Enhancing Learning-Based Binary Code Similarity Detection Model through Adversarial Training with Multiple Function Variants (2024)

Abstract: Compared to identifying binary versions of the same function under different compilation options, existing Learning-Based Binary Code Similarity Detection (LB-BCSD) methods exhibit lower accuracy in recognizing functions with the same functionality but different implementations. To address this issue, we introduces an adversarial attack method called FuncFooler, which focuses on perturbing critical code to generate multiple variants of the same function. These variants are then used to retrain the model to enhance its robustness. Current adversarial attacks against LB-BCSD mainly draw inspiration from the FGSM (Fast Gradient Sign Method) method in the image domain, which involves generating adversarial bytes and appending them to the end of the executable file. However, this approach has a significant drawback: the appended bytes do not affect the actual code of the executable file, thus failing to create diverse code variants. To overcome this limitation, we proposes a gradient-guided adversarial attack method based on critical code—FuncFooler. This method designs a series of strategies to perturb the code while preserving the program’s semantics. Specifically, we first utilizes gradient information to locate critical nodes in the control flow graph. Then, fine-grained perturbations are applied to these nodes, including control flow, data flow, and internal node perturbations, to obtain adversarial samples. The experimental results show that the application of the FuncFooler method can increase the accuracy of the latest LB-BCSD model by 5%-7%.

## introduction binary code similarity detection methods can identify and return a set of functions most similar to a given binary function. these functions usually originate from the same source code but differ due * corresponding author. to various compilation settings. binary code similarity detection plays a crucial role in various security applications such as malware detection @xcite @xcite @xcite , software plagiarism detection @xcite @xcite @xcite , vulnerability discovery @xcite @xcite , and patch analysis @xcite @xcite . in recent years, with the rise of artificial intelligence technologies, learning-based binary code similarity detection (lb-bcsd) techniques have emerged. leveraging the powerful learning capabilities of machine learning models, these techniques excel in instruction semantic recognition, significantly improving detection accuracy and speed compared to traditional methods @xcite @xcite . however, in the field of software development, differences in programmers' coding habits, skill levels, and design approaches lead to various implementations of functions with the same functionality. this diversity is already evident at the source code level and becomes even more complex at the compiled binary code level. although these different code implementations functionally align, their internal structures and design logics may differ significantly. this situation presents substantial challenges for software analysis, maintenance, and security detection. currently, lb-bcsd methods are primarily used to assess the similarity of the same function under different compilation options. however, this study reveals that when the lb-bcsd model encounters functions with identical functionality but different implementations, its identification accuracy decreases by 13% compared to identifying versions of the same function compiled under dif-ferent options (o2 and o3). this finding highlights the limitations of existing lb-bcsd methods in handling diverse code implementations. to improve the model's capability in recognizing such function variants, an intuitive solution is to retrain the model using a large number of function samples with the same functionality but different implementations. however, implementing this strategy faces several challenges. the primary challenge is collecting a sufficient number of function samples with the same functionality but different implementations. although online coding platforms like leetcode offer many implementations of functions with the same functionality, these are mainly concentrated on specific coding problems and do not fully reflect the diversity of realworld programs. for more extensive real-world programs, collecting samples with the same functionality but significantly different implementations is extremely difficult. when implementing the same function, each programmer may choose different algorithms, data structures, or coding techniques based on specific requirements and their own experience, leading to a myriad of implementation methods. theoretically, the different implementation methods for a function are infinite. another important consideration is that not all different implementations will interfere with the lb-bcsd model's identification. therefore, it is crucial to explore which subtle code variations mislead the model, as this has significant practical implications. to address the above issues, this study proposes a gradient-guided white-box attack method based on critical code, called funcfooler. this method generates multiple variants of the same function by designing perturbation strategies for the control flow, data flow, and internal nodes of executable files, such as altering control flow structures. additionally, this study transforms the generation process of adversarial examples into an optimization problem and uses gradient algorithms to select critical nodes in the executable file's control flow graph for perturbation. experimental results show that funcfooler can improve the sota lb-bcsd model's accuracy by 5%-7%, demonstrating the effectiveness of this method in enhancing model robustness. the main contributions of this paper are as follows: when the lb-bcsd model handles functions that have the same functionality but different implementation methods, its recognition accuracy decreases by 13% compared to recognizing different versions of the same function under different compilation options (o2 and o3). ## related work researchers have explored the field of white-box adversarial attacks and pointed out issues with adversarial samples in lb-bcsd methods. early studies @xcite drew