Back to results
US 12,657,298 B2Granted
Automatic binary code understanding
AssigneeMicrosoft Technology Licensing, LLC
InventorsXin Jin, Weiwei Yang, Jonathan Karl Larson, Michael T. Walker, Dustin Richard Fraze
Life of this patent
Estimating the term…
Abstract
The description relates to automated binary code summarization. In one example, a binary code summarization tool receives binary code and combines the received binary code with natural language in a prompt for a large language model (LLM). The binary code summarization tool receives a semantic summarization from the LLM relating to the received binary code and evaluates the new semantic summarization for malicious functionality in the received binary code.
Claims20
A device-implemented method comprising:
- synthesizing multiple prompts for an interpretation task relating to first binary code provided in one or more first executable files;
- constructing a binary code dataset that includes ground truth explanations of the first binary code;
- employing a large language model (LLM) to interpret the first binary code and generate first semantic summarizations of the first binary code for each of the multiple prompts;
- comparing the first semantic summarizations and the ground truth explanations, the comparing resulting in comprehension quality metrics for each of the multiple prompts;
- ranking the multiple prompts according to the comprehension quality metrics;
- choosing a selected prompt based at least on the ranking;
- receiving second binary code provided in one or more second executable files;
- inputting the second binary code to the LLM with the selected prompt;
- receiving a second semantic summarization of the second binary code from the LLM, the second semantic summarization being generated by the LLM by evaluating the second binary code according to the selected prompt, wherein the selected prompt adapts the LLM via in-context learning to capture semantics of the second binary code;
- and
- providing risk associated with the second binary code according to the captured semantics of the second binary code.
8 more elements
A system, comprising:
- storage hardware configured to store computer-readable instructions;
- and,
- a processor configured to execute the computer-readable instructions, wherein, when executed, the computer-readable instructions cause the processor to:
- synthesize multiple prompts for an interpretation task relating to first binary code provided in one or more first executable files;
- construct a binary code dataset that includes ground truth explanations of the first binary code;
- employ a large language model (LLM) to interpret the first binary code and generate first semantic summarizations of the first binary code for each of the multiple prompts;
- compare the first semantic summarizations and the ground truth explanations, the comparing resulting in comprehension quality metrics for each of the multiple prompts;
- rank the multiple prompts according to the comprehension quality metrics;
- choose a selected prompt based at least on the ranking;
- receive second binary code provided in one or more second executable files;
- input the second binary code to the LLM with the selected prompt;
- receive a second semantic summarization of the second binary code from the LLM, the second semantic summarization being generated by the LLM by evaluating the second binary code according to the selected prompt, wherein the selected prompt adapts the LLM via in-context learning to capture semantics of the second binary code;
- and
- provide risk associated with the second binary code according to the captured semantics of the second binary code.
11 more elements
A hardware computer-readable storage device storing computer-readable instructions which, when executed, by processing hardware, cause the processing hardware to perform acts comprising:
- synthesizing multiple prompts for an interpretation task relating to first binary code provided in one or more first executable files;
- constructing a binary code dataset that includes ground truth explanations of the first binary code;
- employing a large language model (LLM) to interpret the first binary code and generate first semantic summarizations of the first binary code for each of the multiple prompts;
- comparing the first semantic summarizations and the ground truth explanations, the comparing resulting in comprehension quality metrics for each of the multiple prompts;
- ranking the multiple prompts according to the comprehension quality metrics;
- choosing a selected prompt based at least on the ranking;
- receiving second binary code provided in one or more second executable files;
- inputting the second binary code to the LLM with the selected prompt;
- receiving a second semantic summarization of the second binary code from the LLM, the second semantic summarization being generated by the LLM by evaluating the second binary code according to the selected prompt, wherein the selected prompt adapts the LLM via in-context learning to capture semantics of the second binary code;
- and
- providing risk associated with the second binary code according to the captured semantics of the second binary code.
8 more elements
Dependencies are inferred from the claim text.