Pith. sign in

REVIEW 3 major objections 6 minor 64 references

ORCAS: Obfuscation-Resilient Binary Code Similarity Analysis using Dominance Enhanced Semantic Graph

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that binary code similarity analysis can resist combined obfuscation by replacing fragile control-flow edges in the graph representation with dominance and post-dominance relations.

desk verdict The DESG graph is a genuine representational idea with a clean ablation behind it, but the paper's headline numbers rest on a contaminated vulnerability-search protocol and an undisclosed train/test split. read the letter →

arxiv 2506.06161 v2 pith:6HASGVWI submitted 2025-06-06 cs.CR cs.SE

Yufeng Wang , Yuhong Feng , Yixuan Cao , Haoran Li , Haiyue Feng , Yifeng Wang This is my paper
classification cs.CRcs.SE
keywords binarycodesimilarityanalysisobfuscation-resilientdominancerelationpost-dominancesemanticgraphneuralnetworkvulnerabilitydetection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Binary code similarity analysis is hobbled by obfuscation because techniques such as bogus control flow and control-flow flattening rewrite the very structure most detectors use. This paper claims that a function representation can drop control-flow edges entirely and instead wire basic blocks together through dominance and post-dominance relations, which survive obfuscation far better. On top of those edges it adds the usual instruction-level data and effect relations, and a containment relation tying instructions to their blocks. The resulting graph, the DESG, is embedded by a gated graph neural network and compared by cosine similarity. The paper reports that this design beats eight baselines, including the previous best method, by an average of 12.1% PR-AUC when all three obfuscations are combined, and recalls up to 43% more vulnerable functions on a new obfuscated CVE dataset.

What carries the argument

The DESG is a graph over normalized P-Code instructions: def-use edges connect an instruction to the one that defines an operand it reads; effect edges impose execution order around calls and memory access; contain edges bind an opcode token to its basic block; and dominate/post-dominate edges connect virtual basic-block nodes according to the dominator and post-dominator trees of the lifted CFG. Varnode normalization collapses register, constant, stack, unique, and ram operands into a small vocabulary that generalizes across x86-64 and ARM64. A Gated Graph Neural Network with multi-head softmax pooling embeds the graph, and a margin-based pairwise loss with distance-weighted negative sampling separates similar from dissimilar functions.

What would settle it

Re-run the CVE vulnerability search with the query's own variant removed from the pool and report recall@10; if ORCAS's margin over the baselines persists, the dominance-based representation carries the result, whereas if recall falls to near the baselines, the reported 43% gain came from the query matching itself.

Watch

Extended reading notes

Core claim

ORCAS establishes that the instability of control-flow graphs under obfuscation is not inherent to binary semantics, and that a graph intentionally built without control-flow edges can carry enough information for robust matching. Its Dominance Enhanced Semantic Graph (DESG) contains three node types (virtual basic-block nodes, opcode nodes, operand nodes) and five edge types (data, effect, contain, dominate, post-dominate). The dominance and post-dominance edges come from the dominator tree and post-dominator tree of the lifted CFG, capturing which blocks lie on every path from the entry, and which lie on every path to the exit. The paper's empirical claim is that this representation yields average PR-AUC gains of 4.3%, 4.7%, 2.3%, and 12.1% over the strongest baseline for BCF, FLA, SUB, and the combined ALL setting, and a recall advantage of up to 43% on the released obfuscated vulnerability dataset.

Load-bearing premise

The evaluation assumes that search pools do not contain the query function itself and that test functions are held out from training; in the vulnerability search the pool is built from all ten variants of each CVE and the query is one of those variants, so an exact self-match can satisfy the top-10 recall.

