file:: [icse2023-paper1123_1666614286724_0.pdf](../assets/icse2023-paper1123_1666614286724_0.pdf)
file-path:: ../assets/icse2023-paper1123_1666614286724_0.pdf

- BSCA solutions
  ls-type:: annotation
  hl-page:: 1
  hl-color:: green
  id:: 635ed6e9-5ab5-494e-920d-d197bad4a0ef
- binary similarity analysis (BSA),
  ls-type:: annotation
  hl-page:: 1
  hl-color:: purple
  id:: 635ed6fa-e494-4bb0-a747-301dac2e3822
  hl-stamp:: 1667159806055
- Software composition analysis (SCA
  ls-type:: annotation
  hl-page:: 1
  hl-color:: purple
  id:: 635ed702-0585-45ec-a36c-3681491f925c
- binary code SCA (BSCA)
  ls-type:: annotation
  hl-page:: 1
  hl-color:: purple
  id:: 635ed718-a954-446b-b442-890d08b54afd
- This study explores bridging the gap between state-of-theart (SOTA) BSA and BSCA. We build the first comprehensive benchmark dataset with considerable manual effort. Then, we establish our BSCA pipeline, by extending the SOTA SCA solution. Particularly, we concretize the key procedure of BSCA, namely matching a binary component with OSS, with six SOTA BSA techniques. Evaluation using our benchmark dataset reveals that simply employing BSA in BSCA exhibits less desirable accuracy, as BSCA faces unique challenges. With manual inspection on the failed cases, we propose three enhancements, whose combination improves the F1 score of BSCA for nearly 30% and outperforms SOTA commercial BSCA software. We discuss several open challenges and potential solutions to augment BSCA solutions.
  ls-type:: annotation
  hl-page:: 1
  hl-color:: yellow
  id:: 635ed78d-51f5-4fa1-9fc5-c8792fe0ba02
- localizing potentially vulnerable or outdated OSS components, reducing risk factors, and leading to healthy open source usage
  ls-type:: annotation
  hl-page:: 1
  hl-color:: purple
  id:: 635ed9b2-f4e7-4a1d-accd-a7c6a0ea5656
  hl-stamp:: 1667394892119
- in many real-world, securitysensitive scenarios, input software’s source code is not always availabl
  ls-type:: annotation
  hl-page:: 1
  hl-color:: green
  id:: 63626d65-b79c-4e25-99f3-12539b9dd086
- when performing SCA over commercial offthe-shelf (COTS) software, the primarily available information is the program binary code.
  ls-type:: annotation
  hl-page:: 1
  hl-color:: green
  id:: 63626d70-8c68-445d-b883-7f453bccbb4b
- binary software composition analysis (BSCA) becomes a demanding, yet underexplored field [5, 8].
  ls-type:: annotation
  hl-page:: 1
  hl-color:: purple
  id:: 63626d75-cec4-406e-bc61-1cd6960be676
- BSA quantifies the similarity between two binary code samples, which forms the basis of various important software engineering and security applications.
  ls-type:: annotation
  hl-page:: 1
  hl-color:: green
  id:: 63626d87-d918-4004-b56b-640591b7fc45
- BSA promotes malware analysis by comparing suspicious code with known malware families to determine if it is malicious
  ls-type:: annotation
  hl-page:: 1
  hl-color:: green
  id:: 63626d8e-389f-4d6d-bc46-59de09eb9cdb
- BSA also helps discover code clones and algorithm plagiarism in executable
  ls-type:: annotation
  hl-page:: 1
  hl-color:: purple
  id:: 63626d96-50c9-47bd-8cf2-88ad64962f91
- “binary code matching.
  ls-type:: annotation
  hl-page:: 1
  hl-color:: green
  id:: 63626d9e-9553-40b2-b621-0263752f8aac
- advanced BSA solutions have been extensively using deep neural networks (DNNs) and its enabled representative learning and large language models (LLMs)-based embedding
  ls-type:: annotation
  hl-page:: 1
  hl-color:: purple
  id:: 63626def-d7c8-462d-b5c1-25b8004f2151
- BSA and SCA/BSCA, two conceptually similar fields, exhibit a notable difference in the technical solution; 
  ls-type:: annotation
  hl-page:: 1
  hl-color:: purple
  id:: 63626e1b-2f36-4b4f-833a-265f5ea2189a
- this paper aims to provide a systematic understanding and study applying SOTA BSA solutions in the field of BSCA.
