Aug 2026· Journal of Computer Virology and Hacking Techniques· Vol 22· 0 citations· 25 references
TL;DR
This work introduces a static, decompiler-driven pipeline built on top of Ghidra that augments decompiled functions with binary-derived evidence including recovered stack regions, callgraph context, and p-code-derived features and presents the real-world evaluation as a diagnostic stress test rather than evidence of a deployable detector.
Abstract
The detection of vulnerabilities in stripped binaries remains a challenge in software security because stripping removes many of the contextual signals that both humans and automated systems use to identify and validate unsafe behavior. Detecting stack buffer overflows is particularly challenging: symbols are gone, types are absent, stack objects are poorly represented, and the decompiler output that replaces them is often noisy, incomplete, or incorrect. Prior work has applied LLMs to vulnerability analysis in binaries, but typically over decompiler output alone or with limited additional context. In this work, we take the position that the central problem is not whether an LLM can read decompiled code, but whether it can be given enough recovered program context to reason effectively about a stripped binary. We therefore introduce a static, decompiler-driven pipeline built on top of Ghidra that augments decompiled functions with binary-derived evidence including recovered stack regions, callgraph context, and p-code-derived features. This pipeline applies LLM agents in three progressively narrower stages of analysis designed to separate broad screening from expensive confirmation. We evaluate this pipeline using gpt-oss-120b [1] on a synthetic dataset compiled from a subset of NIST’s Juliet [2] dataset and stress-test the pipeline using both gpt-oss-120b and gpt-5.4 on paired vulnerable and patched real-world binaries: 12 CVE pairs published after the model’s training cutoff and 10 pre-cutoff pairs. The Juliet results show that context-augmented, staged LLM analysis can identify stack buffer overflow behavior in stripped binaries under controlled conditions. On real-world binaries, candidate generation usually surfaces the known-vulnerable target but at a high discovery burden, and final targeted reachability remains low; we therefore present the real-world evaluation as a diagnostic stress test rather than evidence of a deployable detector.
LLM-based code generation is now embedded in mission-critical pipelines, but defenses against vulnerable output remain post-hoc -- static analyzers, fine-tuned classifiers, or an LLM judge that screen completed code, ignoring the generating model's own internal state. We test a narrower, directly measurable question: when an LLM reads a piece of C/C++ code as context, do its hidden activations already carry a signal about that code's vulnerability status? We extract last prefill token activations from four LLMs (Granite-4.1-8B, Qwen3.5-9B, Qwen3.6-27B, Gemma-4-12B) across three model families and train MLP probes on these activations. We evaluate them on four function-level C/C++ benchmarks (Devign, Big-Vul, Draper VDISC, PrimeVul). Our probes achieve 41.7\% average F1 using 13.4--16.0M-parameter probes -- under 0.2\% of base-model size. On Devign, the best probe (Qwen3.5-9B, 68.8\% F1) matches the published fine-tuned-classifier SOTA (67.9\%) despite reading only a frozen, general-purpose LLM's activations; on the harder, more imbalanced benchmarks (Big-Vul, Draper VDISC, PrimeVul) probes trail SOTA substantially. This is early evidence that a coding LLM's own representation of arbitrary code is informative about that code's vulnerability status, motivating further work toward lightweight, model-native vulnerability screening.
In recent years, code-reuse attacks (CRA) have become increasingly stealthy and destructive to modern software systems. However, existing control-flow integrity techniques mainly focus on control-flow paths and give limited consideration to the program’s overall execution state. To address this problem, we propose StackPatroller, a stack-integrity-based runtime supervision framework that enforces program integrity through configurable policies. Specifically, StackPatroller monitors runtime stack contexts to detect early deviations from normal execution, enabling the identification of whole-function reuse (including return-to-libc) and certain forward-edge attacks earlier—within user mode before any unintended system calls occur. Compared to previous approaches, StackPatroller leverages the program stack as a structured and predictable representation of execution state. This provides a reliable indicator for early anomaly detection during CRA and eliminates the need for specialized hardware support. To validate our approach, we implement a prototype of StackPatroller and evaluate it on representative real-world software samples. The evaluation results show that our prototype can effectively detect CRA with an average performance overhead of 7.8%.
Yuanheng Xu, Siyu Zhang, Juan Wang et al.· Journal of computing and sec...· 0 citations
Large Language Models (LLMs) show promise for vulnerability detection, but their evaluation is limited by the lack of high-quality benchmarks. Most existing datasets rely on coarse function-level labels, overlook fine-grained vulnerability patterns, and lack critical program context such as data/control dependencies. They also suffer from data quality issues, including mislabeling and duplication, leading to unreliable evaluation and limited real-world relevance. To address these limitations, this paper introduces SecVulEval, a context-aware benchmark designed to evaluate LLMs on vulnerability detection with rich contextual information. SecVulEval focuses on real-world C/C++ vulnerabilities at the statement level. This granularity enables more precise evaluation of a model’s ability to localize and understand vulnerabilities, beyond simple binary classification at the function level. By incorporating rich contextual information, SecVulEval sets a new standard for benchmarking vulnerability detection in realistic software development scenarios. This benchmark includes 25,440 function samples covering 5,867 unique CVEs in C/C++ projects from 1999 to 2024. We evaluated state-of-the-art LLMs in both standalone and multi-agent settings. Results on our dataset indicate that current models remain far from accurately identifying vulnerable statements within a given function, although agent-based approaches provide modest but promising improvements. The best-performing Claude-3.7-Sonnet-driven agent achieves an F1-score of 23.83% for vulnerable statement detection. We believe this benchmark can serve as a foundation for advancing context-aware vulnerability detection with LLMs.