Editorial extensions

If this is right

  • If a function's semantics can be matched without any control-flow edge, then other binary analyses that currently lean on CFG structure—clone detection, patch analysis, malware family grouping—could adopt dominance-enhanced graphs for robustness under obfuscation.
  • The construction avoids NLP-style pre-training on giant corpora; a GGNN trained on a few hundred binaries matches or beats transformer-based models that need millions of functions, suggesting cheaper deployment for vulnerability triage.
  • Because the DESG uses a normalized intermediate representation, the same embedding pipeline transfers across instruction set architectures without architecture-specific tuning.
  • The ablation shows the largest gain from dominance edges in the combined-obfuscation setting, implying that stacked obfuscations are exactly where the added structure pays off most.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If dominance relations are as stable as the paper suggests, then deliberate adversarial obfuscation targeting the dominator tree—such as inserting opaque predicates that dominate large regions—would be the natural next test, and the measured GED stability may not survive such targeted attacks.
  • The released vulnerability dataset would let other researchers re-run the search with strict holdout, excluding the query variant from its own pool; that would settle whether the 43% recall advantage is an artifact of self-matching.
  • The paper's success with compact structural features implies that carefully chosen program-structure priors may substitute for large-scale pre-training in binary understanding, which could shift how BCSA models are deployed when training corpora are scarce.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. ORCAS is a function-level binary code similarity analysis method designed to resist obfuscation. The paper proposes the Dominance Enhanced Semantic Graph (DESG), built by decompiling binaries to P-Code with Ghidra, normalizing varnodes, splitting instructions into opcode/operand tokens, and connecting instructions with data and effect edges, virtual basic blocks with dominance and post-dominance edges, and instructions to basic blocks with contain edges. Control-flow edges are deliberately omitted. A GGNN with multi-head attention pooling and a margin-based pairwise loss embeds functions, and cosine similarity scores pairs. Experiments on 578 BinKit binaries compare ORCAS with eight baselines for cross-ISA, cross-optimization, and cross-ISA/optimization/obfuscation search, one-to-one matching under BCF/FLA/SUB/ALL, an ablation removing the dominance edges, and a newly constructed 8-CVE obfuscated vulnerability dataset. The paper reports a 12.1% PR-AUC improvement over the strongest baseline on ALL obfuscation and up to a 43% recall improvement in vulnerability search, and it releases the vulnerability dataset.

Significance. If the empirical claims hold, the contribution is solid: the idea of removing CFG edges and relying on dominance/post-dominance plus semantic relations is a plausible mechanism for obfuscation robustness, and the Table 1 stability observation is independent of model training. The ablation in Section 5.3 cleanly shows that removing the dominance edges degrades performance, and releasing the vulnerability benchmark is a useful community resource. However, two evaluation-protocol gaps currently prevent the headline numbers from being taken at face value: the RQ4 query appears to be present in its own search pool, and no train/test split is disclosed for RQ1/RQ2. The omission of GTrans, a published D-Tree-based obfuscation-resilient method, also weakens the state-of-the-art claim. These issues are empirical and fixable rather than circular or conceptual, so the central idea remains defensible pending a corrected evaluation.

major comments (3)
  1. [5.4 (RQ4)] The vulnerability-search protocol places the query in the search pool. Section 5.4 states that the pool P is built by extracting functions from the 10 project variants and that the search is performed 'using a variant of the vulnerable function.' Since the ALL-obfuscated query variant is itself one of the marked vulnerable functions in P, the query can always self-match and count toward the recall numerator, so the reported 'up to 43%' improvement over HermesSim does not cleanly measure cross-variant retrieval. Please exclude the query variant from P or evaluate with leave-one-out recall, and report recall both with and without self-matches.
  2. [4.1 / 5.1-5.2] No train/test split is described. Section 4.1 defines the 578-binary dataset and Section 3.3.2 describes the training objective, but the RQ1/RQ2 evaluations never state that the query functions were held out from GGNN training. If training and evaluation draw from the same BinKit functions, Tables 3-6 report transductive fitting rather than generalization. This is especially consequential for the ALL row of Table 6, since the 12.1% PR-AUC improvement is the paper's headline result. Please specify and implement a project- or function-disjoint train/test split and report held-out numbers.
  3. [4.3 / 6.2] GTrans, cited in Section 6.2 as an obfuscation-resilient method that leverages the D-Tree structure, is absent from the baseline list in Section 4.3. Because the novelty of DESG centers on dominance and post-dominance relations, a direct comparison with GTrans under the same protocol is necessary to support the claim that ORCAS is state of the art. Without this comparison, the SOTA claim is not fully supported.
minor comments (6)
  1. [Figure 4 caption] The caption contains the typo 'socres'; it should be 'scores'.
  2. [4.3] In the jTrans paragraph, 'anthors' should be 'authors'.
  3. [4.2.2] The term 'group truth' appears twice and should be 'ground truth'.
  4. [4.2.1] The phrase 'the the Area Under the PR Curve' contains a duplicated article; it should be 'the Area Under the PR Curve'.
  5. [Reference [12]] In the reference list, 'Gcomputer' should be 'Computer'.
  6. [Tables 3-5] The tables report a metric labeled Recall@1 while Eq. (6) defines Recall@k; please clarify that Recall@1 is the k=1 instance and consider also reporting Recall@5 and Recall@10 for the search tasks.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the DESG representation and ORCAS's obfuscation-resilience claims are supported by external-benchmark comparisons and controlled ablations; the main caveats (query-in-pool, undisclosed train/test split) are evaluation limitations, not definitional reductions.

