N2NMatcher: Towards Inlining-Resilient Binary Decomposition and Module Matching

2026-08-10

AI Summary

Function inlining disrupts the call graph structure of binary programs, undermining conventional function-based module decomposition and matching approaches. To address this challenge, this work proposes a module decomposition strategy guided by inlining-invariant anchor functions and introduces an ACFG-FCG joint graph representation that integrates opcode sequences, control flow, and calling context. A hierarchical graph neural network is employed to learn module-level embeddings from this enriched representation. Experimental results demonstrate that the proposed method significantly outperforms existing techniques in both module decomposition quality and matching accuracy, thereby enhancing the robustness and precision of program-level binary code similarity analysis.

Abstract

Program-level Binary Code Similarity Analysis (BCSA) aims to identify semantically similar code regions across binary programs, serving as a fundamental technique for software plagiarism detection, vulnerability search, and malware analysis. Existing approaches often decompose binaries into modules following the structure of function call graphs (FCGs) and then match these modules by their contained functions. However, function inlining changes both FCG structures and binary function semantics, making existing decomposition and module matching methods less effective. In this work, we propose N2NMatcher, an inlining-resilient framework for binary decomposition and module matching. We first conduct an empirical study to examine whether binaries still contain functions that provide stable module boundaries across compilation settings. N2NMatcher learns to predict such functions as anchors using a hierarchical graph neural network that encodes binary ACFG-FCG representations built from opcode sequences, control-flow structures, and FCG calling context. It then performs anchor-bounded decomposition and matches the generated modules using learned module graph embeddings. Experimental results show that N2NMatcher improves both the decomposition quality and module matching accuracy compared to existing works, enabling more effective program-level BCSA.

Problem

• binary code similarity analysis
• function inlining
• module matching
• binary decomposition
• call graph

Innovation

• Inlining-Resilient
• Binary Code Similarity Analysis
• Anchor-Based Decomposition
• Hierarchical Graph Neural Network
• Module Matching