Artifacts - Scalable Program Clone Search through Spectral Analysis

Summary

We focus on the problem of program clone search, which involves finding the program in a repository most similar to a target program. Program clone search has important applications, including malware detection and program clustering.

In solving this problem, the inherent workflow involves disassembly, feature extraction (or preprocessing), clone searches, and subsequent generation of tables.

A good similarity metric is crucial to finding the repository's closest program. It has to be precise and robust even in cross-architecture scenarios and fast even when dealing with huge repositories. This artifact encompasses 21 distinctive clone search methods. Each method is different, and therefore, their workflow may be slightly different. Overall, the artifact is a purposely-built framework for clone search method comparison. It is easily extensible and can be tweaked to carry out new measurements.

The artifact includes four datasets with vast numbers of programs: Basic (1K), BinKit (96K), IoT (20K), and Windows (85K). Due to the enormous scale of these datasets, this artifact demands significant time consumption. To offer a perspective, the disassembly process on these considerable datasets can take days even when operating on 20 cores. The subsequent steps, such as preprocessing and clone searches, can also demand hundreds of hours. Note that we have gathered 2 TB of disassembled files throughout accumulating this data.

To tackle these time and space constraints, we have ensured that precomputed data are available within this artifact at multiple workflow phases. This enables a quick transition from reproducing one workflow phase to another. However, we could not include all disassembled files, so we mainly focused on the last phases, such as a clone search.

Article

Title: Scalable Program Clone Search through Spectral Analysis

Authors: Tristan Benoit, Jean-Yves Marion, Sébastien Bardin

Conference: Proceedings of the 31th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE 2023)

DOI: 10.1145/3611643.3616279

Abstract: We consider the problem of program clone search, i.e. given a target program and a repository of known programs (all in executable format), the goal is to find the program in the repository most similar to our target program – with potential applications in terms of reverse engineering, program clustering, malware lineage and software theft detection. Recent years have witnessed a blooming in code similarity techniques, yet most of them focus on function-level similarity while we are interested in program-level similarity. Consequently, these recent approaches are not directly suited to program clone search, being either too slow to handle large code bases, not precise enough, or not robust against slight variations introduced by compilation or source code versions. We introduce Programs Spectral Similarity (PSS), the first spectral analysis dedicated to program-level similarity. PSS reaches a sweet spot in terms of precision, speed and robustness. Especially, its one-time spectral feature extraction is tailored for large repositories of programs, making it a perfect fit for program clone search.

To cite the article, use bibtex:

@inproceedings{pss2023,
title = {Scalable Program Clone Search through Spectral Analysis},
author = {Benoit, Tristan and Marion, Jean-Yves and Bardin, S{\'e}bastien},
booktitle = {Proceedings of the 31th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering},
series = {ESEC/FSE 2023},
doi = {10.1145/3611643.3616279},
}

To cite the dataset, refer to the Zenodo record:

@misc{pss2023Artifacts,
  author       = {Benoit, Tristan},
  title        = {{Artifacts - Scalable Program Clone Search through Spectral Analysis}},
  year         = 2023,
  publisher    = {Zenodo},
  doi          = {10.5281/zenodo.8289599},
  url          = {https://doi.org/10.5281/zenodo.8289599},
  note = {Available at \url{https://doi.org/10.5281/zenodo.8289599}}
}

Content Overview

The artifact includes implementations of 21 distinct clone search methods, comprising 4 new methods, 3 baselines and 14 methods adapted or reimplemented from preceding works in the field.

Proprietary software IDA Pro disassembler v7.5 and Gorille cfgbuilder could not be incorporated into this artifact.

The artifact features four datasets:

• The Basic folder holds comprehensive data about a thousand programs. It includes source code and disassembled files.
• The IoT folder holds twenty thousand malware taken from MalwareBazaar, plus scripts for selecting, downloading, and labeling the data, along with all disassembled files and features.
• Due to size constraints and copyright issues respectively, complete disassembled files and software aren't included inside BinKit and Windows folders. However, setup for disassembly and feature extraction reproduction is included. The BinKit dataset is readily accessible here.

Hardware Requirements:

• A computer with a Debian distribution system.
• Storage capacity of at least 110 GB.
• 8 GB of memory.
• High bandwidth to download the 43 GB content.

Installation

1. Navigate to the desired directory where you want to download the repository.
2. Download every file (archive) of the Zenodo record .
3. Extract each archive.
4. Combine all PSSO folders within each archive into a unique PSSO folder.

Please then refer to INSTALL.md for information on how to install software packages and set up conda environmnents.

Examples of Use

conda activate PSS_Base
python3 MakeTables.py
python3 MakeAblationTables.py

The above will produce in a few minutes the Tables of the Camera Ready version of our article using precomputed results.

See EXAMPLES.md for five quick examples of replications using this artifact.