full rationale

ORCAS is an empirical method paper; its claimed derivation chain is DESG construction from P-Code/CFG (Algorithm 1), GGNN embedding, and cosine similarity. None of these steps defines the target prediction in terms of its own fitted output. The motivation's dominance-stability evidence (Table 1) is an independent GED measurement on about 1,800 obfuscated samples, not a byproduct of ORCAS training. RQ3 is a genuine controlled ablation: removing dominance/post-dominance edges degrades PR-AUC, which directly supports the design claim without circularity. The principal baseline comparisons are against external systems (HermesSim, jTrans, Trex, GMN, etc.); the only author-overlapping citation, CRABS-former [14], is used as a baseline rather than as a load-bearing premise. Two evaluation caveats should be noted but are not derivation circularity: (1) Section 5.4 builds the pool P from all 10 variants, including the ALL-obfuscated query variant, so every method receives a free self-match in top-10 recall; this inflates absolute recall numbers but is common to all compared systems and does not change the reported 43-point relative advantage. (2) Sections 3.3 and 5.1-5.2 do not state a train/test split, so RQ1/RQ2 could be transductive; this is a reproducibility/correctness risk, not a definitional equivalence. Overall the central representation claim is self-contained against external benchmarks and a controlled ablation, so no significant circularity is present.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The model relies on standard graph algorithms and domain assumptions about P-Code lifting and obfuscation stability. No physical or theoretical entities are introduced; DESG is a graph representation. The free parameters are standard ML hyperparameters, none reported, which hurts reproducibility but does not make the method circular.

free parameters (5)
  • GGNN hidden state dimension
    Not reported; determines embedding capacity and is chosen during model development.
  • Number of GGNN message passing layers
    Not reported; controls receptive field over DESG edges.
  • Margin m in pairwise loss (Eq. 5)
    Separation threshold in the training objective; value not given.
  • Attention pooling heads and inverse temperature beta
    Softmax pooling parameters (Eq. 3, Eq. 4) not reported.
  • Training hyperparameters (learning rate, batch size, epochs, negative sampling ratio)
    No training configuration is specified, so the reported results cannot be reproduced exactly.
assumptions (5)
  • domain assumption Dominator and post-dominator trees computed from CFG capture stable intra-function semantics under O-LLVM obfuscation.
    Central motivation; supported only by aggregate GED on about 1,800 samples (Table 1), not by proof. BCF can in principle add reachable fake blocks that change dominators.
  • ad hoc to paper Dropping all CFG edges does not discard semantic information needed for BCSA.
    DESG removes control-flow edges entirely and replaces them with dominance, post-dominance, def-use, effect, and contain edges; no theoretical guarantee is given that enough semantics is preserved.
  • domain assumption Ghidra P-Code lifting and the varnode normalization rules preserve semantic identity across ISAs and obfuscation options.
    Section 3.1; normalizing stack and unique varnodes to generic identifiers and register offsets with an architecture prefix could conflate distinct memory locations across functions.
  • domain assumption Standard library function names remain unchanged under obfuscation.
    Section 3.1; relies on dynamic linking symbol retention, which may fail for statically linked or stripped binaries.
  • standard math Lengauer-Tarjan dominator algorithm and GGNN message passing are correct.
    Background results used without proof; standard in compiler and graph learning literature.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ORCAS: Obfuscation-Resilient Binary Code Similarity Analysis using Dominance Enhanced Semantic Graph." pith.science (2026). https://pith.science/paper/6HASGVWI

