Malsight: Exploring Malicious Source Code and Benign Pseudocode for Iterative
Binary Malware Summarization

Decompilation [29] converts executable files into human-readable pseudocode [30], which is more concise and structured than disassembled assembly code. Unlike disassembly, which maps instruction encoding directly to assembly statements, decompilation relies on algorithms and patterns (e.g. R2 [31], IDA [15], Ghidra [16]) and emerging methods using LLMs [32]. However, pseudocode lacks semantic information such as function names. Decompiled function names are often unreadable (e.g., sub_4061C0 in IDA Pro) [33], providing a little useful pieces of information for further analysis.

In static analysis, human experts start analyzing from the function entry point [34], inferring functionality from system Application Programming Interface (API) calls, string information, and pseudocode logic. Their main challenge is accurately identifying the core function [35] among numerous functions and methodically tracing the function call [36] process to understand the functionality comprehensively. To assist in this process, we developed Machine Learning-based (ML-based) Malsight, which optimizes and facilitates binary malware analysis.

BERT is a large-scale transformer-based language model pre-trained on a wide corpus of text using a self-supervised learning approach. The design of Masked Language Modeling (MLM) and Next Sentence Prediction (NSP) training tasks makes BERT perform well in the tasks of Sequence Labeling (SL), such as Named Entity Recognition (NER).

Building on BERT, CodeBERT [39] learns code semantics through Code-Conditioned masked language modeling (CMLM) and natural language documentation generation (NLG). CodeBERT has been shown to perform well on code-related tasks, and since it is derived from BERT, we have reason to believe that this model can be fine-tuned to solve the problem of SL in pseudocode.

T5 [38], or Text-to-Text Transfer Transformer, is a sequence-to-sequence model based on the Transformer architecture that unifies various Natural Language Processing (NLP) tasks into a single framework, including text classification, question answering, summarization, translation, and text generation.

CodeT5 [40] is an encoder-decoder model supporting code understanding and generation, built on the T5 architecture. It uses Natural Language-Programming Language (NL-PL) bimodal data for pre-training with identifier tagging and masked identifier prediction tasks. CodeT5+ [23] introduces greater architectural flexibility and additional pre-training tasks, with instruction tuning to enhance alignment with natural language instructions. This results in significant performance improvements on various code-related tasks.

Previous works like HexT5 [20] and BinT5 [19] developed datasets to train models for binary code understanding, including code summarization tasks. These efforts demonstrate the potential of T5-based models in binary code summarization for malware analysis.

Transfer learning involves training a model on a source task with abundant labeled data to learn general features. When it is difficult to obtain sufficient datasets for training, transfer learning can be used to supplement them with similar or related datasets [41].

In Malsight, we fine-tune the CodeT5+ [23] model to achieve transfer learning from the source code summarization task to the decompiled code summarization task. Besides, we use dynamic and static annotation to implement feature enhancement to compensate for the poor transfer effect caused by the highly limited similarity between the source code and the stripped decompiled code.

Early text similarity measures like BLEU [25] and ROUGE [27] rely on word n-gram overlap between generated and reference text, with BLEU focusing on precision and ROUGE on recall. However, they lack semantic understanding. METEOR [26] integrates n-gram overlap and semantic similarity using WordNet, providing additional semantic insight.

Recent work [42] highlights limitations of words’ overlap in code summary tasks. It shows that similar structures may yield high similarity scores despite differing semantics.

The words’ embedding measure evaluates semantic similarity by analyzing the distance between sentence embeddings in a vector space, often utilizing neural network learning.

word2vec [43] is a static embedding model that represents words as points in a vector space, facilitating the proximity of semantically similar words. MoverScore [44] uses an n-gram optimized Word Mover’s Distance (WMD) [45] to measure similarity and employs various embedding models like ELMo [46] and BERT.

BLEURT [47] stands out as a versatile metric designed for assessing various natural language generation tasks, which combines the advantages of both Words’ Overlap Measure and Words’ Embedding Measure. It achieves this by integrating diverse lexical and semantic-level supervision signals into its pre-training process and leveraging synthetic data based on pre-trained BERT, ensuring its effectiveness and versatility in various evaluation scenarios.

