StrTune: Data Dependence-based Code Slicing for Binary Similarity Detection with Fine-tuned Representation

Dawu Gu; Kaiyan He; Xuehui Li; Yikun Hu; Yubo Zhao; Yunhao Song

REVIEW 5 major objections 5 minor 40 references

StrTune: Data Dependence-based Code Slicing for Binary Similarity Detection with Fine-tuned Representation

T0 review · 5 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read StrTune claims that slicing binary code by data dependence turns compilation-dependent instruction syntax into stable value-computation units, and that fine-tuning those slices enables matching similar functions across compilers…

desk verdict The slicing idea is clever and the ablations are informative, but the unreported train/test split makes the headline gains unverified until the authors confirm that fine-tuning pairs do not leak into the retrieval test set. read the letter →

arxiv 2411.12454 v1 pith:ESNSEVAO submitted 2024-11-19 cs.CR

Kaiyan He , Yikun Hu , Xuehui Li , Yunhao Song , Yubo Zhao , Dawu Gu This is my paper · ORCID

classification cs.CR

keywords binarycodesimilaritydetectiondatadependenceslicingbackwardSiamesefine-tuninggraphmatchingnetworkMicrocross-optimizationvulnerabilitysearch

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

StrTune claims that binary functions can be matched across compilers, optimization levels, and architectures by slicing each function along data dependencies and comparing the resulting value-computation slices. A slice is a chain of instructions that together compute one value, and it is a stable semantic unit even though instruction syntax and ordering change under different compilation configurations. To make the representation stable, StrTune pre-trains a language model on slices, fine-tunes it with a Siamese network on pairs of slices that perform the same computation but look different, and then uses a graph matching network over the sliced function graph to compute similarity. The paper reports that this pipeline outperforms state-of-the-art methods, with Recall@1 25.3% higher than jTrans and 22.2% higher than GMN for cross-optimization function retrieval in x64, plus strong results in cross-architecture and real-world vulnerability search.

What carries the argument

The central object is the data-dependence slice: a set of instructions obtained by backward slicing from a value-using instruction, so that each slice is the computation chain of one value, with fixed internal order and no data dependence between slices from the same basic block. The graph representation adds four edge types, sequential flow, jump flow, data dependence flow (cross-basic-block def-use), and data parallel flow (emphasizing that independent slices have unfixed relative positions). Two-stage learning carries the empirical argument: RoBERTa is pre-trained by masked prediction over normalized Microcode tokens, then fine-tuned with a Siamese network and contrastive loss on paired slices that share computational content but differ syntactically; finally a Graph Matching Network with cross-graph attention aggregates slice embeddings into a similarity score. The slicing is what converts syntax-varying assembly into stable semantic units, and the fine-tuning is what aligns those units across compilation configurations.

What would settle it

Compile a set of real-world functions at O0 and O3, slice both builds independently, and use symbolic execution to check whether every slice that corresponds to a source-level value, such as a loop index, parameter, or accumulator, has a matching slice in the other build with the same def-use chain; if a source-level computation appears in one build as two separate slices or in the other build merged into one, the canonicality premise fails.

Watch

Extended reading notes

Core claim

StrTune's central claim is that backward data-dependence slicing of IDA Microcode, at a maturity level where instructions are concise, decomposes every basic block into a set of data-independent slices, each capturing the computation of a single value. These slices, together with four flow types (sequential, jump, data dependence, and data parallel), form a function graph that is stable across compilation configurations. The paper further claims that slice-level fine-tuning with a Siamese network, pairing slices that originate from the same source-level computation but are expressed in different instruction dialects, teaches the embedding model to map semantically equivalent slices close together, so the cross-graph attention in a Graph Matching Network concentrates on genuinely similar regions of two functions. The evidence offered is a series of retrieval experiments (cross-optimization, cross-compiler, cross-architecture, mixed), ablations showing each component contributes, and a real-world vulnerability search on NetGear and TP-Link firmware where StrTune ranks vulnerable functions at or near the top.

Load-bearing premise

The whole approach assumes that backward data-dependence slicing on IDA Microcode produces a canonical, behavior-preserving decomposition of a function, meaning that instructions inside a slice keep a fixed valid order, dropping EFLAG assignments and dead register definitions never changes observable behavior, and slices from one basic block are truly independent; this assumption is motivated by examples rather than proven for all code.