@misc{pith2026250606161,
  author       = {Pith},
  title        = {Pith review of: ORCAS: Obfuscation-Resilient Binary Code Similarity Analysis using Dominance Enhanced Semantic Graph},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6HASGVWI}},
  note         = {Machine review of arXiv:2506.06161}
}
read the original abstract

Binary code similarity analysis (BCSA) serves as a foundational technique for binary analysis tasks such as vulnerability detection and malware identification. Existing graph based BCSA approaches capture more binary code semantics and demonstrate remarkable performance. However, when code obfuscation is applied, the unstable control flow structure degrades their performance. To address this issue, we develop ORCAS, an Obfuscation-Resilient BCSA model based on Dominance Enhanced Semantic Graph (DESG). The DESG is an original binary code representation, capturing more binaries' implicit semantics without control flow structure, including inter-instruction relations (e.g., def-use), inter-basic block relations (i.e., dominance and post-dominance), and instruction-basic block relations. ORCAS takes binary functions from different obfuscation options, optimization levels, and instruction set architectures as input and scores their semantic similarity more robustly. Extensive experiments have been conducted on ORCAS against eight baseline approaches over the BinKit dataset. For example, ORCAS achieves an average 12.1% PR-AUC improvement when using combined three obfuscation options compared to the state-of-the-art approaches. In addition, an original obfuscated real-world vulnerability dataset has been constructed and released to facilitate a more comprehensive research on obfuscated binary code analysis. ORCAS outperforms the state-of-the-art approaches over this newly released real-world vulnerability dataset by up to a recall improvement of 43%.

Figures

Figures reproduced from arXiv: 2506.06161 by the authors.

Figure 1
Figure 1. The D-tree and PD-tree of the CFG before and after the application of the BCF and FLA obfuscation, where gray nodes [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. The framework of ORCAS. It first translates binary functions into P-Code functions, generates function embeddings, [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. An example of constructing the DESG. For clarity, each basic block in (b) shows only the core logic P-Code operations. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (2 more)
Figure 5
Figure 5. Figure 5: Recall rate of real-world vulnerability search. [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 4
Figure 4. Figure 4: Average PR-AUC socres of ORCAS, ORCAS-RD on [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

64 extracted references · 57 canonical work pages

  1. [1]

    Sunwoo Ahn, Seonggwan Ahn, Hyungjoon Koo, and Yunheung Paek. 2022. Prac- tical binary code similarity detection with bert-based transferable similarity learning. In Proceedings of the 38th Annual Computer Security Applications Con- ference. 361–374

    work page 2022

  2. [2]

    Razia Azen and David V Budescu. 2003. The dominance analysis approach for comparing predictors in multiple regression. Psychological methods 8, 2 (2003), 129

    work page 2003

  3. [3]

    Silvio Cesare, Yang Xiang, and Wanlei Zhou. 2013. Control flow-based malware variantdetection. IEEE Transactions on Dependable and Secure Computing 11, 4 (2013), 307–317

    work page 2013

  4. [4]

    2021.{Obfuscation-Resilient} Executable Payload Extraction From Packed Malware

    Binlin Cheng, Jiang Ming, Erika A Leal, Haotian Zhang, Jianming Fu, Guojun Peng, and Jean-Yves Marion. 2021.{Obfuscation-Resilient} Executable Payload Extraction From Packed Malware. In 30th USENIX Security Symposium (USENIX Security 21). 3451–3468

    work page 2021

  5. [5]

    Cliff Click and Michael Paleczny. 1995. A simple graph-based intermediate representation. ACM Sigplan Notices 30, 3 (1995), 35–49

    work page 1995

  6. [6]

    Gao Cuiying, Yueming Wu, Heng Li, Wei Yuan, Haoyu Jiang, Qidan He, and Yang Liu. 2024. Uncovering and Mitigating the Impact of Code Obfuscation on Dataset Annotation with Antivirus Engines. In Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis . 553–565

    work page 2024

  7. [7]

