  Binary authorship analysis is a significant problem in many software
engineering applications. In this paper, we formulate a binary authorship
verification task to accurately reflect the real-world working process of
software forensic experts. It aims to determine whether an anonymous binary is
developed by a specific programmer with a small set of support samples, and the
actual developer may not belong to the known candidate set but from the wild.
We propose an effective binary authorship verification framework, BinMLM.
BinMLM trains the RNN language model on consecutive opcode traces extracted
from the control-flow-graph (CFG) to characterize the candidate developers'
programming styles. We build a mixture-of-shared architecture with multiple
shared encoders and author-specific gate layers, which can learn the
developers' combination preferences of universal programming patterns and
alleviate the problem of low training resources. Through an optimization
pipeline of external pre-training, joint training, and fine-tuning, our
framework can eliminate additional noise and accurately distill developers'
unique styles. Extensive experiments show that BinMLM achieves promising
results on Google Code Jam (GCJ) and Codeforces datasets with different numbers
of programmers and supporting samples. It significantly outperforms the
baselines built on the state-of-the-art feature set (4.73% to 19.46%
improvement) and remains robust in multi-author collaboration scenarios.
Furthermore, BinMLM can perform organization-level verification on a real-world
APT malware dataset, which can provide valuable auxiliary information for
exploring the group behind the APT attack.
