🤖 AI Summary
To address the lack of interpretability and auditability in similarity assessment for binary code plagiarism detection, this paper proposes Bin2Vec—a multi-view embedding framework. Bin2Vec jointly models static program structure (e.g., control-flow graphs and instruction sequences) and dynamic execution behavior (e.g., memory access patterns and system call traces) to generate rich, discriminative representations. Leveraging interpretable machine learning techniques, it produces modular, traceable similarity scores and supports interactive visual inspection of detection rationale. Evaluated on multi-version benchmarks derived from PuTTY and 7-Zip, Bin2Vec significantly improves cross-version plagiarism identification accuracy over single-view baselines. Crucially, its design ensures full transparency and verifiability of the decision process—enabling rigorous security auditing and robust intellectual property protection.
📝 Abstract
We introduce Bin2Vec, a new framework that helps compare software programs in a clear and explainable way. Instead of focusing only on one type of information, Bin2Vec combines what a program looks like (its built-in functions, imports, and exports) with how it behaves when it runs (its instructions and memory usage). This gives a more complete picture when deciding whether two programs are similar or not. Bin2Vec represents these different types of information as views that can be inspected separately using easy-to-read charts, and then brings them together into an overall similarity score. Bin2Vec acts as a bridge between binary representations and machine learning techniques by generating feature representations that can be efficiently processed by machine-learning models. We tested Bin2Vec on multiple versions of two well-known Windows programs, PuTTY and 7-Zip. The primary results strongly confirmed that our method compute an optimal and visualization-friendly representation of the analyzed software. For example, PuTTY versions showed more complex behavior and memory activity, while 7-Zip versions focused more on performance-related patterns. Overall, Bin2Vec provides decisions that are both reliable and explainable to humans. Because it is modular and easy to extend, it can be applied to tasks like auditing, verifying software origins, or quickly screening large numbers of programs in cybersecurity and reverse-engineering work.