    Yaniv David, Nimrod Partush, and Eran Yahav. 2017. Similarity of binaries through re-optimization. In Proceedings of the 38th ACM SIGPLAN conference on programming language design and implementation . 79–94

    work page 2017

  8. [8]

    Steven HH Ding, Benjamin CM Fung, and Philippe Charland. 2019. Asm2vec: Boosting static representation robustness for binary clone search against code obfuscation and compiler optimization. In 2019 ieee symposium on security and privacy (sp). IEEE, 472–489

    work page 2019

Show all 64 references
  1. [9]

    Yue Duan, Xuezixiang Li, Jinghan Wang, Heng Yin, et al . 2020. Deepbindiff: Learning program-wide code representations for binary diffing. (2020)

    2020

  2. [10]

    Chris Eagle. 2011. The IDA pro book . no starch press

    2011

  3. [11]

    Chris Eagle and Kara Nance. 2020. The Ghidra Book: The Definitive Guide . no starch press

    2020

  4. [12]

    Qian Feng, Rundong Zhou, Chengcheng Xu, Yao Cheng, Brian Testa, and Heng Yin. 2016. Scalable graph-based bug search for firmware images. In Proceedings of the 2016 ACM SIGSAC conference on Gcomputer and communications security . 480–491

    2016

  5. [13]

    Qian Feng, Rundong Zhou, Yanhui Zhao, Jia Ma, Yifei Wang, Na Yu, Xudong Jin, Jian Wang, Ahmed Azab, and Peng Ning. 2019. Learning Binary Repre- sentation for Automatic Patch Detection. In 2019 16th IEEE Annual Consumer Communications & Networking Conference (CCNC) . 1–6

    2019

  6. [14]

    Yuhong Feng, Haoran Li, Yixuan Cao, Yufeng Wang, and Haiyue Feng. 2024. CRABS-former: CRoss-Architecture Binary Code Similarity Detection based on Transformer. In Proceedings of the 15th Asia-Pacific Symposium on Internetware . 11–20

    2024

  7. [15]

    Cuiying Gao, Minghui Cai, Shuijun Yin, Gaozhun Huang, Heng Li, Wei Yuan, and Xiapu Luo. 2023. Obfuscation-resilient android malware analysis based on complementary features. IEEE Transactions on Information Forensics and Security (2023)

    2023

  8. [16]

    Yixin Guo, Pengcheng Li, Yingwei Luo, Xiaolin Wang, and Zhenlin Wang. 2022. Exploring gnn based program embedding technologies for binary related tasks. In Proceedings of the 30th IEEE/ACM International Conference on Program Com- prehension. 366–377

    2022

  9. [17]

    Irfan Ul Haq and Juan Caballero. 2021. A Survey of Binary Code Similarity. ACM Comput. Surv. 54, 3, Article 51 (Apr. 2021), 38 pages. https://doi.org/10.1145/ 3446371

    2021

  10. [18]

    Haojie He, Xingwei Lin, Ziang Weng, Ruijie Zhao, Shuitao Gan, Libo Chen, Yuede Ji, Jiashui Wang, and Zhi Xue. 2024. Code is not Natural Language: Unlock the Power of Semantics-Oriented Graph Representation for Binary Code Similarity Detection. In 33rd USENIX Security Symposium...

    2024

  11. [19]

    Yikun Hu, Yuanyuan Zhang, Juanru Li, and Dawu Gu. 2016. Cross-architecture binary semantics understanding via similar code comparison. In 2016 IEEE 23rd international conference on software analysis, evolution, and reengineering (SANER), Vol. 1. IEEE, 57–67

    2016

  12. [20]

    Ang Jia, Ming Fan, Xi Xu, Wuxia Jin, Haijun Wang, and Ting Liu. 2024. Cross- Inlining Binary Function Similarity Detection. In Proceedings of the IEEE/ACM 46th International Conference on Software Engineering . 1–13

    2024

  13. [21]

    Lichen Jia, Chenggang Wu, Peihua Zhang, and Zhe Wang. 2024. CodeExtract: Enhancing Binary Code Similarity Detection with Code Extraction Techniques. In Proceedings of the 25th ACM SIGPLAN/SIGBED International Conference on Languages, Compilers, and Tools for Embedded Systems . 143–154

