The Need

Security teams increasingly need to identify related or vulnerable code across large collections of compiled software and firmware. This is difficult because compilation strips away source-level information, while different compilers, optimization settings, and processor architectures can make functionally similar code appear very different. Existing techniques may also suffer from scalability, incomplete code coverage, or machine-learning models that perform poorly on binaries outside their training distribution, limiting reliable large-scale analysis.

The Technology

OSU engineers have developed a non-machine-learning approach for function-level binary code similarity analysis. Rather than relying primarily on assembly-code embeddings, it derives compact semantic fingerprints from meaningful computational values present in binary code while filtering information that is unlikely to reflect core functionality. These fingerprints enable efficient comparison across large binary collections and are designed to remain useful despite changes in compiler, optimization strategy, function inlining, or processor architecture.

Commercial Applications

• Vulnerability detection: locate known vulnerable functions in software and firmware.
• Software supply-chain security: identify reused or related binary components at scale.
• Malware analysis: detect functionally similar code despite differences in compiled representation.
• Software provenance and clone detection: identify related binary functions when source code is unavailable.

Benefits/Advantages

• Robust similarity detection: demonstrated strong performance across compiler and optimization differences.
• No model training required: avoids dependence on a fixed machine-learning training distribution.
• Efficient at scale: designed for rapid retrieval from large binary collections without expensive pairwise theorem proving.
• Cross-architecture capability: demonstrated similarity analysis across multiple processor architectures and real-world firmware.