Binary code digest generation method and system based on cross-domain semantic completion and denoising

Abstract

This invention discloses a method and system for generating binary code summaries based on cross-domain semantic completion and denoising. The method first extracts the context of neighboring nodes centered on the target function in the binary code, constructing inter-process call information as an enhanced inter-process context. Next, it constructs a cross-domain semantic retrieval module based on graph attention enhancement, obtaining a set of candidate source code fragments semantically aligned with the target binary function based on the enhanced inter-process context. Then, it constructs a confidence-based semantic awareness denoising module to clean and evaluate the candidate semantic fragments, constructing prompt words with explicit confidence labels. Finally, the prompt words are used as additional context for the decompiled code of the target function, and together with the decompiled code of the target function, they are used as input to an LLM (Limited Least Meaning) to generate a function summary. This invention effectively removes the influence of noise in the candidate source code fragments on the summary quality, accurately and efficiently generating binary code summaries.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence and software reverse analysis, specifically relating to a binary code digest generation method and system that utilizes cross-domain retrieval enhancement and noise filtering. Background Technology

[0002] In binary code reverse engineering, the stripped binary code in real-world scenarios results in the irreversible loss of symbolic information such as function names, variable names, and type names. This makes it difficult to fill in the semantic gap between binary code and source code based solely on local behavioral clues within functions. Therefore, introducing semantic clues from the external source code domain for completion has become an important approach. Inspired by RAG (Retrieval-Enhanced Generation) and multimodal approaches, existing work establishes a cross-domain semantic mapping between the binary and source code domains, retrieving and generating semantically similar source code fragments as supplementary context, thereby empowering code summarization tasks.

[0003] However, existing cross-domain completion methods mainly face the following problems: (1) Lack of inter-process information: The semantics of a function are often not isolated, but are defined by its context position in the program call graph, i.e., who calls it (Callers) and who it calls (Callees). However, the current state-of-the-art method only takes the assembly instruction sequence of the target function itself as input, ignoring the key semantic clues contained in the neighborhood of the call graph, making it difficult for the model to capture the deep intent of the encapsulated function or callback function.

[0004] (2) Cross-domain retrieval noise interference: The auxiliary source code fragments obtained by cross-domain matching retrieval are based on probability similarity retrieval, and the results inevitably contain content that is irrelevant to the target semantics or even misleading. Directly inputting them as part of the prompt words into the LLM (Large Language Model) and choosing to completely trust the internal analysis of the LLM will increase the reasoning bias caused by illusion and reduce the accuracy of the summary generation, requiring additional pre-quality control mechanisms. Summary of the Invention

[0005] To address the aforementioned challenges, this invention proposes a Call-context Augmented Probing and Denoising (CAPD) method. By constructing an enhanced inter-procedural context, fusing neighborhood semantics using a graph attention network, and designing a confidence-based denoising mechanism, CAPD provides LLM with highly relevant and low-noise external semantic fragment support.

[0006] In one aspect, this invention provides a binary code digest generation method based on cross-domain semantic completion and denoising, comprising the following steps: S1. Extract the context of Callers and Callees' neighborhood nodes centered on the target function in the binary code. Through steps such as coverage completion, noise function filtering, and deep call relationship reconstruction, obtain semantically complete inter-procedural call information based on the CG (function call graph) to serve as an enhanced inter-procedural context for the target function. .

[0007] S2. Construct a cross-domain semantic retrieval module based on graph attention enhancement: First, construct a module oriented towards enhanced inter-process context. An enhanced binary encoder is then constructed; this encoder is combined with a pre-trained source code feature extraction network to perform CLIP (cross-modal contrastive pre-training) pre-alignment training of the dual encoder architecture; finally, the pre-aligned converged enhanced binary encoder is frozen and connected to a generative cross-domain retrieval framework, thereby obtaining candidate source code fragments related to the objective function from the domain knowledge of the source code generative model.

[0008] S3. Construct a confidence-based semantic awareness denoising module: First, perform syntactic and format cleaning on candidate source code fragments to remove obviously invalid outputs; then, based on features such as APIs, strings, and constants extracted from the decompiled code, evaluate the consistency between candidate fragments and the target function; finally, construct Prompts with explicit confidence labels according to confidence level.

