Pith. sign in

REVIEW 5 major objections 4 minor 100 references

KEENHash: Hashing Programs into Function-Aware Embeddings for Large-Scale Binary Code Similarity Analysis

T0 review · 5 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read KEENHash condenses whole binaries into fixed-length function-aware embeddings, claiming 215x faster and more accurate program-level clone search at scale.

desk verdict Clever and practical hashing method for large-scale binary similarity, but training/evaluation overlap and missing artifacts make the headline numbers provisional. read the letter →

arxiv 2506.11612 v1 pith:YRXYFYX3 submitted 2025-06-13 cs.CR cs.SE

Zhijie Liu , Qiyi Tang , Sen Nie , Shi Wu , Liang Feng Zhang , Yutian Tang This is my paper · ORCID
classification cs.CRcs.SE
keywords binarycodesimilarityanalysisprogram-levelBCSAfunction-awarehashingK-MeansclusteringfeatureLLMfunctionembeddingsprogramclonesearchmalwaredetection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

KEENHash aims to make program-level binary code similarity analysis (BCSA) practical at very large scale by replacing expensive per-function matching with a compact, fixed-length hash of the whole binary. The paper argues that function matching can be transformed into classification: cluster millions of source functions, assign each decompiled function in a binary to the nearest cluster, then encode the set of cluster labels into an 8KB bit-vector with Feature Hashing; two binaries are compared by the Jaccard overlap of their label sets. A second variant, KEENHash-sem, averages function embeddings weighted by lines of code and string counts to cope with massive code reuse. Experiments claim that KEENHash is 215 to 1,254 times faster than state-of-the-art function-matching tools while remaining effective, completing 5.3 billion similarity evaluations in 395.83 seconds and outperforming four structure-based baselines by at least 23.16% mAP@100 on 202,305 binaries. The stakes: if the compression preserves similarity well enough, clone search, malware detection, and threat intelligence can move from pair-by-pair diffing to repository-scale retrieval.

What carries the argument

The load-bearing object is the centroid-label bit-vector produced by K-Means clustering plus Feature Hashing (KEENHash-stru). K-Means partitions a large corpus of source-function embeddings into $n = 2^{22}$ clusters; each pseudo function of a binary is assigned the label of its nearest centroid, and the set of labels is compressed from dimension $2^{22}$ to $2^{16}$ bits using a feature hash with a sign hash for unbiased estimates. Jaccard similarity between two such bit-vectors stands in for the proportion of matched functions. The companion mechanism, KEENHash-sem, weights each function embedding by $( ext{LoC})^{0.4}/5 + ( ext{NoS})^{0.45} + 1$ and averages, to amplify unique functions and dilute shared libraries. Together the two vectors are intended to capture structural matching and semantic uniqueness.

What would settle it

Compile a set of program pairs whose only relationship is through small, heavily inlined or split functions (e.g., with link-time optimization and aggressive inlining), compute KEENHash embeddings and BinDiffMatch function-matching scores on the same pairs, and check whether KEENHash's Jaccard ranking still recovers the ground-truth clone pairs; if it does not while BinDiffMatch does, the classification proxy is falsified.

Watch

Extended reading notes

Core claim

The central claim is that a whole binary can be condensed into a fixed-length program embedding that preserves similarity for large-scale BCSA. KEENHash-stru does this by clustering 56 million source functions into K-Means centroids, classifying each decompiled pseudo function by 1-NN to those centroids, and Feature-Hashing the resulting label set into a bit-vector of $2^{16}$ bits; similarity between binaries is Jaccard similarity of the bit-vectors. KEENHash-sem instead takes the weighted average of function embeddings, with weights from lines of code and number of strings, and compares by cosine similarity. The authors contend that the classification-based view makes matching equivalent to classification, reducing the per-comparison cost from $O(n m^3)$ to $O(n)$, and that the experiments support both effectiveness and scalability.

Load-bearing premise

The speedup stands on treating function matching as classifying every function into one of a fixed set of precomputed clusters, then measuring program similarity by which cluster labels appear; if that classification loses the distinctions that true function matching captures, the whole hashing pipeline loses its semantic grounding.

Editorial extensions

If this is right

  • At 5.3 billion similarity evaluations, KEENHash completes the task in 395.83 seconds on 48 cores, where the authors estimate SigmaDiff and BinDiffMatch would take 323 and 56 days.
  • Function matching via K-Means with $n = 2^{22}$ reaches F1 0.7651, about 83% of BinDiffMatch's 0.9244, but at 0.00020 seconds per binary pair on average.
  • On program clone search across 202,305 binaries, KEENHash-stru and KEENHash-sem beat PSSO, Vhash, TLSH, and SSDEEP by at least 23.16% in mAP@100.
  • KEENHash-stru is the stronger variant under code obfuscation (mAP@100 0.7704 on <ALL, N> versus 0.1231 for PSSO), while KEENHash-sem is the stronger variant on benign datasets with massive code reuse.
  • In a K-NN malware detection test on merged repositories, both KEENHash variants report zero false negatives and zero false positives across the IoT, Mirai, and BinKit queries.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The classification proxy has an untested edge: binaries whose semantics live in small functions that inlining splits or merges may scatter labels across clusters, so KEENHash-stru's Jaccard similarity could degrade exactly where function-level tools still succeed.
  • Because the reported retrieval uses a brute-force index, the 395.83-second figure is a lower bound on retrievability; swapping in hierarchical or inverted indexes would trade a little accuracy for much larger repository sizes.
  • The LoC and NoS weights are hand-tuned; a learned or adaptive weighting for KEENHash-sem may be more robust to stripped strings and to O0-versus-O3 differences.
  • The source-to-pseudo embedding alignment means the corpus side of KEENHash-stru could be built from source alone, and the same hash could query a repository of source-only projects without decompilation.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 4 minor

