On Training a Neural Network to Explain Binaries (2404.19631v1)

Abstract: In this work, we begin to investigate the possibility of training a deep neural network on the task of binary code understanding. Specifically, the network would take, as input, features derived directly from binaries and output English descriptions of functionality to aid a reverse engineer in investigating the capabilities of a piece of closed-source software, be it malicious or benign. Given recent success in applying LLMs (generative AI) to the task of source code summarization, this seems a promising direction. However, in our initial survey of the available datasets, we found nothing of sufficiently high quality and volume to train these complex models. Instead, we build our own dataset derived from a capture of Stack Overflow containing 1.1M entries. A major result of our work is a novel dataset evaluation method using the correlation between two distances on sample pairs: one distance in the embedding space of inputs and the other in the embedding space of outputs. Intuitively, if two samples have inputs close in the input embedding space, their outputs should also be close in the output embedding space. We found this Embedding Distance Correlation (EDC) test to be highly diagnostic, indicating that our collected dataset and several existing open-source datasets are of low quality as the distances are not well correlated. We proceed to explore the general applicability of EDC, applying it to a number of qualitatively known good datasets and a number of synthetically known bad ones and found it to be a reliable indicator of dataset value.

• The paper introduces the Embedding Distance Correlation (EDC) method to objectively assess dataset quality for binary code summarization.
• The research demonstrates that large, heterogeneous datasets often fail to provide precise code-description pairs necessary for effective neural network training.
• The study reveals that off-the-shelf models like ChatGPT require substantial fine-tuning and tailored datasets to successfully explain binary code.

A Deep Dive into Evaluating Datasets for Binary Code Summarization using LLMs

Introduction to Binary Code Summarization

Binary code summarization aims to describe the function of a piece of binary code in understandable English. This could greatly assist reverse engineers, who currently rely on labor-intensive manual processes. LLMs hold potential in automating this, but the success heavily depends on the quality of the datasets used for training these models.

Evaluating Dataset Suitability

The core challenge here is finding or crafting datasets that accurately and consistently pair binary code with comprehensible, precise English descriptions of their functionality. The traditional datasets often fall short due to:

• Inadequate Descriptions: Descriptions might be overly simplistic or at the wrong semantic level, like pseudocode.
• Insufficient Examples: Small datasets often do not capture the complex variability needed to understand binary code.
• Compatibility Issues: Many existing datasets are not tailored for the unique challenges posed by binary code.

The Stack Overflow Inspired Dataset Creation

Recognizing these gaps, researchers attempted to create a new dataset by leveraging the extensive programming discussions in Stack Overflow. By parsing, validating, and compiling code snippets into executable binaries paired with textual descriptions, they generated a new dataset of over 73,209 samples. Unfortunately, the sheer number and diversity of snippets didn't automatically translate into quality data suitable for training robust models.

Embedding Distance Correlation Method

To assess the quality of datasets independently from the models, the Embedding Distance Correlation (EDC) method was introduced. This novel approach checks if the dataset can effectively represent the relationship between binary codes and their explanations. It involves:

1. Generating embeddings for binary codes and their English descriptions.
2. Calculating and comparing distances within these embeddings.
3. Analyzing the correlation between these distances to evaluate dataset learnability.

Results from EDC Application

Unfortunately, the application of EDC revealed that even newly created datasets demonstrated weak correlations between binary embeddings and their English descriptions. Such findings underscore the complexity of the task and suggest that simply having a large number of examples doesn’t ensure dataset quality. The researchers also applied EDC to other existing datasets with similarly discouraging results.

Human Expert Analysis

Supplementing their EDC evaluations, researchers included a manual review by experts, which largely confirmed the inadequacies suggested by the EDC results. The human reviewers often disagreed with the proximity scores generated by the embeddings, signaling mismatches between the dataset contents and their potential utility for training models.

Experimenting with Off-the-Shelf Models

Given the recent prominence of models like ChatGPT, researchers also explored whether these ready-made models could handle binary code summarization without specific training. The results were predominantly negative, showcasing that these models could not effectively generalize to such specialized tasks without substantial fine-tuning and suitable datasets.

Moving Forward

While the created datasets were not effective, the journey offers valuable insights. The EDC method itself is a significant contribution, providing a tool to evaluate the potential learnability of datasets objectively. Future work will explore refining datasets, possibly by enhancing or filtering existing samples to better suit the summarization task.

Conclusion

The quest to automate binary code summarization with LLMs is just beginning. It’s clear from this research that the successful application of AI in this field hinges on the quality of available training data. Moreover, the development of robust evaluation methods like EDC will be crucial in guiding and improving future dataset creation and model training efforts.