[0009] S4. Use the Prompt as an additional context for the decompiled code of the target function, and use it together with the decompiled code of the target function as input to the LLM to generate a binary code digest.

[0010] Furthermore, regarding the semantic isolation problem of single binary functions, the specific implementation process of the cross-domain contextual retrieval (CCR) module based on graph attention enhancement described in step S2 is as follows: S2.1, Enhanced Binary Encoder Construction: With Enhanced Inter-Procedure Context As input, the layer is first initialized using node features. Each node function in the process performs initial feature extraction; next, the inter-process semantic aggregation layer receives the initial features, dynamically evaluates the asymmetric attention coefficient based on the call edge relationship between the target node and neighboring nodes, and weights and aggregates the features of neighboring nodes to the target node based on this coefficient, finally producing an enhanced binary feature vector. This is the output. Through the cascaded processing of the above two layers, the construction of the enhanced binary encoder is now complete.

[0011] S2.2, CLIP-based dual encoder pre-alignment training: The enhanced binary encoder constructed in the previous step is combined with the pre-trained source code feature extraction network, respectively using... With the corresponding source code As input, feature vectors are extracted respectively. and By calculating the cosine similarity between the two features and using the symmetric InfoNCE loss function for contrastive learning and backpropagation, this step encourages the binary representation space to converge towards the source code feature distribution, ultimately outputting an enhanced binary encoder that achieves cross-modal alignment and convergence.

[0012] S2.3 Generative Cross-Domain Retrieval Based on Feature Projection: Using an enhanced binary encoder with cross-modal alignment and convergence as a feature extractor, feature vectors are first extracted. The projected features are then projected into the feature vector space of the source code generative model through an MLP (Multilayer Perceptron) layer. The projected features are used as semantic prefixes to guide conditional generation, and finally, a set of candidate source code fragments that are highly related to the semantics of the target binary function is output.

[0013] Furthermore, regarding the potential semantic noise and illusion problems in generative retrieval results, the confidence-based semantic-aware denoising (SDN) module described in step S3 is specifically implemented as follows: S3.1 Semantic Denoising and Confidence Grading Based on Decompilation Features: First, the candidate source code fragments retrieved in S2.3 are syntactically cleaned; then, specific APIs, strings, and constants in the decompiled code of the target function are extracted as fact anchors; finally, the cleaned candidate source code fragments are compared with the fact anchors, and the candidate fragments are marked into four levels—high confidence, reference, uncertainty, and noise—based on the fact anchors using LLM, and finally, graded semantic fragments are output.

[0014] S3.2 Receive the hierarchical semantic fragments output by S3.1, attach explicit labels to them according to different levels, and finally construct a structured Prompt, which is used as the input for subsequent LLM.

[0015] In another aspect, the present invention also provides a binary code digest generation system based on cross-domain semantic completion and denoising, for implementing the aforementioned binary code digest generation method, comprising the following modules: The Enhanced Interprocedural Context module is used to extract the neighborhood node context centered on the target function in the binary code, construct interprocedural call information, and serve as the enhanced interprocedural context of the target binary function.

[0016] The candidate source code fragment module is used to build a cross-domain semantic retrieval module based on graph attention enhancement. Based on the enhanced inter-process context, it obtains a set of candidate source code fragments that are semantically aligned with the target binary function.

[0017] The prompt word module is used to build a confidence-based semantic awareness denoising module, clean the candidate semantic segments, evaluate the consistency between the candidate segments and the objective function, and construct prompt words with explicit confidence labels.

[0018] The summary generation module is used to take prompt words as additional context for the target function decompiled code, and together with the target function decompiled code, as input to the LLM to generate a binary code summary.

[0019] The beneficial effects of this invention are: (1) First, by covering and completing, filtering noise functions and reconstructing deep call relationships, an enhanced inter-process context centered on the objective function was constructed, laying a high-quality data foundation.

