Understand Code Style: Efficient CNN-based Compiler Optimization Recognition System

TL;DR

This paper introduces BinEye, a CNN-based system for recognizing compiler optimization levels in binary files, achieving high accuracy and interpretability, aiding binary analysis and security research.

Contribution

The paper presents a novel CNN-based model, BinEye, for automatic recognition of compiler optimization levels in binary files, with improved speed and interpretability.

Findings

Achieves over 97% accuracy in recognition.

At least 8 times faster than RNN-based models.

Provides insights into code differences caused by optimizations.

Abstract

Compiler optimization level recognition can be applied to vulnerability discovery and binary analysis. Due to the exists of many different compilation optimization options, the difference in the contents of the binary file is very complicated. There are thousands of compiler optimization algorithms and multiple different processor architectures, so it is very difficult to manually analyze binary files and recognize its compiler optimization level with rules. This paper first proposes a CNN-based compiler optimization level recognition model: BinEye. The system extracts semantic and structural differences and automatically recognize the compiler optimization levels. The model is designed to be very suitable for binary file processing and is easy to understand. We built a dataset containing 80,028 binary files for the model training and testing. Our proposed model achieves an accuracy of over 97%. At the same time, BinEye is a fully CNN-based system and it has a faster forward calculation speed, at least 8 times faster than the normal RNN-based model. Through our analysis of the model output, we successfully found the difference in assembly codes caused by the different compiler optimization level. This means that the model we proposed is interpretable. Based on our model, we propose a method to analyze the code differences caused by different compiler optimization levels, which has great guiding significance for analyzing closed source compilers and binary security analysis.