Binary Code Similarity Detection Using BERT Assembly Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing complexity of computer programs and reliance on open source code pose challenges in detecting vulnerabilities and copyright/patent infringement in binary codes, as existing technologies find it difficult to analyze binary code effectively for security and legal compliance.
Innovation Solution
A binary code similarity detection device and method utilizing a trained model based on bidirectional encoder representations from transformers (BERT) that preprocesses binary code into assembly language, extracts functions or commands, and fine-tunes the model to detect similarities between input and pre-stored binary codes, leveraging pre-training and fine-tuning steps for enhanced performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If binary code is analyzed directly using traditional methods, then the analysis process is simple, but the detection accuracy for vulnerabilities and copyright infringement is low
Solution Approach 1:
The patent introduces assembly language as an intermediary representation between binary code and human-readable code. The binary code is first converted to assembly language, which serves as a bridge for further processing and analysis, enabling more accurate detection while maintaining manageable process complexity
Solution Approach 2:
The patent replaces traditional mechanical analysis methods with deep learning-based neural networks. The neural network processes assembly language expressions to detect similarities and identify vulnerabilities, substituting conventional analysis mechanisms with intelligent systems that achieve higher accuracy
2Reliability
If deep learning-based models are used for binary code analysis, then the detection performance is improved, but the computational resources and training time increase
Solution Approach 1:
The patent performs pre-training of the neural network model in advance using a large corpus of assembly language expressions and binary code. This preliminary action allows the model to be pre-optimized for detection tasks, reducing the computational resources needed during actual analysis while maintaining high detection performance
Solution Approach 2:
The patent optimizes model parameters including embedding dimensions, learning rates, and regularization strengths to balance detection accuracy with computational efficiency. By carefully tuning these parameters, the system achieves reliable detection while minimizing unnecessary computational resource consumption
3Ease of operation
If binary code is converted to assembly language for analysis, then the readability and processability are improved, but the conversion process adds complexity
Solution Approach 1:
The patent employs a disassembler tool that automatically converts binary code to assembly language without requiring manual intervention. The conversion process is handled self-service through automated tools, improving processability while keeping the added complexity manageable through standardization
Data Source
AI summary
A binary code similarity detection device performs a preprocessing operation of generating an assembly expression for the binary code by converting a machine language of an input binary code into an assembly language, extracting an assembly function or a command from the binary code converted to the assembly language, and detects a similarity to the assembly expression of a pre-stored binary code by inputting the assembly expression generated by the preprocessing operation to a trained model based on bidirectional encoder representations from transformers (BERT), and the trained model is generated by performing a pre-training step of causing the assembly expression to be understood and a fine-tuning step of inputting an assembly expression of a first binary code and an assembly expression of a second binary code to a pre-trained model and then fine-tuning the pre-trained model based on a similarity between the first binary code and the second binary code.