BinOpLeR: Optimization level recovery from binaries based on rich semantic instruction image and weighted voting

Abstract

Context:

Compiler toolchain differences result in binary code diversity, wherein the impacts of different optimization levels on binary code severely constrains the performance improvement of software security detection tasks such as malware detection, software copyright protection, and vulnerability homology detection. However, binaries compiled with different optimization levels often contain numerous identical or similar code fragments, posing severe challenges to recovering the optimization levels from binaries.

Objective:

The existing optimization level detection methods based on statistical features have poor generalization capabilities, and those based on automated learning have low detection accuracy due to using coarse-grained instruction normalization. To improve accuracy and generalization capabilities, this paper proposes BinOpLeR, a binary optimization level recovery method based on rich semantic instruction images and weighted voting.

Method:

In this paper, we perform fine-grained normalization on disassembly instructions to retain the elements that reflect instruction semantics and code execution characteristics, and utilize the mappings from the ASCII code values of assembly codes to pixel grayscale values to convert functions into grayscale images. Then, a balanced dataset is constructed using the grayscale images of functions to train a convolutional neural network model with adaptive pooling to capture optimization level-related features. Finally, a weighted voting scheme that incorporates prediction probabilities and function lengths is innovatively introduced to infer the optimization levels of binaries.

Results:

We evaluate the performance of BinOpLeR on the public dataset of ARM and MIPS binaries using precision, accuracy, recall and F1 score. The results show that BinOpLeR outperforms the comparison methods in prediction performance.

Conclusion:

The findings indicate that: BinOpLeR effectively improves the accuracy of the optimization levels recovery from binaries. It exhibits stable performance across different compiler versions. The granularity and normalization significantly influence feature extraction, and function lengths along with prediction probabilities are crucial factors in inferring the optimization level of binaries.