## 3 Methodology
### TPL Detetction
#### 3.4.2 TPL Detection Based on Function Features  
In TPL detection based on function semantic features, we measure semantic similarity between functions in the target binary \(B\) and the third-party libraries \(L=L_{1},L_{2},\ldots,L_{k}\), where \(k\) is the number of libraries in the TPL database. Suppose we need to determine whether the target binary \(B\) reuses a library \(L_{i}\in L\), since \(B\) and \(L_{i}\) consist of multiple functions, the matched function similarity score will be aggregated to measure the similarity score \(S_{BL_{i}}\) between \(B\) and \(L_{i}\). To calculate \(S_{BL_{i}}\), a problem we need to deal with is how to choose the matched functions (called anchor functions), which have a high similarity score and may have a high probability of reuse relationships, from \(B\) and \(L_{i}\) to compare with. Due to \(B\), which may reuse multiple libraries \(L_{i},L_{j},\ldots\) and partially reuse \(L_{i}\), many functions may be contained in only one. Therefore, we cannot directly conduct a one-to-many search to find the similar function \(lf_{j}\in L_{i}\) of a function \(bf_{j}\in B\) (i.e., anchor functions) which may be only contained in \(B\) and vice versa. Thus, we design a fast and scalable method to obtain the anchor functions for each library. In the acquisition of anchor functions stage, we select the anchor functions. For each function \(f\in B\), we find vectors that are most similar from the function vector database to obtain candidate reused TPL list and the anchor functions, respectively, i.e., \(L_{i}:[(bf_{1},bf_{1}),(bf_{2},bf_{2}),\ldots,(bf_{j},bf_{j})]\), where \(bf_{j}\) is a function in the target binary \(B\); \(lf_{j}\) is a function in the candidate matching library \(L_{i}\); and \((bf_{j},lf_{j})\) represent the matching anchor functions and we take their similarity scores as part of the similarity scores of \(B\) and \(L_{i}\). Therefore, the problem of anchor function acquisition is expressed as the problem of vector similarity search. Specifically, it can be expressed as, given a collection of \(m\) function vectors in \(V_{B}:q_{1},q_{2},\ldots,q_{m}\) and a collection of \(n*k\) function vectors in \(V_{L}:v_{1},v_{2},\ldots,v_{n*k}\), how to quickly find the top-k similar function vectors for each \(q_{i}\)? In BBDetector, we search similar function vectors based on quantization-based indexes. Search processing of a query \(q_{i}\) over quantization-based indexes takes two steps: (1) Find the closest \(n_{probe}\) clusters based on the distance between \(q_{i}\) and the centroid of each clusters. (2) Search within each of the \(n_{probe}\) relevant clusters to find similar vectors. For example, as shown in the lower right corner of Figure 1, assuming \(n_{probe}\) is 2, the closet clusters centroids of \(q_{i}\) are \(c_{0}\) and \(c_{1}\), and then we scan vectors \(v_{0},v_{1},v_{2},v_{3},v_{4},v_{5},v_{6}\) to find similar vectors. In the stage of the feature match, we measure the similarity score \(S_{BL_{i}}\) based on these anchor functions. We measure their similarity by computing their function vectors' cosine similarity scores for the anchor functions, which are often used to compare the similarity degree of the binary function vectors [12; 23; 24]. We obtain the similarity score \(S_{BL_{i}}\) by calculating the sum of the cosine similarity of these anchor function vectors and averaging it. When the similarity score is greater than the threshold (we set it to 0.8, which is determined empirically), we consider the target binary having a reuse relationship with the corresponding library. If the detected matching libraries have multiple versions in the TPL database, we use the version with the highest similarity score as the final matching version. The specific algorithm of TPL detection based on function features is shown in Algorithm 2. The algorithm's inputs are the function vectors \(V_{B}\) of the target binary and the function vector index table.