  ls-type:: annotation
  hl-page:: 1
  hl-color:: purple
  id:: 63626e3d-aa14-4765-965c-4f083001d53e
- each executable contains reuse relations with 12.6 production OSS libraries on average
  ls-type:: annotation
  hl-page:: 1
  hl-color:: purple
  id:: 63626e99-4840-47d9-a492-27cb3c6ce474
- SOTA BSA solutions
  ls-type:: annotation
  hl-page:: 1
  hl-color:: purple
  id:: 63626eae-3afb-43c1-a8d9-2527f8b60466
- composition searc
  ls-type:: annotation
  hl-page:: 2
  hl-color:: green
  id:: 63626ed9-b973-4a1e-923e-552a97e55f11
- We find that BSCA has distinct requirement than standard BSA, for which the latter case may overly emphasize the necessity of precisely extracting program semantics
  ls-type:: annotation
  hl-page:: 2
  hl-color:: purple
  id:: 63626f5c-a03a-4594-9fba-2809976fd577
- identifying the exact version of OSS libraries is very challenging.
  ls-type:: annotation
  hl-page:: 2
  hl-color:: purple
  id:: 63626f73-9dc0-4ebe-83f8-4a63dc6e375e
- e design three low-cost and highly effective enhancement strategies from different perspectives to enhance BSA for BSCA
  ls-type:: annotation
  hl-page:: 2
  hl-color:: purple
  id:: 63626f8a-156d-4221-a4d7-6a294731413d
- We aim to assess advanced BSA solutions in their usage of BSCA, a highly demanding yet under-explored application field.
  ls-type:: annotation
  hl-page:: 2
  hl-color:: purple
  id:: 63626ffb-64b4-4ada-869a-3f5dceb7523d
- We conduct the first comprehensive study in bridging BSA solutions to BSCA
  ls-type:: annotation
  hl-page:: 2
  hl-color:: purple
  id:: 6362700f-5e6a-48d0-9b0d-3af87c0a4a9e
- we design three enhancement strategies, where each of them (and their combination) can significantly enhance the effectiveness of BSA solutions in BSCA, outperforming the commercial BSCA software.
  ls-type:: annotation
  hl-page:: 2
  hl-color:: purple
  id:: 6362702b-57c3-4781-bd4f-f65dbb18d4d9
- Software Composition Analysis (SCA)
  ls-type:: annotation
  hl-page:: 2
  hl-color:: green
  id:: 6362705c-d05f-4d67-af6a-d0ceb83c69b3
- developers can address security risks from known vulnerabilities and license issues
  ls-type:: annotation
  hl-page:: 2
  hl-color:: green
  id:: 636270d2-a302-4eb2-8c7f-2cac399441f0
- uncovered
  ls-type:: annotation
  hl-page:: 2
  hl-color:: red
  id:: 63627110-f7e5-428f-8622-18063c812521
- inary executables (i.e., BSCA
  ls-type:: annotation
  hl-page:: 2
  hl-color:: green
  id:: 63627131-f61c-457a-a71d-0ed14c5b43d2
- ① Component Dissection.
  ls-type:: annotation
  hl-page:: 2
  hl-color:: green
  id:: 63627164-d2fa-4229-9846-75f75668e2a2
- ② Component Search.
  ls-type:: annotation
  hl-page:: 2
  hl-color:: green
  id:: 63627167-8a28-4c2c-a405-c2f93324124d
- we need to decide the similarity between c and records in Doss
  ls-type:: annotation
  hl-page:: 2
  hl-color:: purple
  id:: 6362717a-fd45-4734-82f6-da677d33ce8d
- A component c, however, should not be matched to any ossi ∈ Doss if it is a user-written code; user-written code is referred to as “custom code” in Fig. 1.
  ls-type:: annotation
  hl-page:: 2
  hl-color:: purple
  id:: 6362718f-9831-4de6-8ba4-46809a7c8b2c
- ③ Valuable Information Identification. 