As mentioned, existing code summary methods for binary focus only on the internal information of the function. We introduced the call relationship between functions and worked on the entire binary as the processing unit. In other words, when function func_E in Figure 2 calls func_F, it is difficult for the subsequent code summarization model to correctly summarize the functionality of func_E without any information about func_F. (We assume that the function name of func_F has been corrupted.) Constructing a list of reverse call sequential relational functions provides a basis for the subsequent recovery of sub-functions functionality.

Iterate through the list of functions (assuming Fun_F has been processed), and Fun_E will first be added with annotations by the static annotator and the dynamic annotator, respectively. Fun_E uses the static annotator to obtain static annotations based on the internal information of the function code, while the dynamic annotator adds dynamic annotations based on the generated summary of the sub-function (Func_F) in the function. The program, in other words, sequentially restores functions according to the Control Flow Graph (CFG) diagram from the outermost to the innermost and passes function summary results inward.

Fun_E(annotated) is then fed into the code summary model for final code summary generation. In our work, we use transfer learning to adapt the model to both the functionality of malware functions and the structural features of decompiled pseudocode. Based on the CodeT5+ model, we have fine-tuned the code summary task. The tokenizer splits the code into tokens and embeddings, incorporating a self-attention mechanism into a complete vector in the encoder. The decoder outputs a fine-tuned prediction based on the code summary.

In order to avoid the data shift problem, the training of the code summary model requires a large dataset of malware pseudocode summary. Unfortunately, malware datasets are typically represented as collections of compiled binary files [48], with the binary code stripped, and possibly structurally confused. Consequently, the creation of code summary datasets for binary malware could be unfeasible without resorting to labor-intensive manual summarization.

In this paper, our key insight is that the code summary model requires two capabilities, understanding of Malware Functionality and adaptability to disassembled pseudocode formats (including the ability to deal with annotated code). Therefore, We build source-based malware datasets and pseudo-code-based benign software datasets to train the model on these two capabilities separately. Based on Sourcefinder [49], we were able to find malware source repositories from GitHub. We generate descriptive labels for the extracted malware functions using a sophisticated language model, followed by manual verification and optimization. Meanwhile, we use the Capybara dataset provided by BinT5 [19] (a benign software dataset) to train the model adaptability to pseudocode structure.

In the evaluation phase, the evaluation method is used to measure the similarity between the model generation results and the reference results to evaluate the quality of the model generation. Given two sentences (generation results and the reference results) $S_{g}$ and $S_{r}$, most evaluation methods output a score $Score$ as the evaluation result. Therefore, if considering the use of machine learning methods, it is necessary to construct a dataset in $\{S_{g},S_{r},Score\}({Score}\in[0,1])$ format. The challenge is that when a dataset of $\{S_{g},S_{r}\}$ is obtained, it is a difficult job to obtain an accurate $Score$. In our subsequent work, we propose a reasonable algorithmic flow for constructing labeled datasets $EvaS$.

In annotation generation process, the static annotater includes a core information extraction module (described in detail in Section 4.2.1). Due to the difficulty in accurately completing the required functions using static methods, we use a machine learning model to complete the sequence labeling task of the pseudocode. By constructing the dataset AnnoS, we have constructed the dataset required for model training and testing.

To sum up, we mainly completed the construction of three sets of datasets in different application fields, as shown in Table I.

Based on our long-term exploration of pseudocode for stripped malware, we deem that although the stripped pseudocode has a serious semantic loss, some extremely critical API calls (such as operating system APIs) and some special forms of strings that are preserved after stripping provide us with ideas for behavior analysis and semantic recovery of malware.

Consequently, we consider building a static annotation module to provide additional information for subsequent code summaries. In general, the static annotation process can be divided into three parts: sequence labeling, online retrieval and annotation generation.

Sequence labeling model: By manually labeling approximately 300,000 tokens within nearly 80,000 functions, we construct a labeled dataset $Set_{SL}$ based on $BenignS$ to train the sequence labeling model.

Formally, the function $f_{i}$ is first sliced into an n-token code sequence by the tokenizer $T$. The n-token code sequence $s_{i}=T(f_{i})=\{t_{0},t_{1},...,t_{n-1}\}$ and the labels of the tokens $L_{i}=\{l_{0},l_{1},...,l_{n-1}\}$ are combined into $d_{i}=\{(t,l)|t\in s_{i},l\in L_{i}\}$. Equation (1) formalizes this dataset.

Subsequently, we opted to utilize the CodeBERT [39] model for training the sequence labeling task using this dataset CSL.