Editorial extensions

If this is right

Functions compiled from the same source with different compilers, optimization levels, or architectures can be retrieved with high recall because value-computation slices are more stable than raw instruction syntax.
Instruction reordering no longer hurts similarity: data-parallel flow explicitly encodes that independent slices can appear in any order, and cross-graph attention aligns slices by content and flow type rather than position.
Slice-level fine-tuning with paired O0/O3 and cross-compiler or cross-architecture slices transfers to unseen compilation settings, since the model learns the dialect mapping between syntactic forms of the same computation.
In real-world vulnerability search on firmware from NetGear and TP-Link, StrTune ranks the vulnerable functions first or near-first across x86, x64, ARM-32, and MIPS-32 query builds.
Ablations imply that the slicing step is the largest contributor to precision: replacing slice nodes with basic-block nodes lowers Recall@1 by roughly 69% in relative terms, and removing fine-tuning lowers it by about 0.2 in absolute terms.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Because the slicing is performed on the disassembler's Microcode, the method's canonicality inherits any instability in that IR; a natural test is whether Ghidra's P-code or another IR yields the same slice graphs, which the paper only mentions as a possibility, not a validated equivalence.
The fine-tuning pairs are built from source-level address mapping, so for closed-source binaries such an oracle is unavailable; an inference is that the method's cross-configuration alignment would degrade without matching source, or would need a syntactic-equivalence or symbolic-execution-based pair generator.
The paper's own false-positive analysis, such as OBJ_dup and BN_dec2bn both matching on OPENSSL_malloc and OPENSSL_free calls, suggests that retaining full call names biases similarity toward common library calls; replacing call names with callee summaries could be a direct, testable improvement that the paper does not evaluate.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

First thing to know: this is a serious BCSD paper with an interesting graph representation, but the headline numbers are not yet believable because the paper never says whether the fine-tuning pairs overlap with the retrieval test set. If they overlap, the 25% gains over jTrans could be leakage, not generalization. The stress-test note is right on that.

What's new: representing a function as a graph whose nodes are backward data-dependence slices (each slice computing one value), with four edge types that encode data/control relationships. That is a real departure from basic-block graphs. Fine-tuning RoBERTa slice embeddings on pairs of slices from the same source compiled at O0/O3, via a Siamese network, is also new in this combination. The ablation shows both slicing and fine-tuning matter: removing slicing drops Recall@1 by roughly 0.34, removing fine-tuning by roughly 0.19. That is evidence the components do something.

Where it's soft: the train/test split issue is the load-bearing omission. Section V-A describes the dataset but never states which functions are used for RoBERTa pre-training, fine-tuning, GMN training, and which are query/pool. The fine-tuning pairs are derived from C source files; the test queries come from the same projects. If any function or even statement used in fine-tuning appears in the query or pool, the model has seen exact slice forms it is later asked to match. The paper must state the split explicitly and ideally release code and data. Also no error bars, no repeated seeds, no artifacts. Eq. (2) defines d as cosine similarity but uses it as a distance in contrastive loss; that is a minor but real inconsistency. The baseline set omits recent methods they cite (CLAP, BinCola, CEBin, He et al. [40]); comparing against at least one of them would strengthen the claim. The slicing assumptions (EFLAG removal, fixed instruction order within a slice) are motivated by examples but not proven; that is a minor point for a machine learning paper.

To be fair, the paper does include a limitations section, which is more than many in this area. The central idea is plausible and the evaluation, if reproducible, would make this a solid contribution. The right fix is not rejection but demands: clarify the split, release artifacts, correct Eq. (2), add variance estimates. I would send this to peer review with a request for major revision.

Referee Report

5 major / 5 minor

Summary. StrTune proposes a binary code similarity detection (BCSD) pipeline in which functions are lifted to IDA Microcode, decomposed into backward data-dependence slices that serve as graph nodes, and encoded by a RoBERTa model that is first pre-trained on masked slice tokens and then fine-tuned with a Siamese contrastive objective on slice pairs from the same source statements compiled under different configurations. A Graph Matching Network (GMN) then computes function-level similarity using the slice embeddings and four/five types of edge flows. The paper reports Recall@1/MRR results on the Marcelli et al. dataset, ablations over each design component, and a small real-world vulnerability-search study on TP-Link and NetGear firmware, claiming consistent improvements over SAFE, Zeek, GMN, VulHawk, Trex, and jTrans.

Significance. The core idea, using data-dependence slices rather than raw basic blocks or instruction sequences as the stable semantic unit for binary similarity, is well motivated and the ablation study in Table II shows that each proposed component contributes positively. The empirical gains over GMN and jTrans on the standard Marcelli benchmark are substantial, and the real-world firmware experiments, though small, are a useful practicality check. The main value of the paper would be in demonstrating that slice-level fine-tuning plus cross-graph attention yields robust cross-configuration matching. However, the evaluation as reported has load-bearing transparency gaps (no explicit train/test separation for the fine-tuning pairs, no seeds or variance, no code/data release), and a central equation and the headline numbers contain internal inconsistencies. The underlying approach is plausible, but the manuscript needs a major revision before the claims can be accepted.

major comments (5)

