PaperlayerView exact revision on arXiv

Source-linked AI summary

BinMLM: Binary Authorship Verification with Flow-aware Mixture-of-Shared Language Model

Qige Song, Yongzheng Zhang, Linshu Ouyang, Yige Chen

arXiv:2203.04472v1cs.SE

TL;DR

Binary authorship verification asks whether an anonymous binary belongs to a specified programmer using few support samples, including cases where the true developer is unknown. BinMLM models flow-aware opcode traces with shared language-model components and author-specific gates. It outperforms state-of-the-art feature baselines across datasets, remains robust to collaboration, and supports organization-level APT verification.

Abstract

from arXiv · show

Binary authorship analysis is a significant problem in many software engineering applications. In this paper, we formulate a binary authorship verification task to accurately reflect the real-world working process of software forensic experts. It aims to determine whether an anonymous binary is developed by a specific programmer with a small set of support samples, and the actual developer may not belong to the known candidate set but from the wild. We propose an effective binary authorship verification framework, BinMLM. BinMLM trains the RNN language model on consecutive opcode traces extracted from the control-flow-graph (CFG) to characterize the candidate developers' programming styles. We build a mixture-of-shared architecture with multiple shared encoders and author-specific gate layers, which can learn the developers' combination preferences of universal programming patterns and alleviate the problem of low training resources. Through an optimization pipeline of external pre-training, joint training, and fine-tuning, our framework can eliminate additional noise and accurately distill developers' unique styles. Extensive experiments show that BinMLM achieves promising results on Google Code Jam (GCJ) and Codeforces datasets with different numbers of programmers and supporting samples. It significantly outperforms the baselines built on the state-of-the-art feature set (4.73% to 19.46% improvement) and remains robust in multi-author collaboration scenarios. Furthermore, BinMLM can perform organization-level verification on a real-world APT malware dataset, which can provide valuable auxiliary information for exploring the group behind the APT attack.

I. INTRODUCTION

The paper frames binary authorship as open-world verification with limited support samples, reflecting software-forensic practice. It addresses prior methods' dependence on manual, dataset-specific features and abundant labeled data, while accounting for collaborative development.

A. Background and Motivation

B. Limitation of Prior Art

A. Background and Motivation

  • Collaborative development introduces code from multiple programmers, creating noise for major-contributor identification and complicating organization-level verification.Source: A. Background and Motivation · p. 1

B. Limitation of Prior Art

  • Existing approaches commonly assume a closed candidate set, limiting their ability to handle developers outside that set, especially with many candidates and few samples.Source: B. Limitation of Prior Art · pp. 1–2

C. Proposed Method

BinMLM formulates binary authorship as verification against a specific candidate while allowing the actual developer to come from outside the candidate set. It combines flow-aware language modeling, shared encoders with author-specific gates, and staged optimization to characterize individual styles under limited data and collaboration.

C. Proposed Method

  • Joint training followed by author-specific fine-tuning reduces collaboration noise and isolates unique stylistic characteristics.Joint training learns general patterns, whereas fine-tuning improves major-author characterization in multi-programmer scenarios.Source: C. Proposed Method · p. 2, D. Key Contributions · p. 2

II. PROBLEM DEFINATION

C. Proposed Method

  • Flow-aware RNN language models characterize programming style from consecutive opcode traces while avoiding manual feature engineering.The traces preserve control-flow information through CFG basic-block bi-grams.Source: D. Key Contributions · p. 2, C. Proposed Method · p. 2
  • Multiple shared encoders model universal programming patterns, while author-specific gates learn each developer’s combination preferences from limited samples.This sharing mechanism addresses the insufficient-data problem of separate author models.Source: D. Key Contributions · p. 2, C. Proposed Method · p. 2

D. Key Contributions

  • Experiments report AUC = 0.83 ∼0.94 and 4.73% ∼19.46% improvement over state-of-the-art feature-set baselines, with robustness to collaboration and organization-level APT verification.Source: D. Key Contributions · p. 2

III. PRELIMINARIES

The preliminary model uses an RNN language model to represent opcode-sequence context and predict subsequent units. Its mixture-of-shared architecture combines shared views of generic programming patterns with author-specific weighting and decoding.

