Binary code similarity detection (BCSD) is critical in enhancing software security. Recent research indicates that deep learning approaches have achieved notable advancements. However, existing methods lack interpretability. They typically provide only a direct similarity score between two functions, without any explanatory rationale. Although large-scale models can provide result explanations, their deployment is costly. Online usage consumes tokens through API and risks exposing sensitive corporate data. Alternatively, local deployment requires expensive hardware resources. To address this issue, we employ LoRA to fine-tune a model, named Fine-Tune Model (FTM), only 33B, which can generate similarity labels and explanations for similarity analysis. These interpretative analyses play an important role in the analysis and repair of potential vulnerabilities for security personnel. Our approach consists of three steps. First, we use Deepseek-Chat to generate an interpretable dataset for model fine-tuning. Second, we perform LoRA-based fine-tuning on the Deepseek-Coder-33B-base using the interpretable dataset, obtaining a domain-specific model named FTM. Finally, users can input the assembly code of two functions into FTM. Combined with our carefully designed prompt, FTM predicts similarity labels and provides an interpretable analysis. Experimental results indicate that FTM performs similarly to Deepseek-Chat in BCSD, validating the successful distillation of the model. FTM outperforms all state-of-the-art (SOTA) methods in terms of AUC. In the vulnerability search task, FTM successfully predicted 7 similarity labels out of 10 cases.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Balancing Interpretability and Cost in Binary Code Similarity Detection by LLM Distillation

  • Yanlin Li,
  • Taiyan Wang,
  • Lu Yu,
  • Qiangpu Chen,
  • Yuwei Li,
  • Zulie Pan

摘要

Binary code similarity detection (BCSD) is critical in enhancing software security. Recent research indicates that deep learning approaches have achieved notable advancements. However, existing methods lack interpretability. They typically provide only a direct similarity score between two functions, without any explanatory rationale. Although large-scale models can provide result explanations, their deployment is costly. Online usage consumes tokens through API and risks exposing sensitive corporate data. Alternatively, local deployment requires expensive hardware resources. To address this issue, we employ LoRA to fine-tune a model, named Fine-Tune Model (FTM), only 33B, which can generate similarity labels and explanations for similarity analysis. These interpretative analyses play an important role in the analysis and repair of potential vulnerabilities for security personnel. Our approach consists of three steps. First, we use Deepseek-Chat to generate an interpretable dataset for model fine-tuning. Second, we perform LoRA-based fine-tuning on the Deepseek-Coder-33B-base using the interpretable dataset, obtaining a domain-specific model named FTM. Finally, users can input the assembly code of two functions into FTM. Combined with our carefully designed prompt, FTM predicts similarity labels and provides an interpretable analysis. Experimental results indicate that FTM performs similarly to Deepseek-Chat in BCSD, validating the successful distillation of the model. FTM outperforms all state-of-the-art (SOTA) methods in terms of AUC. In the vulnerability search task, FTM successfully predicted 7 similarity labels out of 10 cases.