{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/safe-self-attentive-function-embeddings-for","title":"SAFE: Self-Attentive Function Embeddings for Binary Similarity","arxiv_id":"1811.05296","date":"2018-11-13","proceeding":null,"authors":["Luca Massarelli","Giuseppe Antonio Di Luna","Fabio Petroni","Leonardo Querzoni","Roberto Baldoni"],"abstract":"The binary similarity problem consists in determining if two functions are similar by only considering their compiled form. Advanced techniques for binary similarity recently gained momentum as they can be applied in several fields, such as copyright disputes, malware analysis, vulnerability detection, etc., and thus have an immediate practical impact. Current solutions compare functions by first transforming their binary code in multi-dimensional vector representations (embeddings), and then comparing vectors through simple and efficient geometric operations. However, embeddings are usually derived from binary code using manual feature extraction, that may fail in considering important function characteristics, or may consider features that are not important for the binary similarity problem. In this paper we propose SAFE, a novel architecture for the embedding of functions based on a self-attentive neural network. SAFE works directly on disassembled binary functions, does not require manual feature extraction, is computationally more efficient than existing solutions (i.e., it does not incur in the computational overhead of building or manipulating control flow graphs), and is more general as it works on stripped binaries and on multiple architectures. We report the results from a quantitative and qualitative analysis that show how SAFE provides a noticeable performance improvement with respect to previous solutions. Furthermore, we show how clusters of our embedding vectors are closely related to the semantic of the implemented algorithms, paving the way for further interesting applications (e.g. semantic-based binary function search).","url_abs":"https://arxiv.org/abs/1811.05296v4","url_pdf":"https://arxiv.org/pdf/1811.05296v4.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"safe-self-attentive-function-embeddings-for","repo_url":"https://github.com/facebookresearch/SAFEtorch","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"safe-self-attentive-function-embeddings-for","repo_url":"https://github.com/gadiluna/SAFE","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok"}},{"paper_slug":"safe-self-attentive-function-embeddings-for","repo_url":"https://github.com/lucamassarelli/yarasafe","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"Apache-2.0"}}],"tasks":[{"task_slug":"malware-analysis","task_name":"Malware Analysis"},{"task_slug":"vulnerability-detection","task_name":"Vulnerability Detection"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1811.05296","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1811.05296"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/gadiluna/SAFE","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/facebookresearch/SAFEtorch","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/lucamassarelli/yarasafe","reach":{"status":"ok","spdx":"Apache-2.0"}}],"summary":{"unverified":4},"by_repo_kind":{"listed":{"samples":4,"ran":0,"repositories":2}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":1,"samples":[{"code_sha256_prefix":"99b131ae83acbd92","entry":"filter_memory_references","repo":"facebookresearch/SAFEtorch","repo_kind":"listed","path":"utils/capstone_disassembler.py","file_url":"https://github.com/facebookresearch/SAFEtorch/blob/HEAD/utils/capstone_disassembler.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":false,"mcp_get_code":{"code_sha256":"99b131ae83acbd92"}},{"code_sha256_prefix":"efff703a68f0dd58","entry":"read_stream_from_pipe","repo":"lucamassarelli/yarasafe","repo_kind":"listed","path":"python_script/yara_safe.py","file_url":"https://github.com/lucamassarelli/yarasafe/blob/HEAD/python_script/yara_safe.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"efff703a68f0dd58"}},{"code_sha256_prefix":"00953ed1a5d5358c","entry":"read_string_from_pipe","repo":"lucamassarelli/yarasafe","repo_kind":"listed","path":"python_script/yara_safe.py","file_url":"https://github.com/lucamassarelli/yarasafe/blob/HEAD/python_script/yara_safe.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"00953ed1a5d5358c"}},{"code_sha256_prefix":"89490f7ff09f51dc","entry":"write_string_to_pipe","repo":"lucamassarelli/yarasafe","repo_kind":"listed","path":"python_script/yara_safe.py","file_url":"https://github.com/lucamassarelli/yarasafe/blob/HEAD/python_script/yara_safe.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"89490f7ff09f51dc"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}