[Equation (2), Section III-C] The paper never states which functions or even source files are used to construct the Siamese fine-tuning pairs in Section III-C versus which functions form the query and pool sets in Section V-B. Since the fine-tuning pairs are generated by selecting statements from C source files and mapping them to O0/O3 slices, and the query/pool functions are drawn from the same dataset and compilation-configuration space, there is a real risk of train/test overlap: the model may have seen the exact syntactic slice forms it is later asked to match. This is load-bearing because the paper's headline claim of cross-configuration generalization rests entirely on Table I. The authors must specify the split (e.g., hold out entire functions or projects) and report results under a clearly disjoint evaluation protocol.
[Abstract, Introduction, Section V-B] Eq. (2) defines d as the expression v1·v2/(|v1|×|v2|), which is the cosine similarity, but the contrastive loss L = Σ y d² + (1−y) max(m−d, 0)² requires d to be a distance. If d is similarity, then for y=1 the first term d² is minimized by making similar slices less similar, which is the opposite of the stated objective; if d is intended to be cosine distance, the formula should be 1 − similarity. This inconsistency is not merely typographical: it determines the gradient of the fine-tuning objective and must be corrected.
[Section III-B] The abstract and introduction state that StrTune achieves Recall@1 25.3% higher than jTrans in the cross-optimization task on x64, but Section V-B reports a 23.5% improvement for that task, and Table I shows 0.836 vs. 0.677 (a relative improvement of about 23.5%, not 25.3%). The 25.3% figure is not reproducible from any entry in Table I, while the 22.2% improvement over GMN and the 154.9% over VulHawk do match. The inconsistency in a headline quantitative claim must be resolved.
[Table I and general evaluation] The claimed stability of slices across compilation configurations depends on three unverified premises: that removing EFLAG assignments and dead register definitions never changes observable behavior, that the backward-slicing procedure yields a canonical instruction order within each slice, and that slices from the same basic block are truly data-independent. The paper supports these only with the single example in Figure 5 and with empirical end-to-end results. Since the whole method rests on these premises, a direct evaluation is warranted: for a sample of functions compiled with O0/O1/O2/O3/Os, report the fraction of matching value computations that produce identical slice sequences after alignment, or otherwise quantify slice-level stability. Without this, the mechanism claimed for the Recall@1 gains remains a hypothesis.
The experimental report gives no variance across repeated runs, no random seeds for the pre-training, fine-tuning, or structure training, and no code or data release that would allow independent verification. Given that the fine-tuning step randomly selects 10% of non-conditional statements and that all numbers are point estimates, the reported differences (e.g., 0.836 vs. 0.684 in x64-XO) may be within run-to-run noise; the authors should report at least the number of seeds and standard deviations, and ideally release the constructed graphs and fine-tuning pair identities to enable the community to audit the protocol.

minor comments (5)

The text states that the graph includes 'five types of edges' whereas Section II and Figure 3 describe four flow types; since data parallel flow is subdivided into sequential parallel and jump parallel, the total count should be clarified consistently.
The metrics section defines MRR but Table I uses 'MRR10'; the authors should define MRR@10 (or explain that it is the standard MRR truncated at rank 10) so the reader can interpret the numbers.
The number of source statements selected for fine-tuning pairs is not reported; only 'randomly pick 10% of statements without conditional jump' is given, and no total count or seed is stated, so the size of the fine-tuning dataset is unknown.
The real-world vulnerability search uses only three to seven query functions per firmware; the rank numbers are therefore not directly comparable to the large-pool Recall@1 results and should be discussed as anecdotal evidence rather than a full evaluation.
The rendered text contains many instances of 'S TRTUNE' (with a space) in the running text, which is a formatting artifact; the index terms and references are otherwise complete.

Circularity Check

1 steps flagged · score 2.0 of 10

No derivation-level circularity; main risk is an unreported overlap between fine-tuning pairs and retrieval queries/pools.

fitted input called prediction [Section III-C (Node Representation, Fine-tuning) and Section V-B (Effectiveness, Evaluation setup)]
"For each program statement, we perform address mapping in the binary to obtain pairs of slices (s1, s2) under O0 and O3, representing slices with the same computation content in respect of different optimizations. ... For XO, XA and XM, we select 1,000 functions as query functions and randomly pick 100 and 1,000 functions that match the respective compilation setting variances as the function pool."