Summary. The paper proposes KEENHash, a program-level binary code similarity approach that first generates function embeddings with a fine-tuned Pythia-410M model, then condenses a binary into two fixed-length program embeddings: a structural bit-vector obtained by K-Means classification followed by Feature Hashing (KEENHash-stru), and a semantic weighted-average vector (KEENHash-sem). The method is evaluated on function matching against Diaphora, SigmaDiff, and BinDiffMatch, and on large-scale program clone search over IoT, BinaryCorp, BinKit, MLWMC, and merged repositories totaling 202,305 binaries, including malware detection scenarios. The central claims are that KEENHash is 215-1,254 times faster than state-of-the-art function matching tools while maintaining effectiveness, that it completes 5.3 billion similarity evaluations in 395.83 seconds, and that it outperforms four structure-based baselines by at least 23.16% in mAP@100 on program clone search.

Significance. If the reported results survive a properly controlled evaluation, KEENHash would be a practically valuable large-scale BCSA method: the K-Means plus Feature Hashing reduction is simple and well motivated, the evaluation spans multiple real-world datasets and a security-relevant malware detection task, and the comparison against jTrans and CLAP in Appendix E provides additional evidence for the quality of the function embedding model. The main limitation is that the experimental design currently leaves open the possibility that the reported accuracy gains are inflated by training/evaluation overlap and by hyperparameter selection on the same datasets used for evaluation, so the significance of the claims cannot be fully assessed until these issues are addressed.

major comments (5)
  1. [Sec. 4.1 and Appendix C] The training corpus for the function embedding model is built from ArchLinux AOR/AUR and Linux Community (Sec. 4.1), and the BinaryCorp evaluation dataset is explicitly constructed from AOR/AUR using the same compilation pipeline (Appendix C). The paper states only that source functions 'related to the evaluation of RQ1 and the effectiveness of our function embedding model (Appendix E)' are excluded from training; it does not state that the RQ2-RQ5 clone-search binaries or their source/pseudo functions were held out. Because BinaryCorp is built from the same source repositories as the training corpus, and BinKit's GNU packages are plausibly present in the Linux Community corpus, the main clone-search evaluation may include training data. The paper must either demonstrate that all RQ2-RQ5 source and pseudo functions were excluded from the 40.51M training pairs, or re-run the clone-search evaluation on a clearly disjoint corpus; otherwise the reported 23.16% improvement over PSSO (Table 7, Fig. 3) cannot be attributed to generalization.
  2. [Sec. 3.4.2, Eq. (5)] The semantic weight hyperparameters alpha1=0.4, alpha2=5, beta1=0.45, and beta2=1 for KEENHash-sem are obtained by grid search on the IoT and BinaryCorp repository datasets (without query parts), and those same datasets are then used in the main RQ2 evaluation (Table 4). This means KEENHash-sem's reported superiority on IoT and BinaryCorp is a fitted result rather than an independent prediction. A separate validation split or nested cross-validation is needed to support the claimed advantage over Mean Pooling and the structure-based baselines.
  3. [Sec. 4.3, Table 1] The K-Means cluster count n is selected by taking the best value (n=2^22) from the F1 results computed on the DeepBinDiff test set, and this same n is then used in RQ2-RQ5. Consequently, the RQ1 function-matching numbers are the outcome of test-set selection rather than an unbiased evaluation, and the downstream clone-search results inherit this selection. The cluster-count hyperparameter should be chosen on a validation split that is disjoint from the RQ1 evaluation and from the clone-search repositories used in subsequent research questions.
  4. [Sec. 4.3, Table 2 vs. Sec. 4.6] The headline scalability numbers are internally inconsistent. A mean cost of 0.00020 seconds per matching (Table 2) implies that 5.3 billion pairwise evaluations would take roughly 5.3e9 * 0.0002 / 48, or about 22,250 seconds, on 48 cores, not the reported 395.83 seconds. Either the mean cost does not refer to the same operation as the RQ4 similarity evaluations, or the 395.83s figure requires a different derivation. Please clarify the relationship between these numbers and report the actual measured throughput for the RQ4 search.
  5. [Sec. 4.3, Table 1 and Abstract] The abstract's claim of 'maintaining effectiveness' is difficult to reconcile with Table 1, where KEENHash's best function-matching F1 is 0.7651 versus 0.9244 for BinDiffMatch and 0.8213 for SigmaDiff. Since the later program clone-search experiments do not compare against function-matching tools, the paper should either temper the 'maintaining effectiveness' claim or provide direct evidence that an F1 drop of roughly 17 points is still sufficient for the targeted large-scale tasks.
minor comments (4)
  1. [Sec. 4.1 and Appendix C] The number of matched function pairs is reported as 40.51M in Sec. 4.1 but as 4.51M in Appendix C; please correct this discrepancy and verify the correct value.
  2. [Sec. 3.1] The phrase 'huge cose reuse' should be corrected to 'huge code reuse'.
  3. [After Sec. 1] An extraneous block of text from the BinaryAI website appears between the introduction and the preliminary section; this appears to be an artifact and should be removed or properly integrated.
  4. [Sec. 3.4.1] The notation 'm = 216' and 'n = 222' would be clearer if written as 2^16 and 2^22, respectively, to avoid confusion with integer literals.

