|
| | | | |
| | | |
| Stat |
Members: 3657
Articles: 2'599'751
Articles rated: 2609
14 October 2024 |
|
| | | | |
|
Article overview
| |
|
|
Inter-BIN: Interaction-based Cross-architecture IoT Binary Similarity Comparison | | Qige Song
; Yongzheng Zhang
; Binglai Wang
; Yige Chen
; | | Date: |
1 Jun 2022 | | Abstract: | The big wave of Internet of Things (IoT) malware reflects the fragility of
the current IoT ecosystem. Research has found that IoT malware can spread
quickly on devices of different processer architectures, which leads our
attention to cross-architecture binary similarity comparison technology. The
goal of binary similarity comparison is to determine whether the semantics of
two binary snippets is similar. Existing learning-based approaches usually
learn the representations of binary code snippets individually and perform
similarity matching based on the distance metric, without considering
inter-binary semantic interactions. Moreover, they often rely on the
large-scale external code corpus for instruction embeddings pre-training, which
is heavyweight and easy to suffer the out-of-vocabulary (OOV) problem. In this
paper, we propose an interaction-based cross-architecture IoT binary similarity
comparison system, Inter-BIN. Our key insight is to introduce interaction
between instruction sequences by co-attention mechanism, which can flexibly
perform soft alignment of semantically related instructions from different
architectures. And we design a lightweight multi-feature fusion-based
instruction embedding method, which can avoid the heavy workload and the OOV
problem of previous approaches. Extensive experiments show that Inter-BIN can
significantly outperform state-of-the-art approaches on cross-architecture
binary similarity comparison tasks of different input granularities.
Furthermore, we present an IoT malware function matching dataset from real
network environments, CrossMal, containing 1,878,437 cross-architecture reuse
function pairs. Experimental results on CrossMal prove that Inter-BIN is
practical and scalable on real-world binary similarity comparison collections. | | Source: | arXiv, 2206.00219 | | Services: | Forum | Review | PDF | Favorites | |
|
|
No review found.
Did you like this article?
Note: answers to reviews or questions about the article must be posted in the forum section.
Authors are not allowed to review their own article. They can use the forum section.
|
| |
|
|
|
REGISTER