[0020] (2) Secondly, the dynamic attention mechanism of graph attention network is used to effectively aggregate inter-process topological features, and combined with CLIP dual encoder paradigm and symmetric loss function, the accurate alignment and generative retrieval of structured binary features and source code semantics in the latent space are realized.

[0021] (3) Finally, for the semantic fragments generated by the retrieval, consistency judgment and prompt word enhancement are performed based on the decompiled code, transforming the implicit screening process into explicit structured guidance, effectively removing the influence of noise in the candidate source code fragments on the quality of the summary, and generating the summary accurately and efficiently from the binary code. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of the overall framework of CAPD; Figure 2 A schematic diagram of the CCR module; Figure 3 This is a schematic diagram of an SDN module; Figure 4 Build a process for the dataset. Detailed Implementation

[0023] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. The embodiments described are only a part of the embodiments of the present invention and cannot encompass all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0024] The method in this embodiment mainly includes three core stages: enhanced inter-process context construction, cross-domain alignment based on graph attention enhancement, and semantic fragment denoising and summarization generation based on confidence. Its architecture is shown in the appendix. Figure 1 As shown.

[0025] I. Enhanced Inter-procedural Context Construction To address the issues of incomplete function entry point identification, control flow obfuscation, and interference from irrelevant code in the stripped binary code, this step constructs a topologically complete and semantically pure local call graph centered on the target function.

[0026] Coverage and Completion: When processing stripped binary data, IDAPro (a binary reverse engineering tool) often misses some function entries due to indirect jumps or non-standard compiler optimizations, resulting in missing CG nodes. To solve this problem, a control flow scanning strategy is adopted: First, all identified functions are traversed to construct a set of starting addresses of the covered basic blocks. Secondly, perform a deep scan of the entire program's instruction flow to extract the target address set of all jump instructions. Subsequently, the difference set is calculated. traversal The valid address in the code is used to directly call the API in IDAPro to force the creation of a function entity at the corresponding address, ensuring that no potential node functions are missed.

[0027] Noise function filtering: Not all identified functions have learning value. Two-level filtering is performed based on the features of the decompiled pseudocode: (1) Size filtering, setting a pseudocode word count threshold. (Initially set as) ), focusing on target code with clear semantic logic. (2). Noise removal: using regular expressions to analyze the pseudocode structure, identify and remove meaningless node functions. For example, thunk stub functions with " / / attributes:" in the header, function bodies containing only a single transfer / return statement, or functions that are too short and contain only ret instructions are all considered noise code. If these noise nodes enter CG, they will dilute the semantic representation ability of the model.

[0028] Deep Call Relationship Reconstruction: In the disassembly results after stripping the binary data, the target of the `call` instruction is sometimes not the actual logical function, but an intermediate jump function generated by the compiler. This invention designs a recursive address resolution algorithm. When the target address is identified as belonging to an intermediate jump function, it recursively resolves downwards along the jump chain, with a maximum tracing depth set to [value missing]. This process continues until the called function containing the actual assembly instructions is located, and the original indirect call edge is forcibly reset to a direct call edge, ensuring that the generated call graph strictly maps the actual execution logic inside the program.

[0029] The above steps successfully expanded the analytical perspective from isolated single functions to local networks containing upstream and downstream dependencies, laying a high-quality data foundation for the next section on aggregating inter-process semantic features using graph neural networks. The final output is an enhanced inter-process context. .

[0030] II. Cross-domain retrieval based on graph attention enhancement A graph attention-enhanced cross-domain retrieval module (CCR) is attached. Figure 2 As shown, this step first involves an enhanced binary encoder targeting the call context, where the inter-process context features are aggregated using the IP-GATv2 model. Second, this encoder is combined with a pre-trained source code encoder and pre-aligned training is performed using a CLIP-based dual encoder architecture. Finally, the pre-aligned converged binary encoder is frozen and used as a feature extractor in the source code generative model for generative cross-domain retrieval training.

