Similarity Based Binary Backdoor Detection via Attributed Control Flow Graph

The problem of backdoor detection aims at detecting whether binary backdoor functions coming from different embedded end devices are similar to some known backdoors. Existing approaches are using backdoor signature or approximate graph-matching algorithms. They all meet a problem that they are hard to adapt to a new task. Also, approximate graph-matching algorithms are inevitably slow and sometimes inaccurate. To address these issues, in this work, we propose a novel neural network-based approach to compute the embedding, i.e., a numeric vector, based on the control flow graph of each binary function, then the backdoor detection can be done efficiently by measuring the distance between the embeddings for functions in firmware and typical backdoor functions. We evaluate this method can achieve a F-1 score of 0.75 and detect backdoor in firmware significantly faster than graph-matching method.