The Siamese fine-tuning step is fitted on O0/O3 slice pairs of the same source statements, using a contrastive loss (Eq. 2) that pulls their embeddings together. The x64-XO evaluation then ranks functions across optimization levels using 1,000 query functions and a pool chosen from the same dataset (Section V-A), and the paper never states that these functions are disjoint from the functions/statements used to build the fine-tuning pairs. If a query or pool function contains a statement used in fine-tuning, the reported Recall@1 gain over jTrans/GMN is a retrieval over already-fitted slice embeddings rather than evidence of cross-configuration generalization. The omission is load-bearing because Table I is the paper's central evidence.

full rationale

The core construction — backward data-dependence slicing of IDA Microcode into value-computation slices, four edge types, RoBERTa pre-training, and GMN structure training — is not derived from the target result and is not justified by self-citation. The paper cites no prior work by the same authors as evidence, and the real-world firmware searches (TP-Link/NetGear) provide externally relevant pools. The only substantial circularity-adjacent defect is the experimental pipeline: fine-tuning pairs are built from O0/O3 slices of source statements, and the retrieval benchmarks are drawn from the same seven-project dataset without any reported held-out split, including CVE queries from OpenSSL 1.0.2d when OpenSSL is part of that dataset. Because the paper does not document disjointness, the headline recall numbers may overstate generalization. This is best treated as a missing experimental control rather than a derivation-level circularity, so the circularity score stays low at 2.

Assumptions & free parameters 8 free parameters · 7 assumptions · 0 invented entities

The method is a graph representation and training scheme, not a physical theory. Its load-bearing assumptions concern the faithfulness of IDA Microcode and the semantic stability of data-dependence slices. Hyperparameters are chosen by hand and none are swept or derived. No new physical entities are postulated.

free parameters (8)

contrastive loss margin m = 1
Set to 1 by hand in Section III-C; controls the distance threshold for dissimilar slice pairs in Eq. (2).
GMN propagation layers = 10
Chosen in Section IV; depth affects how far cross-graph attention propagates.
GMN hidden node embedding dimension = 128
Section IV; capacity of the structure network.
RoBERTa node embedding dimension = 768
Section IV; fixed by the pre-trained model.
structure training learning rate = 0.001
Section IV; no sensitivity analysis is provided.
structure training batch size = 20
Section IV; no sensitivity analysis is provided.
vocabulary frequency threshold = 10
Tokens occurring more than 10 times are retained; others are replaced by operand type, as described in Section IV.
fine-tuning statement selection ratio = 10% of non-branch statements plus all conditional-judgment statements
Section III-C; this sampling choice defines the set of slice pairs the fine-tuned model sees.

assumptions (7)

domain assumption Backward data-dependence slicing on IDA Microcode yields slices that correspond one-to-one to value computations in the source program and are stable across compilation configurations.
Stated in Section II-B and III-B; no formal proof is given, and this stability is the paper's central motivating premise.
domain assumption Removing EFLAG-assignment instructions and redefined-before-use register assignments does not change the computational content of the function.
Section III-B, 'Removal'; this pruning is necessary for the graph construction and is justified by informal reasoning.
domain assumption IDA Pro's Microcode at maturity level MMAT_LOCOPT is a faithful IR for semantic analysis.
Section IV states the choice; the paper acknowledges dependence on IDA Pro accuracy in Section VI.
domain assumption Instructions within a data-dependence slice have a canonical fixed order that is preserved across compilations.
Section II-B and III-B; the claim that slicing 'ensures fixed instruction sequences within slices' underlies the node representation.
domain assumption Slices from the same basic block are data-independent and their relative order never matters.
Section II-B; used to justify data parallel flow and to permit reordering across compilation settings.
domain assumption A graph matching network with cross-graph attention can align semantically equivalent slices across functions.
Section III-D; the effectiveness of this architectural choice is tested empirically but not guaranteed.
domain assumption The evaluation dataset's ground truth, that functions compiled from the same or logically similar source code are similar, is correct and complete.
Section II-A defines semantic similarity this way; this is standard in the BCSD literature.

how reviews work

0 comments

Cite this review

Pith. "Pith review of StrTune: Data Dependence-based Code Slicing for Binary Similarity Detection with Fine-tuned Representation." pith.science (2026). https://pith.science/paper/ESNSEVAO

@misc{pith2026241112454,
  author       = {Pith},
  title        = {Pith review of: StrTune: Data Dependence-based Code Slicing for Binary Similarity Detection with Fine-tuned Representation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ESNSEVAO}},
  note         = {Machine review of arXiv:2411.12454}
}

read the original abstract

Binary Code Similarity Detection (BCSD) is significant for software security as it can address binary tasks such as malicious code snippets identification and binary patch analysis by comparing code patterns. Recently, there has been a growing focus on artificial intelligence-based approaches in BCSD due to their scalability and generalization. Because binaries are compiled with different compilation configurations, existing approaches still face notable limitations when comparing binary similarity. First, BCSD requires analysis on code behavior, and existing work claims to extract semantic, but actually still makes analysis in terms of syntax. Second, directly extracting features from assembly sequences, existing work cannot address the issues of instruction reordering and different syntax expressions caused by various compilation configurations. In this paper, we propose StrTune, which slices binary code based on data dependence and perform slice-level fine-tuning. To address the first limitation, StrTune performs backward slicing based on data dependence to capture how a value is computed along the execution. Each slice reflects the collecting semantics of the code, which is stable across different compilation configurations. StrTune introduces flow types to emphasize the independence of computations between slices, forming a graph representation. To overcome the second limitation, based on slices corresponding to the same value computation but having different syntax representation, StrTune utilizes a Siamese Network to fine-tune such pairs, making their representations closer in the feature space.

