PEM: Representing Binary Program Semantics for Similarity Analysis via a Probabilistic Execution Model

Authors:
Open Access
Publisher website
Google Scholar
Abstract
Binary similarity analysis determines if two binary executables are from the same source program. Existing techniques leverage static and dynamic program features and may utilize advanced Deep Learning techniques. Although they have demonstrated great potential, the community believes that a more effective representation of program semantics can further improve similarity analysis. In this paper, we propose a new method to represent binary program semantics. It is based on a novel probabilistic execution engine that can effectively sample the input space and the program path space of subject binaries. More importantly, it ensures that the collected samples are comparable across binaries, addressing the substantial variations of input specifications. Our evaluation on 9 real-world projects with 35k functions, and comparison with 6 state-of-the-art techniques show that PEM can achieve a precision of 96% with common settings, outperforming the baselines by 10-20%.
Funding Information
  • DARPA VSPELLS (HR001120S0058)
  • IARPA TrojAI (W911NF-19-S-0012)
  • NSF (1901242, 1910300)
  • ONR (N000141712045, N000141410468, N000141712947)