FoC：利用LLM识别剥离二进制中的密码函数
FoC: Figure out the Cryptographic Functions in Stripped Binaries with LLMs
AI总结：
本文提出FoC框架，结合二进制大语言模型与相似性检索，实现剥离二进制中密码函数的自动识别，性能显著优于现有方法。
摘要：
分析剥离二进制中密码函数的行为是一项具有挑战性但至关重要的任务。与典型代码相比，密码算法表现出更高的逻辑复杂性，然而在病毒分析和遗留代码检查等领域，对其分析是不可避免的。现有方法通常依赖于数据或结构模式匹配，导致泛化能力欠佳且需要大量人工工作。在本文中，我们提出了一种名为FoC的新框架，用于识别剥离二进制中的密码函数。在FoC中，我们首先构建一个二进制大语言模型（FoC-BinLLM），以自然语言总结密码函数的语义。FoC-BinLLM的预测对细微变化（如漏洞补丁）不敏感。为缓解这一问题，我们进一步在FoC-BinLLM之上构建了一个二进制代码相似性模型（FoC-Sim），以生成对变化敏感的表示，并利用该模型在数据库中检索未知密码函数的相似实现。此外，我们构建了一个密码二进制数据集用于评估，并促进该领域的进一步研究。我们还设计了一种自动化方法，为大量二进制函数创建语义标签。评估结果表明，FoC-BinLLM在ROUGE-L分数上比ChatGPT高出14.61%。FoC-Sim在Recall@1上比之前的最佳方法高出52%。此外，我们的方法在病毒分析和1天漏洞检测中也展现了实际能力。
英文摘要：
Analyzing the behavior of cryptographic functions in stripped binaries is a challenging but essential task. Cryptographic algorithms exhibit greater logical complexity compared to typical code, yet their analysis is unavoidable in areas such as virus analysis and legacy code inspection. Existing methods often rely on data or structural pattern matching, leading to suboptimal generalizability and suffering from manual work. In this paper, we propose a novel framework called FoC to Figure out the Cryptographic functions in stripped binaries. In FoC, we first build a binary large language model (FoC-BinLLM) to summarize the semantics of cryptographic functions in natural language. The prediction of FoC-BinLLM is insensitive to minor changes, such as vulnerability patches. To mitigate it, we further build a binary code similarity model (FoC-Sim) upon the FoC-BinLLM to create change-sensitive representations and use it to retrieve similar implementations of unknown cryptographic functions in a database. In addition, we construct a cryptographic binary dataset for evaluation and to facilitate further research in this domain. And an automated method is devised to create semantic labels for extensive binary functions. Evaluation results demonstrate that FoC-BinLLM outperforms ChatGPT by 14.61% on the ROUGE-L score. FoC-Sim outperforms the previous best methods with a 52% higher Recall@1. Furthermore, our method also shows practical ability in virus analysis and 1-day vulnerability detection.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
