BinVulRAG: Knowledge-Level Retrieval-Augmented Detection of Known Vulnerabilities in Binary Functions
TL;DR
BinVulRAG, a function-level assessment framework that retrieves provenance-aware knowledge units rather than plain documents or code fragments, supports grounding retrieved vulnerability knowledge in binary-observable evidence when distinguishing vulnerable functions from patched functions.
Abstract
Detecting known vulnerabilities in binary functions requires associating each function with relevant Common Vulnerabilities and Exposures (CVE) knowledge and determining the function’s state with respect to a specified CVE. Compilation obscures source-level semantics, while security patches often modify only a local check or control-flow condition. We present BinVulRAG, a function-level assessment framework that retrieves provenance-aware knowledge units rather than plain documents or code fragments. Each unit integrates vulnerability conditions, vulnerability and repair behavior, binary-difference evidence, and provenance metadata. During inference, given a target CVE, BinVulRAG retrieves relevant knowledge units and assesses vulnerability and repair behavior. The confidence-gating mechanism then assigns the final labels: vulnerable, non-vulnerable, or unknown. On 380 vulnerable–patched function pairs, BinVulRAG achieved F1 scores of 66.2% (vulnerable-class) and 59.1% (non-vulnerable-class), and a pair accuracy of 26.1%. These three metrics exceeded the corresponding best baseline values by 4.2, 11.2, and 12.2 percentage points, respectively. The ablation results show different precision–recall profiles across evidence configurations, indicating complementary roles for paired-binary evidence and structured vulnerability knowledge. These findings support grounding retrieved vulnerability knowledge in binary-observable evidence when distinguishing vulnerable functions from patched functions.