arXiv:2509.25514cs.SEcs.CR2025-09被引 1

无需依赖架构的函数名预测模型,提升漏洞分析效率

AGNOMIN -- Architecture Agnostic Multi-Label Function Name Prediction

  • 构建融合控制流与反编译特征的分层图结构
  • 在三种架构上实现最高55.86%召回率,精度提升27.17%
  • 支持跨架构泛化,适合安全分析与逆向工程实战

函数名预测对理解剥离二进制文件至关重要,是后续漏洞分析与修补的关键步骤。现有方法常受限于架构特异性、数据稀缺和命名规范差异。本文提出AGNOMIN,一种无架构依赖的多标签函数名预测方法。该方法构建特征丰富的分层图(FEHG),融合控制流图、函数调用图及动态学习的PCode特征;通过分层图神经网络生成跨架构一致的函数表示,支撑可扩展的安全评估。采用受Renée启发的解码器,结合注意力头与算法优化,提升预测性能。在包含9000个ELF可执行文件的跨三架构数据集上验证,相比先进方法,精度最高提升27.17%,召回率提升55.86%。此外,对未见架构具备良好泛化能力,召回率高出基线5.89%。其实际价值已在安全黑客松中得到验证,成功协助逆向工程师在多种架构下分析并修补漏洞二进制。

原文摘要 · Abstract (English)

Function name prediction is crucial for understanding stripped binaries in software reverse engineering, a key step for \textbf{enabling subsequent vulnerability analysis and patching}. However, existing approaches often struggle with architecture-specific limitations, data scarcity, and diverse naming conventions. We present AGNOMIN, a novel architecture-agnostic approach for multi-label function name prediction in stripped binaries. AGNOMIN builds Feature-Enriched Hierarchical Graphs (FEHGs), combining Control Flow Graphs, Function Call Graphs, and dynamically learned \texttt{PCode} features. A hierarchical graph neural network processes this enriched structure to generate consistent function representations across architectures, vital for \textbf{scalable security assessments}. For function name prediction, AGNOMIN employs a Renée-inspired decoder, enhanced with an attention-based head layer and algorithmic improvements. We evaluate AGNOMIN on a comprehensive dataset of 9,000 ELF executable binaries across three architectures, demonstrating its superior performance compared to state-of-the-art approaches, with improvements of up to 27.17\% in precision and 55.86\% in recall across the testing dataset. Moreover, AGNOMIN generalizes well to unseen architectures, achieving 5.89\% higher recall than the closest baseline. AGNOMIN's practical utility has been validated through security hackathons, where it successfully aided reverse engineers in analyzing and patching vulnerable binaries across different architectures.

函数名预测二进制分析图神经网络安全逆向

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。