inspiration from attack methods such as fgsm in the image domain, using gradients to locate and modify critical bytes in executable files to construct adversarial samples. however, these methods have not been very effective when applied to binary programs. the reason lies in the highly structured nature of binary programs, which are extremely sensitive to minor modifications. the elf file includes complex structures such as executable file header tables, data section information, code section information, etc. any arbitrary modification of these bytes can disrupt the integrity of the executable file's functionality. to generate adversarial samples without compromising the functionality of executable files, researchers @xcite have started modifying non-functional areas in the executable file that are not loaded into memory, such as appending invalid bytes at the end of the executable file or adding new sections in the sections that are not loaded. however, these perturbations do not affect the program's execution logic or code regions significantly, thus failing to meet the requirement of generating multiple code variants for the same function. ## challenges in the field of image processing, white-box adversarial attacks induce misclassification in image recognition systems by making imperceptible adjustments to the image. the core challenge lies in creating adversarial samples that cause model misjudgments while ensuring the samples remain visually indistinguishable to humans. methods like fgsm in image processing calculate gradients of the model's loss function with respect to the input, take their sign, multiply by a small step size (perturbation magnitude), and add this perturbation to the original input to generate adversarial samples. fgsm uses gradient information to pinpoint critical pixels that are most likely to affect the model's accuracy. in contrast, this study perturbs binary functions, posing unique challenges compared to image-based approaches: challenge 1: identifying critical code in functions. in the lb-bcsd domain, a similar whitebox attack strategy can theoretically be employed, utilizing gradient information to identify critical code and perturb it to generate adversarial samples. however, to enhance the accuracy of lb-bcsd methods, approaches such as asm2vec and jtrans encode the control flow information of functions into vector embeddings. the asm2vec method, for instance, adopts the concept of random walks, starting from the entry point of a function and randomly sampling edges in the control flow graph. for each sampled edge, the corresponding assembly code is concatenated to construct a new instruction sequence. this random walk strategy simulates the actual execution flow of the program. by performing multiple random walk operations, it covers as many edges in the control flow graph as possible, thereby revealing and expressing the semantic features of the function more comprehensively. however, random walk makes gradient information inconsistent, making it challenging to identify and perturb the critical code effectively. every random walk randomly samples a subgraph from the control flow graph, resulting in unique instruction sequences per walk. this means that if a specific subgraph is selected for perturbation and subsequently attacked using an adversarial sample, the model might embark on a new random walk, which may not resample the previously perturbed node, hence failing to achieve an attack. therefore, to resolve the instability caused by random walk, a corresponding strategy must be developed to ensure an effective implementation of the attack. challenge 2: designing the perturbation method. in image processing, adversarial samples can be generated by directly adjusting the values of critical pixels and limiting the perturbation magnitude to ensure the adversarial samples look similar to the original image. however, in the domain of binary code, it is crucial to ensure the functionality of the code remains intact. directly modifying byte values of instructions can potentially destroy the functionality of the code. therefore, the design of the perturbation method must ensure that the original function's functionality is not adversely affected. ## design the workflow of funcfooler is illustrated in figure 1 . at the top of the process, the training phase of the model is shown, which includes initial training and fine-tuning on the training dataset, followed by evaluation of the model's accuracy on the test dataset. training set augmented training set training trained model 1. identify dominate nodes 3. select perturbation method perturbed sample testing set testing fine tuned model 6. fine tuning 2. compute node importance 4. perturb ori. sample ori. sample perturbation method 5. add adversarial samples to the training set fine tuning fine tuned model funcfooler takes the training set as input with the goal of generating multiple variants of the original samples and enhancing the robustness of the model through fine-tuning. specifically, func-fooler first identifies dominating nodes in the original samples and uses gradient information to determine critical dominating nodes. then, it evaluates different perturbation methods and selects the most effective method to perturb the original samples. if the perturbed sample can cause the target model to make incorrect judgments, it is considered an effective adversarial sample and is added to the training set to augment it. finally, the model is retrained using the augmented training set to improve its robustness and generalization ability. ## experimental evaluation the experimental evaluation in this paper primarily revolves around the following core research questions: ## conclusion to improve the model's ability to recognize function variants, we designed funcfooler to generate multiple variants of a function and then use these code variants to retrain the model to enhance its robustness. when given a function, funcfooler first uses gradient information to determine the importance of each node in its control flow graph. subsequently, specific control flow, data flow, and intra-node perturbations are applied to these key nodes to generate adversarial samples. experimental results show that funcfooler can improve the accuracy of sota lb-bcsd models by 5%-7%.