Scholarlink

<p>In modern software supply chains, security patch function localization seeks to establish a precise correlation between a Common Vulnerabilities and Exposures (CVE) entry and the function in the codebase that contains its patch. Existing approaches predominantly rely on source code information. Thus, when security audits must be conducted directly on binary files, traditional source-code-based localization methods become ineffective. To address this gap, we propose SA2Pat (Security Advisory to Patch), a framework that accurately localizes security patches by learning from patterns in historical vulnerability fixes. SA2Pat first utilizes IDA Pro and BinDiff to identify pairs of modified functions between vulnerable and patched binaries. It then treats the security advisory text as a query to retrieve reference samples from a constructed external knowledge base containing historical vulnerability patches, thereby guiding a large language model (LLM) to locate the patched function. To mitigate the frequent absence of Common Weakness Enumeration (CWE) IDs in security advisories, we employ a fine-tuned SecureBERT model to predict the likely CWE ID, ensuring that the input information remains complete. Experimental results on a dataset of 364 real-world CVEs—constructed by augmenting the PatchDiscovery benchmark with recent vulnerability patches—indicate that SA2Pat improves the F1-score by 19.35 percentage points over baseline methods. An ablation study shows that removing the reference samples decreases the F1-score by 16.6 percentage points, while removing CWE information reduces it by 4.8 percentage points, demonstrating that both components contribute critically to performance. When the oracle CWE is replaced by the SecureBERT classifier’s prediction in an end-to-end setting, SA2Pat still attains an F1-score of 70.8%, close to the 72.2% under oracle CWE. Moreover, SA2Pat remains effective across different LLM backbones.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

SA2Pat: enhancing binary security patch function localization via security advisory-guided LLMs

  • 期刊论文

  • 发表日期：

    2026年8月3日

查看全文
  • Zetan Li,
  • Xiaoya Zhu,
  • Zhuo Li,
  • Min Li,
  • Cong Li,
  • Xiaokang Yin,
  • Yaobin Xie,
  • Shengli Liu

摘要

In modern software supply chains, security patch function localization seeks to establish a precise correlation between a Common Vulnerabilities and Exposures (CVE) entry and the function in the codebase that contains its patch. Existing approaches predominantly rely on source code information. Thus, when security audits must be conducted directly on binary files, traditional source-code-based localization methods become ineffective. To address this gap, we propose SA2Pat (Security Advisory to Patch), a framework that accurately localizes security patches by learning from patterns in historical vulnerability fixes. SA2Pat first utilizes IDA Pro and BinDiff to identify pairs of modified functions between vulnerable and patched binaries. It then treats the security advisory text as a query to retrieve reference samples from a constructed external knowledge base containing historical vulnerability patches, thereby guiding a large language model (LLM) to locate the patched function. To mitigate the frequent absence of Common Weakness Enumeration (CWE) IDs in security advisories, we employ a fine-tuned SecureBERT model to predict the likely CWE ID, ensuring that the input information remains complete. Experimental results on a dataset of 364 real-world CVEs—constructed by augmenting the PatchDiscovery benchmark with recent vulnerability patches—indicate that SA2Pat improves the F1-score by 19.35 percentage points over baseline methods. An ablation study shows that removing the reference samples decreases the F1-score by 16.6 percentage points, while removing CWE information reduces it by 4.8 percentage points, demonstrating that both components contribute critically to performance. When the oracle CWE is replaced by the SecureBERT classifier’s prediction in an end-to-end setting, SA2Pat still attains an F1-score of 70.8%, close to the 72.2% under oracle CWE. Moreover, SA2Pat remains effective across different LLM backbones.