoD-ProM

A New Approach for Workflow Process Delta Analysis Based on SYN-NET.

A Model Merging Based Approach for Modeling the CMM Implementation Process

Process Model Fragmentization, Clustering and Merging: An Empirical Study.

Alignment-Based Conformance Checking of Hierarchical Process Models

DiffSeer: Difference-based Dynamic Weighted Graph Visualization

Multiobjective Binary Differential Approach with Parameter Tuning for Discovering Business Process Models: MoD-ProM

SemDiff: Binary Similarity Detection by Diffing Key-Semantics Graphs