A. RNN Language Model

  • The RNN language model embeds instruction-sequence units, encodes preceding context, and uses a softmax decoder to predict the next unit.Training minimizes cross-entropy between predicted and ground-truth distributions.Source: A. RNN Language Model · p. 3

B. Mixture-of-Shared Network Architecture

  • The model is motivated by the limited operation types and strict syntax of programming languages, which make personal style a combination of universal patterns.Source: B. Mixture-of-Shared Network… · p. 3
  • The mixture-of-shared network trains candidate authors simultaneously using multiple shared RNN encoders that model generic programming patterns from different perspectives.Shared layers improve generalization for low-resource programmers.Source: B. Mixture-of-Shared Network… · pp. 3–4
  • Author-specific gate layers assign importance weights to shared representations, which are combined and passed to each programmer’s independent decoder.This architecture represents each developer’s preference for combining common programming patterns.Source: B. Mixture-of-Shared Network… · p. 3

IV. PROPOSED METHOD

BinMLM characterizes programming style from binary files through language modeling and combines four modules: flow-aware preprocessing, external pre-training, candidate-style modeling, and verification.

A. Overview

  • BinMLM disassembles binaries into control-flow-aware opcode traces and uses opcode n-grams as units for programming-style characterization.This preprocessing is shared by the subsequent modules.Source: A. Overview · p. 4
  • External pre-training initializes subsequent models with a general language model trained on a large unlabeled corpus of wild binary files.Source: A. Overview · p. 4
  • The candidate-style module uses shared encoders with author-specific gates and decoders to train language models for all candidate programmers.Source: A. Overview · p. 4
  • The optimization pipeline jointly trains shared and author-specific parameters, then fine-tunes separate decoders with additional regularization.Source: A. Overview · p. 4
  • Verification evaluates an anonymous binary under each candidate programmer’s language model and normalizes its losses into a final verification score.Source: A. Overview · p. 4

B. Binary File Pre-processing

The preprocessing module preserves control-flow information while converting binaries into compact opcode n-gram sequences, which an RNN language model uses to characterize developer style.

B. Binary File Pre-processing

1) Process disassembly code:

  • Operands are removed and only opcodes are retained, reducing vocabulary size and improving versatility across compilation environments.Source: B. Binary File Pre-processing · p. 4
  • A fixed-size sliding window converts opcode sequences into n-grams, accommodating the uncertain number of assembly instructions compiled from each source statement.Opcode traces can reflect programming patterns expressed by short source-code statements.Source: 1) Process disassembly code · pp. 4–5

2) Build language model for binaries:

  • An RNN language model encodes preceding opcode n-gram context and predicts subsequent units to characterize developer programming style.Predicting units multiple hops ahead was found to produce more distinguishable author-specific styles.Source: 2) Build language model for binaries · p. 5

C. External Language Model Pre-training

BinMLM addresses limited author data by pretraining shared language-model components, learning author-specific mixtures of common patterns, and regularizing decoder fine-tuning.

1) Mixture-of-shared language model:

  • Multiple shared RNN encoders model common programming patterns from different views, while each author’s gate learns a personalized combination of those representations.An independent decoder predicts subsequent units from the mixed representation using the author’s own samples.Source: 1) Mixture-of-shared language model · p. 5

C. External Language Model Pre-training

2) Optimization pipeline:

  • Joint training learns generic and author-specific patterns, after which shared layers and gates are frozen while each decoder is fine-tuned separately.The pipeline is intended to exploit limited samples and distill unique styles from common patterns.Source: 2) Optimization pipeline · p. 6

3) Regularization of specific-decoders:

  • Decoder regularization uses pairwise parameter similarity to constrain author-specific models and reduce overfitting on inadequate training data.The regularization is computed with L1 distances between decoder parameters and added to the overall language-model loss.Source: 3) Regularization of specific-decoders · p. 6

E. Binary Authorship Verification

Binary authorship verification scores whether an anonymous binary matches a candidate programmer by comparing its losses across candidate language models, within an evaluation program covering benchmark and collaboration settings.

