PreFilter: Enhancing the Efficiency of Binary Code Similarity Detection by Efficient Prefiltration
摘要
Binary code similarity detection is crucial in security applications. Recent studies have shown that deep learning-based methods have made significant progress. However, they face inherent efficiency bottlenecks due to their computational demands and large-scale data processing overhead in function-level similarity comparisons. To address this issue, we propose a pre-filtering method named PreFilter that aims to reduce the data scale of functions waiting for detection. This method consists of two key steps. First, the PreFilter features of all the functions in the function pool are extracted. Second, the PreFilter features are normalized as vectors, used to compute the similarity and obtain the top M functions for a fine-grained comparison. Among them, the selection of PreFilter features is a step that we carefully design. It consists mainly of two key steps. First, several initial features are extracted from the binary code of the function, and then these features are evaluated and ranked according to ANOVA and MAE. Second, the top P features are chosen to represent the functions, where P is determined by balancing feature representation capability and extraction time. In addition, a novel evaluation metric, FRecall is introduced to calculate the retention rate of actual vulnerability functions during pre-filtering. The cross-architecture Firm-Vul dataset is developed to evaluate our method in real firmware vulnerability detection scenarios. The evaluation results demonstrate that the state-of-the-art methods, when incorporating PreFilter, maintain the MRR, while the search efficiency of the function is 2.4× faster. In the vulnerability search task, the search efficiency is improved by 2.19×.