Inter-BIN: Interaction-Based Cross-Architecture IoT Binary Similarity Comparison

The big wave of Internet Things (IoT) malware reflects the fragility current IoT ecosystem. Research has found that can spread quickly on devices different processer architectures, which leads our attention to cross-architecture binary similarity comparison technology. goal is determine whether semantics two snippets similar. Existing learning-based approaches usually learn representations code individually and perform matching based distance metric, without considering inter-binary semantic interactions. Moreover, they often rely large-scale external corpus for instruction embeddings pre-training, heavyweight easy suffer out-of-vocabulary (OOV) problem. In this paper, we propose an interaction-based system, Inter-BIN. Our key insight introduce interaction between sequences by co-attention mechanism, flexibly soft alignment semantically related instructions from architectures. And design a lightweight multi-feature fusion-based embedding method, avoid heavy workload OOV problem previous approaches. Extensive experiments show Inter-BIN significantly outperform state-of-the-art tasks input granularities. Furthermore, present function dataset real network environments, CrossMal, containing 1,878,437 reuse pairs. Experimental results CrossMal prove practical scalable real-world collections.