Circularity Check

2 steps flagged · score 6.0 of 10

Part of the headline clone-search margin is fitted: KEENHash-sem hyperparameters are grid-searched on the IoT/BinaryCorp evaluation datasets, and the function-embedding training corpus overlaps the BinaryCorp/BinKit evaluation corpora.

  1. fitted input called prediction [Sec. 3.4.2 (Eqs. 4-5) and Sec. 4.4, Table 4]
    "We evaluate the performance of program clone search on the IoT (malicious) and BinaryCorp (benign) repository datasets (Sec. 4.1), without their query parts, to adjust and find an optimal configuration for them: f1(LoC_i, α) = (LoC_i)^{α1/α2}, f2(NoS_i, β) = (NoS_i)^{β1/β2} + 1 ... where α1, α2, β1, β2 = 0.4, 5, 0.45, 1 (obtained through grid search [61])."

    The semantic-weight hyperparameters in Eq. (5) are selected by grid search to maximize clone-search performance on the IoT and BinaryCorp datasets, and the same datasets then appear as main results in Table 4 and in the merged RQ4 repository behind the 'at least 23.16%' claim. Even though the query subsets are described as withheld, no separate validation split is specified, and the repository side of those datasets is itself part of the retrieval evaluation; the reported margin of KEENHash-sem over Mean Pooling/LoC/NoS on IoT and BC is therefore a fitted value, not an independent prediction.

  2. fitted input called prediction [Sec. 4.1 Training Dataset; Appendix C; RQ2/RQ4 (Tables 4 and 7)]
    "we collect (and build) open-sourced C/C++ projects ... through ArchLinux official repositories (AOR) [12], Arch User Repository (AUR) [13], and Linux Community [39] ... The source functions (with matched pseudo ones) related to the evaluation of RQ1 and the effectiveness of our function embedding model (see Appendix E) are excluded, preventing data leakage."

    The fine-tuning corpus for the function embedding model is built from AOR/AUR/Linux Community projects. Appendix C states that the BinaryCorp clone-search dataset used in RQ2-RQ4 is itself crafted from AOR and AUR, and BinKit is compiled from widely used GNU packages of the kind collected from the Linux Community. The exclusion clause covers only functions tied to RQ1 and Appendix E; it does not state that the RQ2-RQ5 binaries were held out of the 40.51M matched training pairs.

full rationale

KEENHash's structural hashing core (K-Means labels + Feature Hashing + Jaccard similarity) is not circular by itself: RQ1 measures the K-Means classifier directly against genuine function-matching ground truth, and the Feature Hashing approximation is supported by external theoretical citations. The circularity is concentrated in the program clone-search evaluation. First, the KEENHash-sem weights (α, β) are chosen by grid search on the IoT and BinaryCorp repository datasets, then the same datasets are used to demonstrate superiority in Table 4 and the merged RQ4 result. Second, the function embedding model is fine-tuned on AOR/AUR/Linux Community pairs, while BinaryCorp is explicitly built from AOR/AUR and BinKit from common GNU packages; only RQ1 and Appendix E functions are excluded from training, so the held-out status of the main clone-search corpora is unestablished. These two issues make part of the reported >=23.16% improvement a fitted or in-distribution value rather than an independent prediction. The core hashing pipeline itself retains independent content, so this is partial circularity, not a fully definitional derivation.

Assumptions & free parameters 5 free parameters · 6 assumptions · 0 invented entities

The central claim rests on a learned embedding plus a series of approximation choices: K-Means cluster count, feature-hash length, and semantic weight hyperparameters. The weight hyperparameters are fitted to the evaluation repository distribution, and no formal guarantees are given for the 1-NN-to-centroid approximation of function matching. No new physical entities are introduced.

free parameters (5)
  • K-Means cluster count n = 2^22 = 4,194,304
    Set by evaluating function-matching F1 across 2^16 to 2^22; largest gives best F1 (0.7651) and is used in reported speedups (Sec. 4.3).
  • Feature Hashing output length m = 2^16 bits = 8KB
    Chosen as the largest practical size of a bit-vector for the Milvus vector database and memory constraints (Sec. 3.4.1, Appendix A).
  • KEENHash-sem weight hyperparameters (alpha1, alpha2, beta1, beta2) = 0.4, 5, 0.45, 1
    Obtained via grid search on IoT and BinaryCorp repository datasets, which are also used in the main evaluation (Sec. 3.4.2, Sec. 4.1).
  • CLIP temperature t = learnable
    Free parameter in the contrastive loss (Eq. 2) learned during fine-tuning of Pythia-410M.
  • Fine-tuning hyperparameters (epochs, batch size, LR) = 196, 512, 0.001
    Chosen settings for the function embedding model; not derived from first principles (Sec. 4.2).
assumptions (6)
  • domain assumption Ghidra decompilation yields pseudo-C functions that preserve enough semantics for similarity.
    The whole pipeline operates on Ghidra output; if decompilation is inaccurate (packed or obfuscated code), KEENHash degrades (Sec. 2.3, Sec. 5).
  • domain assumption Source-to-pseudo matching via DWARF debug info is correct ground truth.
    Training pairs for the contrastive model are constructed by compiling with debug info and matching function names/rva (Sec. 3.2.1).
  • domain assumption 1-NN to K-Means centroids is a sufficient approximation of function matching.
    This is the core transform in Sec. 3.4.1; the paper motivates it but does not prove it.
  • standard math Feature Hashing approximately preserves Jaccard similarity of label sets.
    Invoked from Weinberger et al. [88] in Sec. 3.4.1.
  • ad hoc to paper A weighted average of function embeddings with LoC/NoS weights captures program semantics.
    The weight formula (Eq 4-5) is motivated by heuristic and tuned on evaluation datasets; not derived.
  • domain assumption The function embedding model generalizes from training pairs to unseen binaries.
    Necessary for KEENHash to work on new malware and real-world binaries (Sec. 3.3).

