Search papers, labs, and topics across Lattice.
This paper introduces ICFlowNet, a novel framework designed for long-range indirect control-flow (ICF) prediction in stripped binaries, addressing the limitations of existing methods that struggle with long-range dependencies and label noise. By employing candidate-aware Dual Virtual Hubs and multi-task graph learning, ICFlowNet effectively models various ICF types, resulting in significant improvements in prediction accuracy. The framework's evaluation methodology ensures robustness against data leakage and noise, leading to a final model that surpasses prior baselines by over 13 F1 points on long-range indirect calls while maintaining low topological overhead.
Dual Virtual Hubs enable ICFlowNet to achieve a remarkable 9.13-point improvement in long-range F1 scores, revolutionizing how we predict indirect control-flow in stripped binaries.
Recovering indirect control-flow (ICF) edges is fundamental to binary security analysis, yet existing methods struggle with long-range dependencies, isolate different ICF types, and are often evaluated under protocols vulnerable to label noise and data leakage. We present ICFlowNet, a unified framework for long-range ICF prediction in stripped binaries. ICFlowNet introduces candidate-aware Dual Virtual Hubs, a Global Code Hub and a Global Data Hub, to create short routing paths between distant code and data evidence, and combines them with multi-task graph learning to jointly model indirect calls, indirect tail calls, jump tables, and returns. To enable credible evaluation, we further develop a leakage-aware, noise-controlled pipeline with package-level splits, function-level mnemonic-hash deduplication, and a clean test protocol built from dynamic positives and absolute negatives. Using this pipeline, we construct a dataset of 15,901 unique stripped x86-64 binaries, including 1,351 with dynamic ground truth. Experiments show that simply scaling static supervision yields only marginal gains, whereas our structural and multi-task designs are essential: Dual Virtual Hubs improve long-range F1 by up to 9.13 points, multi-task learning adds up to 5.81 points, and the final model outperforms prior baselines by more than 13 F1 points on long-range indirect calls while adding only 11.44 percent topological overhead.
