Transfer learning strategies for vulnerability detection in software binaries.

Area of Science:

• Computer Science
• Software Engineering
• Cybersecurity

Background:

• Detecting vulnerabilities in closed-source software necessitates binary code analysis due to unavailability of source code.
• Transformer models from Natural Language Processing (NLP) are increasingly used for their context-awareness in code analysis.
• Current methods often focus on similarity detection, lacking robust frameworks for direct vulnerability classification in binary code.

Purpose of the Study:

• Investigate transfer learning strategies for optimizing transformer models in Binary Code Vulnerability Detection (BCVD).
• Establish clear frameworks for adapting NLP transformers to the BCVD domain.
• Provide a comprehensive benchmark and comparative analysis for BCVD methods.

Main Methods:

• Assessed three transformer adaptation methods: Full Sequence Fine-Tuning, Token-Level Fine-Tuning, and Frozen Feature Extraction.
• Utilized four diverse datasets covering x86/ARM architectures and Linux/Windows platforms.
• Developed VulnBin, a heterogeneous benchmark dataset for robust BCVD evaluation.
• Compared code-specialized vs. general-purpose transformers and benchmarked against existing BCVD techniques.

Main Results:

• All three transfer learning strategies demonstrated similar vulnerability detection performance.
• Frozen Feature Extraction achieved comparable results to other methods while requiring fewer computational resources.
• Code-pretrained transformers consistently outperformed text-pretrained models.
• Context-aware embeddings proved more effective at capturing vulnerability semantics than static representations.
• Evaluation across different projects revealed generalization gaps not apparent in random-split benchmarks, highlighting distribution shift challenges.

Conclusions:

• Transfer learning is effective for adapting transformers to BCVD, with frozen feature extraction being resource-efficient.
• Code-pretrained transformers and context-aware embeddings are crucial for improved BCVD performance.
• Distribution shift poses a significant, under-explored challenge in BCVD research that requires further investigation.