IoTSim: Internet of Things-Oriented Binary Code Similarity Detection with Multiple Block Relations.

Area of Science:

• Computer Security
• Software Engineering
• Internet of Things (IoT)

Background:

• Binary code similarity detection (BCSD) is vital for cybersecurity tasks like vulnerability and malware detection.
• The proliferation of IoT devices necessitates BCSD methods that are robust across diverse instruction architectures.
• Existing BCSD approaches often struggle with cross-architecture analysis and out-of-vocabulary (OOV) challenges.

Purpose of the Study:

• To propose a novel IoT-oriented binary code similarity detection approach.
• To develop a method that is robust against different instruction architectures.
• To address the out-of-vocabulary (OOV) challenge in language models for BCSD.

Main Methods:

• Leveraging a customized transformer-based language model with disentangled attention for relative position information.
• Implementing a base-token prediction pre-training task to handle OOV tokens and capture basic semantics.
• Integrating directed jumps, data dependency, and address adjacency for function embedding generation using multi-layer Graph Convolutional Networks (GCN).

Main Results:

• The proposed block relation matrix significantly enhances the performance of the IoTSim system.
• IoTSim achieved a recall@1 of 0.903 across different architectures with a pool size of 103.
• The approach demonstrated superior performance compared to state-of-the-art methods like Trex, SAFE, and PalmTree.

Conclusions:

• The developed IoTSim approach offers a robust solution for cross-architecture binary code similarity detection, particularly for IoT environments.
• The novel pre-training task and integrated block relations effectively address key challenges in BCSD.
• IoTSim represents a significant advancement in binary analysis for diverse and evolving IoT ecosystems.