## 4 The Design of GeneDiff
### Semantic Representation Model
1\(G_{f}\leftarrow\) DataRepository.getCFG( \(f\) );
2 Paths \(\leftarrow\varnothing\);
3 blks \(\leftarrow\varnothing\);
4 foreach edg in shuffle( \(G_{f}\) )do
5 ifedg in blksthen
6 continue;
7 seq \(\leftarrow\varnothing\);
8 node \(\leftarrow\) edg;
9 whileprev( node )do
10 ifprev( node ) \(\setminus\) blksthen
11 node \(\leftarrow\) rand( prev( node ) \(\setminus\) blks );
12 seq \(\cup\) node;
13
14
15 seq \(\leftarrow\) edg;
16
17 whilenext( node )do
18 ifnext( node ) \(\setminus\) blksthen
19 node \(\leftarrow\) rand( next( node ) \(\setminus\) blks );
20 seq \(\cup\) node;
21
22
23 else
24\(node\leftarrow\) rand( next( node ));
25 seq \(\cup\) node;
26
27 Paths \(\leftarrow\) Paths \(\cup\) {seq};
28 blks \(\leftarrow\) blks \(\cup\) seq;
29
30 returnPaths;
```  
**Algorithm 2**Generating multiple paths  
This method ensures that all the blocks of \(f\) are fully covered. Lines 7-23 of Algorithm 2 are used to expand an _edg_ into a sequence, where prev( _node_ ) \(\setminus\)_blks_ means \(\{x|x\in\text{prev}(\)_node_ ) _and_\(x\
otin\)_blks_}. To avoid too many blocks being repeated in _Paths_, unselected blocks are selected first when expanding _edg_ (Algorithm 2, lines 10-13 and lines 18-20). Finally, we add all the expanded sequences to _Paths_ and return it. In _Paths_, every sequence represents a potential execution trace. **Training model**. After generating the multiple paths of functions, we take each path as an input, train a representation learning model based on semantics, and map instructions and functions into high-dimensional vectors. Figure 6 shows the structure of the model. For functions in the data repository, we map each function \(f_{c}\) into a numeric vector \(\overrightarrow{\delta_{f_{c}}}\in\mathbb{R}^{d}\). Each dimension of \(\overrightarrow{\delta_{f_{c}}}\) is initialized to a small random value near zero. Similarly, we map each token of the data repository into a vector \(\overrightarrow{v}\in\mathbb{R}^{d}\). Unlike references [18, 26], each token in GeneDiff consists of several VEX instructions from the same assembly instruction. For example, \(t_{1}\) in Figure 6 consists of three VEX instructions (after deletion). These VEX instructions come from the same IMark(0x4, 3, 0),where an IMark represents an assembly instruction. The initialization method of \(\overrightarrow{v}\) is the same as that of \(\overrightarrow{\delta_{f_{c}}}\). Given a function \(f_{c}\) from the data repository, where \(paths_{f_{c}}\) represents the multiple paths of \(f_{c}\), for each path \(p_{i}\) in \(paths_{f_{c}}\), the model walks through the basic blocks from their beginning. When traversing VEX instructions in a basic block, we treat an IMark as a token. When we calculate \(\overrightarrow{v}\) of the current token \(t_{i}\), the first \(k\) tokens and the last \(k\) tokens are treated as the context \(\mathbb{C}\). Simultaneously, we look up the vector representation \(\overrightarrow{\delta_{f_{c}}}\) in the previously built dictionary. We use \(\phi(t_{i},f_{c})\) to represent the average of the neighbour tokens and \(\overrightarrow{\delta_{f_{c}}}\). This can be formulated as follows:  
\[\phi(t_{i},f_{c})=\frac{1}{|C_{\mathbf{t_{i}}}|+1}(\overrightarrow{\delta_{f _{c}}}+\sum_{\overrightarrow{v}}^{C_{\mathbf{t_{i}}}}\overrightarrow{v}). \tag{2}\]  
The proposed model attempts to maximize the following log probability:  
\[\sum_{f_{c}}^{\mathbb{D}}\sum_{p_{i}}^{paths_{f_{c}}}\sum_{t_{j}}^{p_{i}}log( \mathbf{P}(t_{j}|f_{c},t_{j-k},\ldots,t_{j+k})). \tag{3}\]  
The prediction task is typically performed via a softmax algorithm, which is a multi-class classifier:  
\[\mathbf{P}(t_{j}|f_{c},t_{j-k},\ldots,t_{j+k})=\frac{e^{y_{j}}}{\sum_{d}^{ \mathbb{D}}e^{y_{d}}}, \tag{4}\]  
where \(D\) denotes all the tokens constructed in the data repository. Each \(y_{t_{d}}\) is an un-normalized log probability for each output token \(t_{d}\), computed as follows:  
\[y=b+Uh(t_{j-k},\ldots,t_{j+k};\overrightarrow{v}) \tag{5}\]  
where \(U\) and \(b\) are the softmax parameters.