$B$ is the CodeBERT base model, and $C$ is the classifier head. As a sequence is inputted, the complete model outputs the predicted labels of its tokens. Equation (2) and (3) formalize this.

We further formalize the target function in equation (4), where $l_{i_{c}}$ is the truth label and $y_{i_{c}}$ is the Softmax probability for the $c^{th}$ class.

By optimizing $LF$, $B$ and $C$ are trained simultaneously. This necessitates that the model effectively classifies code-tokens to accurately label the key API calls and special strings within the pseudocode.

Label to annotation: Once we can get the key API calls and special strings in the stripped pseudocode, we use GitHub Code Search [53] to retrieve the relevant context in the GitHub repositories. In the implementation, we keep the first three blocks of the search results (this is because the code search has already sorted the relevance of the results [54]).

The outcome of random sampling and manual discrimination reveals that approximately 54.8% of the function contexts contain code comments closely associated with the functionality of the function. For the remaining functions, nearly 90% also offer contextual information related to the function’s operation, such as parameter names, interconnected functions, and processing logic. Only a small number of functions yield invalid search results.

The filtered and preprocessed code snippets will be continuously input into the prompt-based generic model for generating static annotation.

As shown in Figure 4 (the blue parts represent the steps in which the annotation was added), the summary of the callee is provided to the caller as a complement to the semantic information, which we define as dynamic annotation. This is consistent with the actual analysis flow of binary malware analysis by reverse workers, i.e., analyzing the call relationship from the inner layer of the CFG diagram to the outer layer (corresponding function list generated in Section 4.1) and summarizing the function from the outside in (corresponding to the passing of dynamic annotation). In this way, we can make full use of the dynamic behavior characteristics implied by the call relationships between functions in the pseudocode.

During training, the model undergoes two phases. The first phase involves fine-tuning malware source code (MalS) to learn malicious behavioral features. The second phase focuses on generating high-quality code summaries (BenignC) by incorporating semantic information from pseudocode and annotations. In both phases, we split the dataset into training, cross-validation, and test sets with a ratio of 7:2:1. We then evaluated the model at each stage to ensure its effectiveness. The result is shown in Table II.

Since each phase uses a different dataset, their effectiveness should be verified independently rather than by direct score comparison. Considering there is no universally accepted threshold for model evaluation scores, we provide the performance of another state-of-the-art binary code summarization model (CP-BCS [55]) as a baseline. CP-BCS was tested on its own dataset, which consists of binaries compiled with GCC 7.3.0 for x86 architecture (32-bit) and then stripped. Our results in both phases demonstrate higher usability compared to CP-BCS.

After completing the training step, we use MalP as the test set (it is the only pseudocode summary dataset built for malware that we know until now). We compare Malsight to existing pseudocode summarization methods and the popular prompt-based general-purpose large model on dataset MalP. In the actual experiment, we built three versions of data for MalP: not-stripped, demi-stripped (only stripping the function name), and all-stripped (stripping the function name and all identifiers inside the function).

The closest version of the dataset to the real world, that is, the results of the all-stripped version as test set, are shown in Table III.

As shown in Table III, we conducted experiments using evaluation methods such as BLEURT-sum, BLEU, ROUGE, and METEOR (the usability of BLEURT-sum is substantiated in the referenced paper) to carry out experiments on Malsight, WizardLM [57], and Code Llama [58], etc. We also measured model performance using criteria such as summary length, variance, and processing time, as these factors can directly impact algorithm-based evaluations (see Appendix I for details).

As previously mentioned, general-purpose large models, trained on extensive corpora, possess broader knowledge, providing an advantage in code summarization tasks. Among these, GPT, as a commercial large model, performed the best with a BLEURT-sum score of 0.6009. Malsight’s innovative fine-tuning approach offers a significant advantage in summarizing malware code, with its annotation generation effectively bridging the knowledge gap between specialized and general-purpose models. Malsight achieved the highest scores among all methods in both BLEURT-sum and METEOR, which we consider two of the most reliable evaluation metrics.

This conclusion can be corroborated by Figure 6. The figure shows that Malsight has better score evaluation results and less variance, i.e., more stable code summary output, on test results stripped of data.

