{"id":"https://openalex.org/W4409664068","doi":"https://doi.org/10.1145/3731449","title":"FoC: Figure Out the Cryptographic Functions in Stripped Binaries with LLMs","display_name":"FoC: Figure Out the Cryptographic Functions in Stripped Binaries with LLMs","publication_year":2025,"publication_date":"2025-04-22","ids":{"openalex":"https://openalex.org/W4409664068","doi":"https://doi.org/10.1145/3731449"},"language":"en","primary_location":{"id":"doi:10.1145/3731449","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3731449","pdf_url":null,"source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5038253295","display_name":"Xiuwei Shang","orcid":"https://orcid.org/0009-0009-6660-9947"},"institutions":[{"id":"https://openalex.org/I126520041","display_name":"University of Science and Technology of China","ror":"https://ror.org/04c4dkn09","country_code":"CN","type":"education","lineage":["https://openalex.org/I126520041","https://openalex.org/I19820366"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Xiuwei Shang","raw_affiliation_strings":["University of Science and Technology of China, Hefei, China"],"raw_orcid":"https://orcid.org/0009-0009-6660-9947","affiliations":[{"raw_affiliation_string":"University of Science and Technology of China, Hefei, China","institution_ids":["https://openalex.org/I126520041"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102956146","display_name":"Guoqiang Chen","orcid":"https://orcid.org/0000-0003-0651-6617"},"institutions":[{"id":"https://openalex.org/I4210117825","display_name":"Beijing Research Institute of Mechanical and Electrical Technology","ror":"https://ror.org/02bjnsn63","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210117825"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guoqiang Chen","raw_affiliation_strings":["QI\u2010ANXIN Technology Research Institute, Beijing, China","QI-ANXIN Technology Research Institute, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-0651-6617","affiliations":[{"raw_affiliation_string":"QI\u2010ANXIN Technology Research Institute, Beijing, China","institution_ids":["https://openalex.org/I4210117825"]},{"raw_affiliation_string":"QI-ANXIN Technology Research Institute, Beijing, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5085001934","display_name":"Shaoyin Cheng","orcid":"https://orcid.org/0000-0002-3992-9509"},"institutions":[{"id":"https://openalex.org/I126520041","display_name":"University of Science and Technology of China","ror":"https://ror.org/04c4dkn09","country_code":"CN","type":"education","lineage":["https://openalex.org/I126520041","https://openalex.org/I19820366"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shaoyin Cheng","raw_affiliation_strings":["University of Science and Technology of China, Hefei, China and Anhui Province Key Laboratory of Digital Security, Hefei, China","University of Science and Technology of China, Anhui Province Key Laboratory of Digital Security, Hefei, China"],"raw_orcid":"https://orcid.org/0000-0002-3992-9509","affiliations":[{"raw_affiliation_string":"University of Science and Technology of China, Hefei, China and Anhui Province Key Laboratory of Digital Security, Hefei, China","institution_ids":["https://openalex.org/I126520041"]},{"raw_affiliation_string":"University of Science and Technology of China, Anhui Province Key Laboratory of Digital Security, Hefei, China","institution_ids":["https://openalex.org/I126520041"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5018071549","display_name":"Shikai Guo","orcid":"https://orcid.org/0000-0002-8554-6365"},"institutions":[{"id":"https://openalex.org/I43313876","display_name":"Dalian Maritime University","ror":"https://ror.org/002b7nr53","country_code":"CN","type":"education","lineage":["https://openalex.org/I43313876"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shikai Guo","raw_affiliation_strings":["Dalian Maritime University, The Dalian Key Laboratory of Artificial Intelligence, Dalian, China"],"raw_orcid":"https://orcid.org/0000-0002-8554-6365","affiliations":[{"raw_affiliation_string":"Dalian Maritime