BinSim: Trace-based Semantic Binary Diffing via System Call Sliced Segment Equivalence Checking

Detecting differences between two binary executables (binary diffing), first derived from patch analysis, have been widely employed in various software security analysis tasks, such as software plagiarism detection and malware lineage inference. Especially when analyzing malware variants, pervasive code obfuscation techniques have driven recent work towards determining semantic similarity in spite of ostensible difference in syntax. Existing ways rely on either comparing runtime behaviors or modeling code snippet semantics with symbolic execution. However, neither approach delivers the expected precision. In this paper, we propose system call sliced segment equivalence checking, a hybrid method to identify fine-grained semantic similarities or differences between two execution traces. We perform enhanced dynamic slicing and symbolic execution to compare the logic of instructions that impact on the observable behaviors. Our approach improves existing semantics-based binary diffing by 1) inferring whether two executable binaries’ behaviors are conditionally equivalent; 2) detecting the similarities or differences, whose effects spread across multiple basic blocks. We have developed a prototype, called BinSim, and performed empirical evaluations against sophisticated obfuscation combinations and more than 1,000 recent malware samples, including now-infamous crypto ransomware. Our experimental results show that BinSim can successfully identify finegrained relations between obfuscated binaries, and outperform existing binary diffing tools in terms of better resilience and accuracy.

检测两个二进制可执行文件（二进制差异），首先是从补丁分析中得出的，已广泛用于各种软件安全分析任务，例如软件pla窃检测和恶意软件谱系推理。尽管语法上有可能的差异，但在确定语义相似性方面的最新工作依赖于任何一种。但是，将运行时行为或建模代码代码段语义与符号执行。但是，我们在本文中都提供了预期的精度执行轨迹方法通过1​​）提出两个可执行的二进制行为是否有条件地等于2）检测相似之处或差异对复杂的混淆组合和1,000多个恶意软件样本的评估，包括现在的crypto勒索软件实验结果表明，BINSIM可以成功地识别混淆的二进制文件之间的良好关系，并且在更好的弹性和准确性方面优于现有的二进制扩散工具。