  ls-type:: annotation
  hl-page:: 2
  hl-color:: green
  id:: 63627196-cd1c-4a2b-ad71-132ab73a5ffd
- the mapping rules are often assumed to be available in a “valuable information database”
  ls-type:: annotation
  hl-page:: 3
  hl-color:: purple
  id:: 636271d1-7f3f-4935-89b8-c167197e4d14
- 2) SCA metrics: 
  ls-type:: annotation
  hl-page:: 3
  hl-color:: blue
  id:: 636271d4-9a00-47e5-a3c1-5e61d3f07448
  hl-stamp:: 1667396068531
- 1) SCA Overview:
  ls-type:: annotation
  hl-page:: 2
  hl-color:: blue
  id:: 636271e2-35d3-4164-8683-854daf41e7b4
- we need to prepare a ground-truth dataset R∗ from input software to benchmark SCA techniques.
  ls-type:: annotation
  hl-page:: 3
  hl-color:: green
  id:: 6362720c-e7cd-4749-b499-bdb465e55f6a
- it becomes much harder for executable files compiled from C/C++ programs, where most meta information is absent. In fact, one of our contributions in this work is to build a comprehensive real-world dataset for BSCA benchmark; 
  ls-type:: annotation
  hl-page:: 3
  hl-color:: purple
  id:: 63627249-50ea-4133-8ebb-caec8f275abd
- reverse engineering Android apps is deemed as much simpler comparing with decompiling x86 executables compiled from C/C++ code. 
  ls-type:: annotation
  hl-page:: 3
  hl-color:: green
  id:: 63627285-44e3-47fd-a84a-50c53e204a6b
- he available information in launching SCA for Android APKs is richer. 
  ls-type:: annotation
  hl-page:: 3
  hl-color:: green
  id:: 6362728d-64e4-4137-837c-8ebb55ac28e8
- Decompiling C/C++ executable is much harder, and recovering those high-level information (e.g., class inheritance dependencies) is not well addressed yet [64]. 
  ls-type:: annotation
  hl-page:: 3
  hl-color:: green
  id:: 636272a4-f642-488a-a357-9201eb25f73a
- BSA decides how similar they are. The similarity is usually a score ranging from 0 to 1.
  ls-type:: annotation
  hl-page:: 3
  hl-color:: purple
  id:: 636272c4-f501-4c90-a143-f726c78eed5f
- Overall, given two pieces of code
  ls-type:: annotation
  hl-page:: 3
  hl-color:: purple
  id:: 636272ca-4811-4c8b-b2a1-7edf777e65c7
- we can merely find six tools(i.e., BAT [43], OSSPolice [36], FIBER [79], B2SFinder [76], CodeCMR [75] and XLIR [40]) aiming at B2S.
  ls-type:: annotation
  hl-page:: 3
  hl-color:: green
  id:: 636272e6-03a5-4fb7-a414-2ba0b36d7122
- 1) binary-to-binary
  ls-type:: annotation
  hl-page:: 3
  hl-color:: blue
  id:: 636272ee-e2b1-4c01-88fd-4e7b7881b288
- 2) binary-to-source
  ls-type:: annotation
  hl-page:: 3
  hl-color:: blue
  id:: 636272f2-f3bc-4239-bd15-c89b4a8b2800
- Advantages of B2S for BSCA.
  ls-type:: annotation
  hl-page:: 3
  hl-color:: blue
  id:: 6362733e-9f93-436b-93fd-683ffa272c2c
- BSCA is envisioned to analyze hundreds of OSS projects with various dependencies and compilation toolchains required. Therefore, compiling all OSS projects requires enormous resources and considerable manual effort. 
  ls-type:: annotation
  hl-page:: 3
  hl-color:: purple
  id:: 6362736b-3a5c-4db4-aaca-c79adcc712c7
- Hence, it appears a dilemma to use either B2B or B2S in BSCA
  ls-type:: annotation
  hl-page:: 3
  hl-color:: purple
  id:: 6362739d-1e52-41b0-9a25-2a1b9c35cbb7
- Motivation. There is a high demand of performing accurate and dependable BSCA, envisioning the practical need of analyzing closed-source software and track any (unsafe or outdated) opensource component brought into executabl
  ls-type:: annotation
  hl-page:: 3
  hl-color:: green
  id:: 63627962-5888-4a42-9e69-abbc078fc211
- we believe that the academy and our community lack a systematic and in-depth understanding to calibrate the technical solution and uncover the best practical of performing BSCA. This motivates our study in this paper.