University, The Dalian Key Laboratory of Artificial Intelligence, Dalian, China","institution_ids":["https://openalex.org/I43313876"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Yanming Zhang","orcid":"https://orcid.org/0009-0000-1554-2556"},"institutions":[{"id":"https://openalex.org/I126520041","display_name":"University of Science and Technology of China","ror":"https://ror.org/04c4dkn09","country_code":"CN","type":"education","lineage":["https://openalex.org/I126520041","https://openalex.org/I19820366"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yanming Zhang","raw_affiliation_strings":["University of Science and Technology of China, Hefei, China"],"raw_orcid":"https://orcid.org/0009-0000-1554-2556","affiliations":[{"raw_affiliation_string":"University of Science and Technology of China, Hefei, China","institution_ids":["https://openalex.org/I126520041"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5067689180","display_name":"Weiming Zhang","orcid":"https://orcid.org/0000-0001-5576-6108"},"institutions":[{"id":"https://openalex.org/I126520041","display_name":"University of Science and Technology of China","ror":"https://ror.org/04c4dkn09","country_code":"CN","type":"education","lineage":["https://openalex.org/I126520041","https://openalex.org/I19820366"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Weiming Zhang","raw_affiliation_strings":["University of Science and Technology of China, Hefei, China and Anhui Province Key Laboratory of Digital Security, Hefei, China","University of Science and Technology of China, Anhui Province Key Laboratory of Digital Security, Hefei, China"],"raw_orcid":"https://orcid.org/0000-0001-5576-6108","affiliations":[{"raw_affiliation_string":"University of Science and Technology of China, Hefei, China and Anhui Province Key Laboratory of Digital Security, Hefei, China","institution_ids":["https://openalex.org/I126520041"]},{"raw_affiliation_string":"University of Science and Technology of China, Anhui Province Key Laboratory of Digital Security, Hefei, China","institution_ids":["https://openalex.org/I126520041"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5064573190","display_name":"Nenghai Yu","orcid":"https://orcid.org/0000-0003-4417-9316"},"institutions":[{"id":"https://openalex.org/I126520041","display_name":"University of Science and Technology of China","ror":"https://ror.org/04c4dkn09","country_code":"CN","type":"education","lineage":["https://openalex.org/I126520041","https://openalex.org/I19820366"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Nenghai Yu","raw_affiliation_strings":["University of Science and Technology of China, Hefei, China and Anhui Province Key Laboratory of Digital Security, Hefei, China","University of Science and Technology of China, Anhui Province Key Laboratory of Digital Security, Hefei, China"],"raw_orcid":"https://orcid.org/0000-0003-4417-9316","affiliations":[{"raw_affiliation_string":"University of Science and Technology of China, Hefei, China and Anhui Province Key Laboratory of Digital Security, Hefei, China","institution_ids":["https://openalex.org/I126520041"]},{"raw_affiliation_string":"University of Science and Technology of China, Anhui Province Key Laboratory of Digital Security, Hefei, China","institution_ids":["https://openalex.org/I126520041"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":7,"corresponding_author_ids":["https://openalex.org/A5038253295"],"corresponding_institution_ids":["https://openalex.org/I126520041"],"apc_list":null,"apc_paid":null,"fwci":9.5286,"has_fulltext":false,"cited_by_count":5,"citation_normalized_percentile":{"value":0.97522399,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":98},"biblio":{"volume":"35","issue":"1","first_page":"1","last_page":"38"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11130","display_name":"Coding theory and cryptography","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11130","display_name":"Coding theory and cryptography","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10237","display_name":"Cryptography and Data