AwesomeREA.org

2024 · Conference paper

Code is not Natural Language: Unlock the Power of Semantics-Oriented Graph Representation for Binary Code Similarity Detection

Haojie He; Xingwei Lin; Ziang Weng; Ruijie Zhao; Shuitao Gan; Libo Chen; Yuede Ji; Jiashui Wang; Zhi Xue

HermesSim detects binary code similarity by lifting each function to Ghidra P-code and building a semantics-oriented graph that exposes operand structure inside instructions, def-use, control-flow and effect-order relations, while dropping semantics-independent details such as which register temporarily holds a value. A gated graph neural network with a multi-head softmax aggregator embeds the graph, and functions are compared by embedding similarity. On the Dataset-1 benchmark of Marcelli et al., the authors report 48.1% RECALL@1 for x64 cross-compiler retrieval in pools of 10,000 functions, against 31.4% for a fine-tuned jTrans, with a 388K-parameter model.

Scope and limitations

Laboratory results reuse Dataset-1 from Marcelli et al.: 257K, 13K and 522K training, validation and test functions for x86, ARM and MIPS in 32 and 64 bits, built at O0–O3 and Os by GCC and Clang. HermesSim keeps that dataset's IDA Pro 7.3 control flow and basic-block boundaries and uses Ghidra only to disassemble and lift each block, so the results do not measure function or CFG recovery. Each setting samples 1,000 queries against pools of up to 10,000 functions, and the gains are relative to the paper's own runs of SAFE, Asm2Vec, GMN, Trex and jTrans, which supports x86 only and was compared on the x64 subset. The real-world study searches 62,605 ARM32 and MIPS32 functions from 12 RTOS firmware images of three vendors for 10 functions linked to 5 CVEs; its ground truth comes from manually examining the top 20 results of the compared methods. String, integer and external-symbol references are not encoded, only memory effects are modeled, and unresolved indirect branches leave graphs incomplete. Similarity ranks candidates for review; it does not establish equivalence or vulnerability.

Why it fits this collection

Adds learned binary code similarity search, which reverse engineers use to match functions across builds, recover library functions in stripped binaries and locate known vulnerable code, complementing decompilation and symbol-recovery research.

Publication and review details

Venue
USENIX Security 2024
Status
Conference paper
Publication / posting date
August 2024
Date source
Publication month in the official USENIX proceedings BibTeX; the August 14–16, 2024 symposium dates are not used to assert a publication day.

The USENIX page, its BibTeX entry and the final PDF agree on the nine-author order, pages 1759–1776 and ISBN 978-1-939133-44-1; the page also lists a prepublication PDF. USENIX assigns no paper DOI and no arXiv version was found, so the record relies on the reviewed USENIX Security 2024 URL/PDF identity. The paper links github.com/NSSL-SJTU/HermesSim. At the reviewed 2024-12-10 commit its LICENSE file is MIT for the project and reproduces MIT and Apache-2.0 notices for included Cisco Talos and DeepMind code, which is why GitHub reports no single license. The README's paper link uses /presentation/he, which redirects to the he-haojie page. Lifting calls the separate GPL-3.0 GSAT Ghidra toolkit (gsat-1.0.jar). Zenodo record 10.5281/zenodo.10369788 (CC BY 4.0), linked from the README, holds the Dataset-RTOS binaries and archives of about 17 GB, 19 GB and 5 GB with extracted features, model inputs and outputs; that DOI identifies the data, not the paper. Dataset-1 binaries come from the Cisco Talos binary_function_similarity repository. The pinned requirements target Python 3.10, PyTorch 1.13.1 with CUDA 11.6 and PyTorch Geometric 2.3.0. No archives were downloaded, and no code or experiments were run.

Sources reviewed

Source review only; experiments were not rerun for this collection. Cite the original authors using the linked paper or BibTeX.

Report an outdated entry Suggest a translation fix

Primary sources

  1. https://www.usenix.org/conference/usenixsecurity24/presentation/he-haojie
  2. https://www.usenix.org/system/files/usenixsecurity24-he-haojie.pdf
  3. https://github.com/NSSL-SJTU/HermesSim/tree/db37ec664fda4ea9d26afe46ec28ff4de0d8ebc3
  4. README.md GitHub · NSSL-SJTU/HermesSim · Revision db37ec6
  5. LICENSE GitHub · NSSL-SJTU/HermesSim · Revision db37ec6
  6. requirements.txt GitHub · NSSL-SJTU/HermesSim · Revision db37ec6
  7. https://github.com/sgfvamll/gsat/releases/tag/v1.0.0
  8. https://zenodo.org/records/10369788