[0031] (1) Construction of an enhanced binary encoder Node feature initialization layer: for graph any node in (Including the objective function and its neighbors), any node The assembly instruction sequence after disassembly and basic block linearization. First, CODEART (a state-of-the-art model for binary feature representation) is used as the encoder to extract the semantic features of its assembly instruction sequence: in This represents the feature vector of the node. The superscript 0 indicates that this feature vector will be used as the input of the 0th layer of the subsequent inter-process semantic aggregation network, i.e., the initial state. Inter-process semantic aggregation layer: Constructs the inter-process semantic aggregation network IP-GATv2, and connects target nodes. The set of neighboring nodes Divided into upstream , and downstream Construct the inter-process semantic aggregation network IP-GATv2, and calculate the first... Layer target node and its neighboring nodes Attention score and : Taking the upstream node Callers as an example, where This is a learnable weight vector used to project the high-dimensional features after the interaction into a scalar score; It is a non-linear activation function; and It is a learnable mapping matrix used to achieve asymmetric transformation and spatial alignment of features between the target node and its neighboring nodes.

[0032] Then, each is normalized using the Softmax function to obtain the attention weight coefficients: To aggregate semantic features, this invention introduces a multi-head attention mechanism (assuming the number of attention heads is ). This employs a feature fusion strategy with residual connections, introducing a ratio during inter-layer feature propagation. The Dropout mechanism prevents overfitting, and the nonlinear mapping is completed via the ELU activation function. The target node is at the The formula for updating the feature vector of a layer is: in, This is a vector concatenation operator under the multi-head attention mechanism, used to concatenate results; taking the upstream node Callers as an example. For the first Normalized coefficients under each attention head This is the corresponding feature mapping matrix; This is a learnable feature projection matrix. After... Iterative propagation of layers yields As the final output enhanced feature vector .

[0033] At this point, the enhanced binary encoder consisting of CODEART and IP-GATv2 cascaded together has been fully constructed.

[0034] (1) CLIP-based dual encoder pre-alignment training This stage combines the enhanced binary encoder built in the previous stage with the pre-trained source code feature extraction network into a dual encoder architecture. Through massive pairwise data constraints, the binary feature vectors converge towards the semantic distribution of the source code in the shared latent space.

[0035] Suppose a training batch contains For the sample ,in Corresponding to the number Enhanced inter-procedural context for binary functions for The corresponding source code.

[0036] Dual encoder architecture: Enhanced binary encoder: Input is context First, CODEART extracts the initial features of each node in the graph, then IP-GATv2 is used for neighbor aggregation, and the final output is an enhanced binary feature vector. The parameters are It participates in backpropagation training. Source code encoder: Input is... A pre-trained source code feature extraction network is used as the feature extractor, and the output is the source code feature vector. Its parameters Only in each iteration step Time Perform momentum update: in is the momentum coefficient. This design ensures that the representations of the two encoders maintain high temporal consistency across a large queue of negative samples in contrastive learning.

[0037] InfoNCE Contrastive Loss Function: The ultimate goal of CLIP training is to maximize the mutual information between the binary feature vector and the source code feature vector in the shared vector space. To improve the robustness of cross-modal alignment, this invention employs a symmetric InfoNCE loss function, defining the feature vector... and The cosine similarity between them is the metric: For the first in this batch binary feature vector of each sample In fact, the corresponding source code feature vectors are positive samples. The rest for All samples are negative. The actual loss of the samples includes two symmetric directions: Binary alignment source code: Source code to binary: in, and This is the loss function. This is the scaling factor.

[0038] The final loss function is: Through this training phase, the IP-GATv2 model, guided by the gradient of the InfoNCE loss function, overcomes the alignment bias caused by the original CODEART's focus on isolated objective functions, successfully transforming discrete inter-process contextual semantic information into a key gain that improves the cross-modal alignment accuracy of CLIP. This ultimately yields an enhanced binary encoder with converged cross-modal alignment. Its internal parameters are then frozen and used as a fixed feature extractor, directly integrated into the generative cross-domain retrieval task in the next section.

