Binary Code Similarity Detection through LSTM and Siamese Neural Network

EAI Endorsed Transactions on Security and Safety

Tao Hou¹  Xiangrong Zhou²  Zhengping Luo³  Hui Zeng⁴  Zhuo Lu⁴ 

[1] Physics, Rider University, Lawrenceville, NJ 08648, USA;Computer Science Engineering and Electrical Engineering, University of South Florida, Tampa FL 33620, USA;;Department of Computer Science &Intelligent Automation Inc., Rockville MD 20855, USA;

关键词: malware detection;    binary analysis;    lstm;    siamese neural network;    similarity detection;   

DOI  :  10.4108/eai.14-9-2021.170956

来源: DOAJ

【 摘 要 】

Given the fact that many software projects are closed-source, analyzing security-related vulnerabilities at the binary level is quintessential to protect computer systems from attacks of malware. Binary code similarity detection is a potential solution for detecting malware from the binaries generated by the processor. In this paper, we proposed a malware detection mechanism based on the binaries using machine learning techniques. Through utilizing the Recurrent Neural Network (RNN), more specifically Long Short-Term Memory (LSTM) network, we generate the uniformed feature embedding of each binary file and further take advantage of the Siamese Neural Network to compute the similarity measure of the extracted features. Therefore, the security risks of the software projects can be evaluated through the similarity measure of the corresponding binaries with existing trained malware. Our real-world experimental results demonstrate a convincing performance indistinguishing out the outliers, and achieved slightly better performance compared with existing state-of-the-art methods.

【 授权许可】

Unknown