1-to-1 or 1-to-n? Investigating the effect of function inlining on binary similarity analysis
1-to-1 or 1-to-n? Investigating the effect of function inlining on binary similarity analysis
复制标题
1对1还是1对n？
DOI：
10.1145/3561385
复制
发表时间：
2021-12
影响因子：
4.4
通讯作者：
Ting Liu
中科院分区：
文献类型：
--
作者：
Ang Jia;Ming Fan;Wuxia Jin;Xi Xu;Zhaohui Zhou;Qiyi Tang;Sen Nie;Shi Wu;Ting Liu
Binary similarity analysis is critical to many code-reuse-related issues, where function matching is its fundamental task. “ 1-to-1 ” mechanism has been applied in most binary similarity analysis works, in which one function in a binary file is matched against one function in a source file or binary file. However, we discover that the function mapping is a more complex problem of “ 1-to-n ” (one binary function matches multiple source functions or binary functions) or even “ n-to-n ” (multiple binary functions match multiple binary functions) due to the existence of function inlining , different from traditional understanding. In this paper, we investigate the effect of function inlining on binary similarity analysis. We carry out three studies to investigate the extent of function inlining, the performance of existing works under function inlining, and the effectiveness of existing inlining-simulation strategies. Firstly, a scalable and lightweight identification method is designed to recover function inlining in binaries. 88 projects (compiled in 288 versions and resulting in 32,460,156 binary functions) are collected and analyzed to construct 4 inlining-oriented datasets for 4 security tasks in the software supply chain, including code search, OSS (Open Source Software) reuse detection, vulnerability detection, and patch presence test. Datasets reveal that the proportion of function inlining ranges from 30%-40% when using O3 and sometimes can reach nearly 70%. Then, we evaluate 4 existing works on our dataset. Results show most existing works neglect inlining and use the “1-to-1” mechanism. The mismatches cause a 30% loss in performance during code search and a 40% loss during vulnerability detection. Moreover, most inlined functions would be ignored during OSS reuse detection and patch presence test, thus leaving these functions risky. Finally, we analyze 2 inlining-simulation strategies on our dataset. It is shown that they miss nearly 40% of the inlined functions, and there is still a large space for promotion. By precisely recovering when function inlining happens, we discover that inlining is usually cumulative when optimization increases. Thus, conditional inlining and incremental inlining are recommended to design a low-cost and high-coverage inlining-simulation strategy.
Binary similarity analysis is critical to many code-reuse-related issues, where function matching is its fundamental task. “ 1-to-1 ” mechanism has been applied in most binary similarity analysis works, in which one function in a binary file is matched against one function in a source file or binary file. However, we discover that the function mapping is a more complex problem of “ 1-to-n ” (one binary function matches multiple source functions or binary functions) or even “ n-to-n ” (multiple binary functions match multiple binary functions) due to the existence of function inlining , different from traditional understanding. In this paper, we investigate the effect of function inlining on binary similarity analysis. We carry out three studies to investigate the extent of function inlining, the performance of existing works under function inlining, and the effectiveness of existing inlining-simulation strategies. Firstly, a scalable and lightweight identification method is designed to recover function inlining in binaries. 88 projects (compiled in 288 versions and resulting in 32,460,156 binary functions) are collected and analyzed to construct 4 inlining-oriented datasets for 4 security tasks in the software supply chain, including code search, OSS (Open Source Software) reuse detection, vulnerability detection, and patch presence test. Datasets reveal that the proportion of function inlining ranges from 30%-40% when using O3 and sometimes can reach nearly 70%. Then, we evaluate 4 existing works on our dataset. Results show most existing works neglect inlining and use the “1-to-1” mechanism. The mismatches cause a 30% loss in performance during code search and a 40% loss during vulnerability detection. Moreover, most inlined functions would be ignored during OSS reuse detection and patch presence test, thus leaving these functions risky. Finally, we analyze 2 inlining-simulation strategies on our dataset. It is shown that they miss nearly 40% of the inlined functions, and there is still a large space for promotion. By precisely recovering when function inlining happens, we discover that inlining is usually cumulative when optimization increases. Thus, conditional inlining and incremental inlining are recommended to design a low-cost and high-coverage inlining-simulation strategy.
登录
查看更多内容
影响因子：
10.3
作者：
通讯作者：
--
利用线程相关的系统调用进行多线程程序的抄袭检测
影响因子：
3.5
作者：
Zheng, Qinghua;Fan, Ming;Zhuang, Eryue;Yang, Zijiang
通讯作者：
Yang, Zijiang
DOI：
10.1016/j.diin.2015.05.015
发表时间：
2015-08
期刊：
Digit. Investig.
影响因子：
--
作者：
Ashkan Rahimian;Paria Shirani;S. Alrabaee;Lingyu Wang;M. Debbabi
通讯作者：
Ashkan Rahimian;Paria Shirani;S. Alrabaee;Lingyu Wang;M. Debbabi
DOI：
10.1145/73141.74840
发表时间：
1989-06
期刊：
--
影响因子：
--
作者：
W. Hwu;P. Chang
通讯作者：
W. Hwu;P. Chang
DOI：
10.1109/icse.2019.00085
发表时间：
2019-05
期刊：
2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE)
影响因子：
--
作者：
Ming Fan;Xiapu Luo;Jun Liu;Meng Wang;Chunyin Nong;Q. Zheng;Ting Liu
通讯作者：
Ming Fan;Xiapu Luo;Jun Liu;Meng Wang;Chunyin Nong;Q. Zheng;Ting Liu