# BinaryAI: Binary Software Composition Analysis via Intelligent Binary Source Code Matching

**Authors:** Ling Jiang, Junwen An, Huihui Huang, Qiyi Tang, Sen Nie, Shi Wu, Yuqun Zhang  
**arXiv:** [2401.11161](https://arxiv.org/abs/2401.11161)  
**Date:** 2024-01-20  
**Summary page:** https://www.summarizepaper.com/en/arxiv-id/2401.11161v1/

## Key points

- The paper addresses challenges and risks of using third-party libraries in software development
- Software composition analysis (SCA) techniques have been developed to mitigate these risks
- Existing techniques for binary-to-source SCA have limitations, leading to false positives and compromised recall
- The authors propose a novel technique called BinaryAI that utilizes a two-phase binary source code matching approach
- BinaryAI trains a transformer-based model to generate function-level embeddings and find similar source functions for each binary function
- Experimental results show that BinaryAI outperforms existing models in terms of binary source code matching and downstream SCA tasks
- BinaryAI achieves higher recall@1 and MRR compared to the state-of-the-art model CodeCMR
- BinaryAI also surpasses existing binary-to-source SCA tools in detecting third-party libraries, increasing precision and recall compared to the commercial SCA product Black Duck
- Overall, BinaryAI provides an innovative approach for improving the accuracy and effectiveness of binary-to-source SCA techniques

## Summary

, , , , 

The paper titled "BinaryAI: Binary Software Composition Analysis via Intelligent Binary Source Code Matching" addresses the challenges and risks associated with using third-party libraries in software development. While these libraries can enhance productivity, they also introduce potential security vulnerabilities. To mitigate these risks, software composition analysis (SCA) techniques have been developed, with binary-to-source SCA being a popular approach. However, this process is challenging due to disparities between binary and source code after compilation. Existing techniques rely on basic syntactic features, leading to false positives and compromised recall in large-scale third-party library datasets. To overcome these limitations, the authors propose a novel technique called BinaryAI that utilizes a two-phase binary source code matching approach to capture both syntactic and semantic code features. In the first phase, BinaryAI trains a transformer-based model to generate function-level embeddings and find similar source functions for each binary function. The second phase employs link-time locality to facilitate function matching and detects reused third-party libraries based on the ratio of matched source functions. Experimental results demonstrate that BinaryAI outperforms existing models in terms of binary source code matching and downstream SCA tasks. The embedding model of BinaryAI achieves 22.54% recall@1 and 0.34 MRR compared to 10.75% and 0.17 respectively for the state-of-the-art model CodeCMR. Additionally, BinaryAI surpasses all existing binary-to-source SCA tools in detecting third-party libraries by increasing precision from 73.36% to 85.84% and recall from 59.81% to 64.98% compared to the commercial SCA product Black Duck. Overall, BinaryAI presents an innovative approach for improving the accuracy and effectiveness of binary-to-source SCA techniques. By considering both syntactic and semantic code features, it provides a more robust solution for identifying reused third-party libraries and reducing security risks in software development.