[0039] (2) Generative cross-domain retrieval based on feature projection In this stage, the enhanced binary encoder, which achieved cross-modal alignment and convergence in the previous stage, is used as a feature extractor to extract the feature vector of the objective function. The features are projected onto the feature vector space of the SCFM through the MLP layer. Then, the projected features are used as semantic prefixes and input into the parameter-frozen SCFM. This leverages the rich source code knowledge acquired by the source code-based model during its pre-training process to ultimately generate candidate source code fragments containing high-level semantic information of the target. The training process is as follows: Retrieval architecture: Encoder: Reuses an enhanced binary encoder converged via CLIP pre-alignment. To fully utilize the learned alignment knowledge while avoiding the destruction of converged model features in large-scale generation tasks, a parameter freezing strategy is adopted. Given the target binary function... The encoder outputs a binary feature vector that contains rich inter-process semantics and is highly aligned with the source code domain. MLP projection layer: Introducing a lightweight MLP projection layer to... Mapped to Decoder: Using CodeLlama-13B as the base model, to preserve the general programming knowledge (such as syntax structure and variable naming conventions) learned from massive source code corpora and to prevent catastrophic forgetting, all parameters of CodeLlama are completely frozen during training. .

[0040] Generative retrieval training: During training, the projected feature vectors Insert into the head of the input sequence of the source code base model. Assume the target source code sequence... The goal of training is to maximize the features given the binary context. The probability of generating this sequence under given conditions. Training employed a standard language modeling loss function, namely minimizing the negative log-likelihood loss: in, Indicates time The previously generated token sequence; Indicates the parameter set Defined conditional probability distribution; Indicates in Conditions are generated based on deep semantic constraints.

[0041] Through this process, the MLP projection layer learns to extract the feature vectors from the enhanced binary encoder. The tokens are translated into token embeddings that SCFM can understand, thereby generating semantically rich and readable source code semantic fragments. These fragments will serve as crucial contextual supplements in the candidate fragment denoising and final summary generation process described in step three.

[0042] III. Confidence-based semantic-aware denoising A confidence-based semantic-aware denoising (SDN) module is attached. Figure 3 As shown, to address the potential semantic noise issue in candidate fragments, this step makes the original implicit screening process explicit and structured. Through pre-classification and grading, it reduces the bias in summary generation caused by irrelevant semantic interference. It should be noted that the judgment criterion in this stage is still based on stripping away the decompiled code itself, without introducing any additional external prior information.

[0043] (1) Rule-based syntax cleaning First, a coarse-grained cleaning process is performed. In this stage, LLM is used to perform noise discrimination on candidate fragments based on syntax rules. The discrimination criteria are based on two core dimensions: (1) C language logic, whether the fragment contains legal control flow keywords (such as if, for, return), general variable types, language features, etc. in C language. (2) Understandability, whether the fragment has a programming intent that can be recognized by human programmers.

[0044] The candidate fragment is discarded if and only if it is a meaningless stack of symbols or a repetitive variable definition and assignment; otherwise, the analysis proceeds to the next stage.

[0045] (2) Consistency judgment This is the core step in this process, introducing an explicit discrimination step before digest generation. This step uses the removal of decompiled code as the sole baseline fact, performing consistency checks on each candidate fragment. Although the decompiled code itself has been removed, some highly semantic information such as strings and APIs may still be retained. The discrimination logic is as follows: High-value semantic extraction: First, scan the decompiled code to extract high-semantic features such as specific APIs, strings, and constants.

[0046] Conservative classification strategy: (1) If the decompiled code itself is semantically poor (lacking features), the system adopts a conservative strategy, marking all candidate segments as uncertain, to avoid incorrectly eliminating potentially correct logic when there is a lack of evidence. (2) If the decompiled code contains explicit features, the candidate segments are explicitly classified as high confidence, reference, or noise based on their overlap with these features.

[0047] This step, through rigorous semantic consistency verification, effectively filters out noisy fragments that conflict with the facts of the decompilation process, providing a high-confidence contextual basis for subsequent summary generation.

