测试发现，二进制函数相似性模型易受对抗攻击，性能好不等于抗干扰强。
On the Lack of Robustness of Binary Function Similarity Systems
- 用黑盒贪心攻击修改控制流拓扑和内容
- 攻击成功率高达57.06%（定向）和95.81%（非定向）
- 提醒部署时需权衡性能与鲁棒性，适合安全研究者参考
二进制函数相似性分析依赖学习型算法，用于在函数库中寻找与查询函数最相似的函数，在机器学习、软件工程和安全领域具有重要价值，广泛应用于逆向工程、恶意代码分析和漏洞自动化检测。尽管近期研究提升了其在干净数据上的表现，但对先进机器学习模型在对抗攻击下的鲁棒性仍缺乏深入理解。本文通过一种简单有效的黑盒贪心攻击，改变目标函数的控制流拓扑和内容，评估模型鲁棒性。实验表明，该攻击在所有测试模型上均成功，平均攻击成功率分别达到57.06%（定向攻击）和95.81%（非定向攻击）。结果揭示：在干净数据上表现优异的模型，并不一定具备强鲁棒性，明确指出性能与鲁棒性之间的权衡关系，呼吁进一步研究。
原文摘要 · Abstract (English)
Binary function similarity, which often relies on learning-based algorithms to identify what functions in a pool are most similar to a given query function, is a sought-after topic in different communities, including machine learning, software engineering, and security. Its importance stems from the impact it has in facilitating several crucial tasks, from reverse engineering and malware analysis to automated vulnerability detection. Whereas recent work cast light around performance on this long-studied problem, the research landscape remains largely lackluster in understanding the resiliency of the state-of-the-art machine learning models against adversarial attacks. As security requires to reason about adversaries, in this work we assess the robustness of such models through a simple yet effective black-box greedy attack, which modifies the topology and the content of the control flow of the attacked functions. We demonstrate that this attack is successful in compromising all the models, achieving average attack success rates of 57.06% and 95.81% depending on the problem settings (targeted and untargeted attacks). Our findings are insightful: top performance on clean data does not necessarily relate to top robustness properties, which explicitly highlights performance-robustness trade-offs one should consider when deploying such models, calling for further research.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。