스트립 바이너리에서 보안 취약점 탐지를 위한 LLM 기반 프레임워크 = LLM-Based Detection Framework of Vulnerabilities in Stripped Binaries

다국어 초록 (Multilingual Abstract)

Stripped binaries have debugging information removed, making it difficult to directly apply existing source code-based static analysis techniques. To address this challenge, this paper proposes a framework for detecting memory vulnerabilities in stripped binaries using large language models. The proposed framework decompiles stripped binaries into pseudocode using Ghidra, then extracts data flow paths from memory deallocation functions to allocation functions through backward slicing, using deallocation functions as reference points. Attention markers are inserted at memory allocation and deallocation points in the extracted code to guide the LLM to focus on critical locations during vulnerability detection analysis. Finally, vulnerability type-specific prompts are generated to classify vulnerable bug classes and patterns through few-shot inference without fine-tuning. Experimental results demonstrate an overall accuracy of 83.6% on 1,996 samples, proving the feasibility of detecting CWE-415(Double Free) and CWE-416(Use-After-Free) vulnerabilities in stripped binaries through prompt engineering without model training.