Beyond rules: leveraging Large Language Models for code-data separation in binary disassembly

Static binary analysis serves as a critical technique for identifying security vulnerabilities in binaries without source code access. The first step of static binary analysis is disassembly, which involves deconstructing the binary file to identify code and data instructions (also known as the code-data separation problem). Current methods for code-data separation assume a fixed or standard file format of the binary file. However, with the proliferation of Internet-of-Things (IoT) devices, new non-standard file formats, which do not conform to a fixed format, are becoming prevalent. This presents a hurdle in performing binary analysis tasks (e.g., detecting security flaws, malware classification, license obligations) for such non-standard file formats. In this work, we examine the code and data distributions for standard and non-standard file formats. Our analysis indicates a distribution shift between standard and non-standard file formats, motivating the need to tackle code-data separation for non-standard file formats. We approach this problem as an unsupervised domain adaptation problem by proposing a pseudo-labeling approach based on Large Language Models. Our best model achieves high performance on standard binary files (F1-Score = 0.99) and non-standard binary files (F1-Score = 0.95). Finally, we discuss our findings and the limitations of our approach.

Name thesis:degree_name

M.S.

Level thesis:degree_level

Thesis

Discipline thesis:degree_discipline

Computer Science

Grantor

University of Illinois at Urbana-Champaign

Year dc:date

2024

Author dc:creator

• Diwan, Nirav

Contributors dc:contributor

• Wang, Gang

• Large Language Models
• Binary Analysis
• Code-data Separation
• Unsupervised Domain Adaptation
• Security

Statement dc:rights

• Copyright 2024 Nirav Diwan

Language dc:language

en, eng

Handle dc:identifier

https://hdl.handle.net/2142/124607

OAI record oai:identifier

https://www.ideals.illinois.edu/oai-pmh?verb=GetRecord&metadataPrefix=etdms&identifier=oai%3Awww.ideals.illinois.edu%3A2142%2F124607