Security","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10951","display_name":"Cryptographic Implementations and Security","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.727595865726471},{"id":"https://openalex.org/keywords/cryptography","display_name":"Cryptography","score":0.6446247696876526},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.39581498503685}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.727595865726471},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.6446247696876526},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.39581498503685}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3731449","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3731449","pdf_url":null,"source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G7513678713","display_name":null,"funder_award_id":"U20B2047, 62072421, 62002334, 62102386, and 62121002","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":90,"referenced_works":["https://openalex.org/W40327287","https://openalex.org/W74868156","https://openalex.org/W126407768","https://openalex.org/W1553308705","https://openalex.org/W1593271688","https://openalex.org/W2055117747","https://openalex.org/W2065995359","https://openalex.org/W2123301721","https://openalex.org/W2362855512","https://openalex.org/W2579698096","https://openalex.org/W2600463316","https://openalex.org/W2670925489","https://openalex.org/W2888698761","https://openalex.org/W2889354405","https://openalex.org/W2890703206","https://openalex.org/W2894732341","https://openalex.org/W2897937925","https://openalex.org/W2901689459","https://openalex.org/W2926178846","https://openalex.org/W2942259124","https://openalex.org/W2979826702","https://openalex.org/W2981852735","https://openalex.org/W2990714382","https://openalex.org/W2992048510","https://openalex.org/W3007413911","https://openalex.org/W3024871886","https://openalex.org/W3046379090","https://openalex.org/W3084397815","https://openalex.org/W3091730360","https://openalex.org/W3093415205","https://openalex.org/W3105926539","https://openalex.org/W3109206613","https://openalex.org/W3109716606","https://openalex.org/W3150583396","https://openalex.org/W3152962719","https://openalex.org/W3153698034","https://openalex.org/W3180995430","https://openalex.org/W3193654868","https://openalex.org/W3195235276","https://openalex.org/W3212166010","https://openalex.org/W4206741834","https://openalex.org/W4221141536","https://openalex.org/W4224308101","https://openalex.org/W4226278401","https://openalex.org/W4226485558","https://openalex.org/W4234627006","https://openalex.org/W4240061226","https://openalex.org/W4241670792","https://openalex.org/W4246774680","https://openalex.org/W4246788636","https://openalex.org/W4248746314","https://openalex.org/W4248799824","https://openalex.org/W4248950571","https://openalex.org/W4249672879","https://openalex.org/W4283013039","https://openalex.org/W4285417467","https://openalex.org/W4285490400","https://openalex.org/W4286494280","https://openalex.org/W4286795887","https://openalex.org/W4289388090","https://openalex.org/W4297974898","https://openalex.org/W4308469411","https://openalex.org/W4311887664","https://openalex.org/W4312415020","https://openalex.org/W4313203541","https://openalex.org/W4313598551","https://openalex.org/W4315746341","https://openalex.org/W4318562265","https://openalex.org/W4324007217","https://openalex.org/W4365806382","https://openalex.org/W4376607756","https://openalex.org/W4376652621","https://openalex.org/W4380993527","https://openalex.org/W4381050433","https://openalex.org/W4381050443","https://openalex.org/W4388412504","https://openalex.org/W4388483715","https://openalex.org/W4388631682","https://openalex.org/W4388867283","https://openalex.org/W4399793829","https://openalex.org/W4403536423","https://openalex.org/W4404584824","https://openalex.org/W4406416869","https://openalex.org/W4408750175","https://openalex.org/W6749694362","https://openalex.org/W6780819823","https://openalex.org/W6810081322","https://openalex.org/W6861772092","https://openalex.org/W6898505805","https://