AwesomeREA.org

2024 · Conference paper

Cross-Inlining Binary Function Similarity Detection

Ang Jia; Ming Fan; Xi Xu; Wuxia Jin; Haijun Wang; Ting Liu

Studies binary function similarity when function inlining makes one binary function correspond to several source functions. From BinKit builds of 51 GNU projects with and without -fno-inline (9 GCC and Clang versions, O0–O3, six x86, ARM and MIPS targets; 216 combinations each), debug-line mappings label 5,621,140 cross-inlining pairs. The authors identify Leaf-, Root- and Internal-Inlining patterns, show that Gemini, SAFE and GMN lose accuracy on them, and propose CI-Detector, which trains one attributed-CFG graph neural network per pattern and aggregates their scores, reporting 81% precision and 97% recall.

Scope and limitations

The three patterns are derived from the authors’ own matrix of 51 GNU projects, and the authors note that other compilation settings, such as non-default optimizations, or projects with different inlining conventions may not fit the learned models. Labels depend on IDA Pro and DWARF debug tools, which the authors list as threats to construct validity, and ACFGs come from IDA Pro 7.3, so disassembly errors can affect results. Precision and recall come from balanced sets of 40,000 positive and 40,000 negative test pairs with a threshold tuned for F1, not from large-pool search. Baselines are released Gemini, SAFE and GMN models plus Bingo-style inlining strategies with Asm2Vec. Obfuscated binaries and LLM-based similarity models are not evaluated.

Why it fits this collection

Adds inlining-aware function matching, complementing similarity studies that disable inlining and single-model records such as jTrans.

Publication and review details

Venue
ICSE 2024
Status
Conference paper
Publication / posting date
April 12, 2024
Date source
ACM’s Crossref deposit records published/print and online publication on 2024-04-12. The date comes from that publisher deposit, not from the April 14–20 conference dates.
First arXiv submission
January 11, 2024
arXiv
2401.05739
Reviewed arXiv version
v1
DOI
10.1145/3597503.3639080

Crossref and the arXiv v1 PDF, the only version and marked as the ICSE 2024 camera-ready, agree on the six-author order; Crossref gives pages 1–13. The paper’s reference 16 prints the repository URL with a line break. At reviewed commit ff606dd (2026-04-20), the repository declares AGPL-3.0 in a LICENSE file added that day, about two years after publication, and earlier snapshots carried no license file. The README links two Google Drive archives built with BinKit and says the workflow reuses code from Cisco-Talos/binary_function_similarity; it requires IDA Pro, Docker and nvidia-docker. Its training step builds a NeuralNetwork/ Docker context that is absent from the reviewed tree, and no trained CI-Detector checkpoints are included. No datasets were downloaded and no code or experiments were run.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Report an outdated entry Suggest a translation fix

Primary sources

  1. https://dl.acm.org/doi/10.1145/3597503.3639080
  2. https://api.crossref.org/works/10.1145/3597503.3639080
  3. https://arxiv.org/abs/2401.05739
  4. https://arxiv.org/pdf/2401.05739v1
  5. README.md GitHub · island255/cross-inlining_binary_function_similarity · Revision ff606dd
  6. LICENSE GitHub · island255/cross-inlining_binary_function_similarity · Revision ff606dd
  7. 4.training_for_cross_inlining GitHub · island255/cross-inlining_binary_function_similarity · Revision ff606dd