Unsupervised Binary Code Translation with Application to Code Clone Detection and Vulnerability Discovery (2023)

Abstract: Binary code analysis has immense importance in the research domain of software security. Today, software is very often compiled for various Instruction Set Architectures (ISAs). As a result, cross-architecture binary code analysis has become an emerging problem. Recently, deep learning-based binary analysis has shown promising success. It is widely known that training a deep learning model requires a massive amount of data. However, for some low-resource ISAs, an adequate amount of data is hard to find, preventing deep learning from being widely adopted for binary analysis. To overcome the data scarcity problem and facilitate cross-architecture binary code analysis, we propose to apply the ideas and techniques in Neural Machine Translation (NMT) to binary code analysis. Our insight is that a binary, after disassembly, is represented in some assembly language. Given a binary in a low-resource ISA, we translate it to a binary in a high-resource ISA (e.g., x86). Then we can use a model that has been trained on the high-resource ISA to test the translated binary. We have implemented the model called UNSUPERBINTRANS, and conducted experiments to evaluate its performance. Specifically, we conducted two downstream tasks, including code similarity detection and vulnerability discovery. In both tasks, we achieved high accuracies.

## introduction in software security research, binary code analysis plays a significant role. it can play a vital role in various tasks, such as vulnerability discovery, code plagiarism detection, and security auditing of software, etc., without accessing the source code. today, software is very often compiled for various instruction set architectures (isas). for example, iot vendors often use the same code base to compile firmware for different devices that operate on varying isas (e.g., x86 and arm), which causes a single vulnerability at source-code level to spread across binaries of diverse devices. as a result, cross-architecture binary code analysis has become an emerging problem @xcite @xcite @xcite . analysis of binaries across isas, however, is non-trivial: such binaries differ greatly in instruction sets; calling conventions; general-and special-purpose cpu register usages; and memory addressing modes. recently, we have witnessed a surge in research efforts that leverage deep learning to tackle various binary code analysis tasks, including code clone detection @xcite , malware classification @xcite , vulnerability discovery @xcite , and function prototype inference @xcite . deep learning has demonstrated its strengths in code analysis, and shown noticeably better performances over traditional program analysis-based methods @xcite @xcite in terms of both accuracy and scalability. it is widely known that training a deep learning model usually requires a massive amount of data. as a result, most deep learning-based binary code analysis methods have been dedicated to a high-resource isa, such as x86, where large-scale labeled datasets exist for training their models. but for many other isas (e.g., arm, powerpc), there are few or even no labeled datasets, resulting in negligent focus on these low-resource isas. moreover, it is labor-intensive and time-consuming to collect data samples and manually label them to build datasets for such low-resource isas. in this work, we aim to overcome the challenge of data scarcity in low-resource isas and facilitate crossarchitecture binary code analysis. our insight. given a pair of binaries in different isas, they, after being disassembled, are represented in two sequences of instructions in two assembly languages. in light of this insight, we propose to learn from neural machine translation (nmt), an area that focuses on translating texts from one human language into another using machine/deep learning techniques @xcite . there are two types of nmt systems. one is supervised and requires a large parallel corpus, which poses a major practical problem. another is unsupervised, which removes the need for parallel data. as unsupervised nmt has the advantage of requiring no cross-lingual signals, we adopt unsupervised nmt for binary code analysis. our approach. drawing inspiration from the unsupervised neural machine translation model undreamt @xcite , we design an unsupervised binary code translation model called unsuperbintrans. unsuperbintrans is trained in a completely unsupervised manner, relying solely on mono-architecture corpora. once trained, unsuperbintrans can translate binaries from a low-resource isa to a high-resource isa (e.g., x86). consequently, when dealing with a binary in a low-resource isa, translating it into a high-resource isa enables us to use a model trained on the high-resource isa to test the translated binary code. unsuperbintrans can be applied to a variety of applications, such as vulnerability discovery and code similarity detection. we have implemented unsuperbintrans foot_0 , and evaluated its performance. specifically, we conduct two critical binary analysis tasks, including code similarity detection and vulnerability discovery. in both tasks, we achieve high accuracies across different isas. for example, a model trained on x86 can successfully detect all vulnerable functions in arm (even the model has not been exposed to any vulnerable functions in arm during its training), indicating the exceptional translation capabilities of unsuperbintrans. below we summarize our contributions: through this, we can resolve the data scarcity issue in low-resource isas. ## background a control flow graph (cfg) is the graphical representation of control flow or computation during the execution of programs or applications. a cfg is a directed graph in which each node represents a basic block and each edge represents the flow of control between blocks. a basic block is a sequence of consecutive statements in which the flow of control enters at the beginning and leaves at the end without halt or branching except at the end. as shown in figure 1 (a), given a piece of source code, its corresponding cfg is shown in figure 1(b), where each node is a basic block. similarly, we can also generate the corresponding cfg for a piece of binary code. we here use the source code as an example for simplicity. ## motivation and model design this section first discusses the motivation behind our proposal for unsupervised binary code translation, and then presents the model design. ## evaluation we conducted experiments to evaluate the translation performance of unsuperbintrans. we first describe the experimental settings, and then conduct quantitative analysis by computing the bleu scores (bilingual evaluation understudy) @xcite . after that, we conduct two downstream tasks, including code similarity comparison and vulnerability discovery. finally, we evaluate the efficiency. ## related work the related work can be divided into: traditional and machine/deep learning based. each one can be further divided into: mono-architecture and crossarchitecture based. ## conclusion deep learning has been widely adopted for binary code analysis. however, the limited availability of data for low-resource isas hinders automated analysis. in this work, we proposed unsuperbin-trans, which can leverage the easy availability of dataset in x86 to address the data scarcity problem in low-resource isas. we conducted experiments to evaluate the performance. for vulnerability discovery, unsuperbintrans is able to detect all vulnerable functions across isas. thus, unsu-perbintrans offers a viable solution for addressing the data scarcity issue in low-resource isas. nlp-inspired binary code analysis is a promising research direction, but not all nlp techniques are applicable to binary code analysis. therefore, works like ours that identify and study effective nlp techniques for binary code analysis are valuable in advancing exploration along this direction. this work demonstrates how nlp techniques can be leveraged in binary code analysis and underscores the practical utility of such approaches.