Figures

Figures reproduced from arXiv: 2411.12454 by the authors.

**Figure 1.** ⃝1 shows instructions of the function uninit options with its corresponding computational contents in ⃝2 . ⃝3 shows the general method that current approaches use to process the instruction token. ⃝4 involves the prologue of the function uninit options. • We employ the Graph Matching Network for functionlevel representation, with attention coefficient focusing on the matching of similar slices. • We implement the a… view at source ↗

**Figure 2.** IR of the uninit options function compiled with O0 and O3, and our ways to slice the instructions, corresponding to the computational contents in the same color. 1 xdu (ebx+#1), rbx 6 jg [ds: (r13+#0x108)], ebx, @next 2 add rbp, [ds: (r13+#0x100)], rdi 4 add rdi, #0x18, rdi 5 call $av_freep 3 add rbp, #0x20, rbp …… …… …… …… ① Sequential Flow ② Data Parallel Flow ④ Jump Flow ③ Data Dependence Flow [PITH_FULL_IMAGE:f… view at source ↗

**Figure 3.** Example of our graph representation, consisting of four [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗

Figures from the paper (8 more)

**Figure 4.** Figure 4: The overview of STRTUNE consisting of three components: ⃝1 Graph Construction that builds novel graphs base on IR lifted from binaries. ⃝2 Node Representation that forms a two-step learning process for similar slices, including pre-training and fine-tuning of RoBERTa m…

**Figure 5.** Figure 5: Graph Construction of our model STRTUNE: ⃝1 shows unprocessed Microcode in a basic block. After removal and preservation, we obtain the remaining instructions in ⃝2 , where instructions of the same color exhibiting data dependence, are considered as one code slice. The…

**Figure 6.** Figure 6: Siamese neural network for fine-tuning RoBERTa [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]

**Figure 7.** Figure 7: Recall on different K for tasks. Structure Training Node Pre-training Inferring Lifting Node Fine-tuning 9240 54033 707 18910 14403 Structure Training, 9240s Node Pre-training, 54033s Inferring, 707 Lifting, 18910s Node Fine-tuning, 14403s [PITH_FULL_IMAGE:figures/ful…

**Figure 8.** Figure 8: Efficiency of STRTUNE for execution of each part. Lifting and Inferring denote the average time taken for 100,000 pairs of functions under three rounds of execution. The time unit is seconds. SAFE Zeek GMN VulHawk Trex jTrans STRTUNE 878 231 518 1015 758 385 707 878 23…

**Figure 9.** Figure 9: Average inferring time compared with baselines for [PITH_FULL_IMAGE:figures/full_fig_p009_9.png]

**Figure 10.** Figure 10: Visualization of clustering of code slices with different [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]

**Figure 11.** Figure 11: Visualization of attention coefficients between a pair of similar functions during inference. The intensity and thickness [PITH_FULL_IMAGE:figures/full_fig_p011_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

40 extracted references · 32 canonical work pages

[40]

Code is not natural language: Unlock the power of semantics- oriented graph representation for binary code similarity detection,

H. He, X. Lin, Z. Weng, R. Zhao, S. Gan, L. Chen, Y . Ji, J. Wang, and Z. Xue, “Code is not natural language: Unlock the power of semantics- oriented graph representation for binary code similarity detection,” in 33rd USENIX Security Symposium (USENIX Security 24), PHILADEL- PHIA, PA, 2024

2024
[1]

Scalable graph-based bug search for firmware images,

Q. Feng, R. Zhou, C. Xu, Y . Cheng, B. Testa, and H. Yin, “Scalable graph-based bug search for firmware images,” inProceedings of the 2016 ACM SIGSAC conference on computer and communications security , pp. 480–491, 2016

work page 2016
[2]

Vulseeker: A semantic learning based vulnerability seeker for cross-platform binary,

J. Gao, X. Yang, Y . Fu, Y . Jiang, and J. Sun, “Vulseeker: A semantic learning based vulnerability seeker for cross-platform binary,” in Pro- ceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering, pp. 896–899, 2018

work page 2018
[3]

Vulhawk: Cross-architecture vulnerability detection with entropy-based binary code search.,

Z. Luo, P. Wang, B. Wang, Y . Tang, W. Xie, X. Zhou, D. Liu, and K. Lu, “Vulhawk: Cross-architecture vulnerability detection with entropy-based binary code search.,” in NDSS, 2023

work page 2023
[4]