how reviews work

0 comments
Cite this review

Pith. "Pith review of KEENHash: Hashing Programs into Function-Aware Embeddings for Large-Scale Binary Code Similarity Analysis." pith.science (2026). https://pith.science/paper/YRXYFYX3

@misc{pith2026250611612,
  author       = {Pith},
  title        = {Pith review of: KEENHash: Hashing Programs into Function-Aware Embeddings for Large-Scale Binary Code Similarity Analysis},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YRXYFYX3}},
  note         = {Machine review of arXiv:2506.11612}
}
read the original abstract

Binary code similarity analysis (BCSA) is a crucial research area in many fields such as cybersecurity. Specifically, function-level diffing tools are the most widely used in BCSA: they perform function matching one by one for evaluating the similarity between binary programs. However, such methods need a high time complexity, making them unscalable in large-scale scenarios (e.g., 1/n-to-n search). Towards effective and efficient program-level BCSA, we propose KEENHash, a novel hashing approach that hashes binaries into program-level representations through large language model (LLM)-generated function embeddings. KEENHash condenses a binary into one compact and fixed-length program embedding using K-Means and Feature Hashing, allowing us to do effective and efficient large-scale program-level BCSA, surpassing the previous state-of-the-art methods. The experimental results show that KEENHash is at least 215 times faster than the state-of-the-art function matching tools while maintaining effectiveness. Furthermore, in a large-scale scenario with 5.3 billion similarity evaluations, KEENHash takes only 395.83 seconds while these tools will cost at least 56 days. We also evaluate KEENHash on the program clone search of large-scale BCSA across extensive datasets in 202,305 binaries. Compared with 4 state-of-the-art methods, KEENHash outperforms all of them by at least 23.16%, and displays remarkable superiority over them in the large-scale BCSA security scenario of malware detection.

Figures

Figures reproduced from arXiv: 2506.11612 by the authors.

Figure 1
Figure 1. Workflow of KEENHash. packed binaries. KEENHash hashes programs based on decompiled results through Ghidra (see Sec. 3.2) which may be affected by packing techniques. Additionally, how to unpack any packed binary goes beyond the scope of our paper. Thus, to avoid biases, in this study, we divide the range of binaries that KEENHash can process into programs without packing, or packed programs can be unpacked easily (… view at source ↗
Figure 2
Figure 2. The time cost of performing function match [PITH_FULL_IMAGE:figures/full_fig_p014_2.png] view at source ↗
Figure 3
Figure 3. Program clone search on all binaries [PITH_FULL_IMAGE:figures/full_fig_p019_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

100 extracted references · 65 canonical work pages

  1. [1]

    GCC, the GNU Compiler Collection

    2025. GCC, the GNU Compiler Collection. https://gcc.gnu.org/

    2025

  2. [2]

    Hybrid Search

    2025. Hybrid Search. https://milvus.io/docs/multi-vector-search.md

    2025

  3. [3]

    The LLVM Project is a collection of modular and reusable compiler and toolchain technologies

    2025. The LLVM Project is a collection of modular and reusable compiler and toolchain technologies. https://github. com/llvm/llvm-project

    2025

  4. [4]

    TLSH is a fuzzy matching program and library

    2025. TLSH is a fuzzy matching program and library. https://tlsh.org/

    2025

  5. [5]

    tshd malware

    2025. tshd malware. https://www.virustotal.com/gui/file/289616b59a145e2033baddb8a8a9b5a8fb01bdbba1b8cf9acadcdd92e6cc0562

    2025

  6. [6]

    Zygug malware

    2025. Zygug malware. https://www.virustotal.com/gui/file/fa541d1274b450c2bbdc0c29531b847fb06baf30da46367c100c917ef5e8cbe8

    2025

  7. [7]

    National Security Agency. 2024. Ghidra Software Reverse Engineering Framework. https://github.com/ NationalSecurityAgency/ghidra

    2024

  8. [8]

    Jina AI. 2023. jina-embeddings-v2-base-en. https://huggingface.co/jinaai/jina-embeddings-v2-base-en

    2023

Show all 100 references
  1. [9]

    Loubna Ben Allal, Raymond Li, Denis Kocetkov, Chenghao Mou, Christopher Akiki, Carlos Munoz Ferrandis, Niklas Muennighoff, Mayank Mishra, Alex Gu, Manan Dey, et al. 2023. SantaCoder: don’t reach for the stars! arXiv preprint arXiv:2301.03988 (2023)

    2023 arXiv

  2. [10]

    Blake Anderson, Daniel Quist, Joshua Neil, Curtis Storlie, and Terran Lane. 2011. Graph-based malware detection using dynamic analysis. Journal in computer Virology 7 (2011), 247–258

    2011

  3. [11]

    Manos Antonakakis, Tim April, Michael Bailey, Matt Bernhard, Elie Bursztein, Jaime Cochran, Zakir Durumeric, J Alex Halderman, Luca Invernizzi, Michalis Kallitsis, et al. 2017. Understanding the mirai botnet. In 26th USENIX security symposium (USENIX Security 17) . 1093–1110

    2017

  4. [12]

    Archlinux. 2021. Arch linux. https://archlinux.org/packages/

    2021

  5. [13]

    Archlinux. 2021. Arch User Repository. https://aur.archlinux.org/

    2021

  6. [14]

    Sanjeev Arora, Yingyu Liang, and Tengyu Ma. 2017. A simple but tough-to-beat baseline for sentence embeddings. In International conference on learning representations . Proc. ACM Softw. Eng., Vol. 2, No. ISSTA, Article ISSTA036. Publication date: July 2025. ISSTA036:22 Zhijie ...