The annotation extraction model was trained and tested on the AnnoS dataset, and the test results are shown in the table The annotated extraction model was trained and tested on the AnnoS dataset to complete the sequence SL task, dividing the data into normal codes (represented by N-label), important function APIs (represented by A-label), and important strings (represented by S-label). The model test produces the confusion matrix shown in Table IV below.

The results show that the accuracy of the model is 96.99%, which is almost comparable to the results obtained by manual annotation.

As shown in Table V, the modules in Malsight complemented each other effectively. This ablation study was conducted on the not-stripped version of MalP to minimize result fluctuations due to the absence of dynamic annotation.

We designed five experiments to test different combinations for the code summarization task, as follows: (1) Removing the annotation module and summarizing without any annotation, labeled as “w/o Annotation”; (2) Canceling the phase 1, labeled as “w/o Phase ”; (3) Canceling the phase 1 and removing the annotation module, labeled as “w/o Phase 1 and Annotatio”; (4) Canceling the phase 2, labeled as “w/o Phase 2”; (5) Canceling the phase 2 and removing the annotation module, labeled as “w/o Phase 2 and Annotation”.

The results indicate that different degrees of ablation have varying negative impacts on systematic performance. “w/o Phase 1 and Annotation” suffered a data shift and thus exhibited worse performance on the malware dataset than the other combinations, 56.48 in BLEURT-sum. Notably, the absence of the annotation generation module (static annotation generation module) significantly affects performance, demonstrating its effectiveness.

The influence of different levels of strip on the annotation module continues to be explored, and the results are shown in Table VI. Experiments have shown that a higher degree of stripping creates a tolerable performance degradation in the absence of annotation, demonstrating the robustness of Malsight. After the annotation module was ablated, it produced a 9.41% performance degradation (measured by a BLEURT-sum score) in the not-stripped test and nearly 12% in the all-stripped test, which proved that the annotator effectively resisted the adverse conditions caused by stripping.

In the generated results, we selected relatively representative sentences, as shown in Figure 7. In the yellow box, the output from the generation module without annotations shows that the large model is highly susceptible to biases due to hallucination [59]. Based on our observations, hallucinations can cause the code summary model to make false guesses about the types of parameters and internally called functions, leading to potential user misdirection. To mitigate this issue, we incorporate annotations, which not only enhance the model’s ability to summarize behavior, structure, and application scenarios but also reduce the nonsensical outputs caused by these illusions.

So far, we have evaluated Malsight’s performance at the function level. However, this approach did not allow us to fully showcase the capabilities of the dynamic annotation module. Additionally, real-world malware predominantly manifests in executable files. Hence, we manually analyzed 10 real-world malware samples and selected 79 critical functions out of them, three experienced reverse engineers add summaries to these functions based on discussion. The complete workflow of Malsight was applied to these functions and the outputs was evaluated using both BLEURT-sum and human evaluation metrics. We further calculated the variance deviation of all calculated results as a reference to demonstrate the stability of our solution and the time required for code summarization for a single malware sample.

For the human evaluation metrics, we invited ten evaluators, including five reverse engineers who are rich in experience, three experienced, and two beginners. They were asked to focus on evaluating the usability of the code summarization results and provide a score of 0, 0.5 or 1, indicating whether the summary corresponded to the original code. It is noteworthy that due to the subjectivity of human evaluation of the summaries, different evaluators may have varying opinions on the summary of the same code. Therefore, we opted to evaluate usability only and did not solicit more detailed scores beyond 0,0.5 and 1, respectively corrrepond to usable, partially usable and unusable.

After three sets of scores, we obtained the human assessment scores shown in Table VII. Experienced evaluators tend to give more conservative and stable scores, while less experienced evaluators give a wider range of scores with higher variance. Further, we take the arithmetic average of the scores received by these evaluators as the final human assessment score.

Table b shows the mean value of BLEURT-sum and the mean value of human evaluation on 79 labeled functions. The human evaluation score of 59.87 means that most functions have exceeded 0.5, i.e. the partially usable standard.

Further, we formed a data point by combining a BLEURT-sum score with a human evaluation score for the same function’s code summary, thus, we plotted a distribution of 79 data points in Figure 10. It indicates that BLEURT-sum has a positive linear correlation with human evaluation metrics, which shows the rationality of BLEURT-sum. Furthermore, the data distribution indicates that, across the two distinct evaluation metrics, the majority of the evaluation scores for Malsight’s outputs are concentrated within the middle to high range, which shows that our scheme is also usable in the real world.