arXiv:2608.02084cs.SEcs.CR2026-08中稿 · ICPC '26

用调用图增强二进制函数嵌入,提升鲁棒性但未必通用。

Pretraining on Call Graphs: When Binary Analysis Tasks Profit From Context

  • 利用调用图信息改进函数嵌入,增强上下文感知能力。
  • 调用图增强显著提升相似性检测性能,但不保证下游任务通用性。
  • 对命名空间相关函数效果更佳,适合上下文依赖场景。

二进制函数嵌入模型旨在将二进制代码语义编码为可泛化到多种逆向工程任务(如二进制代码搜索、漏洞检测、恶意软件分类)的向量表示。尽管许多模型仅以目标函数为输入,已有研究通过利用调用图信息提升了嵌入质量。本文在两个前沿二进制函数嵌入模型生成的嵌入基础上,测试了多种图模型。结果表明,引入过程间上下文虽能提升二进制代码相似性检测(BCSD)表现,但该改进并不一定推广至其他语义或语法类下游任务。进一步分析发现,优化语义相似性任务常导致语法任务性能下降。对数据集的解释性分析显示,调用图增强显著提高了嵌入在初始模型表现差时的鲁棒性。此外,额外上下文对命名空间相关函数的增益大于对单一逻辑函数,说明调用图在上下文依赖场景中最具价值。

原文摘要 · Abstract (English)

Binary function embedding models are trained to encode the semantics of binary code in such a way that they can be generalized to a variety of reverse engineering tasks, such as binary code search, vulnerability detection, or malware classification. While many models only take the function in question as contextual input, there have been successful attempts to improve function embeddings by leveraging information from the call graph. In this study, we dissect the implications of these embedding refinements. We conduct experiments using a range of graph-based models on the embeddings generated by two state-of-the-art binary function embedding models. Integrating inter-procedural context, we show that improvements on binary code similarity detection (BCSD) will not necessarily generalize to downstream tasks, neither of semantic nor of syntactic nature. More generally, we find that optimizing for semantic similarity tasks correlates with worse performance on syntactic tasks. By conducting an explanatory analysis on the dataset, we find that the call graph-based enhancements significantly enhance the robustness of embeddings, particularly in scenarios where the initial models struggle. Furthermore, we observe that the added context is more beneficial for namespace-related functions than for those focused on individual logic, confirming that the call graph can be leveraged most effectively in context-dependent scenarios.

二进制分析函数嵌入调用图逆向工程

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。