StriderSPD: Structure-Guided Joint Representation Learning for Binary Security Patch Detection

Qingyuan Li

doi:10.1109/tse.2026.3747569

StriderSPD: Structure-Guided Joint Representation Learning for Binary Security Patch Detection

2026-10-26

0

PRE

AI

DOI：10.1109/tse.2026.3747569

Original

Save

Abstract

En 中文

Vulnerabilities severely threaten software systems, making the timely application of security patches crucial for mitigating attacks. However, software vendors often silently patch vulnerabilities with limited disclosure, where Security Patch Detection (SPD) comes to protect software assets. Recently, most SPD studies have targeted Open-Source Software (OSS), yet a large portion of real-world software is closed-source, where patches are distributed as binaries without accessible source code. The limited binary SPD approaches often lift binaries to abstraction levels, i.e., assembly code or pseudo-code. However, assembly code is register-based instructions conveying limited semantics, while pseudo-code lacks parser-compatible grammar to extract structure, both hindering accurate vulnerability-fix representation learning. In addition, previous studies often obtain training and testing data from the same project for evaluation, which fails to reflect closed-source conditions. To alleviate the above challenges, we propose StriderSPD, a Structure-guided joint representation SPD framework of binary code that integrates a graph branch into a large language model (LLM), leveraging structural information to guide the LLM in identifying security patches. Our novel adapters project the graph representation into the LLM’s latent space and inject it into token-level attention. We further present a two-stage training strategy to address the optimization imbalance caused by the large parameter disparity between StriderSPD’s two branches, enabling proper branch fitting. To enable more realistic evaluation, we construct a binary SPD benchmark that is disjoint from prior datasets in both projects and domains and extensively evaluate StriderSPD on this benchmark. Experimental results show that StriderSPD achieves the best effectiveness while maintaining practicality, surpassing the best-performing baseline by 12.66% in accuracy, with only 0.67s average inference latency and a total cost of $21.62. Furthermore, StriderSPD generalizes well across different LLMs, improving multiple models from the Llama, Qwen, and DeepSeek families.

Keywords:

Security Patch Detection

Binary Program Analysis

Graph Representation

Large Language Model

StriderSPD: Structure-Guided Joint Representation Learning for Binary Security Patch Detection

Abstract

Journal

Organization

Cited Papers