Searching for similar binary code based on the influence of basic block vertex

Abstract

Binary code similarity detection (BCSD) has many security applications and has attracted a lot of focus. But existing solutions for BCSD problems mainly focus on comparing the similarity between two binary functions and what need to be compared is not always a pair of equal-size binary programs. To solve the problem of searching similar binary code for a small size program in a large size program, in this manuscript, we propose a searching method based on the influence of basic block vertex. Firstly, we formalize the similar code searching problem as a subgraph matching problem and extract the attributed control flow graphs (ACFGs) of the binary programs. Then, we propose a novel metrics to measure the influence of each basic block vertex in query ACFGs and choose the vertex with the largest influence value as the central node. Next, we take the matching nodes of the central node in target ACFG as seed nodes and extending each candidate sub-area from the seed nodes. At last, these candidate sub-areas are further filtered and similar subgraphs are verified in these sub-areas. Experimental results indicate that the proposed method can find similar binary code efficiently.