Safe: Self-attentive function embeddings for binary similarity,

L. Massarelli, G. A. Di Luna, F. Petroni, R. Baldoni, and L. Querzoni, “Safe: Self-attentive function embeddings for binary similarity,” in Detection of Intrusions and Malware, and Vulnerability Assessment: 16th International Conference, DIMVA 2019, Gothenburg, Sweden, June 19–20, 2019, Proceedings 16 , pp. 309–329, Springer, 2019

work page 2019
[5]

Neural network- based graph embedding for cross-platform binary code similarity detec- tion,

X. Xu, C. Liu, Q. Feng, H. Yin, L. Song, and D. Song, “Neural network- based graph embedding for cross-platform binary code similarity detec- tion,” in Proceedings of the 2017 ACM SIGSAC conference on computer and communications security , pp. 363–376, 2017

work page 2017
[6]

αdiff: cross-version binary code similarity detection with dnn,

B. Liu, W. Huo, C. Zhang, W. Li, F. Li, A. Piao, and W. Zou, “ αdiff: cross-version binary code similarity detection with dnn,” in Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering, pp. 667–678, 2018

work page 2018
[7]

Cross- architecture bug search in binary executables,

J. Pewny, B. Garmany, R. Gawlik, C. Rossow, and T. Holz, “Cross- architecture bug search in binary executables,” in 2015 IEEE Symposium on Security and Privacy , pp. 709–724, IEEE, 2015

work page 2015

Show all 40 references

[8]

Leveraging semantic signatures for bug search in binary programs,

J. Pewny, F. Schuster, L. Bernhard, T. Holz, and C. Rossow, “Leveraging semantic signatures for bug search in binary programs,” in Proceedings of the 30th Annual Computer Security Applications Conference, pp. 406– 415, 2014

2014
[9]

B in a rm: Scalable and efficient detection of vulnerabilities in firmware images of intelligent electronic devices,

P. Shirani, L. Collard, B. L. Agba, B. Lebel, M. Debbabi, L. Wang, and A. Hanna, “B in a rm: Scalable and efficient detection of vulnerabilities in firmware images of intelligent electronic devices,” in Detection of Intrusions and Malware, and Vulnerability Assessment: 15th In...

2018
[10]

Control flow-based malware variant- detection,

S. Cesare, Y . Xiang, and W. Zhou, “Control flow-based malware variant- detection,” IEEE Transactions on Dependable and Secure Computing , vol. 11, no. 4, pp. 307–317, 2013

2013
[11]

Binclone: Detecting code clones in malware,

M. R. Farhadi, B. C. Fung, P. Charland, and M. Debbabi, “Binclone: Detecting code clones in malware,” in 2014 Eighth International Con- ference on Software Security and Reliability (SERE) , pp. 78–87, IEEE, 2014

2014
[12]

Large-scale malware indexing using function-call graphs,

X. Hu, T.-c. Chiueh, and K. G. Shin, “Large-scale malware indexing using function-call graphs,” in Proceedings of the 16th ACM conference on Computer and communications security , pp. 611–620, 2009

2009
[13]

Towards automatic software lineage inference,

J. Jang, M. Woo, and D. Brumley, “Towards automatic software lineage inference,” in 22nd USENIX Security Symposium (USENIX Security 13) , pp. 81–96, 2013

2013
[14]

Towards robust instruction-level trace alignment of binary code,

U. Karg ´en and N. Shahmehri, “Towards robust instruction-level trace alignment of binary code,” in 2017 32nd IEEE/ACM International Conference on Automated Software Engineering (ASE) , pp. 342–352, IEEE, 2017

2017
[15]

Spain: security patch analysis for binaries towards understanding the pain and pills,

Z. Xu, B. Chen, M. Chandramohan, Y . Liu, and F. Song, “Spain: security patch analysis for binaries towards understanding the pain and pills,” in 2017 IEEE/ACM 39th International Conference on Software Engineering (ICSE), pp. 462–472, IEEE, 2017

2017
[16]

Asm2vec: Boosting static representation robustness for binary clone search against code obfusca- tion and compiler optimization,

S. H. Ding, B. C. Fung, and P. Charland, “Asm2vec: Boosting static representation robustness for binary clone search against code obfusca- tion and compiler optimization,” in 2019 IEEE Symposium on Security and Privacy (SP) , pp. 472–489, IEEE, 2019

2019
[17]

Neural machine translation inspired binary code similarity comparison beyond function pairs,

F. Zuo, X. Li, P. Young, L. Luo, Q. Zeng, and Z. Zhang, “Neural machine translation inspired binary code similarity comparison beyond function pairs,” arXiv preprint arXiv:1808.04706 , 2018

2018 arXiv
[18]

Exploring gnn based program embedding technologies for binary related tasks,

Y . Guo, P. Li, Y . Luo, X. Wang, and Z. Wang, “Exploring gnn based program embedding technologies for binary related tasks,” in Pro- ceedings of the 30th IEEE/ACM International Conference on Program Comprehension, pp. 366–377, 2022