E. Binary Authorship Verification

  • Verification preprocesses the anonymous binary like training data, then feeds its control-flow-aware opcode n-grams into the trained mixture-of-shared models.Source: E. Binary Authorship Verification · p. 6
  • The method jointly uses the loss under the queried programmer’s model and the binary’s loss array across all candidate models.A relatively small queried-programmer loss indicates greater likelihood of authorship.Source: E. Binary Authorship Verification · p. 6
  • The verification score normalizes the queried loss using the average and variance of losses across candidate programmers.Source: E. Binary Authorship Verification · p. 6

V. EVALUATION

  • The evaluation covers baseline comparisons, varying candidate and sample counts, component analysis, multi-programmer collaboration, and organization-level APT malware verification.Source: §V · p. 6

A. Experiment Setup

The experiments use GCJ, Codeforces, and APT-Malware data with candidate sets, limited support samples, and open-world negative pairs. BinMLM is evaluated with threshold-independent metrics against similarity- and confidence-based baselines.

1) Datasets:

  • GCJ, Codeforces, and APT-Malware provide competition, online-judge, and real-world APT malware samples for evaluation.Source: 1) Datasets · p. 6
  • Each candidate set contains N programmers with m labeled support binaries, while negative pairs include both known-candidate and previously unseen developers.Source: 1) Datasets · p. 6

2) Evaluation metrics:

1) Comparision with Baselines:

2) Performance under different numbers of programmers:

BinMLM remains effective as candidate populations and support-sample conditions become more difficult. Its advantage persists with large candidate sets and only five support binaries.

2) Performance under different numbers of programmers:

3) Performance under different numbers of binary sapmles:

C. Ablation studies of BinMLM

Ablations support the contributions of longer opcode contexts, multi-hop prediction, shared architecture, optimization, and regularization. Additional tests show robustness to collaborator noise and organization-level APT verification.

C. Ablation studies of BinMLM

  • Opcode n-gram performance rises with n from 1 to 5, with only slight improvement beyond 5; prediction across more hops also improves verification.The selected configuration uses n = 5 and three hops.Source: C. Ablation studies of BinMLM · p. 8
  • The mixture-of-shared architecture, optimization pipeline, and regularization loss each significantly improve BinMLM over its variant models across three datasets.Source: C. Ablation studies of BinMLM · pp. 8–9, Table IV · p. 9

D. Robutness on multi-programmer collaboration datasets

  • AUC-ROC remains above 0.8 under collaborator mixing, while performance declines by only 0.0306 to 0.0564 as collaborator proportions increase.BinMLM remains ahead of similarity- and classifier-confidence baselines under every collaboration setting.Source: D. Robutness on multi-programmer… · p. 9, Table V · p. 9

E. Case study in a real-world scenario

VI. RELATED WORK

Prior work studies authorship in source code, binaries, and text, but binary methods often depend on dataset-specific manual features. BinMLM addresses binary verification with shared language models and reports broad robustness in its conclusion.

A. Source code authorship analysis

B. Binary authorship analysis

  • Binary authorship research includes CFG graphlets, programming choices, disassembly and decompiled-code features, basic-block analysis, and deep CNN models.Source: B. Binary authorship analysis · p. 10

C. Text authorship analysis

  • Text authorship work uses character- and POS-level language models, gated decoding, open-world stylometry, and PAN competition settings.Source: C. Text authorship analysis · p. 10

VII. CONCLUSION

  • BinMLM trains author-specific language models on flow-aware opcode n-grams, combines shared encoders with author-specific preferences, and uses optimization to isolate unique styles.Source: §VII · p. 10
  • BinMLM surpasses state-of-the-art-feature baselines, remains robust under multi-programmer collaboration, and supports organization-level verification on real-world APT malware.Source: §VII · p. 10
Loading 2203.04472v1…