## 5 Discussion  
GMN+ leverages an NLP model to extract semantic information within the basic blocks of binary functions and employs a GMN with enhanced attention to analyze the semantic similarity between functions, thus facilitating the detection of homologous vulnerabilities in binaries. Experimental results demonstrate that GMN+ outperforms baseline methods in function similarity detection, homologous function search tasks, and real-world vulnerability detection as well. The effectiveness of GMN+ can be attributed to several key aspects:  
* An efficient instruction embedding method is utilized, which integrates operator and operand type information for a more comprehensive representation of instructions.
* An ITP pre-training task is used to pre-train BERT to enhance its capability in the semantic learning of functions.
* Enhanced attention is applied, focusing concurrently on crucial information for assessing homology within and between functions.  
However, it still faces several challenges:  
Figure 11: Comparison of detection results of different methods on real-world vulnerability detection tasks.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Software** & **CVE Number** & **Function Name** & **CFG Size** \\ \hline \multirow{4}{*}{Curl(v7.29.0)} & CVE-2013-2174 & curl\_easy\_unescape & 18 \\  & CVE-2013-0249 & Curl\_sasl\_create\_digest\_md5\_message & 47 \\  & CVE-2014-3707 & curl\_easy\_duphandle & 21 \\  & CVE-2016-7167 & curl\_easy\_escape & 19 \\  & CVE-2016-8621 & curl\_getdate & 89 \\ \hline \multirow{4}{*}{Xml(v2.9.2)} & CVE-2015-8317 & xmlParseXMLDecl & 67 \\  & CVE-2015-8242 & xmlSAX2 TextNode & 42 \\ \cline{1-1}  & CVE-2016-2073 & htmlParseNameComplex & 51 \\ \cline{1-1}  & CVE-2016-3627 & xmlStringGetNodeList & 68 \\ \hline \hline \end{tabular}
\end{table}
Table 9: The details of the CVE vulnerable function.  
* Subtle Semantic Distinctions: GMN+ may fail to recognize subtle semantic distinctions between vulnerable functions and their patched versions, often resulting in high false positive rates. To address this limitation, incorporating fine-grained homology detection at the code slices level could provide a more nuanced understanding of code semantics and reduce false positives.
* Inter-function Vulnerability Detection: While GMN+ primarily analyzes individual functions for vulnerability detection, many real-world vulnerabilities emerge from interactions between multiple function [25]. Future studies should explore integrating function call relationships into the input of the model to enhance detection capabilities for inter-function vulnerabilities.
* Computational Overhead: GMN+ is computationally intensive, particularly during inference, where both the query function and functions in the vulnerability pool require processing, leading to substantial computational overhead. To mitigate this problem, a tiered detection approach could be employed, using initial quick filters based on function representations before conducting a detailed analysis with GMN+.
* Dependency on Disassembly Accuracy: The effectiveness of GMN+ heavily depends on the accuracy of the disassembly tool used to convert binaries into instructions. Errors in disassembly can lead to incomplete or inaccurate semantic representations, which may impair the detection accuracy of GMN+. Developing strategies to handle disassembly errors, such as using multiple disassembly tools for cross-validation, could enhance robustness.