Benjamin Fung

FIN: Boosting binary code embedding by normalizing function inlinings

Mohammadhossein Amouei

Benjamin Fung

Philippe Charland

2025-12-31

Journal of Systems and Software (published)

doi.org

PAC-X: Fuzzy Explainable AI for Multi-Class Malware Detection

Mohd Saqib

Benjamin Fung

Philippe Charland

2025-12-31

IEEE Trans. Fuzzy Syst. (published)

doi.org

MalGPT: A Generative Explainable Model for Malware Binaries

Mohd Saqib

Benjamin Fung

Steven H. H. Ding

Philippe Charland

2025-09-30

Lecture Notes in Computer Science (published)

doi.org

MalGPT: A Generative Explainable Model for Malware Binaries

Mohd Saqib

Benjamin Fung

Steven H. H. Ding

Philippe Charland

2025-09-30

Lecture Notes in Computer Science (published)

doi.org

Beyond Embeddings: Interpretable Feature Extraction for Binary Code Similarity

Charles E. Gagnon

Steven H. H. Ding

Philippe Charland

Benjamin Fung

Binary code similarity detection is a core task in reverse engineering. It supports malware analysis and vulnerability discovery by identify… (see more)ing semantically similar code in different contexts. Modern methods have progressed from manually engineered features to vector representations. Hand-crafted statistics (e.g., operation ratios) are interpretable, but shallow and fail to generalize. Embedding-based methods overcome this by learning robust cross-setting representations, but these representations are opaque vectors that prevent rapid verification. They also face a scalability-accuracy trade-off, since high-dimensional nearest-neighbor search requires approximations that reduce precision. Current approaches thus force a compromise between interpretability, generalizability, and scalability. We bridge these gaps using a language model-based agent to conduct structured reasoning analysis of assembly code and generate features such as input/output types, side effects, notable constants, and algorithmic intent. Unlike hand-crafted features, they are richer and adaptive. Unlike embeddings, they are human-readable, maintainable, and directly searchable with inverted or relational indexes. Without any matching training, our method respectively achieves 42% and 62% for recall@1 in cross-architecture and cross-optimization tasks, comparable to embedding methods with training (39% and 34%). Combined with embeddings, it significantly outperforms the state-of-the-art, demonstrating that accuracy, scalability, and interpretability can coexist.

2025-09-27

ArXiv (preprint)

arxiv.org

Beyond Embeddings: Interpretable Feature Extraction for Binary Code Similarity

Charles E. Gagnon

Steven H. H. Ding

Philippe Charland

Benjamin Fung

Binary code similarity detection is a core task in reverse engineering. It supports malware analysis and vulnerability discovery by identify… (see more)ing semantically similar code in different contexts. Modern methods have progressed from manually engineered features to vector representations. Hand-crafted statistics (e.g., operation ratios) are interpretable, but shallow and fail to generalize. Embedding-based methods overcome this by learning robust cross-setting representations, but these representations are opaque vectors that prevent rapid verification. They also face a scalability-accuracy trade-off, since high-dimensional nearest-neighbor search requires approximations that reduce precision. Current approaches thus force a compromise between interpretability, generalizability, and scalability. We bridge these gaps using a language model-based agent to conduct structured reasoning analysis of assembly code and generate features such as input/output types, side effects, notable constants, and algorithmic intent. Unlike hand-crafted features, they are richer and adaptive. Unlike embeddings, they are human-readable, maintainable, and directly searchable with inverted or relational indexes. Without any matching training, our method respectively achieves 42% and 62% for recall@1 in cross-architecture and cross-optimization tasks, comparable to embedding methods with training (39% and 34%). Combined with embeddings, it significantly outperforms the state-of-the-art, demonstrating that accuracy, scalability, and interpretability can coexist.

2025-09-27

ArXiv (preprint)

arxiv.org