Binary Similarity Research Articles

IFAttn: Binary code similarity analysis based on interpretable features with attention

Binary code similarity analysis (BCSA11BCSA: Binary Code Similarity Analysis.) is meaningful in various software security applications, including vulnerability discovery, clone detection, and malware detection. Although many BCSA studies have been based on neural networks in recent years, some significant problems are challenging to solve. First, most existing methods focus more on the function pair similarity detection task (FPSDT22FPSDT: Function Pair Similarity Detection Task.) while ignoring the function search task (FST33FST: Function Search Task.), which is more major in vulnerability discovery. Moreover, they care more about the final result, which is to improve the success rate of FPSDT by using unexplainable neural networks. Finally, in practice, most methods are difficult to resist cross-optimization and cross-obfuscation in BCSA. We first proposed an adaptive BCSA architecture combining interpretable feature engineering and learnable attention mechanism to solve these problems. We design an adaptive model with rich interpretable features, and the experimental results on FPSDT and FST are better than the state-of-the-art methods. In addition, we also found that the attention mechanism has outstanding advantages in functional semantic expression. Finally, the evaluation shows that our approach can significantly improve FST performance between cross-architecture, cross-optimization, cross-obfuscation and cross-compiler binaries.

Asymmetric cross–modal hashing with high–level semantic similarity

Cross-modal hashing aims at using modality content to retrieve semantically relevant objects of different modalities, so cross-modal retrieval has attracted much attention. To effectively exploit the discriminative label information and retain more semantic information in the process of hash learning, we propose a novel cross-modal hashing method, named high-level semantic similarity analysis hashing (HSSAH) for cross-modal retrieval. To reduce time complexity and enhance discriminant ability in hash codes, HSSAH constructs an asymmetric high-level semantic similarity learning framework to replace the binary semantic similarity matrix. Moreover, the developed HSSAH is a two-stage approach, and a semantic-enhanced scheme is proposed in the second stage, which fully leverages the label information to gain more powerful hash functions. We conducted comprehensive experiments on three benchmark datasets to evaluate the performance of HSSAH. Experimental results show that HSSAH can achieve significantly better retrieval precision and outperforms several state-of-the-art approaches.

Label embedding semantic-guided hashing

Hashing technologies have been widely used for information retrieval tasks due to their efficient retrieval and storage capabilities. Generally, most of the current supervised learning only utilizes labels to construct a binary similarity matrix of instance pairs and ignores the rich semantic information contained in the labels. Indeed, the reason why supervised hashing is better than unsupervised hashing is that the labels itself has strong discriminative information. Therefore, how to effectively explore the label information is one of the ways to improve the performance of retrieval tasks. In addition, existing hashing methods have the problems of high time consumption and weak scalability when facing large-scale data. To remedy these problems, in this paper, we present a flexible two-step label embedding hashing method named Label Embedding Semantic-Guided Hashing (LESGH). In the first step, LESGH leverages an asymmetric discrete learning framework to learn discriminative compact hash codes only from label information, and adds the constraints of bit-balance and bit-decorrelation to boost the quality of the hash code generation. In the second step, LESGH learns the hash projection function through the generated hash codes in the first step. Moreover, an effective and fast iterative discrete optimization algorithm is presented to solve the discrete problem instead of using the relaxation-based scheme. In doing so, we can not only simplify the optimization process, but also easily scale to large-scale data. We conduct several experiments on three public datasets, i.e., WIKI, MIRFlickr and NUS-WIDE, demonstrate that LESGH can improve the retrieval performance over the compared state-of-the-art baselines.

Improve Deep Unsupervised Hashing via Structural and Intrinsic Similarity Learning

Hashing has attracted increasing attention in image retrieval recently due to its storage and computational efficiency. Although several deep unsupervised hashing methods have been proposed lately, their effectiveness is far from satisfactory in practice owing to two drawbacks. On the one hand, they mostly construct binary similarity matrices which could neglect the confidence differences among multiple similarity signals. On the other hand, they ignore the desired properties of hash codes (i.e., independence and robustness). In this paper, we propose an effective unsupervised hashing method called <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">H</b> ashing via <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">S</b> tructural and <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">I</b> ntrinsic si <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">M</b> ilarity learning (HashSIM) to tackle these issues in an end-to-end manner. Specifically, HashSIM utilizes both highly and normally confident image pairs to jointly build a continuous similarity matrix, which guides hash code learning via structural similarity learning. Moreover, inspired by contrastive learning, we impose an intrinsic similarity learning objective, which can maximally satisfy the independence and robustness properties of hash bits. Extensive experiments on three popular benchmark datasets demonstrate that our HashSIM outperforms a broad range of state-of-the-art baselines.

