This repository contains the complete implementation and resources for OCEAN: Open-World Contrastive Authorship Identification, a novel system for function-level code authorship attribution in compiled binaries using contrastive learning.
"OCEAN: Open-World Contrastive Authorship Identification"
Felix Mächtle, Jan-Niclas Serr, Nils Loose, Jonas Sander, Thomas Eisenbarth
Accepted at ACNS 2025 - 23rd International Conference on Applied Cryptography and Network Security
Paper Link: https://arxiv.org/abs/2412.05049
OCEAN is the first framework to explore code authorship attribution on compiled binaries in an open-world extreme scenario, where two code samples from unknown authors are compared to determine if they were developed by the same author. This approach is crucial for:
- 🔒 Supply Chain Security: Detecting code injections from unknown authors
- 🛡️ Malware Attribution: Identifying threat actors in binary analysis
- ✅ Code Provenance: Verifying authorship of critical software components
- First binary authorship attribution system for open-world extreme scenarios (AUROC: 0.86)
- Outperforms state-of-the-art SCS-Gan by 10% in source code scenarios
- New realistic datasets: Conan (training) and Snoopy (evaluation) improve performance by 7% over Google Code Jam
- Real-world application: Successfully detects code injections in software supply chains
git clone https://github.com/UzL-ITS/OCEAN.git
cd OCEAN
pip install -r requirements.txtcd OCEAN_src
# Train UniXcoder model on decompiled code
python main.py --representation source-code --model unixcoder --epochs 10 --gpu 0
# Train CNN model on raw binary data
python main.py --representation raw --model cnn --epochs 5 --gpu 0
# Compare different representations
python main.py --representation assembly_cleaned --model unixcoder --id assembly_expOCEAN/
├── OCEAN_src/ # Main implementation
│ ├── main.py # Training and evaluation entry point
│ ├── dataset_loader.py # OCEAN dataset loading from HuggingFace
│ ├── training.py # Contrastive learning training loop
│ ├── Evaluator.py # Open-world evaluation metrics
│ ├── models.py # Model architectures and wrappers
│ ├── unixcoder.py # UniXcoder implementation
│ ├── ModelCNN.py # CNN for binary image representation
│ ├── ModelLSTM.py # LSTM with BPE tokenization
│ ├── ModelFNN.py # Feed-forward networks (TF-IDF/N-gram)
│ ├── contrax_loss.py # Contrastive learning loss functions
│ ├── utils.py # Utility functions
│ └── README.md # Detailed implementation documentation
├── dataset_collection_tool/ # Tools for creating OCEAN datasets
├── requirements.txt # Python dependencies
└── README.md # This file
Link: https://huggingface.co/datasets/Jaserro/OCEAN
The dataset contains two components:
- Conan: 464 real-world C/C++ projects from the Conan package manager (training)
- Snoopy: 7 popular projects (Bitcoin, Curl, GLibC, Nginx, OpenSSH, PHP, Redis) for unbiased evaluation
The dataset collection tool is available in ./dataset_collection_tool/ for creating custom datasets from your own repositories.
- Source Code: Original and decompiled C/C++ code
- Assembly: Raw and cleaned assembly instructions
- P-Code: Ghidra P-code representations (raw and refined)
- Binary: Raw binary bytes
- Comments: Versions with/without comments
OCEAN uses contrastive learning to train models that generate discriminative embeddings:
- Function Extraction: Extract functions from binaries using Ghidra
- Representation Processing: Convert to various code representations
- Contrastive Training: Train embeddings to cluster same-author functions
- Similarity Comparison: Use cosine similarity for authorship determination
- Statistical Thresholding: Apply dynamic thresholds for unknown author detection
- UniXcoder: Pre-trained transformer for code understanding
- CNN: Converts code to 100×100 images for visual pattern recognition
- LSTM: Sequential processing with BPE tokenization
- FNN: Feed-forward networks with TF-IDF or N-gram features
| Scenario | Model | Representation | AUROC | Improvement |
|---|---|---|---|---|
| Source Code | OCEAN | Source | 0.99 | +10% vs SCS-Gan |
| Binary (Unseen) | OCEAN | Decompiled | 0.86 | First of its kind |
| Real-world Training | OCEAN | Conan vs GCJ | - | +7% improvement |
- Supply Chain Attack Detection: Identify injected malicious code
- Malware Family Attribution: Link malware to specific threat groups
- Code Theft Detection: Identify unauthorized code reuse
- Forensic Analysis: Attribute code in legal investigations
# Pseudocode for supply chain security
old_functions = extract_functions(old_binary)
new_functions = extract_functions(updated_binary)
for new_func in changed_functions:
similarities = [cosine_sim(new_func, old_func) for old_func in old_functions]
min_similarity = min(similarities)
if min_similarity < dynamic_threshold(len(similarities)):
flag_as_potential_injection(new_func)- Python 3.7+
- PyTorch 1.8+
- Transformers (HuggingFace)
- scikit-learn
- Ghidra (for binary analysis)
If you use OCEAN in your research, please cite:
@article{machtle2024ocean,
author = {Mächtle, Felix and Serr, Jan-Niclas and Loose, Nils and Sander, Jonas and Eisenbarth, Thomas},
journal = {To be published at ACNS 2025},
title = {OCEAN: Open-World Contrastive Authorship Identification},
year = {2025}
}We welcome contributions! Please see the individual component READMEs for detailed documentation:
- OCEAN_src/README.md - Main implementation details
- dataset_collection_tool/ - Dataset creation tools