[0048] (3) Enhanced prompts based on hierarchical tags After screening and classification, instead of providing straightforward candidate fragments to the LLM, a structured Prompt with explicit confidence labels is constructed. The motivation for this design is to introduce manually defined inductive biases: (1) For F1 (high confidence): explicitly instructs the LLM that the fragment logic has passed consistency verification and can be used as the main source of information. Allows the LLM to directly utilize its high-level semantics (such as specific algorithm flow) to generate a summary. (2) For F2 (reference): explicitly instructs the LLM to only refer to its domain knowledge, such as variable naming style, structure member definition, and the meaning of specific macros, but strictly prohibits copying its specific code logic. (3) For F3 (uncertain): explicitly instructs the LLM that the fragment lacks strong evidence of correlation with the decompiled code and should be adopted with caution.

[0049] This step, through a process design of explicit classification followed by targeted guidance, does not substantially increase the total amount of semantic information, but significantly improves the signal-to-noise ratio and the degree of structure of the information, thus allowing LLM to focus more on the task of summarizing itself.

[0050] In another aspect, the present invention also provides a binary code digest generation system based on cross-domain semantic completion and denoising, for implementing the aforementioned binary code digest generation method, comprising the following modules: The Enhanced Interprocedural Context module is used to extract the neighborhood node context centered on the target function in the binary code, construct interprocedural call information, and serve as the enhanced interprocedural context of the target binary function.

[0051] The candidate source code fragment module is used to build a cross-domain semantic retrieval module based on graph attention enhancement. Based on the enhanced inter-process context, it obtains a set of candidate source code fragments that are semantically aligned with the target binary function.

[0052] The prompt word module is used to build a confidence-based semantic awareness denoising module, clean the candidate semantic segments, evaluate the consistency between the candidate segments and the objective function, and construct prompt words with explicit confidence labels.

[0053] The summary generation module is used to take prompt words as additional context for the target function decompiled code, and together with the target function decompiled code, as input to the LLM to generate a binary code summary.

[0054] Experimental environment This invention systematically reviews existing related work in the field of binary code understanding, and on this basis, expands the dataset on a large scale, ultimately collecting 91 open source C / C++ projects.

[0055] The specific process for building the dataset is shown in the attached figure. Figure 4 As shown in Table 1, all experiments in this invention (including model training and inference evaluation) were performed on a high-performance computing server to ensure the stability and reproducibility of the experimental results. The experimental platform was equipped with eight NVIDIA RTX A100 graphics cards (each with 80GB of video memory), supporting large-scale parallel training and inference. The specific experimental environment is shown in Table 1.

[0056] Table 1 Experimental Environment

[0057] The specific hyperparameters are shown in Table 2.

[0058] Table 2 Hyperparameter Settings

[0059] Experimental results To verify the effectiveness of the CAPD framework proposed in this invention for binary code digest generation tasks, systematic experiments were conducted in the X64_O2 compilation environment. The results are shown in Table 3. In addition to using LLM-Zero as the benchmark network for large language models, the experiments also compared it with traditional pre-training and fine-tuning work BinT5, as well as three cutting-edge works including CP-BCS, MiSum, and ProRec, which represent recent advancements in binary code digestion. The LLM used here is GPT-5.

[0060] Table 3 Experimental results under the X64_O2 compilation environment

[0061] Compared to the current best-performing benchmark model ProRec, the CAPD model (Ours) proposed in this invention significantly outperforms it in most core metrics. Specifically: In the text-similarity-based machine translation metric, CAPD improves BLEU-4 by 0.09, METEOR by 0.22, and ROUGE-L by 0.72. In the semantic evaluation metric based on semanticssimilarity, SIDE improves by 0.06. In the LLM-as-a-judge-based semantic evaluation metric, CAPD significantly improves Accuracy by 6.1% (0.5985 vs 0.5375), Coverage by 3.35% (0.3670 vs 0.3335), and Effectiveness by 5.9% (0.4835 vs 0.4245).

[0062] This demonstrates that by constructing an enhanced inter-process context and performing cross-domain retrieval, this method is more suitable for stripped binary code with severe information gaps in real-world scenarios, proving its effectiveness in solving the problem of semantic isolation of single functions and improving the accuracy of summary generation.