Md Basim Uddin Ahmed, Nima Shiri Harzevili, Jiho Shin et al.· AIware· 2 citations
Filesystem isolation in container ecosystems is often weakened by cross-boundary path misresolution, causing path traversal (PaTra) vulnerabilities. These vulnerabilities stem from insecure host-container interactions and have become increasingly pervasive as cloud systems mount shared resources, such as GPUs and agent workspaces, into containers to support AI workloads. Existing defenses remain inadequate. Kernel-level protections are intrusive, can destabilize system calls, and have therefore not been accepted into the Linux mainline. Detection methods rely on static rule matching or manual code auditing. Static rules can flag path-related functions but fail to capture the semantics needed to determine whether a host-container interaction exists, causing many false positives. Manual review requires domain expertise, making it costly, inefficient, and difficult to scale. To address this threat, we present Bulkhead, an automated framework that integrates large language models (LLMs) with formal methods for semantic vulnerability discovery and remediation. Bulkhead uses a multi-agent system to identify and repair PaTra vulnerabilities through multi-dimensional knowledge patterns generalized from known cases. It first applies high-risk functional patterns to locate entry points for cross-boundary interactions in containerized code, then uses call-chain patterns to recover the corresponding execution paths at suitable depth. The Detection pipeline analyzes these call chains against the application scenarios and threat model, identifying vulnerabilities such as missing security checks and TOCTOU flaws in cross-boundary interactions, and generating proof-of-concept (PoC) exploits for validation. These PoCs then guide patch generation. To ensure remediation correctness, the Patch pipeline performs assertion-driven verification using predefined model-checking templates.
Large language models (LLMs) embedded in enterprise workflows cannot structurally distinguish legitimate instructions from adversarial ones in the same token stream, making prompt injection OWASP's top LLM risk for two consecutive editions a persistent threat across direct and indirect vectors. This paper presents PromptShield-RT, a layered, real-time, model-agnostic framework combining input normalization and provenance tagging, lexical-heuristic pattern matching, a statistical classifier, structural anomaly features, and calibrated risk fusion, with policy-driven mitigation (allow/sanitize/quarantine/block) and an explainable, adaptive-feedback mechanism for SOC workflows. We construct an original evaluation corpus, SynPI-Bench (n = 450, six categories), and a template-disjoint held-out generalization set (n = 31) with novel phrasings, obfuscation encodings, and adversarial hard-negative benign text. Using template-grouped 5-fold cross-validation, the fused pipeline achieves 92.4% accuracy (F1 = 0.930, AUC = 0.990), outperforming heuristic-only (57.0%) and naive-averaged (59.2%) baselines, while a lexical classifier reaches 85.9% with lower precision. We report a pronounced generalization gap on the held-out set (48.4% accuracy, 90% false-positive rate on hard negatives), quantifying a known limitation of surface-lexical defenses. The pipeline achieves sub-millisecond P95 latency (0.266 ms), within typical 50 ms enterprise SLAs. We situate PromptShield-RT relative to structural, architectural, and guardrail-product defenses, arguing for layered, defense-in-depth architectures, with reproducible code provided.
Fatimah Alhamzawi· Al-Noor Journal of Engineeri...· 0 citations
Vulnerabilities in web applications, particularly within content management systems (CMSs) and their plugins, remain a critical attack vector in practice. Dynamic testing techniques such as fuzzing are underutilized in the web domain due to their limited ability to explore deeply nested code paths and context-dependent application logic. This limitation is especially pronounced in CMSs, where third-party plugins often introduce complex, domain-specific behaviors that challenge general-purpose fuzzers to detect context-specific software defects.In this work, we present Themis, a context-aware, grey-box fuzzing framework specifically designed for WordPress plugins. We built Themis based on the Atropos testing infrastructure and extended it with a domain-specific instrumentation layer, an adaptive test harness, and a custom bug oracle. Together, these components enable targeted vulnerability detection by guiding the fuzzer toward semantically meaningful and security-relevant code paths. Our tool, by design, prioritizes server-side vulnerability classes, including injection flaws, insecure file access, and logic bugs, while leveraging domain knowledge of WordPress APIs to improve detection precision. We evaluate Themis on 68 real-world plugins, including a representative subset drawn from related work. Themis successfully reproduces known CVEs from this selection and discovers 10 previously unknown vulnerabilities, which have been responsibly disclosed to the affected vendors. Compared to existing work, Themis achieves, on average, faster bug discovery and higher code coverage across the evaluated plugins. Our results demonstrate that domain-specific dynamic analysis, when paired with context-aware instrumentation and oracle-guided feedback, can outperform generic fuzzers in precision, effectiveness, and depth of exploration. These results underscore the importance of adopting more secure, context-aware security testing strategies.
Matteo Leonelli, David Jannis Dewes, Thorsten Holz· European Symposium on Securi...· 0 citations
Related blog posts
MIT News · Artificial Intelligence· news.mit.eduAug 17, 2026
A USAF cadet and a Lincoln Laboratory researcher found AI chatbots can help nontechnical service members produce viable software applications for their unique problems.
