.png){kind=icon}
返回
SA2Pat: enhancing binary security patch function localization via security advisory-guided LLMs
.png){kind=icon}
PRE
AI
DOI：10.1007/s10664-026-10942-z.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
In modern software supply chains, security patch function localization seeks to establish a precise correlation between a Common Vulnerabilities and Exposures (CVE) entry and the function in the codebase that contains its patch. Existing approaches predominantly rely on source code information. Thus, when security audits must be conducted directly on binary files, traditional source-code-based localization methods become ineffective. To address this gap, we propose SA2Pat (Security Advisory to Patch), a framework that accurately localizes security patches by learning from patterns in historical vulnerability fixes. SA2Pat first utilizes IDA Pro and BinDiff to identify pairs of modified functions between vulnerable and patched binaries. It then treats the security advisory text as a query to retrieve reference samples from a constructed external knowledge base containing historical vulnerability patches, thereby guiding a large language model (LLM) to locate the patched function. To mitigate the frequent absence of Common Weakness Enumeration (CWE) IDs in security advisories, we employ a fine-tuned SecureBERT model to predict the likely CWE ID, ensuring that the input information remains complete. Experimental results on a dataset of 364 real-world CVEs—constructed by augmenting the PatchDiscovery benchmark with recent vulnerability patches—indicate that SA2Pat improves the F1-score by 19.35 percentage points over baseline methods. An ablation study shows that removing the reference samples decreases the F1-score by 16.6 percentage points, while removing CWE information reduces it by 4.8 percentage points, demonstrating that both components contribute critically to performance. When the oracle CWE is replaced by the SecureBERT classifier’s prediction in an end-to-end setting, SA2Pat still attains an F1-score of 70.8%, close to the 72.2% under oracle CWE. Moreover, SA2Pat remains effective across different LLM backbones.
Keyword:
Security patch function localization
LLM
Program analysis
Patch presence test
Software supply chain
期刊
IF:
3.6
论文数:
2.0K
被引数:
5.3K
机构
引用论文
.png){kind=icon}
Pairing Security Advisories with Vulnerable Functions Using Open-Source LLMs使用开源大语言模型将安全咨询与易受攻击函数进行配对
PREAI
分享收藏分享收藏
查看更多内容