    2024

  14. [22]

    Pascal Junod, Julien Rinaldini, Johan Wehrli, and Julie Michielin. 2015. Obfuscator- LLVM–software protection for the masses. In 2015 ieee/acm 1st international workshop on software protection . IEEE, 3–9

    2015

  15. [23]

    Ulf Kargén and Nahid Shahmehri. 2017. Towards robust instruction-level trace alignment of binary code. In 2017 32nd IEEE/ACM International Conference on Automated Software Engineering (ASE). IEEE, 342–352

    2017

  16. [24]

    Dongkwan Kim, Eunsoo Kim, Sang Kil Cha, Sooel Son, and Yongdae Kim. 2023. Revisiting Binary Code Similarity Analysis Using Interpretable Feature Engineer- ing and Lessons Learned. IEEE Transactions on Software Engineering 49, 04 (2023), 1661–1682

    2023

  17. [25]

    Geunwoo Kim, Sanghyun Hong, Michael Franz, and Dokyung Song. 2022. Im- proving cross-platform binary analysis using representation learning via graph alignment. In Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis. 151–163

    2022

  18. [26]

    TaeGuen Kim, Yeo Reum Lee, BooJoong Kang, and Eul Gyu Im. 2019. Binary executable file similarity calculation using function matching. The Journal of Supercomputing 75 (2019), 607–622

    2019

  19. [27]

    Quoc Le and Tomas Mikolov. 2014. Distributed representations of sentences and documents. In International conference on machine learning . PMLR, 1188–1196

    2014

  20. [28]

    Thomas Lengauer and Robert Endre Tarjan. 1979. A fast algorithm for finding dominators in a flowgraph. ACM Transactions on Programming Languages and Systems (TOPLAS) 1, 1 (1979), 121–141

    1979

  21. [29]

    Guohao Li, Chenxin Xiong, Ali Thabet, and Bernard Ghanem. 2020. Deepergcn: All you need to train deeper gcns. arXiv preprint arXiv:2006.07739 (2020)

    2020 arXiv

  22. [30]

    Munan Li, Hongbo Liu, Xiangdong Jiang, Zheng Zhao, and Tianhao Zhang

  23. [31]

    Weilong Li, Jintian Lu, Ruizhi Xiao, Pengfei Shao, and Shuyuan Jin. 2024. RCFG2Vec: Considering Long-Distance Dependency for Binary Code Similar- ity Detection. In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering. 770–782

    2024

  24. [32]

    Xuezixiang Li, Yu Qu, and Heng Yin. 2021. Palmtree: Learning an assembly language model for instruction embedding. InProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security . 3236–3251

    2021

  25. [33]

    Yujia Li, Chenjie Gu, Thomas Dullien, Oriol Vinyals, and Pushmeet Kohli. 2019. Graph matching networks for learning the similarity of graph structured objects. In International conference on machine learning . PMLR, 3835–3845

    2019

  26. [34]

    Yujia Li, Daniel Tarlow, Marc Brockschmidt, and Richard Zemel. 2015. Gated graph sequence neural networks. arXiv preprint arXiv:1511.05493 (2015)

    2015 arXiv

  27. [35]

    Lannan Luo, Jiang Ming, Dinghao Wu, Peng Liu, and Sencun Zhu. 2017. Semantics-based obfuscation-resilient binary code similarity comparison with applications to software and algorithm plagiarism detection. IEEE Transactions on Software Engineering 43, 12 (2017), 1157–1177

    2017

  28. [36]

    Zhenhao Luo, Pengfei Wang, Baosheng Wang, Yong Tang, Wei Xie, Xu Zhou, Dan- jun Liu, and Kai Lu. 2023. VulHawk: Cross-architecture Vulnerability Detection with Entropy-based Binary Code Search.. In NDSS

    2023

  29. [37]

    Andrea Marcelli, Mariano Graziano, Xabier Ugarte-Pedrero, Yanick Fratantonio, Mohamad Mansouri, and Davide Balzarotti. 2022. How machine learning is solv- ing the binary function similarity problem. In 31st USENIX Security Symposium (USENIX Security 22). 2099–2116