    2017

  7. [15]

    David Arthur, Sergei Vassilvitskii, et al. 2007. k-means++: The advantages of careful seeding. InSoda, Vol. 7. 1027–1035

    2007

  8. [16]

    Tristan Benoit, Jean-Yves Marion, and Sébastien Bardin. 2023. Scalable program clone search through spectral analysis. In Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering. 808–820

    2023

  9. [17]

    Stella Biderman, Hailey Schoelkopf, Quentin Gregory Anthony, Herbie Bradley, Kyle O’Brien, Eric Hallahan, Moham- mad Aflah Khan, Shivanshu Purohit, USVSN Sai Prashanth, Edward Raff, et al. 2023. Pythia: A suite for analyzing large language models across training and scaling. I...

    2023

  10. [18]

    BigCode. 2023. starcoderbase-1b. https://huggingface.co/bigcode/starcoderbase-1b

    2023

  11. [19]

    BinaryAI. 2024. BinaryAI BindiffMatch algorithm. https://github.com/binaryai/bindiffmatch

    2024

  12. [20]

    Xander Bouwman, Harm Griffioen, Jelle Egbers, Christian Doerr, Bram Klievink, and Michel Van Eeten. 2020. A different cup of{TI}? the added value of commercial threat intelligence. In 29th USENIX security symposium (USENIX security 20). 433–450

    2020

  13. [21]

    Andrei Z Broder. 1997. On the resemblance and containment of documents. InProceedings. Compression and Complexity of SEQUENCES 1997 (Cat. No. 97TB100171) . IEEE, 21–29

    1997

  14. [22]

    Ben Carterette and Ellen M Voorhees. 2011. Overview of information retrieval evaluation. In Current challenges in patent information retrieval. Springer, 69–85

    2011

  15. [23]

    ChangC. 2020. The gh0st RAT malware. https://github.com/Cc28256/CcRemote

    2020

  16. [24]

    Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. 2020. A simple framework for contrastive learning of visual representations. In International conference on machine learning . PMLR, 1597–1607

    2020

  17. [25]

    Savino Dambra, Yufei Han, Simone Aonzo, Platon Kotzias, Antonino Vitale, Juan Caballero, Davide Balzarotti, and Leyla Bilge. 2023. Decoding the Secrets of Machine Learning in Malware Classification: A Deep Dive into Datasets, Feature Extraction, and Model Performance. In Proce...

    2023

  18. [26]

    Steven HH Ding, Benjamin CM Fung, and Philippe Charland. 2019. Asm2vec: Boosting static representation robustness for binary clone search against code obfuscation and compiler optimization. In 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 472–489

    2019

  19. [27]

    Matthijs Douze, Alexandr Guzhva, Chengqi Deng, Jeff Johnson, Gergely Szilvasy, Pierre-Emmanuel Mazaré, Maria Lomeli, Lucas Hosseini, and Hervé Jégou. 2024. The faiss library. arXiv preprint arXiv:2401.08281 (2024)

    2024 arXiv

  20. [28]

    Yue Duan, Xuezixiang Li, Jinghan Wang, and Heng Yin. 2020. Deepbindiff: Learning program-wide code representations for binary diffing. In Network and distributed system security symposium

    2020

  21. [29]

    EleutherAI. 2023. Pythia-160M. https://huggingface.co/EleutherAI/pythia-160m

    2023

  22. [30]

    EleutherAI. 2023. Pythia-1B. https://huggingface.co/EleutherAI/pythia-1b

    2023

  23. [31]

    EleutherAI. 2023. Pythia-410M. https://huggingface.co/EleutherAI/pythia-410m

    2023

  24. [32]

    Qian Feng, Rundong Zhou, Chengcheng Xu, Yao Cheng, Brian Testa, and Heng Yin. 2016. Scalable graph-based bug search for firmware images. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. 480–491

    2016

  25. [33]

    Zhangyin Feng, Daya Guo, Duyu Tang, Nan Duan, Xiaocheng Feng, Ming Gong, Linjun Shou, Bing Qin, Ting Liu, Daxin Jiang, et al . 2020. Codebert: A pre-trained model for programming and natural languages. arXiv preprint arXiv:2002.08155 (2020)

    2020 arXiv

  26. [34]

    Lian Gao, Yu Qu, Sheng Yu, Yue Duan, and Heng Yin. 2024. SigmaDiff: Semantics-aware deep graph matching for pseudocode diffing. In Network and distributed system security symposium

    2024

  27. [35]

    GitHub. 2024. GitHub: Let’s build from here. https://github.com/

    2024

  28. [36]

    GNU. 2019. GNU Coretuils. https://www.gnu.org/software/coreutils/

    2019

  29. [37]

    GNU. 2019. GNU Difftuils. https://www.gnu.org/software/diffutils/

    2019

  30. [38]

    GNU. 2019. GNU Findutils. https://www.gnu.org/software/findutils/

    2019

  31. [39]

    GNU. 2024. The GNU Operating System and the Free Software Movement. https://www.gnu.org/home.en.html

    2024

  32. [40]

    Daya Guo, Shuai Lu, Nan Duan, Yanlin Wang, Ming Zhou, and Jian Yin. 2022. Unixcoder: Unified cross-modal pre-training for code representation. arXiv preprint arXiv:2203.03850 (2022)