FirmVulSeeker—BERT and Siamese Network-Based Vulnerability Search for Embedded Device Firmware Images

In recent years, with the development of the natural language processing (NLP) technologies, security analyst began to use NLP directly on assembly codes which were disassembled from binary executables in order to examine binary similarity, achieved great progress. However, we found that the existing frameworks often ignored the complex internal structure of instructions and didn’t fully consider the long-term dependencies of instructions. In this paper, we propose firmVulSeeker—a vulnerability search tool for embedded firmware images, based on BERT and Siamese network. It first builds a BERT MLM task to observe and learn the semantics of different instructions in their context in a very large unlabeled binary corpus. Then, a finetune mode based on Siamese network is constructed to guide training and matching semantically similar functions using the knowledge learned from the first stage. Finally, it will use a function embedding generated from the fine-tuned model to search in the targeted corpus and find the most similar function which will be confirmed whether it’s a real vulnerability manually. We evaluate the accuracy, robustness, scalability and vulnerability search capability of firmVulSeeker. Results show that it can greatly improve the accuracy of matching semantically similar functions, and can successfully find more real vulnerabilities in real-world firmware than other tools.

Effects of Binary Vectors Similarities on the Accuracy of Multi-Criteria Collaborative Filtering

Recommender systems offer tailored recommendations by employing various algorithms, and collaborative filtering is one of the well-known and commonly used of those. A traditional collaborative filtering system allows users to rate on a single criterion. However, a single criterion may be insufficient to indicate preferences in domains such as restaurants, movies, or tourism. Multi-criteria collaborative filtering provides a multi-dimensional rating option. In similarity-based multi-criteria collaborative filtering schemes, existing similarity methods utilize co-users or co-items regardless of how many there are. However, a high correlation with a few co-ratings does not always provide a reliable neighborhood. Therefore, it is very common, in both single- and multi-criteria collaborative filtering, to weight similarities with functions utilizing the number of co-ratings. Since multi-criteria collaborative filtering is yet growing, it lacks a comprehensive view of the effects of similarity weighting. This work studies multi-criteria collaborative filtering and the literature of binary vector similarities, which are frequently used for weighting, by giving a related taxonomy and conducts extensive experiments to analyze the effects of weighting similarities on item- and user-based multi-criteria collaborative filtering. Experimental findings suggest that prediction accuracy of item-based multi-criteria collaborative filtering can be boosted by especially binary vector similarity measures which do not consider mutual absences.

Cross-Platform Binary Code Homology Analysis Based on GRU Graph Embedding

Binary code homology analysis refers to detecting whether two pieces of binary code are compiled from the same piece of source code, which is a fundamental technique for many security applications, such as vulnerability search, plagiarism detection, and malware detection. With the increase in critical vulnerabilities in IoT devices, homology analysis is increasingly needed to perform cross-platform vulnerability searches. Existing methods for cross-platform binary code homology detection usually convert binary code to instruction sequences and do semantic embedding of the sequences as if they were natural language. However, the gap between natural language and binary code is large, and the spatial features of the binary code are easily lost by directly comparing the semantics. In this paper, we propose a GRU-based graph embedding method to compare the homology of binary functions. First, the attribute control flow graph (ACFG) is built for the assembly function, then the GRU-based graph embedding neural network is used to generate the embedding vector for the ACFG, and finally the homology of the binary code is determined by calculating the distance between the embedding vectors. The experimental results show that our method greatly improves the detection accuracy of negative samples compared with Gemini, the latest method based on graph embedding binary code similarity detection.

