  The widespread code reuse allows vulnerabilities to proliferate among a vast
variety of firmware. There is an urgent need to detect these vulnerable code
effectively and efficiently. By measuring code similarities, AI-based binary
code similarity detection is applied to detecting vulnerable code at scale.
Existing studies have proposed various function features to capture the
commonality for similarity detection. Nevertheless, the significant code
syntactic variability induced by the diversity of IoT hardware architectures
diminishes the accuracy of binary code similarity detection. In our earlier
study and the tool Asteria, we adopt a Tree-LSTM network to summarize function
semantics as function commonality and the evaluation result indicates an
advanced performance. However, it still has utility concerns due to excessive
time costs and inadequate precision while searching for large-scale firmware
bugs.
  To this end, we propose a novel deep learning enhancement architecture by
incorporating domain knowledge-based pre-filtration and re-ranking modules, and
we develop a prototype based on Asteria called Asteria-Pro. Pre-filtration
module seeks to eliminates dissimilar functions to boost subsequent deep
learning model calculations, while re-ranking module aims to raises the
rankings of vulnerable functions among candidates generated by deep learning
model. Our evaluation indicates that pre-filtration module cuts the calculation
time by 96.9% and re-ranking improves MRR and Recall by 23.71% and 36.4%. By
incorporating the pre-filtration and re-ranking modules, Asteria-Pro
outperforms existing state-of-the-art approaches in bug search task, by a
significant large margin. We conduct a large-scale real-world firmware bug
search and Asteria-Pro manages to detect 1,482 vulnerable functions with a high
precision 91.65%.
