Binary Code Similarity Detection by Fusing Graph Attention Network and Abstract Syntax Tree

Since the introduction of deep learning-based binary code similarity detection methods, there has been a proliferation of methods using graph neural networks to learn semantic information from intermediate representations such as control flow graphs. Graph Attention Network (GAT) is a graph neural network model based on the attention mechanism, the core idea of which is to dynamically aggregate information from adjacent nodes by adaptively learning the importance weights between nodes in the graph, which can enhance the training effect of the model by incorporating the attention mechanism. The structured representation advantage of Abstract Syntax Trees (AST) is reflected in the hierarchical decomposition of program syntax structures, which effectively captures the logical semantics and contextual dependencies of the code, a feature that makes AST robust against the obfuscation of cross-architecture binary code. However, there has not yet been an approach that fuses graph attention networks and abstract syntax trees in the field of binary code similarity detection, so we propose a cross-architecture binary code similarity detection approach that fuses abstract syntax trees and graph attention networks. We use the open-source dataset provided by Asteria, decompile the binary code using the binary analysis tool IDA pro to extract the abstract syntax tree as the feature source of the neural network, and deeply optimize GAT for the limitations of processing tree data structure to improve its ability to learn the semantic information of AST. We trained TreeLSTM, plain GAT, and deeply optimized GAT neural network models respectively, and compared them. The experimental results show that the training speed of our proposed method is improved by 54.63% compared to the TreeLSTM-based method, and the AUC and Accuracy metrics are basically comparable.