2024 · Conference paper
BinaryAI: Binary Software Composition Analysis via Intelligent Binary Source Code Matching
BinaryAI identifies which open-source C/C++ libraries a stripped binary reuses by matching its functions to source code. Ghidra decompiles each binary function to pseudo-C, and a Pythia-410M model, trained with a CLIP-style contrastive loss on about 10 million binary–source function pairs, embeds pseudo-code and source functions in one space. Candidates retrieved from a corpus of 56,342,179 source functions from 12,013 libraries are refined with link-time locality and the call graph, and a library is reported when the share of its matched functions exceeds a threshold. The authors report 22.54% recall@1 against 10.75% for CodeCMR, and library-detection precision and recall of 85.84% and 64.98% against 73.36% and 59.81% for an unnamed commercial tool.
Scope and limitations
Training pairs come from ArchLinux and AUR packages compiled automatically with DWARF debug information, and the corpus and test set cover C/C++ projects only. The SCA test set is 150 stripped binaries the authors compiled from 85 GitHub projects, with 1,045 reused libraries labeled manually from build files, headers and license metadata; function-level ground truth covers 15 of those binaries (23,529 pairs). The recall@1 figures combine the model's validation set with those 15 binaries. The two commercial baselines are anonymized under confidentiality agreements, and every baseline was rebuilt on the authors' 12,013-library dataset. The 112 false positives the authors examined all trace to incomplete library-dependency data. The model, training pairs, source-function corpus and labeled test set are not public, and the hosted service the paper links may run a different model and corpus from the evaluated 2024 system. Matches identify reused source; they are not a decompilation or proof that the binary is unmodified.
Why it fits this collection
Adds binary-to-source function matching and binary software composition analysis, which identify reused open-source code inside stripped binaries, complementing binary-to-binary similarity and decompilation research.
Publication and review details
- Venue
- ICSE 2024
- Status
- Conference paper
- Publication / posting date
- April 12, 2024
- Date source
- ACM's Crossref deposit records print and online publication on 2024-04-12, two days before the April 14–20 ICSE 2024 conference; the conference dates and arXiv dates are not substituted for it.
- First arXiv submission
- January 20, 2024
- arXiv
- 2401.11161
- Reviewed arXiv version
- v3
- DOI
- 10.1145/3597503.3639100
Crossref records the ICSE 2024 proceedings article, pages 1–13, and its seven-author order matches arXiv. arXiv v1 is dated 2024-01-20, v2 2024-01-23 and v3 2024-08-26; the reviewed v3 carries the ICSE '24 ACM reference format and DOI. The ACM landing page refused automated access, so publication facts follow Crossref and the arXiv v3 copy. The abstract links binaryai.net, which now redirects to the binaryai.cn web service, and the GPL-3.0 binaryai/sdk repository is a client for that service that needs a service credential. Neither releases the model, training pairs, corpus or labeled test set, so code_url and project_url stay null. A footnote says the module is deployed in industry with a growing corpus; another says the base model went through earlier OPT and BLOOM iterations before Pythia. Nothing was run.
Sources reviewed
Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.