arXiv:2409.07889cs.LGcs.CR2024-09中稿 · the 34th USENIX Se…被引 4

用图像描述思路给二进制函数命名,提升跨项目泛化能力

BLens: Contrastive Captioning of Binary Functions using Ensemble Embedding

  • 融合多嵌入表示,通过对比学习对齐名称语义空间
  • 跨项目场景下F1达0.46,比现有方法高24%
  • 适合需要泛化命名的逆向工程任务

函数名能显著帮助人工逆向工程师,推动了基于机器学习预测剥离二进制文件中函数名的研究。当前多数工作采用Transformer模型,将代码到函数名的映射类比为机器翻译,但模型在面对训练集外项目时泛化能力不足。本文提出全新方法:借鉴自动图像描述技术,使二进制函数的不同部分与函数名的相应部分建立关联。我们设计了BLens,将多个二进制函数嵌入整合为新集合表示,通过对比学习将其对齐至名称表示的潜在空间,并使用专为函数名设计的Transformer生成名称。实验表明,BLens显著优于现有方法:在按二进制分割的标准设置下,F1得分为0.79(此前为0.70);在强调泛化性的跨项目设置中,F1达0.46(此前为0.29);在减少项目间共享组件的实验中,F1为0.32(此前为0.19)。

原文摘要 · Abstract (English)

Function names can greatly aid human reverse engineers, which has spurred the development of machine learning-based approaches to predicting function names in stripped binaries. Much current work in this area now uses transformers, applying a metaphor of machine translation from code to function names. Still, function naming models face challenges in generalizing to projects unrelated to the training set. In this paper, we take a completely new approach by transferring advances in automated image captioning to the domain of binary reverse engineering, such that different parts of a binary function can be associated with parts of its name. We propose BLens, which combines multiple binary function embeddings into a new ensemble representation, aligns it with the name representation latent space via a contrastive learning approach, and generates function names with a transformer architecture tailored for function names. Our experiments demonstrate that BLens significantly outperforms the state of the art. In the usual setting of splitting per binary, we achieve an $F_1$ score of 0.79 compared to 0.70. In the cross-project setting, which emphasizes generalizability, we achieve an $F_1$ score of 0.46 compared to 0.29. Finally, in an experimental setting reducing shared components across projects, we achieve an $F_1$ score of $0.32$ compared to $0.19$.

函数命名逆向工程对比学习Transformer

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。