openalex.org/W6997522785"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W4396701345","https://openalex.org/W2376932109","https://openalex.org/W2060145807","https://openalex.org/W4248806346"],"abstract_inverted_index":{"Analyzing":[0],"the":[1,31,50,97,134,152,215,223,230,277,285],"behavior":[2],"of":[3,36,46,53,136,178,185,191,234,287],"cryptographic":[4,37,64,115,137,180,187,250,288,304],"functions":[5,100,116,138,181],"in":[6,18,56,117,139,203,242,283,301,316],"stripped":[7,118],"binaries":[8,57],"is":[9,16,144],"a":[10,102,161,183,248,297],"challenging":[11],"but":[12],"essential":[13],"task,":[14],"which":[15,75,143,170],"crucial":[17],"software":[19],"security":[20],"fields":[21],"such":[22,206],"as":[23,207],"malware":[24],"analysis":[25,41,322],"and":[26,49,79,113,232,237,253,323],"legacy":[27],"code":[28,163],"inspection.":[29],"However,":[30],"inherent":[32],"high":[33],"logical":[34],"complexity":[35],"algorithms":[38],"makes":[39],"their":[40,77],"more":[42],"difficult":[43,198],"than":[44],"that":[45,105],"ordinary":[47],"code,":[48,205],"general":[51],"absence":[52],"symbolic":[54],"information":[55],"exacerbates":[58],"this":[59,243],"challenge.":[60],"Existing":[61],"methods":[62,295],"for":[63,222,262],"algorithm":[65],"identification":[66],"frequently":[67],"rely":[68],"on":[69,151,276],"data":[70],"or":[71],"structural":[72],"pattern":[73],"matching,":[74],"limits":[76],"generality":[78],"effectiveness":[80],"while":[81],"requiring":[82],"substantial":[83],"manual":[84],"effort.":[85],"In":[86,120,213],"response":[87],"to":[88,111,132,147,173,199,225,238,258],"these":[89,235,307],"challenges,":[90],"we":[91,122,158,245],"present":[92],"F":[93],"igure":[94],"o":[95],"ut":[96],"C":[98],"ryptographic":[99],"(FoC),":[101],"novel":[103],"framework":[104],"leverages":[106],"Large":[107],"Language":[108],"Models":[109],"(LLMs)":[110],"identify":[112],"analyze":[114],"binaries.":[119],"FoC,":[121],"first":[123],"build":[124],"an":[125,255],"LLM-based":[126],"generative":[127,192],"model":[128,166,193],"(":[129,167],"FoC-BinLLM":[130,195,271],")":[131],"summarize":[133],"semantics":[135,286],"natural":[140],"language":[141],"form,":[142],"intuitively":[145],"readable":[146],"analysts.":[148],"Subsequently,":[149],"based":[150],"semantic":[153,260],"insights":[154],"provided":[155],"by":[156,210,219,274],"FoC-BinLLM,":[157],"further":[159,240],"develop":[160],"binary":[162,204,251,264],"similarity":[164],"detection":[165],"FoC-Sim":[168,220,290],"),":[169],"allows":[171],"analysts":[172],"effectively":[174],"retrieve":[175],"similar":[176,303],"implementations":[177],"unknown":[179],"from":[182],"library":[184],"known":[186],"functions.":[188,265,289,305],"The":[189],"predictions":[190],"like":[194],"are":[196,269],"inherently":[197],"reflect":[200],"minor":[201],"alterations":[202],"those":[208],"introduced":[209],"vulnerability":[211,325],"patches.":[212],"contrast,":[214],"change-sensitive":[216],"representations":[217],"generated":[218],"compensate":[221],"shortcomings":[224],"some":[226],"extent.":[227],"To":[228],"support":[229],"development":[231],"evaluation":[233,267],"models,":[236],"facilitate":[239],"research":[241],"domain,":[244],"also":[246,291],"construct":[247],"comprehensive":[249],"dataset":[252],"introduce":[254],"automatic":[256],"method":[257,310],"create":[259],"labels":[261],"extensive":[263],"Our":[266],"results":[268],"promising.":[270],"outperforms":[272],"ChatGPT":[273],"14.61%":[275],"ROUGE-L":[278],"score,":[279],"demonstrating":[280],"superior":[281],"capability":[282],"summarizing":[284],"surpasses":[292],"previous":[293],"best":[294],"with":[296],"52%":[298],"higher":[299],"Recall@1":[300],"retrieving":[302],"Beyond":[306],"metrics,":[308],"our":[309],"has":[311],"proven":[312],"its":[313],"practical":[314],"utility":[315],"real-world":[317],"scenarios,":[318],"including":[319],"cryptographic-related":[320],"virus":[321],"1-day":[324],"detection.":[326]},"counts_by_year":[{"year":2025,"cited_by_count":5}],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-10-10T00:00:00"}