BSimVis v0.3.0 - Binary clustering, Notes and AI Insights

BSimVis is a tool to analyze similarities across a collection of binaries, based on Ghidra analyzers and the BSim (Behavioral Similarity) plugin. It provides an API and Web interface to upload large quantities of decompiled binaries and BSim feature vectors to a Kvrocks database for similarity analysis, function diffing, and binary family clustering.

New features

This new version focuses on file-level similarities, hierarchical clustering visualizations. It also brings analyst notes, and local LLM insights to streamline binary analysis workflows.

Screenshots

Binary Similarity & Clustering

• Hierarchical binary clustering and interactive file dendrogram visualization
• Automated metadata propagation from similar files in clusters to infer attributes (Yara rules, AV classification, file type, C2 IPs)

Analyst Notes & IA Insights

• Analyst notes system for files and functions
• Local LLM assistant for file and function summaries, supporting Ollama
• Note-owner indexing and filtering in function and file search

Navigation & SPA

• Single Page Application (SPA) architecture with full browser history support
• Contextual right-click menus for copying, tagging and navigating
• Unified breadcrumbs navigation

Performance & Maintenance

• Fixed pipelining transaction performance issue
• CLI tools for deleting and cleaning up collections

New Contributors

• @adulau made their first contribution in #2

Full Changelog: v0.2.0...v.0.3.0

BSimVis v0.2.0 - Clustering & Workflow improvements

BSimVis is a tool to analyze similarities across a collection of binaries, based on Ghidra analyzers and the BSim (Behavioral Similarity) plugin. It provides an API and Web interface to upload large quantities of decompiled binaries and BSim feature vectors to a Kvrocks database for similarity analysis, function diffing, and family clustering.

New features

This new version focuses on function clustering and improving analyst workflow.

Screenshots

Clustering

• HDBSCAN clustering
• Cluster search view
• Dendrogram and Packing diagram

Search

• Full text file search, sorting and filtering
• Full text feature search, sorting and filtering
• Matching both function filters
• Indexing configuration
• Search history and caching

Call graph

• Callees and callers navigation
• Call graph view

API

• Extended upload API: analysis config params (processor/compiler, profiling, batch metadata, similarity params)
• Swagger UI API documentation

UI Improvements

• Function code / diff selection and copy
• All dashboard tables selection and copy
• All search export to JSON and CSV
• Tag management panel and user settings panel
• Quick preview tooltips :
  • Cluster preview (scroll to view all functions code)
  • Diff preview (scroll to view all diffs)
• Job view

Setup

• install.sh: automated install of Redis, Kvrocks, Ghidra and optional Milvus
• launch.sh: one-command service launcher with screen sessions and --clear flag
• Milvus support is now optional (ENABLE_MILVUS=true in .env)
• Configurable DATA_BASE_DIR for data storage paths

Refactor

• New similarity graph using D3js, with more coloring options
• New window management, allowing multiple code preview in the same page
• Modular frontend JS

Experimental

• Tests with Milvus vector database for building similarities

Full Changelog: v0.1.0...v0.2.0

v0.1.0 - Initial Release

BSimVis v0.1.0

BSimVis is a tool to analyze similarities across a collection of binaries, based on Ghidra analyzers and the BSim (Behavioral Similarity) plugin. It provides an API and Web interface to upload large quantities of decompiled binaries and BSim feature vectors to a Kvrocks database for similarity analysis, function diffing, and family clustering.

Features

• Upload decompiled functions and BSIM vectors from Ghidra to a Kvrocks database
• API / web interface for :
  • Similarity of decompiled function and BSIM features
  • Function diffing based on BSim features
  • BSim Feature mapping with decompiled C tokens / Pcode blocks
  • Advanced search of function similarity with binary, function and similarity level filters
  • Tagging and filtering of binary, function and similarities
• CLI admin tools

Getting started

# Use the UV CLI for uploading, monitoring jobs and collections of binaries
uv run bsimvis --help

To deploy quickly redis and kvrocks databases :

docker compose up -d

To launch the web App / API :

uv run app.py

To start the workers (required for indexing and similarity processing)

uv run bsimvis worker start --count 5

Assuming you have the API running, and ghidra/PyGhidra installed, you can upload data using the following command:

bsimvis upload <target_files> -c <collection_name> -t <tag> -n <num_threads>

All processing jobs will be scheduled and picked up by workers.
See bsimvis_config.toml for an example config file.

Full Changelog: https://github.com/MISP/bsimvis/commits/v0.1.0