2022
[19]

Practical binary code similarity detection with bert-based transferable similarity learning,

S. Ahn, S. Ahn, H. Koo, and Y . Paek, “Practical binary code similarity detection with bert-based transferable similarity learning,” in Proceed- ings of the 38th Annual Computer Security Applications Conference , pp. 361–374, 2022

2022
[20]

jtrans: Jump-aware transformer for binary code similarity,

H. Wang, W. Qu, G. Katz, W. Zhu, Z. Gao, H. Qiu, J. Zhuge, and C. Zhang, “jtrans: Jump-aware transformer for binary code similarity,” arXiv preprint arXiv:2205.12713 , 2022

2022 arXiv
[21]

Trex: Learning execution semantics from micro-traces for binary similarity,

K. Pei, Z. Xuan, J. Yang, S. Jana, and B. Ray, “Trex: Learning execution semantics from micro-traces for binary similarity,” arXiv preprint arXiv:2012.08680, 2020

2012 arXiv
[22]

Binary similarity detection using machine learning,

N. Shalev and N. Partush, “Binary similarity detection using machine learning,” in Proceedings of the 13th Workshop on Programming Lan- guages and Analysis for Security , pp. 42–47, 2018

2018
[23]

Graph matching networks for learning the similarity of graph structured objects,

Y . Li, C. Gu, T. Dullien, O. Vinyals, and P. Kohli, “Graph matching networks for learning the similarity of graph structured objects,” in International conference on machine learning , pp. 3835–3845, PMLR, 2019

2019
[24]

Order matters: Semantic-aware neural networks for binary code similarity detection,

Z. Yu, R. Cao, Q. Tang, S. Nie, J. Huang, and S. Wu, “Order matters: Semantic-aware neural networks for binary code similarity detection,” in Proceedings of the AAAI conference on artificial intelligence , vol. 34, pp. 1145–1152, 2020

2020
[25]

sem2vec: Semantics-aware assembly tracelet embedding,

H. Wang, P. Ma, S. Wang, Q. Tang, S. Nie, and S. Wu, “sem2vec: Semantics-aware assembly tracelet embedding,” ACM Transactions on Software Engineering and Methodology , vol. 32, no. 4, pp. 1–34, 2023

2023
[26]

Pelican: Exploiting backdoors of naturally trained deep learning models in binary code analysis,

Z. Zhang, G. Tao, G. Shen, S. An, Q. Xu, Y . Liu, Y . Ye, Y . Wu, and X. Zhang, “Pelican: Exploiting backdoors of naturally trained deep learning models in binary code analysis,” 2023

2023
[27]

Abstract interpretation frameworks,

P. Cousot and R. Cousot, “Abstract interpretation frameworks,” Journal of logic and computation , vol. 2, no. 4, pp. 511–547, 1992

1992
[28]

A formal model of program dependences and its implications for software testing, debugging, and maintenance,

A. Podgurski and L. Clarke, “A formal model of program dependences and its implications for software testing, debugging, and maintenance,” IEEE Transactions on Software Engineering, vol. 16, no. 9, pp. 965–979, 1990

1990
[29]

Ida pro

Hex-Rays, “Ida pro.” https://hex-rays.com/ida-pro/, 2008

2008
[30]

Idapython documentation

“Idapython documentation.” Available online: https://hex-rays.com/pr oducts/ida/support/idapython docs/, 2008

2008
[31]

Roberta: A robustly optimized bert pretraining approach,

Y . Liu, M. Ott, N. Goyal, J. Du, M. Joshi, D. Chen, O. Levy, M. Lewis, L. Zettlemoyer, and V . Stoyanov, “Roberta: A robustly optimized bert pretraining approach,” arXiv preprint arXiv:1907.11692 , 2019

1907 arXiv
[32]

Transformers: State- of-the-art natural language processing,

T. Wolf, L. Debut, V . Sanh, J. Chaumond, C. Delangue, A. Moi, P. Cistac, T. Rault, R. Louf, M. Funtowicz, et al., “Transformers: State- of-the-art natural language processing,” in Proceedings of the 2020 conference on empirical methods in natural language processing: system d...

2020
[33]

Exploring network structure, dy- namics, and function using networkx,

A. Hagberg, P. Swart, and D. S Chult, “Exploring network structure, dy- namics, and function using networkx,” tech. rep., Los Alamos National Lab.(LANL), Los Alamos, NM (United States), 2008

2008
[34]

TensorFlow: Large-scale machine learning on heterogeneous systems,

M. Abadi, A. Agarwal, P. Barham, E. Brevdo, Z. Chen, C. Citro, G. S. Corrado, A. Davis, J. Dean, M. Devin, S. Ghemawat, I. Goodfellow, A. Harp, G. Irving, M. Isard, Y . Jia, R. Jozefowicz, L. Kaiser, M. Kudlur, J. Levenberg, D. Man ´e, R. Monga, S. Moore, D. Murray, C. Olah, M...