  ls-type:: annotation
  hl-page:: 4
  hl-color:: green
  id:: 63627979-8692-4bf9-9992-6af06fb92945
- assembly functions should form the “components” in an executable.
  ls-type:: annotation
  hl-page:: 4
  hl-color:: green
  id:: 63627c1a-c4ad-4bf6-9c5b-47f1d5d57f9e
- unctions as the components
  ls-type:: annotation
  hl-page:: 4
  hl-color:: yellow
  id:: 63627c28-fdf8-49e3-acd4-43717d5bda68
- ① Component Dissection
  ls-type:: annotation
  hl-page:: 4
  hl-color:: blue
  id:: 63627c9f-ab5f-458d-84aa-1233f293c510
- ② Component Identification
  ls-type:: annotation
  hl-page:: 4
  hl-color:: blue
  id:: 63627ca2-6780-4444-b80e-12f28afec187
- a Clustering-based detection,
  ls-type:: annotation
  hl-page:: 4
  hl-color:: green
  id:: 63627d1c-e4b0-4b42-9320-f2a6d957bc33
- b Similarity-based detection
  ls-type:: annotation
  hl-page:: 4
  hl-color:: green
  id:: 63627d27-7585-4a78-83d2-4a8380fcf26d
- de facto SCA methods are primarily based on similarity-based detections.
  ls-type:: annotation
  hl-page:: 4
  hl-color:: green
  id:: 63627d45-e617-4450-aeeb-faf13e7e16e4
- ③ Valuable Information Identification
  ls-type:: annotation
  hl-page:: 4
  hl-color:: blue
  id:: 63627d5a-9a24-443e-a609-1b5f81224aec
- whereas the component identification phase iterate over functions in the input executable and query the databas
  ls-type:: annotation
  hl-page:: 4
  hl-color:: green
  id:: 63627dca-7da3-4692-b293-e353c51004a0
- Selection of B2B solutions
  ls-type:: annotation
  hl-page:: 5
  hl-color:: green
  id:: 63627e68-12b6-456a-8350-334e6e118c26
- CommercialB
  ls-type:: annotation
  hl-page:: 5
  hl-color:: red
  id:: 63627ec4-67be-43d6-ad30-5d42827adbc0
- SAFE and PalmTree
  ls-type:: annotation
  hl-page:: 5
  hl-color:: green
  id:: 63627eda-1065-4980-9ee8-8d660ab2ff3a
- redundancy elimination and code segmentation to reduce the size of the database without undermining the accuracy.
  ls-type:: annotation
  hl-page:: 5
  hl-color:: green
  id:: 63627f03-310b-46fe-bc7a-4772afcefd21
- storing only one copy of such unchanged functions across all versions is sufficient
  ls-type:: annotation
  hl-page:: 5
  hl-color:: green
  id:: 63627f13-5155-4a55-9ab6-c1b87739c4fe
- Redundancy Elimination
  ls-type:: annotation
  hl-page:: 5
  hl-color:: blue
  id:: 63627f2f-f423-4af8-9576-fe854ccb202c
- Code Segmentation
  ls-type:: annotation
  hl-page:: 5
  hl-color:: blue
  id:: 63627f34-30ba-4750-ad5c-6a38021011c6
- Component Identification.
  ls-type:: annotation
  hl-page:: 5
  hl-color:: blue
  id:: 63627f54-e4ce-4ebc-8805-ec05cbe313d8
- When using B2S, we save the effort of compiling OSS projects.
  ls-type:: annotation
  hl-page:: 7
  hl-color:: green
  id:: 63627ff7-8506-476d-9c03-f6d28207f5dd
- BSCA solutions (i.e., BAT and CommercialA) manifest high accuracy, with the achieved F1 scores over 0.4 across all settings
  ls-type:: annotation
  hl-page:: 7
  hl-color:: green
  id:: 63628073-a2b7-4ae9-9b39-69677e460626
- By observing the missing constant−1 (i.e., 0xffffffff of Fig. 3(c)), we could treat function Unref as similar but not reused.
