# Binary Code Similarity Detection

arXiv: https://arxiv.org/abs/2308.02992 · HTML: https://mlsanity.com/paper/2308.02992/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 Aug 2023.

## Built on by (most cited first, 3 of 3)

- [MALSIGHT: Exploring Malicious Source Code and Benign Pseudocode for Iterative Binary Malware Summarization](https://mlsanity.com/paper/2406.18379/) (2024)
- [Beyond Embeddings: Interpretable Feature Extraction for Binary Code Similarity](https://mlsanity.com/paper/2509.23449/) (2025)
- [Bin2Vec: Interpretable and Auditable Multi-View Binary Analysis for Code Plagiarism Detection](https://mlsanity.com/paper/2512.02197/) (2025)

## Abstract (arXiv)

Binary code similarity detection is to detect the similarity of code at binary (assembly) level without source code. Existing works have their limitations when dealing with mutated binary code generated by different compiling options. In this paper, we propose a novel approach to addressing this problem. By inspecting the binary code, we found that generally, within a function, some instructions aim to calculate (prepare) values for other instructions. The latter instructions are defined by us as key instructions. Currently, we define four categories of key instructions: calling subfunctions, comparing instruction, returning instruction, and memory-store instruction. Thus if we symbolically execute similar binary codes, symbolic values at these key instructions are expected to be similar. As such, we implement a prototype tool, which has three steps. First, it symbolically executes binary code; Second, it extracts symbolic values at defined key instructions into a graph; Last, it compares the symbolic graph similarity. In our implementation, we also address some problems, including path explosion and loop handling.