Neural decompilation improves vulnerability detection in executable programs
VulDec: Vulnerability Detection in Binaries via Neural Decompilation
Cryptography and SecurityMachine LearningSoftware Engineering
Summary
Finding security problems in software when only the machine code is available is hard because this code is low-level and hard to understand. The authors created a big dataset that matches machine code with the original source code and highlights where vulnerabilities occur. They trained neural network models to turn machine code back into source code and then detect vulnerabilities with reasonable accuracy. Their work shows that turning machine code back into source code helps find security issues better than looking at the low-level code alone.
What this means in practice
- •For security analysts: Improve detection of vulnerabilities in compiled software by using neural models that recover and analyze source-level code from binaries.
- •For software reverse engineers: Use neural decompilation techniques to better understand assembly code and identify potential security flaws across different processor architectures.
Authors
Francesco Crescenzo Grasso, Pietro Liguori, Roberto Natella, Domenico Cotroneo
Abstract
Automated vulnerability detection in binary executables is challenging due to the lack of source code and the limited semantic information available at the assembly level. Despite significant progress in machine-learning-based code analysis, the field still lacks methodologies and large, high-quality datasets that provide vulnerable code jointly at assembly- and source-level with precise vulnerability labels. To address this gap, we introduce VulDec, consisting of (i) a new large-scale, carefully curated dataset aligning real-world Assembly-C function pairs with detailed CWE annotations across multiple architectures, and (ii) the first end-to-end framework that leverages neural decompilation for binary vulnerability detection. Tuned LLM-based neural decompilers trained on our dataset achieve strong source-level recovery across architectures (Edit Similarity of approximately 56%, BLEU-4 of approximately 43%), while our tuned LLM-based detectors reach a macro F1-score of 0.61 on an in-distribution realistic test set (3% vulnerability rate). Our findings provide evidence that neural decompilation offers a powerful alternative to conventional low-level binary representations, facilitating robust binary vulnerability detection.