  ls-type:: annotation
  hl-page:: 7
  hl-color:: green
  id:: 63628120-1b3f-4bb5-91e8-1833a296edeb
- Centris 
  ls-type:: annotation
  hl-page:: 7
  hl-color:: green
  id:: 63628130-fc84-43c2-a89f-e597084d4cc2
- 1.45
  ls-type:: annotation
  hl-page:: 7
  hl-color:: green
  id:: 63628138-f050-4def-bee6-b27c1563520c
- BSA solutions are designed to find similar semantics rather than reuse relations.
  ls-type:: annotation
  hl-page:: 7
  hl-color:: green
  id:: 6362815c-e55c-4910-bbe0-27bfc5fdb519
- function-level matching
  ls-type:: annotation
  hl-page:: 8
  hl-color:: green
  id:: 63628199-6ef9-4561-9363-4b3a5bd72a7f
- BSA tools aim at detecting the similarity between pieces of arbitrary assembly function
  ls-type:: annotation
  hl-page:: 8
  hl-color:: yellow
  id:: 63628218-3b82-4e56-8819-1f8409b52987
  hl-stamp:: 1667400219191
- matching every OSS functions may not be needed. Rather, strings may offer a short-cut to match OSS projects, which often use strings to encode OSS names, vendors, and even version information.
  ls-type:: annotation
  hl-page:: 8
  hl-color:: green
  id:: 63628244-94ec-4cdc-aba9-198bd7e3cb73
- IDA pro
  ls-type:: annotation
  hl-page:: 8
  hl-color:: green
  id:: 6362824b-3f48-47e5-bcd8-76e3a4b8956c
- match(f ) has at least one element
  ls-type:: annotation
  hl-page:: 8
  hl-color:: green
  id:: 6362827a-3a39-4d91-beee-a7557e757fd6
- BSA solutions to identify functions of different versions, we rely on string-level signatures to rank the most likely version for each identified OSS project
  ls-type:: annotation
  hl-page:: 9
  hl-color:: green
  id:: 63628330-e831-4455-824b-7727afd3a45a
- string-level signature
  ls-type:: annotation
  hl-page:: 10
  hl-color:: green
  id:: 6362833d-0aca-48c8-9b32-6d9aa93d6288
- functions with potentially high distinguishability
  ls-type:: annotation
  hl-page:: 10
  hl-color:: green
  id:: 63628341-6221-4a48-a03f-59fac3c41e2a
- object file layouts
  ls-type:: annotation
  hl-page:: 10
  hl-color:: green
  id:: 63628346-2e00-484c-a5b2-c221679e02fb
- signature-based SCA
  ls-type:: annotation
  hl-page:: 10
  hl-color:: green
  id:: 63628360-07c0-4bd8-ac80-9f6ab05992a2
- unction-level granularity matching
  ls-type:: annotation
  hl-page:: 10
  hl-color:: green
  id:: 63628373-ac39-44e5-8263-41accb27d85c
- Although we have spent tremendous efforts on labeling the ground truth of the reuse relations, 
  ls-type:: annotation
  hl-page:: 10
  hl-color:: green
  id:: 6362839b-041c-49eb-bff1-843a1894c897
- Binary Software Composition Analysis
  ls-type:: annotation
  hl-page:: 10
  hl-color:: blue
  id:: 636283cb-ff7d-4eb6-8187-b53aa90f53ae
- they discard semantic knowledge and cannot work when the OSS project has few unique strings
  ls-type:: annotation
  hl-page:: 10
  hl-color:: green
  id:: 636283e1-06c2-46ac-b965-8ca3fac83342
- Binary Similarity Analysis
  ls-type:: annotation
  hl-page:: 10
  hl-color:: blue
  id:: 636283ec-de12-44aa-a6ed-c646892a9bb9
- BSCA, a critical application widely needed in security and software re-engineering tasks
  ls-type:: annotation
  hl-page:: 10
  hl-color:: green
  id:: 63628406-8417-428b-b2d9-a3bdfd368877
- were incapable in version identification
  ls-type:: annotation
  hl-page:: 10
  hl-color:: yellow
  id:: 63628422-490c-49fb-b91d-e53699218c2e
- We then proposed optimization tactics from three aspects, which largely improved the accuracy of OSS identification with moderate cost
  ls-type:: annotation
  hl-page:: 10
  hl-color:: yellow
  id:: 6362842c-c66a-4391-a7aa-159b922d3e5d