用神经去编译技术从二进制代码预测漏洞，无需源码即可实现高效安全检测。
Can Neural Decompilation Assist Vulnerability Prediction on Binary Code?
- 通过神经去编译还原二进制为近似源码，再用深度学习分析漏洞
- 在二分类和多分类任务中均优于现有最先进方法
- 适合缺乏源码的软件安全审计场景
漏洞预测对高效识别安全问题具有重要意义，但传统方法依赖目标软件的源码，这一假设限制了其应用。本文开展实验研究，提出一种无需源码或复杂二进制表示的漏洞预测方法：利用神经去编译技术将二进制文件还原为近似源码，并在此基础上通过深度学习模型进行漏洞预测。实验结果表明，该方法在二分类（有漏洞/无漏洞）与多分类（漏洞类型）任务中均超越当前最优水平，证明了基于神经去编译的漏洞预测在实际应用中的可行性与有效性。
原文摘要 · Abstract (English)
Vulnerability prediction is valuable in identifying security issues efficiently, even though it requires the source code of the target software system, which is a restrictive hypothesis. This paper presents an experimental study to predict vulnerabilities in binary code without source code or complex representations of the binary, leveraging the pivotal idea of decompiling the binary file through neural decompilation and predicting vulnerabilities through deep learning on the decompiled source code. The results outperform the state-of-the-art in both neural decompilation and vulnerability prediction, showing that it is possible to identify vulnerable programs with this approach concerning bi-class (vulnerable/non-vulnerable) and multi-class (type of vulnerability) analysis.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。