arXiv:2509.23449cs.AIcs.CR2025-09

用语言模型解析汇编代码,实现可读可查的相似性检测。

Beyond Embeddings: Interpretable Feature Extraction for Binary Code Similarity

  • 用语言模型分析汇编代码,生成类型、副作用等可解释特征。
  • 跨架构和跨优化场景下召回率分别达42%和62%,媲美训练过的嵌入方法。
  • 特征可直接检索,兼顾准确、高效与人类可读性,适合安全分析人员。

二进制代码相似性检测是逆向工程的核心任务,支持恶意软件分析与漏洞发现。现有方法从手工特征演变为向量表示:手工统计(如操作比例)可解释但泛化差;嵌入方法虽具鲁棒性,但结果为不可读向量,且高维最近邻搜索需近似,牺牲精度。本文提出基于语言模型的智能体,对汇编代码进行结构化推理,生成输入输出类型、副作用、显著常量及算法意图等特征。相比手工特征更丰富自适应,相比嵌入更可读可维护,且支持倒排或关系索引直接检索。无需训练,跨架构与跨优化任务中召回率@1分别为42%和62%,接近有训练嵌入方法(39%和34%)。结合嵌入后显著优于当前最优,证明准确、可扩展与可解释性可共存。

原文摘要 · Abstract (English)

Binary code similarity detection is a core task in reverse engineering. It supports malware analysis and vulnerability discovery by identifying semantically similar code in different contexts. Modern methods have progressed from manually engineered features to vector representations. Hand-crafted statistics (e.g., operation ratios) are interpretable, but shallow and fail to generalize. Embedding-based methods overcome this by learning robust cross-setting representations, but these representations are opaque vectors that prevent rapid verification. They also face a scalability-accuracy trade-off, since high-dimensional nearest-neighbor search requires approximations that reduce precision. Current approaches thus force a compromise between interpretability, generalizability, and scalability. We bridge these gaps using a language model-based agent to conduct structured reasoning analysis of assembly code and generate features such as input/output types, side effects, notable constants, and algorithmic intent. Unlike hand-crafted features, they are richer and adaptive. Unlike embeddings, they are human-readable, maintainable, and directly searchable with inverted or relational indexes. Without any matching training, our method respectively achieves 42% and 62% for recall@1 in cross-architecture and cross-optimization tasks, comparable to embedding methods with training (39% and 34%). Combined with embeddings, it significantly outperforms the state-of-the-art, demonstrating that accuracy, scalability, and interpretability can coexist.

二进制分析可解释性代码相似性语言模型

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。