  Binary code similarity detection is an important problem with applications in
areas like malware analysis, vulnerability research and plagiarism detection.
This paper proposes a novel graph neural network architecture combined with a
novel graph data representation called call graphlets. A call graphlet encodes
the neighborhood around each function in a binary executable, capturing the
local and global context through a series of statistical features. A
specialized graph neural network model is then designed to operate on this
graph representation, learning to map it to a feature vector that encodes
semantic code similarities using deep metric learning. The proposed approach is
evaluated across four distinct datasets covering different architectures,
compiler toolchains, and optimization levels. Experimental results demonstrate
that the combination of call graphlets and the novel graph neural network
architecture achieves state-of-the-art performance compared to baseline
techniques across cross-architecture, mono-architecture and zero shot tasks. In
addition, our proposed approach also performs well when evaluated against an
out-of-domain function inlining task. Overall, the work provides a general and
effective graph neural network-based solution for conducting binary code
similarity detection.