Executive dysfunction accompanying essential tremor

Essential tremor (ET) is one of the most common neurological diseases. New evidence suggest that ET is associated with cognitive disorders other than motor symptoms. We aimed to investigate executive dysfunctions, which are comorbid cognitive deficiencies that may accompany ET. The study was conducted as an observational, case-control study in the Neurology Department of Ankara City Hospital in a 3-month period. The “Fahn-Tolosa-Marin Tremor Evaluation Scale” was used to rate tremor severity. Both patients and control group were subjected to the Mini Mental Test, followed by the Stroop TBAG test (TBAG is composed of the first letters of “TUBİTAK Temel Bilimler Araştırma Grubu,” which means Scientific and Technological Research Council of Turkey Basic Sciences Research Group), word fluency (category fluency), phonemic fluency (K), and abstract thinking (binary similarities, proverb interpretation) tests. Both the patient and the control group consisted of 20 women and 20 men, with age, gender, and educational background compatible. Mean age of the patient group was 34.80 ± 13.23 years, while it was 34.95 ± 10.21 years in control group. In the ET group, statistically significant impairment was detected in the Stroop Test section 5 duration and error + correction number, category fluency, binary similarity, and phonemic fluency tests compared to the control group. There was a correlation between the severity of tremor and especially Stroop, category fluency, and binary similarity tests such that, as the severity of tremor increased, these test scores deteriorated. In ET patients, an impairment, accompanying tremor, may be present in executive functions that are a part of frontal lobe functions even in younger patients. This finding may suggest that impairment in the cerebellum–thalamus–frontal lobe connection may play a role in ET pathology.

Revise-Net: Exploiting Reverse Attention Mechanism for Salient Object Detection

Recently, deep learning-based methods, especially utilizing fully convolutional neural networks, have shown extraordinary performance in salient object detection. Despite its success, the clean boundary detection of the saliency objects is still a challenging task. Most of the contemporary methods focus on exclusive edge detection modules in order to avoid noisy boundaries. In this work, we propose leveraging on the extraction of finer semantic features from multiple encoding layers and attentively re-utilize it in the generation of the final segmentation result. The proposed Revise-Net model is divided into three parts: (a) the prediction module, (b) a residual enhancement module, and (c) reverse attention modules. Firstly, we generate the coarse saliency map through the prediction modules, which are fine-tuned in the enhancement module. Finally, multiple reverse attention modules at varying scales are cascaded between the two networks to guide the prediction module by employing the intermediate segmentation maps generated at each downsampling level of the REM. Our method efficiently classifies the boundary pixels using a combination of binary cross-entropy, similarity index, and intersection over union losses at the pixel, patch, and map levels, thereby effectively segmenting the saliency objects in an image. In comparison with several state-of-the-art frameworks, our proposed Revise-Net model outperforms them with a significant margin on three publicly available datasets, DUTS-TE, ECSSD, and HKU-IS, both on regional and boundary estimation measures.

Binary Code Similarity Detection through LSTM and Siamese Neural Network

Given the fact that many software projects are closed-source, analyzing security-related vulnerabilities at the binary level is quintessential to protect computer systems from attacks of malware. Binary code similarity detection is a potential solution for detecting malware from the binaries generat

Parallel and independent true random bitstreams from optical emission spectra of atmospheric microplasma arc discharge

AbstractIn this study, we propose the possibility of generating several parallel and independent random bitstreams from the time‐varying optical emission spectra of an atmospheric pressure air microplasma system. This is achieved by splitting the plasma arc emission into discrete wavelengths using an optical spectrometer and then monitoring the fluctuating intensities of each wavelength as an independent time series. As a proof of concept, we considered eight wavelengths centered at 377.8, 389.1, 425.8, 591.4, 630.5, 673.0, 714.2, and 776.4 nm corresponding to atomic emissions lines from species either from the surrounding atmospheric air gap or from the electrodes' materials. NIST SP 800‐22 statistical randomness tests and other statistical estimates (auto‐ and cross‐correlation analysis and binary vector similarity measures) are subsequently applied to the binarized data, and the obtained results confirm the possibility of generating several parallel and independent random bitstreams from the microplasma system. The data throughput is, however, relatively low with the optical setup we used, which can be improved using faster spectrometry.

Accurate detection method of moving target based on sequential SAR images with multiple azimuth squint angles

In this paper, a novel moving target detection method for sequential Synthetic Aperture Radar (SAR) images with different azimuth-squint angles is proposed. In sequential SAR images, due to the movement of the target, the imaging position of moving targets among different frames differs. The method proposed in this paper uses this kind of motion characteristics to achieve the detection of moving targets in multi-frame SAR images. This algorithm can be divided into two parts: block-level detection and pixel-level detection. Block-level detection is achieved by stacked denoising autoencoders to extract the high-dimensional features of the moving target. Pixel-level detection consists of Local Binary Similarity Patterns (LBSP) coding as well as grayscale background subtraction. Pixel-level detection only needs to consider the pixels of foreground image pieces which contain moving targets. This method can not only increase the detection speed, but also suppress the false alarm problem caused by clutter. Experiments are carried out for verifying the validation of the method and the comparison are made between the proposed method and the traditional Constant False Alarm Rate (CFAR) algorithm.