    2022

  30. [38]

    Luca Massarelli, Giuseppe Antonio Di Luna, Fabio Petroni, Leonardo Querzoni, and Roberto Baldoni. 2022. Function Representations for Binary Similarity. IEEE Transactions on Dependable and Secure Computing 19, 4 (July 2022), 2259–2273

    2022

  31. [39]

    Andre Pawlowski, Moritz Contag, and Thorsten Holz. 2016. Probfuscation: an obfuscation approach using probabilistic control flows. In Detection of Intrusions and Malware, and Vulnerability Assessment: 13th International Conference, DIMV A 2016, San Sebastián, Spain, July 7-8, ...

    2016

  32. [40]

    Kexin Pei, Zhou Xuan, Junfeng Yang, Suman Jana, and Baishakhi Ray. 2023. Learning Approximate Execution Semantics From Traces for Binary Function Similarity. IEEE Trans. Softw. Eng. 49, 4 (Apr. 2023), 2776–2790

    2023

  33. [41]

    Jannik Pewny, Felix Schuster, Lukas Bernhard, Thorsten Holz, and Christian Rossow. 2014. Leveraging semantic signatures for bug search in binary programs. In Proceedings of the 30th Annual Computer Security Applications Conference . 406–415

    2014

  34. [42]

    Dominik Picheta. 2020. Code obfuscation for the C/C++ language. arXiv preprint arXiv:2003.03449 (2020)

    2020 arXiv

  35. [43]

    Abdullah Qasem, Mourad Debbabi, Bernard Lebel, and Marthe Kassouf. 2023. Binary function clone search in the presence of code obfuscation and optimization over multi-cpu architectures. In Proceedings of the 2023 acm asia conference on computer and communications security . 443–456

    2023

  36. [44]

    Sri Shaila, Ahmad Darki, Michalis Faloutsos, Nael Abu-Ghazaleh, and Manu Sridharan. 2021. Disco: Combining disassemblers for improved performance. In Proceedings of the 24th International Symposium on Research in Attacks, Intrusions and Defenses. 148–161

    2021

  37. [45]

    Yan Shoshitaishvili, Ruoyu Wang, Christopher Salls, Nick Stephens, Mario Polino, Andrew Dutcher, John Grosen, Siji Feng, Christophe Hauser, Christopher Kruegel, et al. 2016. Sok:(state of) the art of war: Offensive techniques in binary analysis. In 2016 IEEE symposium on secur...

    2016

  38. [46]

    A Vaswani. 2017. Attention is all you need. Advances in Neural Information Processing Systems (2017)

    2017

  39. [47]

    Hao Wang, Zeyu Gao, Chao Zhang, Mingyang Sun, Yuchen Zhou, Han Qiu, and Xi Xiao. 2024. Cebin: A cost-effective framework for large-scale binary code similarity detection. In Proceedings of the 33rd ACM SIGSOFT International ORCAS: Obfuscation-Resilient Binary Code Similarity A...

    2024

  40. [48]

    Hao Wang, Wenjie Qu, Gilad Katz, Wenyu Zhu, Zeyu Gao, Han Qiu, Jianwei Zhuge, and Chao Zhang. 2022. Jtrans: Jump-aware transformer for binary code similarity detection. In Proceedings of the 31st ACM SIGSOFT International Sym- posium on Software Testing and Analysis . 1–13

    2022

  41. [49]

    Xinda Wang, Kun Sun, Archer Batcheller, and Sushil Jajodia. 2019. Detecting" 0-Day" Vulnerability: An Empirical Study of Secret Security Patch in OSS. In 2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN). IEEE, 485–492

    2019

  42. [50]

    Dominik Wermke, Nicolas Huaman, Yasemin Acar, Bradley Reaves, Patrick Traynor, and Sascha Fahl. 2018. A large scale investigation of obfuscation use in google play. In Proceedings of the 34th annual computer security applications conference. 222–235

    2018

  43. [51]

    Chao-Yuan Wu, R Manmatha, Alexander J Smola, and Philipp Krahenbuhl. 2017. Sampling matters in deep embedding learning. In Proceedings of the IEEE interna- tional conference on computer vision . 2840–2848

    2017

  44. [52]

    Xiangzhe Xu, Shiwei Feng, Yapeng Ye, Guangyu Shen, Zian Su, Siyuan Cheng, Guanhong Tao, Qingkai Shi, Zhuo Zhang, and Xiangyu Zhang. 2023. Improv- ing binary code similarity transformer models by semantics-driven instruction deemphasis. In Proceedings of the 32nd ACM SIGSOFT In...

