论文标题
跨体系结构二进制相似性比较的多关系指令关联图
Multi-relational Instruction Association Graph for Cross-architecture Binary Similarity Comparison
论文作者
论文摘要
在许多安全应用程序中，跨架构二进制相似性比较至关重要。最近，研究人员提出了基于学习的方法来提高比较性能。他们采用了指导预训练，单个二进制编码和基于距离的相似性比较的范式。但是，在外部代码语料库中预先训练的指令嵌入在不同的现实世界应用中并不普遍。并单独编码跨架构二进制文件将累积指令集的语义差距，从而限制了比较精度。本文提出了一种新型的跨架构二进制相似性比较方法与多关系指令关联图。我们将单构结构指令令牌与上下文相关性和跨架构令牌联系起来，从不同的角度将潜在的语义相关性。然后，我们利用关系图卷积网络（R-GCN）执行特定于类型的图形信息传播。我们的方法可以弥合跨架构说明表示空间中的差距，同时避免外部培训工作量。我们对基本块级和功能级数据集进行了广泛的实验，以证明我们的方法的优势。此外，对大规模现实的物联网恶意软件重复使用功能收集的评估表明，我们的方法对于识别在各种体系结构的物联网设备上传播的恶意软件很有价值。
Cross-architecture binary similarity comparison is essential in many security applications. Recently, researchers have proposed learning-based approaches to improve comparison performance. They adopted a paradigm of instruction pre-training, individual binary encoding, and distance-based similarity comparison. However, instruction embeddings pre-trained on external code corpus are not universal in diverse real-world applications. And separately encoding cross-architecture binaries will accumulate the semantic gap of instruction sets, limiting the comparison accuracy. This paper proposes a novel cross-architecture binary similarity comparison approach with multi-relational instruction association graph. We associate mono-architecture instruction tokens with context relevance and cross-architecture tokens with potential semantic correlations from different perspectives. Then we exploit the relational graph convolutional network (R-GCN) to perform type-specific graph information propagation. Our approach can bridge the gap in the cross-architecture instruction representation spaces while avoiding the external pre-training workload. We conduct extensive experiments on basic block-level and function-level datasets to prove the superiority of our approach. Furthermore, evaluations on a large-scale real-world IoT malware reuse function collection show that our approach is valuable for identifying malware propagated on IoT devices of various architectures.
