arXiv:2410.22677cs.LGcs.CR2024-10NeurIPS被引 8

简单比对原始字节就能达到顶尖效果,挑战了复杂分析的必要性。

Is Function Similarity Over-Engineered? Building a Benchmark

  • 只用函数原始字节,无需反汇编等预处理
  • 在多个场景下表现超越现有复杂模型
  • 适合安全分析、恶意软件检测等实战场景

二进制分析是逆向工程、恶意软件分析和漏洞检测等关键安全任务的核心。手动分析耗时,但识别常见或已知函数可显著缩短理解新文件的时间。然而,由于汇编复杂性和函数等价性判定的NP难性质,该任务极难实现。现有方法通常依赖复杂的反汇编、反编译工具、图分析等昂贵预处理步骤。本文指出当前研究环境与实际应用需求之间的偏差,构建了新的基准REFuSE-Bench,包含高质量数据集和更贴近真实场景的测试。解决数据重复、标签不准确等问题,首次在Windows数据上系统评估了机器学习类二进制函数相似性模型。结果表明,仅基于函数原始字节的简单基线,在多个设置下已达当前最优性能。研究质疑了复杂模型充分挖掘特征价值的假设,证明简单方法同样具有巨大实用价值。

原文摘要 · Abstract (English)

Binary analysis is a core component of many critical security tasks, including reverse engineering, malware analysis, and vulnerability detection. Manual analysis is often time-consuming, but identifying commonly-used or previously-seen functions can reduce the time it takes to understand a new file. However, given the complexity of assembly, and the NP-hard nature of determining function equivalence, this task is extremely difficult. Common approaches often use sophisticated disassembly and decompilation tools, graph analysis, and other expensive pre-processing steps to perform function similarity searches over some corpus. In this work, we identify a number of discrepancies between the current research environment and the underlying application need. To remedy this, we build a new benchmark, REFuSE-Bench, for binary function similarity detection consisting of high-quality datasets and tests that better reflect real-world use cases. In doing so, we address issues like data duplication and accurate labeling, experiment with real malware, and perform the first serious evaluation of ML binary function similarity models on Windows data. Our benchmark reveals that a new, simple basline, one which looks at only the raw bytes of a function, and requires no disassembly or other pre-processing, is able to achieve state-of-the-art performance in multiple settings. Our findings challenge conventional assumptions that complex models with highly-engineered features are being used to their full potential, and demonstrate that simpler approaches can provide significant value.

二进制分析函数相似性安全检测简化模型

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。