Can a Deep Learning Model for One Architecture Be Used for Others? Retargeted-Architecture Binary Code Analysis
Can a Deep Learning Model for One Architecture Be Used for Others? Retargeted-Architecture Binary Code Analysis
复制标题
DOI：
--
复制
发表时间：
2023
期刊：
影响因子：
--
通讯作者：
Junzhe Wang;Matthew Sharp;Chuxiong Wu;Qiang Zeng;Lannan Luo
中科院分区：
文献类型：
--
作者：
Junzhe Wang;Matthew Sharp;Chuxiong Wu;Qiang Zeng;Lannan Luo
基于nlp的深度学习二进制代码分析展示了显著的性能。考虑到市场上各种各样的指令集体系结构（isa），能够分析各种isa的代码是很重要的。然而，训练一个深度学习模型通常需要大量的数据，这给某些isa（如PowerPC）带来了挑战，这些isa存在“数据稀缺”问题。例如，获取大型PowerPC恶意软件数据集被证明是具有挑战性的。此外，给定一个二进制分析任务和多个ISA，每个ISA训练一个模型需要花费大量的时间和精力（例如，用于数据收集、标记和清理以及参数调优）。我们提出了一个新的方向，即重目标架构二进制代码分析，以处理数据稀缺问题并减轻每个isa的工作量。我们的想法是将知识从一个ISA转移到其他ISA——也就是说，一个模型，用丰富的数据和大量的时间和精力为一个ISA训练，可以在没有任何修改的情况下为其他ISA执行预测。我们通过两个重要的任务来展示这个想法：恶意软件检测和功能相似性检测。对四个isa （x86、ARM、MIPS和PowerPC）进行了广泛的评估，证明了该方法的有效性，并解释了高性能。
NLP-inspired deep learning for binary code analysis demonstrates notable performance. Considering the diverse Instruction Set Architectures (ISAs) on the market, it is important to be able to analyze code of various ISAs. However, training a deep learning model usually requires a large amount of data, which poses a challenge for certain ISAs such as PowerPC that suffer from the “ data scarcity ” issue. For instance, acquiring a large dataset of PowerPC malware proves to be challenging. Moreover, given a binary analysis task and multiple ISAs, it takes much time and effort (e.g., for data collection, labeling and cleaning, and parameter tuning) to train one model per ISA. We propose a new direction, retargeted-architecture binary code analysis , to handle the data scarcity issue and alleviate the per-ISA effort. Our idea is to transfer knowledge from one ISA to others —that is, a model, trained with rich data and much time and effort for one ISA, can perform prediction for others without any modi-fication . We showcase the idea through two important tasks: malware detection and function similarity detection. An extensive evaluation involving four ISAs (x86, ARM, MIPS, and PowerPC) demonstrates the effectiveness of the approach and the high performance is interpreted.