SimCLF: A Simple Contrastive Learning Framework for Function-level Binary Embeddings

TL;DR

SimCLF introduces an unsupervised contrastive learning framework for function-level binary code similarity detection, leveraging augmented data to improve robustness and accuracy without manual annotations.

Contribution

It presents a novel unsupervised contrastive learning approach for binary code embeddings that operates on disassembled functions and uses data augmentation techniques.

Findings

Outperforms state-of-the-art in accuracy

Excels in few-shot learning scenarios

Operates effectively without manual annotations

Abstract

Function-level binary code similarity detection is a crucial aspect of cybersecurity. It enables the detection of bugs and patent infringements in released software and plays a pivotal role in preventing supply chain attacks. A practical embedding learning framework relies on the robustness of the assembly code representation and the accuracy of function-pair annotation, which is traditionally accomplished using supervised learning-based frameworks. However, annotating different function pairs with accurate labels poses considerable challenges. These supervised learning methods can be easily overtrained and suffer from representation robustness problems. To address these challenges, we propose SimCLF: A Simple Contrastive Learning Framework for Function-level Binary Embeddings. We take an unsupervised learning approach and formulate binary code similarity detection as instance discrimination. SimCLF directly operates on disassembled binary functions and could be implemented with any encoder. It does not require manually annotated information but only augmented data. Augmented data is generated using compiler optimization options and code obfuscation techniques. The experimental results demonstrate that SimCLF surpasses the state-of-the-art in accuracy and has a significant advantage in few-shot settings.