    2022 arXiv

  33. [41]

    Rentong Guo, Xiaofan Luan, Long Xiang, Xiao Yan, Xiaomeng Yi, Jigao Luo, Qianya Cheng, Weizhi Xu, Jiarui Luo, Frank Liu, et al. 2022. Manu: a cloud native vector database management system. Proceedings of the VLDB Endowment 15, 12 (2022), 3548–3561

    2022

  34. [42]

    Irfan Ul Haq and Juan Caballero. 2021. A survey of binary code similarity. ACM Computing Surveys (CSUR) 54, 3 (2021), 1–38

    2021

  35. [43]

    horsicq. 2024. Detect It Easy. https://github.com/horsicq/Detect-It-Easy

    2024

  36. [44]

    2013.{MutantX-S}: Scalable Malware Clustering Based on Static Features

    Xin Hu, Kang G Shin, Sandeep Bhatkar, and Kent Griffin. 2013.{MutantX-S}: Scalable Malware Clustering Based on Static Features. In 2013 USENIX Annual Technical Conference (USENIX ATC 13) . 187–198

    2013

  37. [45]

    UNIX International. 2024. DWARF Debugging Information Format. https://dwarfstd.org/. Proc. ACM Softw. Eng., Vol. 2, No. ISSTA, Article ISSTA036. Publication date: July 2025. KEENHash: Hashing Programs into Function-Aware Embeddings... ISSTA036:23

    2024

  38. [46]

    Jiyong Jang, David Brumley, and Shobha Venkataraman. 2011. Bitshred: feature hashing malware for scalable triage and semantic analysis. In Proceedings of the 18th ACM conference on Computer and communications security . 309–320

    2011

  39. [47]

    jgamblin. 2016. Mirai BotNet. https://github.com/jgamblin/Mirai-Source-Code

    2016

  40. [48]

    Ang Jia, Ming Fan, Wuxia Jin, Xi Xu, Zhaohui Zhou, Qiyi Tang, Sen Nie, Shi Wu, and Ting Liu. 2023. 1-to-1 or 1-to-n? Investigating the effect of function inlining on binary similarity analysis. ACM Transactions on Software Engineering and Methodology 32, 4 (2023), 1–26

    2023

  41. [49]

    Ling Jiang, Junwen An, Huihui Huang, Qiyi Tang, Sen Nie, Shi Wu, and Yuqun Zhang. 2024. BinaryAI: Binary Software Composition Analysis via Intelligent Binary Source Code Matching. In Proceedings of the IEEE/ACM 46th International Conference on Software Engineering . 1–13

    2024

  42. [50]

    Ling Jiang, Hengchen Yuan, Qiyi Tang, Sen Nie, Shi Wu, and Yuqun Zhang. 2023. Third-Party Library Dependency for Large-Scale SCA in the C/C++ Ecosystem: How Far Are We?. InProceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis . 1383–1395....

    2023

  43. [51]

    Jeff Johnson, Matthijs Douze, and Hervé Jégou. 2019. Billion-scale similarity search with GPUs. IEEE Transactions on Big Data 7, 3 (2019), 535–547

    2019

  44. [52]

    joxeankoret. 2024. Diaphora. https://github.com/joxeankoret/diaphora

    2024

  45. [53]

    Pascal Junod, Julien Rinaldini, Johan Wehrli, and Julie Michielin. 2015. Obfuscator-LLVM – Software Protection for the Masses. In Proceedings of the IEEE/ACM 1st International Workshop on Software Protection, SPRO’15, Firenze, Italy, May 19th, 2015, Brecht Wyseur (Ed.). IEEE, ...

    2015 doi

  46. [54]

    Dongkwan Kim, Eunsoo Kim, Sang Kil Cha, Sooel Son, and Yongdae Kim. 2022. Revisiting binary code similarity analysis using interpretable feature engineering and lessons learned. IEEE Transactions on Software Engineering 49, 4 (2022), 1661–1682

    2022

  47. [55]

    Jesse Kornblum. 2006. Identifying almost identical files using context triggered piecewise hashing. Digital investigation 3 (2006), 91–97

    2006

  48. [56]

    Harold W Kuhn. 1955. The Hungarian method for the assignment problem. Naval research logistics quarterly 2, 1-2 (1955), 83–97

    1955

  49. [57]

    Tencent Keen Security Lab. 2024. BinaryAI: Binary File Security Analysis Platform. https://www.binaryai.cn/home

    2024

  50. [58]

    Raymond Li, Loubna Ben Allal, Yangtian Zi, Niklas Muennighoff, Denis Kocetkov, Chenghao Mou, Marc Marone, Christopher Akiki, Jia Li, Jenny Chim, et al. 2023. Starcoder: may the source be with you!arXiv preprint arXiv:2305.06161 (2023)

    2023 arXiv

  51. [59]

    Vector Guo Li, Matthew Dunn, Paul Pearce, Damon McCoy, Geoffrey M Voelker, and Stefan Savage. 2019. Reading the tea leaves: A comparative analysis of threat intelligence. In 28th USENIX security symposium (USENIX Security 19) . 851–867

    2019

  52. [60]

    Xuezixiang Li, Yu Qu, and Heng Yin. 2021. Palmtree: Learning an assembly language model for instruction embedding. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security . 3236–3251

    2021

  53. [61]

    Petro Liashchynskyi and Pavlo Liashchynskyi. 2019. Grid search, random search, genetic algorithm: a big comparison for NAS. arXiv preprint arXiv:1912.06059 (2019)

    2019 arXiv

  54. [62]