[0063] To further verify the independent contributions of each innovative module in the CAPD architecture, this invention conducted ablation experiments for comparison, and the results are shown in Table 4. Three model variants were designed for the ablation experiments: M1 (the baseline model using only LLM-Zero), M2 (a variant that introduces the CCR module), and M3 (a complete model that simultaneously introduces CCR and SDN).

[0064] Table 4 Ablation Experiment Results

[0065] As can be seen from the table, both core modules of this invention deliver stable and significant performance gains. Effectiveness of the CCR module (M1 vs M2): After introducing the CCR module, the model's accuracy jumped from 0.5415 to 0.5760, an improvement of 3.45%; ROUGE-L improved from 19.23 to 20.99. This fully demonstrates that using inter-process graph attention networks to aggregate contextual information can effectively compensate for the feature loss after removing binary code. Effectiveness of the SDN module (M2 vs M3): After further introducing the SDN module on top of M2, the model's accuracy improved again by 2.25% (reaching 0.5985), and Effectiveness improved by 2.05% (reaching 0.4835). This indicates that the confidence grading based on decompiled facts and the structured Prompt design successfully eliminated the potential noise introduced by cross-domain retrieval and suppressed the illusion problem of LLM.

[0066] In summary, M3 (Full Model) achieved optimal performance across all test metrics, demonstrating the complementary and indispensable synergistic optimization role of CCR and SDN modules in the entire cross-domain semantic completion and denoising framework.

[0067] The above description is merely a detailed explanation of preferred embodiments and principles of the present invention. For those skilled in the art, there may be changes in specific implementation methods based on the ideas provided by the present invention, and these changes should also be considered within the scope of protection of the present invention.

Claims

1. A method for binary code summary generation based on cross-domain semantic completion and denoising, characterized in that, Includes the following steps: S1, extract the neighborhood nodes context centered on the target function in the binary code, build the inter-process call information as the enhanced inter-process context of the target binary function ; S2. Construct a cross-domain semantic retrieval module based on graph attention enhancement, using enhanced inter-process context. This yields a set of candidate source code fragments semantically aligned with the target binary function; S3. Construct a confidence-based semantic awareness denoising module to clean candidate semantic segments, evaluate the consistency between candidate segments and the objective function, and construct prompt words with explicit confidence labels. S4. Use the Prompt as an additional context for the decompiled code of the target function, and use it together with the decompiled code of the target function as input to the LLM to generate a binary code digest.

2. The binary code digest generation method based on cross-domain semantic completion and denoising according to claim 1, characterized in that, Step S1 is specifically implemented as follows: extracting the context of the neighboring nodes of Callers and Callees centered on the target function; constructing semantically complete inter-procedural call information on the basis of the function call graph CG through coverage completion, noise function filtering, and deep call relationship reconstruction, as an enhanced inter-procedural context of the target binary function. .

3. The binary code digest generation method based on cross-domain semantic completion and denoising according to claim 2, characterized in that, The implementation process of the cross-domain semantic retrieval module based on graph attention enhancement is as follows: S2.1 Construct an enhanced binary encoder with enhanced inter-procedural context. As input, the layer is first initialized using node features. Initialize and extract features for each node function; Next, the inter-process semantic aggregation layer receives the initial features, dynamically evaluates the asymmetric attention coefficient based on the call edge relationship between the target node and neighboring nodes, and then weights and aggregates the features of the neighboring nodes to the target node based on this coefficient, ultimately producing an enhanced binary feature vector. For output; S2.2, Combine the enhanced binary encoder with the pre-trained source code feature extraction network, respectively using... With corresponding source code As input, feature vectors are extracted respectively. and By calculating the cosine similarity between the two as the loss function for reverse training, the final output is an enhanced binary encoder that converges across modalities; S2.3, Eigenvectors The projected features are projected into the feature vector space of the source code generative model through the MLP layer. The projected features are used as semantic prefixes to guide the conditional generation, and finally a set of candidate source code fragments that are highly related to the semantics of the target binary function is output.

