发表机构
School of Software, Dalian University of Technology; School of Cyber Science and Engineering, Xi’an Jiaotong University（大连理工大学软件学院; 西安交通大学网络空间安全学院）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
针对PLC二进制文件检索对应ST源文件的任务，提出跨平台框架PLC-Bin2Src，结合CDFG、FCG和符号相似性，在PLC-BEAD上达到95.89%的Recall@1。
AI 中文摘要
软件复用允许将现有组件和第三方库整合到新应用中，但仅以二进制形式提供的组件可能掩盖其来源和实现。软件成分分析旨在识别这些被复用的组件并追溯其来源，以支持依赖清单、漏洞评估和安全审计。对于PLC应用，二进制到源文件匹配（binary2source matching）提供了该分析中的核心环节：给定一个不透明的PLC二进制工件，从收集的源文件库中检索其对应的结构化文本（ST）源文件。然而，该任务因跨平台编译异构性、PLC二进制与ST源代码之间的表示差距，以及恢复的二进制单元与ST源文件之间的粒度不匹配而变得复杂。本文提出了PLC-Bin2Src，一个跨平台的二进制到源文件匹配框架，用于为CODESYS、GEB、OpenPLC v2和OpenPLC v3生成的二进制文件检索对应的ST源文件。平台感知的前端构建可比较的表示，共享后端同等结合控制-数据流图（CDFG）、函数调用图（FCG）和恢复符号的相似性来对源候选进行排序。我们在PLC-BEAD上评估了PLC-Bin2Src。结果表明，PLC-Bin2Src在四个PLC平台上实现了95.89%的Recall@1、99.66%的Recall@5和0.9769的MRR。
英文摘要
PLC developers reuse existing components and third-party libraries to reduce the cost of developing new applications, but this reuse can also introduce security risks. When components are distributed only in binary form, provenance tracing, vulnerability assessment, and security auditing become more difficult. To support these analyses, binary2source matching can retrieve the corresponding Structured Text (ST) source file for a PLC binary from a candidate source repository. However, due to the properties of PLC software, this task faces three challenges: cross-platform compilation heterogeneity, a binary-source representation gap, and inadequate representations of PLC semantics. Therefore, we present PLC-Bin2Src, a cross-platform binary2source matching framework that retrieves corresponding ST source files for binaries produced by CODESYS, GEB, OpenPLC v2, and OpenPLC v3. First, PLC-Bin2Src uses platform-aware binary frontends to recover user control logic across toolchains. Then, ST-to-C conversion and shared normalization are used to reduce syntactic differences between source- and binary-side representations. Next, control-data flow graphs (CDFGs) and function call graphs (FCGs) are constructed to capture program semantics, while recovered symbols provide complementary identity evidence. Finally, PLC-Bin2Src compares these representations and combines their similarity scores to rank source candidates. We evaluate PLC-Bin2Src on PLC-BEAD. The results show that PLC-Bin2Src achieves 95.89% Recall@1, 99.66% Recall@5, and an MRR of 0.9769 across four PLC platforms.