Hierarchical Attention Graph Embedding Networks for Binary Code Similarity against Compilation Diversity

Binary code similarity comparison is the technique that determines if two functions are similar by only considering their compiled form, which has many applications, including clone detection, malware classification, and vulnerability discovery. However, it is challenging to design a robust code similarity comparison engine since different compilation settings that make logically similar assembly functions appear to be very different. Moreover, existing approaches suffer from high-performance overheads, lower robustness, or poor scalability. In this paper, a novel solution HBinSim is proposed by employing the multiview features of the function to address these challenges. It first extracts the syntactic and semantic features of each basic block by static analysis. HBinSim further analyzes the function and constructs a syntactic attribute control flow graph and a semantic attribute control flow graph for each function. Then, a hierarchical attention graph embedding network is designed for graph-structured data processing. The network model has a hierarchical structure that mirrors the hierarchical structure of the function. It has three levels of attention mechanisms applied at the instruction, basic block, and function level, enabling it to attend differentially to more and less critical content when constructing the function representation. We conduct extensive experiments to evaluate its effectiveness and efficiency. The results show that our tool outperforms the state-of-the-art binary code similarity comparison tools by a large margin against compilation diversity clone searching. A real-world vulnerabilities search case further demonstrates the usefulness of our system.

Multiple Sclerosis Lesion Segmentation in Brain MRI Using Inception Modules Embedded in a Convolutional Neural Network.

Multiple sclerosis (MS) is a chronic and autoimmune disease that forms lesions in the central nervous system. Quantitative analysis of these lesions has proved to be very useful in clinical trials for therapies and assessing disease prognosis. However, the efficacy of these quantitative analyses greatly depends on how accurately the MS lesions have been identified and segmented in brain MRI. This is usually carried out by radiologists who label 3D MR images slice by slice using commonly available segmentation tools. However, such manual practices are time consuming and error prone. To circumvent this problem, several automatic segmentation techniques have been investigated in recent years. In this paper, we propose a new framework for automatic brain lesion segmentation that employs a novel convolutional neural network (CNN) architecture. In order to segment lesions of different sizes, we have to pick a specific filter or size 3 × 3 or 5 × 5. Sometimes, it is hard to decide which filter will work better to get the best results. Google Net has solved this problem by introducing an inception module. An inception module uses 3 × 3, 5 × 5, 1 × 1 and max pooling filters in parallel fashion. Results show that incorporating inception modules in a CNN has improved the performance of the network in the segmentation of MS lesions. We compared the results of the proposed CNN architecture for two loss functions: binary cross entropy (BCE) and structural similarity index measure (SSIM) using the publicly available ISBI-2015 challenge dataset. A score of 93.81 which is higher than the human rater with BCE loss function is achieved.

Bridge Extraction Algorithm Based on Deep Learning and High-Resolution Satellite Image

This paper proposes a novel method of extracting roads and bridges from high-resolution remote sensing images based on deep learning. Edge detection is performed on the images in the road area along with the road skeleton line, and the result of the detected binary edge is vectorized. The interference of protective belts on both sides of the road, road vehicles, road green belts, traffic signs, etc. and the shadow interference of the bridge itself are eliminated to determine the parallel sides of the road. The bridge features on the road are used to locate the detected bridge and obtain information such as the location, length, width, and direction of the bridge, verifying the experimental results of the Shaoguan Le point images. In addition, in order to learn higher-level road feature information, the algorithm in this paper introduces the hollow convolution and multicore pooling modules. Secondly, the residual refinement network further refines the output of the prediction network to improve the ambiguity of the prediction network results. In addition, in view of the small proportion of road pixels in remote sensing images, the network also integrates binary cross entropy, structural similarity, and intersection ratio loss function to reduce road information loss. The applicability of the proposed study was tested, and the results show that the algorithm is very effective for the extraction of road and bridge targets.

Discrimination Ability of Assessors in Check-All-That-Apply Tests: Method and Product Development.

Binary similarity measures have been used in several research fields, but their application in sensory data analysis is limited as of yet. Since check-all-that-apply (CATA) data consist of binary answers from the participants, binary similarity measures seem to be a natural choice for their evaluation. This work aims to define the discrimination ability of CATA participants by calculating the consensus values of 44 binary similarity measures. The proposed methodology consists of three steps: (i) calculating the binary similarity values of the assessors, sample pair-wise; (ii) clustering participants into good and poor discriminators based on their binary similarity values; (iii) performing correspondence analysis on the CATA data of the two clusters. Results of three case studies are presented, highlighting that a simple clustering based on the computed binary similarity measures results in higher quality correspondence analysis with more significant attributes, as well as better sample discrimination (even according to overall liking).

