Abstract:The rapid expansion of the open-source community has shortened the software development cycle, but the spread of vulnerabilities has been accelerated, especially in the field of the Internet of Things. In recent years, the frequency of attacks against connected devices is increasing exponentially; thus, the vulnerabilities are more serious in nature. The state-of-the-art firmware security inspection technologies, such as methods based on machine learning and graph theory, find similar applications depending on the known vulnerabilities but cannot do anything without detailed information about the vulnerabilities. Moreover, model training, which is necessary for the machine learning technologies, requires a significant amount of time and data, resulting in low efficiency and poor extensibility. Aiming at the above shortcomings, a high-efficiency similarity analysis approach for firmware code is proposed in this study. First, the function control flow features and data flow features are extracted from the functions of the firmware and of the vulnerabilities, and the features are used to calculate the SimHash of the functions. The mass storage and fast query capabilities of the SimHash are implemented by the pigeonhole principle. Second, the similarity function pairs are analyzed in detail within and among the basic blocks. Within the basic blocks, the symbolic execution is used to generate the basic block semantic information, and the constraint solver is used to determine the semantic equivalence. Among the basic blocks, the local control flow graphs are analyzed to obtain their similarity. Then, we implemented a prototype and present the evaluation. The evaluation results demonstrate that the proposed approach can implement large-scale firmware function similarity analysis. It can also get the location of the real-world firmware patch without vulnerability function information. Finally, we compare our method with existing methods. The comparison results demonstrate that our method is more efficient and accurate than the Gemini and StagedMethod. More than 90% of the firmware functions can be indexed within 0.1 s, while the search time of 100,000 firmware functions is less than 2 s.

FF-BCSD: A Binary Code Similarity Detection Method Based on Feature Fusion

Binary Code Similarity Detection via Graph Contrastive Learning on Intermediate Representations

FUSION: Measuring Binary Function Similarity with Code-Specific Embedding and Order-Sensitive GNN

IoTSim: Internet of Things-Oriented Binary Code Similarity Detection with Multiple Block Relations

Asteria: Deep Learning-based AST-Encoding for Cross-platform Binary Code Similarity Detection

Semantic aware-based instruction embedding for binary code similarity detection

CEBin: A Cost-Effective Framework for Large-Scale Binary Code Similarity Detection

A Malicious Code Detection Method Based on FF-MICNN in the Internet of Things

A Survey of Binary Code Similarity Detection Techniques

Inter-BIN: Interaction-based Cross-architecture IoT Binary Similarity Comparison

Hierarchical Attention Graph Embedding Networks for Binary Code Similarity against Compilation Diversity

Implementing a High-Efficiency Similarity Analysis Approach for Firmware Code

SimCLF: A Simple Contrastive Learning Framework for Function-level Binary Embeddings

SemDiff: Binary Similarity Detection by Diffing Key-Semantics Graphs

BinCola: Diversity-sensitive Contrastive Learning for Binary Code Similarity Detection

Staged Method of Code Similarity Analysis for Firmware Vulnerability Detection

FASER: Binary Code Similarity Search through the use of Intermediate Representations

A Review of Deep Learning-Based Binary Code Similarity Analysis

DeepDual-SD: Deep Dual Attribute-Aware Embedding for Binary Code Similarity Detection

IFAttn: Binary Code Similarity Analysis Based on Interpretable Features with Attention

Binary code similarity analysis based on naming function and common vector space