Bin2Vec: Interpretable and Auditable Multi-View Binary Analysis for Code Plagiarism Detection

TL;DR

Bin2Vec is a multi-view binary analysis framework that combines structural and behavioral features of software to improve interpretability and accuracy in code similarity detection, aiding cybersecurity and reverse-engineering.

Contribution

It introduces a modular, multi-view approach that integrates static and dynamic features into an explainable similarity measure for binary programs.

Findings

Effective in distinguishing different versions of Windows programs

Provides interpretable visualizations of program similarities

Enhances reliability and explainability of binary analysis

Abstract

We introduce Bin2Vec, a new framework that helps compare software programs in a clear and explainable way. Instead of focusing only on one type of information, Bin2Vec combines what a program looks like (its built-in functions, imports, and exports) with how it behaves when it runs (its instructions and memory usage). This gives a more complete picture when deciding whether two programs are similar or not. Bin2Vec represents these different types of information as views that can be inspected separately using easy-to-read charts, and then brings them together into an overall similarity score. Bin2Vec acts as a bridge between binary representations and machine learning techniques by generating feature representations that can be efficiently processed by machine-learning models. We tested Bin2Vec on multiple versions of two well-known Windows programs, PuTTY and 7-Zip. The primary results strongly confirmed that our method compute an optimal and visualization-friendly representation of the analyzed software. For example, PuTTY versions showed more complex behavior and memory activity, while 7-Zip versions focused more on performance-related patterns. Overall, Bin2Vec provides decisions that are both reliable and explainable to humans. Because it is modular and easy to extend, it can be applied to tasks like auditing, verifying software origins, or quickly screening large numbers of programs in cybersecurity and reverse-engineering work.