    Lannan Luo, Jiang Ming, Dinghao Wu, Peng Liu, and Sencun Zhu. 2017. Semantics-based obfuscation-resilient binary code similarity comparison with applications to software and algorithm plagiarism detection. IEEE Transactions on Software Engineering 43, 12 (2017), 1157–1177

    2017

  55. [63]

    Zhenhao Luo, Pengfei Wang, Baosheng Wang, Yong Tang, Wei Xie, Xu Zhou, Danjun Liu, and Kai Lu. 2023. VulHawk: Cross-architecture Vulnerability Detection with Entropy-based Binary Code Search.. In NDSS

    2023

  56. [64]

    Guillermo Macbeth, Eugenia Razumiejczyk, and Rubén Daniel Ledesma. 2011. Cliff’s Delta Calculator: A non-parametric effect size program for two groups of observations. Universitas Psychologica 10, 2 (2011), 545–555

    2011

  57. [65]

    MalwareBazaar. 2024. MalwareBazaar | Malware sample exchange. https://bazaar.abuse.ch/

    2024

  58. [66]

    Alessandro Mantovani, Simone Aonzo, Xabier Ugarte-Pedrero, Alessio Merlo, and Davide Balzarotti. 2020. Prevalence and impact of low-entropy packing schemes in the malware ecosystem. In NDSS 2020, Network and Distributed System Security Symposium, 23-26 February 2020, San Diego...

    2020

  59. [67]

    2017.{BinSim}: Trace-based semantic binary diffing via system call sliced segment equivalence checking

    Jiang Ming, Dongpeng Xu, Yufei Jiang, and Dinghao Wu. 2017.{BinSim}: Trace-based semantic binary diffing via system call sliced segment equivalence checking. In 26th USENIX Security Symposium (USENIX Security 17) . 253–270

    2017

  60. [68]

    Jaron Mink, Hadjer Benkraouda, Limin Yang, Arridhana Ciptadi, Ali Ahmadzadeh, Daniel Votipka, and Gang Wang

  61. [69]

    Erik Nijkamp, Bo Pang, Hiroaki Hayashi, Lifu Tu, Huan Wang, Yingbo Zhou, Silvio Savarese, and Caiming Xiong. 2022. Codegen: An open large language model for code with multi-turn program synthesis. arXiv preprint arXiv:2203.13474 (2022)

    2022 arXiv

  62. [70]

    Jonathan Oliver, Chun Cheng, and Yanggui Chen. 2013. TLSH–a locality sensitive hash. In 2013 Fourth Cybercrime and Trustworthy Computing Workshop. IEEE, 7–13. Proc. ACM Softw. Eng., Vol. 2, No. ISSTA, Article ISSTA036. Publication date: July 2025. ISSTA036:24 Zhijie Liu, Qiyi ...

    2013

  63. [71]

    Kuntal Kumar Pal, Ati Priya Bajaj, Pratyay Banerjee, Audrey Dutcher, Mutsumi Nakamura, Zion Leonahenahe Basque, Himanshu Gupta, Saurabh Arjun Sawant, Ujjwala Anantheswaran, Yan Shoshitaishvili, et al. 2024. len or index or count, anything but v1”: Predicting variable names in ...

    2024

  64. [72]

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. 2021. Learning transferable visual models from natural language supervision. In International conference on machine learni...

    2021

  65. [73]

    Hex Rays. 2024. IDA Pro: The best-of-breed binary code analysis tool, an indispensable item in the toolbox of world-class software analysts, reverse engineers, malware analyst and cybersecurity professionals. https://hex-rays.com/ida-pro/

    2024

  66. [74]

    Marcos Sebastián, Richard Rivera, Platon Kotzias, and Juan Caballero. 2016. Avclass: A tool for massive malware labeling. In Research in Attacks, Intrusions, and Defenses: 19th International Symposium, RAID 2016, Paris, France, September 19-21, 2016, Proceedings 19 . Springer, 230–253

    2016

  67. [75]

    Silvia Sebastián and Juan Caballero. 2020. Avclass2: Massive malware tag extraction from av labels. In Proceedings of the 36th Annual Computer Security Applications Conference . 42–53

    2020

  68. [76]

    Ensheng Shi, Yanlin Wang, Wenchao Gu, Lun Du, Hongyu Zhang, Shi Han, Dongmei Zhang, and Hongbin Sun. 2023. Cocosoda: Effective contrastive learning for code search. In 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE). IEEE, 2198–2210

    2023

  69. [77]

    Wei Tang, Zhengzi Xu, Chengwei Liu, Jiahui Wu, Shouguo Yang, Yi Li, Ping Luo, and Yang Liu. 2022. Towards understanding third-party library dependency in c/c++ ecosystem. In Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering . 1–12

    2022

  70. [78]

    tree sitter. 2024. Tree-sitter is a parser generator tool and an incremental parsing library. https://tree-sitter.github.io/tree- sitter/

    2024

  71. [79]

    upx. 2024. The Ultimate Packer for eXecutables. https://github.com/upx/upx

    2024

  72. [80]

    Kevin van Liebergen, Juan Caballero, Platon Kotzias, and Chris Gates. 2023. A Deep Dive into the VirusTotal File Feed. In International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment . Springer, 155–176

    2023

  73. [81]

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. Advances in neural information processing systems 30 (2017)

    2017

  74. [82]

    VirusTotal. 2024. VirusTotal - free online virus, malware and URL scanner. https://www.virustotal.com

    2024

  75. [83]

    Hao Wang, Zeyu Gao, Chao Zhang, Zihan Sha, Mingyang Sun, Yuchen Zhou, Wenyu Zhu, Wenju Sun, Han Qiu, and Xi Xiao. 2024. CLAP: Learning Transferable Binary Code Representations with Natural Language Supervision. Proceedings of the 33rd ACM SIGSOFT International Symposium on Sof...