    2023

  45. [53]

    Xiaojun Xu, Chang Liu, Qian Feng, Heng Yin, Le Song, and Dawn Song. 2017. Neural network-based graph embedding for cross-platform binary code similarity detection. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security. 363–376

    2017

  46. [54]

    Zhengzi Xu, Bihuan Chen, Mahinthan Chandramohan, Yang Liu, and Fu Song

  47. [55]

    Shouguo Yang, Long Cheng, Yicheng Zeng, Zhe Lang, Hongsong Zhu, and Zhiqiang Shi. 2021. Asteria: Deep Learning-based AST-Encoding for Cross- platform Binary Code Similarity Detection. In 2021 51st Annual IEEE/IFIP In- ternational Conference on Dependable Systems and Networks (...

    2021

  48. [56]

    Shouguo Yang, Chaopeng Dong, Yang Xiao, Yiran Cheng, Zhiqiang Shi, Zhi Li, and Limin Sun. 2023. Asteria-Pro: Enhancing Deep Learning-based Binary Code Similarity Detection by Incorporating Domain Knowledge.ACM Trans. Softw. Eng. Methodol. 33, 1, Article 1 (Nov. 2023), 40 pages...

    2023 doi

  49. [57]

    Shouguo Yang, Zhengzi Xu, Yang Xiao, Zhe Lang, Wei Tang, Yang Liu, Zhiqiang Shi, Hong Li, and Limin Sun. 2023. Towards Practical Binary Code Similarity Detection: Vulnerability Verification via Patch Semantic Analysis. ACM Trans. Softw. Eng. Methodol. 32, 6, Article 158 (Sept....

    2023

  50. [58]

    Shih-Yuan Yu, Yonatan Gizachew Achamyeleh, Chonghan Wang, Anton Ko- cheturov, Patrick Eisen, and Mohammad Abdullah Al Faruque. 2023. Cfg2vec: Hierarchical graph neural network for cross-architectural software reverse engi- neering. In 2023 IEEE/ACM 45th International Conferenc...

    2023

  51. [59]

    Zeping Yu, Rui Cao, Qiyi Tang, Sen Nie, Junzhou Huang, and Shi Wu. 2020. Order matters: Semantic-aware neural networks for binary code similarity detection. In Proceedings of the AAAI conference on artificial intelligence , Vol. 34. 1145–1152

    2020

  52. [60]

    Yuntao Zhang, Binxing Fang, Zehui Xiong, Yanhao Wang, Yuwei Liu, Chao Zheng, and Qinnan Zhang. 2024. A Semantics-Based Approach on Binary Function Similarity Detection. IEEE Internet of Things Journal (2024)

    2024

  53. [61]

    Yun Zhang, Yuling Liu, Ge Cheng, and Bo Ou. 2024. GTrans: Graph Transformer- Based Obfuscation-resilient Binary Code Similarity Detection. In Proc. NDSS Symp

    2024

  54. [62]

    Deqing Zou, Yutao Hu, Wenke Li, Yueming Wu, Haojun Zhao, and Hai Jin. 2022. mvulpreter: A multi-granularity vulnerability detection system with interpreta- tions. IEEE Transactions on Dependable and Secure Computing (2022)

    2022

  55. [2017]

    In 2017 IEEE/ACM 39th International Conference on Software Engineering (ICSE)

    Spain: security patch analysis for binaries towards understanding the pain and pills. In 2017 IEEE/ACM 39th International Conference on Software Engineering (ICSE). IEEE, 462–472

    2017

  56. [2023]

    Computers & Security 135 (2023), 103500

    SENSE: An unsupervised semantic learning model for cross-platform vulnerability search. Computers & Security 135 (2023), 103500

    2023

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.