An Empirical Study of CPG-based Static Analysis on Binaries

Abstract

Software supply chain security has drawn growing attention, yet effective static analysis for widely deployed closed-source binaries remains challenging. While CPG-based methods perform well in source code vulnerability detection, their effectiveness and limitations in the binary domain still lack systematic evaluation.This paper empirically investigates the transferability of source-code-oriented static analysis to binaries using multiple code reconstruction and CPG construction strategies. Using the BinPool dataset, which contains real-world vulnerable binaries, we design three mainstream binary analysis workflows and evaluate 152 CVEs covering 11 CWE types. Experimental results show that CPG-based static analysis performance heavily relies on binary code recovery and high-level semantic retention, and leveraging inherent code traits can improve accuracy in certain case. This work reveals the limitations of current static analysis methods when applied across domains, and provides empirical guidance for selecting and optimizing binary-oriented static vulnerability detection approaches.