# Code is not Natural Language: Unlock the Power of Semantics-Oriented Graph Representation for Binary Code Similarity Detection > HermesSim detects binary code similarity by lifting each function to Ghidra P-code and building a semantics-oriented graph that exposes operand structure inside instructions, def-use, control-flow and effect-order relations, while dropping semantics-independent details such as which register temporarily holds a value. A gated graph neural network with a multi-head softmax aggregator embeds the graph, and functions are compared by embedding similarity. On the Dataset-1 benchmark of Marcelli et al., the authors report 48.1% RECALL@1 for x64 cross-compiler retrieval in pools of 10,000 functions, against 31.4% for a fine-tuned jTrans, with a 388K-parameter model. - Authors: Haojie He; Xingwei Lin; Ziang Weng; Ruijie Zhao; Shuitao Gan; Libo Chen; Yuede Ji; Jiashui Wang; Zhi Xue - Venue: USENIX Security 2024 - Status: Conference paper - Publication / posting date: August 2024 - Date source: Publication month in the official USENIX proceedings BibTeX; the August 14–16, 2024 symposium dates are not used to assert a publication day. - Sources reviewed: 2026-10-19 - Added to the catalog: 2026-10-27 - Original paper: - PDF: - Code: - BibTeX: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-hermessim/index.md) ## Scope and limitations Laboratory results reuse Dataset-1 from Marcelli et al.: 257K, 13K and 522K training, validation and test functions for x86, ARM and MIPS in 32 and 64 bits, built at O0–O3 and Os by GCC and Clang. HermesSim keeps that dataset's IDA Pro 7.3 control flow and basic-block boundaries and uses Ghidra only to disassemble and lift each block, so the results do not measure function or CFG recovery. Each setting samples 1,000 queries against pools of up to 10,000 functions, and the gains are relative to the paper's own runs of SAFE, Asm2Vec, GMN, Trex and jTrans, which supports x86 only and was compared on the x64 subset. The real-world study searches 62,605 ARM32 and MIPS32 functions from 12 RTOS firmware images of three vendors for 10 functions linked to 5 CVEs; its ground truth comes from manually examining the top 20 results of the compared methods. String, integer and external-symbol references are not encoded, only memory effects are modeled, and unresolved indirect branches leave graphs incomplete. Similarity ranks candidates for review; it does not establish equivalence or vulnerability. ## Why it fits this collection Adds learned binary code similarity search, which reverse engineers use to match functions across builds, recover library functions in stripped binaries and locate known vulnerable code, complementing decompilation and symbol-recovery research. ## Publication and review notes The USENIX page, its BibTeX entry and the final PDF agree on the nine-author order, pages 1759–1776 and ISBN 978-1-939133-44-1; the page also lists a prepublication PDF. USENIX assigns no paper DOI and no arXiv version was found. The paper links github.com/NSSL-SJTU/HermesSim. At the reviewed 2024-12-10 commit its LICENSE file is MIT for the project and reproduces MIT and Apache-2.0 notices for included Cisco Talos and DeepMind code, which is why GitHub reports no single license. The README's paper link uses /presentation/he, which redirects to the he-haojie page. Lifting calls the separate GPL-3.0 GSAT Ghidra toolkit (gsat-1.0.jar). Zenodo record 10.5281/zenodo.10369788 (CC BY 4.0), linked from the README, holds the Dataset-RTOS binaries and archives of about 17 GB, 19 GB and 5 GB with extracted features, model inputs and outputs; that DOI identifies the data, not the paper. Dataset-1 binaries come from the Cisco Talos binary_function_similarity repository. The pinned requirements target Python 3.10, PyTorch 1.13.1 with CUDA 11.6 and PyTorch Geometric 2.3.0. ## Primary sources 1. 2. 3. 4. 5. 6. 7. 8. ## About this entry Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.