2015
[35]

How machine learning is solving the binary function similarity problem,

A. Marcelli, M. Graziano, X. Ugarte-Pedrero, Y . Fratantonio, M. Man- souri, and D. Balzarotti, “How machine learning is solving the binary function similarity problem,” in 31st USENIX Security Symposium (USENIX Security 22) , pp. 2099–2116, 2022

2022
[36]

Improving binary code similarity transformer models by semantics-driven instruction deemphasis,

X. Xu, S. Feng, Y . Ye, G. Shen, Z. Su, S. Cheng, G. Tao, Q. Shi, Z. Zhang, and X. Zhang, “Improving binary code similarity transformer models by semantics-driven instruction deemphasis,” 2023

2023
[37]

Clap: Learning transferable binary code representations with natural language supervision,

H. Wang, Z. Gao, C. Zhang, Z. Sha, M. Sun, Y . Zhou, W. Zhu, W. Sun, H. Qiu, and X. Xiao, “Clap: Learning transferable binary code representations with natural language supervision,” in Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysi...

2024
[38]

Bincola: Diversity- sensitive contrastive learning for binary code similarity detection,

S. Jiang, C. Fu, S. He, J. Lv, L. Han, and H. Hu, “Bincola: Diversity- sensitive contrastive learning for binary code similarity detection,” IEEE Transactions on Software Engineering , 2024

2024
[39]

Cebin: A cost-effective framework for large-scale binary code similarity detection,

H. Wang, Z. Gao, C. Zhang, M. Sun, Y . Zhou, H. Qiu, and X. Xiao, “Cebin: A cost-effective framework for large-scale binary code similarity detection,” in Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis , pp. 149–161, 2024

2024

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.

[1] [40]

Code is not natural language: Unlock the power of semantics- oriented graph representation for binary code similarity detection,

H. He, X. Lin, Z. Weng, R. Zhao, S. Gan, L. Chen, Y . Ji, J. Wang, and Z. Xue, “Code is not natural language: Unlock the power of semantics- oriented graph representation for binary code similarity detection,” in 33rd USENIX Security Symposium (USENIX Security 24), PHILADEL- PHIA, PA, 2024

2024

[2] [1]

Scalable graph-based bug search for firmware images,

Q. Feng, R. Zhou, C. Xu, Y . Cheng, B. Testa, and H. Yin, “Scalable graph-based bug search for firmware images,” inProceedings of the 2016 ACM SIGSAC conference on computer and communications security , pp. 480–491, 2016

work page 2016

[3] [2]

Vulseeker: A semantic learning based vulnerability seeker for cross-platform binary,

J. Gao, X. Yang, Y . Fu, Y . Jiang, and J. Sun, “Vulseeker: A semantic learning based vulnerability seeker for cross-platform binary,” in Pro- ceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering, pp. 896–899, 2018

work page 2018

[4] [3]

Vulhawk: Cross-architecture vulnerability detection with entropy-based binary code search.,

Z. Luo, P. Wang, B. Wang, Y . Tang, W. Xie, X. Zhou, D. Liu, and K. Lu, “Vulhawk: Cross-architecture vulnerability detection with entropy-based binary code search.,” in NDSS, 2023

work page 2023

[5] [4]

Safe: Self-attentive function embeddings for binary similarity,

L. Massarelli, G. A. Di Luna, F. Petroni, R. Baldoni, and L. Querzoni, “Safe: Self-attentive function embeddings for binary similarity,” in Detection of Intrusions and Malware, and Vulnerability Assessment: 16th International Conference, DIMVA 2019, Gothenburg, Sweden, June 19–20, 2019, Proceedings 16 , pp. 309–329, Springer, 2019

work page 2019

[6] [5]

Neural network- based graph embedding for cross-platform binary code similarity detec- tion,

X. Xu, C. Liu, Q. Feng, H. Yin, L. Song, and D. Song, “Neural network- based graph embedding for cross-platform binary code similarity detec- tion,” in Proceedings of the 2017 ACM SIGSAC conference on computer and communications security , pp. 363–376, 2017

work page 2017

[7] [6]

αdiff: cross-version binary code similarity detection with dnn,

B. Liu, W. Huo, C. Zhang, W. Li, F. Li, A. Piao, and W. Zou, “ αdiff: cross-version binary code similarity detection with dnn,” in Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering, pp. 667–678, 2018

work page 2018

[8] [7]

Cross- architecture bug search in binary executables,

J. Pewny, B. Garmany, R. Gawlik, C. Rossow, and T. Holz, “Cross- architecture bug search in binary executables,” in 2015 IEEE Symposium on Security and Privacy , pp. 709–724, IEEE, 2015

work page 2015