Two Probabilistic Models for Quick Dissimilarity Detection of Big Binary Data

The task of data matching arises frequently in many aspects of science. It can become a time consuming process when the data is being matched to a huge database consisting of thousands of possible candidates, and the goal is to find the best match. It can be even more time consuming if the data are big (&gt; 100 MB). One approach to reducing the time complexity of the matching process is to reduce the search space by introducing a pre-matching stage, where very dissimilar data are quickly removed. In this paper we focus our attention to matching big binary data. In this paper we present two probabilistic models for the quick dissimilarity detection of big binary data: the Probabilistic Model for Quick Dissimilarity Detection of Binary vectors (PMQDD) and the Inverse-equality Probabilistic Model for Quick Dissimilarity Detection of Binary vectors (IPMQDD). Dissimilarity detection between binary vectors can be accomplished quickly by random element mapping. The detection technique is not a function of data size and hence dissimilarity detection is performed quickly. We treat binary data as binary vectors, and hence any binary data of any size and dimension is treated as a binary vector. PMQDD is based on a binary similarity distance that does not recognize data and its exact inverse as containing the same pattern and hence considers them to be different. However, in some applications a specific data and its inverse, are regarded as the same pattern, and thus should be identified as being the same; IPMQDD is able to identify such cases, as it is based on a similarity distance that does not distinguish between data and its inverse instance as being dissimilar. We present a comparative analysis between PMQDD and IPMQDD, as well as their similarity distances. We present an application of the models to a set of object models, that show the effectiveness and power of these models

Binary Jaya algorithm based on binary similarity measure for feature selection

Feature selection (FS) has become an indispensable data preprocessing task because of the huge amount of high dimensional data being generated by current technologies. These high dimensional data contains irrelevant, redundant, and noisy features that deteriorate classification accuracy. FS reduces dimensionality by removing the unwanted features thus improves classification accuracy. FS can be considered as a binary optimization problem. In order to solve this problem, this work proposes a new wrapper feature selection technique based on the Jaya algorithm. Three binary variants of the Jaya algorithm are proposed, the first and second ones are based on transfer functions namely BJaya-S and BJaya-V. The third variant (BJaya-JS) explores the search space on the basis of the Jaccard Similarity index. In addition, a probability-based local search technique, namely Neighbourhood Search is proposed to balance the exploration and exploitation. The variants of Jaya algorithm are evaluated and the best variant is selected. The best variant is further compared with six state-of-the-art feature selection techniques. All the performances are tested on 18 high dimensional standard UCI datasets. Experimental result comparison shows that the proposed feature selection technique performs better than other competitors.

Differential Consistency Analysis: Which Similarity Measures can be Applied in Drug Discovery?

Similarity measures are widely used in various areas from taxonomy to cheminformatics. To this end, a large number of similarity and distance measures (or, collectively, comparative measures) have been introduced, with only a few studies directed to revealing their inner relationships. We present a thorough analytical study of the conditions leading to two comparative measures providing equivalent results over a given set of molecules. A key part of this work is the introduction of a novel way to study the consistency between comparative measures: the differential consistency analysis (DCA). This tool reveals how the consistency can be established in an analytical way with minimal (or no) assumptions. We found that the consensus between Tanimoto and the Cosine coefficients improved by choosing a reference whose similarity to the rest of the molecules varies less, or by representing the molecules in a way that does not depend strongly on their size (i. e. bit frequency in the chosen fingerprint representation). The presented derivations are just some generic examples; DCA can be applied widely and for all binary similarity coefficients introduced so far, independently from the molecular representations.

A Survey of Binary Code Similarity

Binary code similarityapproaches compare two or more pieces of binary code to identify their similarities and differences. The ability to compare binary code enables many real-world applications on scenarios where source code may not be available such as patch analysis, bug search, and malware detection and analysis. Over the past 22 years numerous binary code similarity approaches have been proposed, but the research area has not yet been systematically analyzed. This article presents the first survey of binary code similarity. It analyzes 70 binary code similarity approaches, which are systematized on four aspects: (1) the applications they enable, (2) their approach characteristics, (3) how the approaches are implemented, and (4) the benchmarks and methodologies used to evaluate them. In addition, the survey discusses the scope and origins of the area, its evolution over the past two decades, and the challenges that lie ahead.