4. The binary code digest generation method based on cross-domain semantic completion and denoising according to claim 3, characterized in that, The specific implementation process of constructing the enhanced binary encoder is as follows: Node feature initialization layer: For any node in any node The assembly instruction sequence after disassembly and basic block linearization. First, CODEART is used as an encoder to extract the semantic features of the assembly instruction sequence. This serves as the input to layer 0 of the subsequent inter-process semantic aggregation network, i.e., the initial state. Inter-process semantic aggregation layer: This layer aggregates target nodes. The set of neighboring nodes Divided into upstream , and downstream For Callers, construct the inter-process semantic aggregation network IP-GATv2 to calculate the... Layer target node and its neighboring nodes Attention score : in, This is a learnable weight vector used to project the high-dimensional features after the interaction into a scalar score; It is a non-linear activation function; and It is a learnable mapping matrix; Subsequently, The asymmetric attention coefficients are obtained by normalization using the Softmax function. For Callees, the asymmetric attention coefficient Calculation and same; For Callers, set the number of attention heads to [value]. Each head performs parallel computation, and the results are concatenated. A multi-head attention mechanism employs a feature fusion strategy with residual connections, introduces Dropout during inter-layer feature propagation, and completes non-linear mapping via the ELU activation function to obtain... The target node is at the The formula for updating the feature vector of a layer is: in, It is a vector concatenation operator under the multi-head attention mechanism, used to fuse multi-dimensional topological association features; For the first Normalized coefficients under each attention head This is the corresponding feature mapping matrix; for Callees, Calculation and same; The learnable feature projection matrix is ​​processed by Iterative propagation of layers yields As the final output enhanced feature vector .

5. The binary code digest generation method based on cross-domain semantic completion and denoising according to claim 4, characterized in that, Step S2.2 is specifically implemented as follows: the constructed enhanced binary encoder is combined with the pre-trained source code feature extraction network to form a dual encoder architecture, and CLIP pre-alignment training is performed using paired data. Suppose a training batch contains For the sample ,in Corresponding to the number Enhanced inter-procedural context for binary functions for The corresponding source code; Dual encoder architecture: Enhanced binary encoder: Composed of CODEART and IP-GATv2 cascaded, with parameters as follows It participates in backpropagation training; the input is the context. The final output is a feature vector. ; Source code encoder: Input is A pre-trained source code feature extraction network is used as the feature extractor, and the output is the source code feature vector. Its parameters Only in each iteration step Time Perform momentum update: in This is the momentum coefficient.

6. The binary code digest generation method based on cross-domain semantic completion and denoising according to claim 5, characterized in that, The specific implementation of step S3 is as follows: S3.

1. A semantic denoising and confidence grading technique based on decompilation features is proposed. First, the candidate source code fragments are syntactically cleaned. Then, APIs, strings and constants in the decompiled code of the target function are extracted as fact anchors. Finally, the cleaned candidate source code fragments are compared with the fact anchors. Based on the fact anchors, the candidate fragments are marked into four levels: high confidence, reference, uncertainty and noise by LLM, and the hierarchical semantic fragments are finally output. S3.2 Receive the hierarchical semantic fragments output by S3.1, attach explicit labels according to different levels, and finally construct a structured Prompt, which is used as the input for subsequent LLM.

7. A binary code digest generation system based on cross-domain semantic completion and denoising, used to implement the binary code digest generation method according to any one of claims 1 to 6, characterized in that, Includes the following modules: The enhanced inter-procedural context module is used to extract the neighborhood node context centered on the target function in the binary code, construct inter-procedural call information, and serve as the enhanced inter-procedural context of the target binary function. The candidate source code fragment module is used to construct a cross-domain semantic retrieval module based on graph attention enhancement. Based on the enhanced inter-process context, it obtains a set of candidate source code fragments that are semantically aligned with the target binary function. The prompt word module is used to build a confidence-based semantic awareness denoising module, clean the candidate semantic segments, evaluate the consistency between the candidate segments and the objective function, and construct prompt words with explicit confidence labels. The summary generation module is used to take prompt words as additional context for the target function decompiled code, and together with the target function decompiled code, as input to the LLM to generate a binary code summary.

Images