Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

BinCoFer: Three-Stage Purification for Effective C/C++ Binary Third-Party Library Detection

Yayi Zou, Yixiang Zhang, Guanghao Zhao, Yueming Wu, Shuhao Shen, Cai Fu

TL;DR

BinCoFer tackles the challenge of detecting C/C++ third-party library reuse in binary software without source code. It introduces a two-stage pipeline: (i) building a function-level TPL feature repository via BCSD-based embeddings and a three-stage purification to highlight core functions, and (ii) detecting reuse by a weighted aggregation of function similarities rather than a fixed threshold. The method shows strong precision (0.893) and competitive recall (0.649) on an ArchLinux dataset, outperforming four baselines and reducing detection time by up to 99.7%. A TF-IDF-like weighting of core and common functions, plus an explicit handling of partial reuse, enables robust binary-to-binary TPL detection in the absence of source code. The work also provides a new ground-truth dataset to support future research in binary SCA and partial-TPL reuse scenarios.

Abstract

Third-party libraries (TPL) are becoming increasingly popular to achieve efficient and concise software development. However, unregulated use of TPL will introduce legal and security issues in software development. Consequently, some studies have attempted to detect the reuse of TPLs in target programs by constructing a feature repository. Most of the works require access to the source code of TPLs, while the others suffer from redundancy in the repository, low detection efficiency, and difficulties in detecting partially referenced third-party libraries. Therefore, we introduce BinCoFer, a tool designed for detecting TPLs reused in binary programs. We leverage the work of binary code similarity detection(BCSD) to extract binary-format TPL features, making it suitable for scenarios where the source code of TPLs is inaccessible. BinCoFer employs a novel three-stage purification strategy to mitigate feature repository redundancy by highlighting core functions and extracting function-level features, making it applicable to scenarios of partial reuse of TPLs. We have observed that directly using similarity threshold to determine the reuse between two binary functions is inaccurate, a problem that previous work has not addressed. Thus we design a method that uses weight to aggregate the similarity between functions in the target binary and core functions to ultimately judge the reuse situation with high frequency. To examine the ability of BinCoFer, we compiled a dataset on ArchLinux and conduct comparative experiments on it with other four most related works (i.e., ModX, B2SFinder, LibAM and BinaryAI)...

BinCoFer: Three-Stage Purification for Effective C/C++ Binary Third-Party Library Detection

TL;DR

BinCoFer tackles the challenge of detecting C/C++ third-party library reuse in binary software without source code. It introduces a two-stage pipeline: (i) building a function-level TPL feature repository via BCSD-based embeddings and a three-stage purification to highlight core functions, and (ii) detecting reuse by a weighted aggregation of function similarities rather than a fixed threshold. The method shows strong precision (0.893) and competitive recall (0.649) on an ArchLinux dataset, outperforming four baselines and reducing detection time by up to 99.7%. A TF-IDF-like weighting of core and common functions, plus an explicit handling of partial reuse, enables robust binary-to-binary TPL detection in the absence of source code. The work also provides a new ground-truth dataset to support future research in binary SCA and partial-TPL reuse scenarios.

Abstract

Third-party libraries (TPL) are becoming increasingly popular to achieve efficient and concise software development. However, unregulated use of TPL will introduce legal and security issues in software development. Consequently, some studies have attempted to detect the reuse of TPLs in target programs by constructing a feature repository. Most of the works require access to the source code of TPLs, while the others suffer from redundancy in the repository, low detection efficiency, and difficulties in detecting partially referenced third-party libraries. Therefore, we introduce BinCoFer, a tool designed for detecting TPLs reused in binary programs. We leverage the work of binary code similarity detection(BCSD) to extract binary-format TPL features, making it suitable for scenarios where the source code of TPLs is inaccessible. BinCoFer employs a novel three-stage purification strategy to mitigate feature repository redundancy by highlighting core functions and extracting function-level features, making it applicable to scenarios of partial reuse of TPLs. We have observed that directly using similarity threshold to determine the reuse between two binary functions is inaccurate, a problem that previous work has not addressed. Thus we design a method that uses weight to aggregate the similarity between functions in the target binary and core functions to ultimately judge the reuse situation with high frequency. To examine the ability of BinCoFer, we compiled a dataset on ArchLinux and conduct comparative experiments on it with other four most related works (i.e., ModX, B2SFinder, LibAM and BinaryAI)...
Paper Structure (29 sections, 8 equations, 7 figures, 6 tables)

This paper contains 29 sections, 8 equations, 7 figures, 6 tables.

Table of Contents

  1. Introduction
  2. Background
  3. Related Work
  4. Third Party Library Detection
  5. Binary Code Similarity Detection
  6. Definition
  7. Third Party Library
  8. Core Functions
  9. Simple Functions
  10. Common Functions
  11. Methodology
  12. Overview
  13. TPL Feature Repository Generation
  14. Feature Extraction
  15. Repository Purification
  16. ...and 14 more sections

Figures (7)

  • Figure 1: TPL Feature Repository Generation Overview
  • Figure 2: Control Flow Graph (CFG) of two functions in libasn1.so.8.0.0
  • Figure 3: TPL Detection Overview
  • Figure 4: Similarity Distribution of same and different function pairs detected by the models before and after fine-tuning with jTrans
  • Figure 5: The heatmap of Precision as $\theta_1$ and $\theta_2$ vary with fixed values of $\theta_3$ = 0.89
  • ...and 2 more figures