Ex2Vec: Enhancing assembly code semantics with end-to-end execution-aware embeddings.

Abstract

Binary code similarity detection (BSCD), whose goal is to identify and analyze similar or identical functions in compiled binaries, is an essential task in computer security. Recent methods leveraging deep neural networks (DNN) for numerical vector representation of code have achieved significant success. However, these methods primarily adapt techniques from masked language modeling (MLM), encoding code instructions by predicting missing values from an instruction context, which limits their ability to fully capture execution semantics. In this paper, we propose Ex2vec, an innovative end-to-end encoding method that generates high-quality embeddings rich in execution semantics for BCSD. Ex2vec employs a novel pre-training strategy that enables the model to learn the impact of assembly instructions on register states, thus mitigating the reliance on learning the frequency and co-occurrence of the instructions in the assembly context. By simulating the execution of assembly instructions, Ex2Vec accurately captures the semantic features of assembly code, which is further demonstrated by Principal Component Analysis (PCA) that functionally similar instructions cluster closely in the embedding space. Extensive experiments on large datasets validate that Ex2vec performs exceptionally well in binary code similarity detection, surpassing all existing state-of-the-art methods. In real-world vulnerability detection experiments, Ex2Vec exhibits the highest accuracy.