    2024

  76. [84]

    Huaijin Wang, Zhibo Liu, Shuai Wang, Ying Wang, Qiyi Tang, Sen Nie, and Shi Wu. 2024. Are We There Yet? Filling the Gap Between Binary Similarity Analysis and Binary Software Composition Analysis. In 2024 IEEE 9th European Symposium on Security and Privacy (EuroS&P) . IEEE, 506–523

    2024

  77. [85]

    Huaijin Wang, Pingchuan Ma, Shuai Wang, Qiyi Tang, Sen Nie, and Shi Wu. 2023. sem2vec: Semantics-aware Assembly Tracelet Embedding. ACM Transactions on Software Engineering and Methodology 32, 4 (2023), 1–34

    2023

  78. [86]

    Hao Wang, Wenjie Qu, Gilad Katz, Wenyu Zhu, Zeyu Gao, Han Qiu, Jianwei Zhuge, and Chao Zhang. 2022. Jtrans: Jump-aware transformer for binary code similarity detection. In Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis . 1–13

    2022

  79. [87]

    Jianguo Wang, Xiaomeng Yi, Rentong Guo, Hai Jin, Peng Xu, Shengjun Li, Xiangyu Wang, Xiangzhou Guo, Chengming Li, Xiaohai Xu, et al . 2021. Milvus: A Purpose-Built Vector Data Management System. In Proceedings of the 2021 International Conference on Management of Data . 2614–2627

    2021

  80. [88]

    Kilian Weinberger, Anirban Dasgupta, John Langford, Alex Smola, and Josh Attenberg. 2009. Feature hashing for large scale multitask learning. In Proceedings of the 26th annual international conference on machine learning . 1113–1120

    2009

  81. [89]

    Seunghoon Woo, Sunghan Park, Seulbae Kim, Heejo Lee, and Hakjoo Oh. 2021. CENTRIS: A precise and scalable approach for identifying modified open-source software reuse. In 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE). IEEE, 860–872

    2021

  82. [90]

    Ho Chung Wu, Robert Wing Pong Luk, Kam Fai Wong, and Kui Lam Kwok. 2008. Interpreting TF-IDF term weights as making relevance decisions. ACM Transactions on Information Systems (TOIS) 26, 3 (2008), 1–37

    2008

  83. [91]

    Jiahui Wu, Zhengzi Xu, Wei Tang, Lyuye Zhang, Yueming Wu, Chengyue Liu, Kairan Sun, Lida Zhao, and Yang Liu

  84. [92]

    Xiaojun Xu, Chang Liu, Qian Feng, Heng Yin, Le Song, and Dawn Song. 2017. Neural network-based graph embedding for cross-platform binary code similarity detection. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security. 363–376

    2017

  85. [93]

    In 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE)

    Ossfp: Precise and scalable c/c++ third-party library detection using fingerprinting functions. In 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE) . IEEE, 270–282

    2023

  86. [94]

    Zeping Yu, Rui Cao, Qiyi Tang, Sen Nie, Junzhou Huang, and Shi Wu. 2020. Order matters: Semantic-aware neural networks for binary code similarity detection. InProceedings of the AAAI conference on artificial intelligence. 1145–1152

    2020

  87. [95]

    Can Yang, Zhengzi Xu, Hongxu Chen, Yang Liu, Xiaorui Gong, and Baoxu Liu. 2022. ModX: binary level partially imported third-party library detection via program modularization and semantic matching. In Proceedings of the 44th Proc. ACM Softw. Eng., Vol. 2, No. ISSTA, Article IS...

    2022

  88. [96]

    Zimu Yuan, Muyue Feng, Feng Li, Gu Ban, Yang Xiao, Shiyang Wang, Qian Tang, He Su, Chendong Yu, Jiahuan Xu, et al. 2019. B2SFinder: Detecting open-source software reuse in COTS software. In 2019 34th IEEE/ACM International Conference on Automated Software Engineering (ASE) . I...

    2019

  89. [97]

    Zeping Yu, Wenxin Zheng, Jiaqi Wang, Qiyi Tang, Sen Nie, and Shi Wu. 2020. Codecmr: Cross-modal retrieval for function-level binary source code matching. Advances in Neural Information Processing Systems 33 (2020), 3872–3883

    2020

  90. [98]

    Xiaohua Zhai, Basil Mustafa, Alexander Kolesnikov, and Lucas Beyer. 2023. Sigmoid loss for language image pre-training. In Proceedings of the IEEE/CVF International Conference on Computer Vision . 11975–11986. Proc. ACM Softw. Eng., Vol. 2, No. ISSTA, Article ISSTA036. Publica...

    2023

  91. [99]

    Zhengran Zeng, Hanzhuo Tan, Haotian Zhang, Jing Li, Yuqun Zhang, and Lingming Zhang. 2022. An extensive study on pre-trained models for program understanding and generation. InProceedings of the 31st ACM SIGSOFT international symposium on software testing and analysis . 39–51

    2022

  92. [2023]

    In 2023 IEEE Symposium on Security and Privacy (SP)

    Everybody’s Got ML, Tell Me What Else You Have: Practitioners’ Perception of ML-Based Security Tools and Explanations. In 2023 IEEE Symposium on Security and Privacy (SP) . IEEE, 2068–2085

    2023

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.