Similarity Based Binary Backdoor Detection via Attributed Control Flow Graph

摘要: The problem of backdoor detection aims at detecting whether binary functions coming from different embedded end devices are similar to some known backdoors. Existing approaches using signature or approximate graph-matching algorithms. They all meet a that they hard adapt new task. Also, algorithms inevitably slow and sometimes inaccurate. To address these issues, in this work, we propose novel neural network-based approach compute the embedding, i.e., numeric vector, based on control flow graph each function, then can be done efficiently by measuring distance between embeddings for firmware typical functions. We evaluate method achieve F-1 score 0.75 detect significantly faster than method.