| Περίληψη: |
Fuzzy hashing can identify source code duplication in compiled binary functions, with applications ranging from vulnerability detection to malware attribution, where the source code is not available. However, its application across the compilation gap has not been systematically studied. This paper studies fuzzy hashes applied to cross-compiled Binary Function Similarity Analysis (BFSA). We first propose the Stratified Abstraction Model, a taxonomy that maps how platform divergence affects binary artefacts across six analysis layers. Then, we use it to classify existing approaches, ranging from learned embeddings to fuzzy hashes. Then, we evaluate the effect of divergence across compilers, optimisation settings, bitness, and architectures to reframe what Machine Learning techniques should be expected to achieve. We conduct a large-scale evaluation of state-of-the-art fuzzy hashes, including Catalog1, FunctionSimSearch, Machoke, and CCBHash. We evaluate these techniques against uncompressed byte signatures (Position Independent Code), using a ground truth of cross-compiled functions, comprising 2.8 M targets and 4.3 M distractors. Under cross-architecture divergence (XA), the single-modality fuzzy hashes FCatalog and Machoke reach 8.57E−4 and 0.0978 in Mean Reciprocal Rank at 10 (MRR@10). Conversely, the weighted multi-modal algorithms, CCBHash and FunctionSimSearch, achieve 0.4671 and 0.4720 in the same scenario. Under optimisation divergence (XO), CCBHash reaches the highest values, between 0.6271 with feature weights and 0.6865 with naive, unweighted features. Our results show that fuzzy hashes may be used to detect code duplication in cross-compiled binaries, where the original source code is not available. They cannot, however, detect different source implementations with shared intent. This second gap defines where learned representations become necessary. • Fuzzy hashes complement ML where representative training datasets are not available. • Stratified Binary Abstraction Model classifies reverse-engineering artefacts. • Binary-function fuzzy hashing algorithms evaluated in cross-compiled settings. • Combining feature abstractions improved robustness across the compilation gap. • Partitioned hashing facilitates the analysis and adjustment of individual features. [ABSTRACT FROM AUTHOR] |