arXiv subjects

Yaxin Duan

Publications and source records attributed to Yaxin Duan.

3 recordsLinked to original sources

arXiv2026

PLC-Bin2Src: Retrieving Corresponding Structured Text Source Files for PLC Binaries

PLC developers reuse existing components and third-party libraries to reduce the cost of developing new applications, but this reuse can also introduce security risks. When components are distributed only in binary form, provenance tracing, vulnerability assessment, and security auditing become more difficult. To support these analyses, binary2source matching can retrieve the corresponding Structured Text (ST) source file for a PLC binary from a candidate source repository. However, due to the properties of PLC software, this task faces three challenges: cross-platform compilation heterogeneity, a binary-source representation gap, and inadequate representations of PLC semantics. Therefore, we present PLC-Bin2Src, a cross-platform binary2source matching framework that retrieves corresponding ST source files for binaries produced by CODESYS, GEB, OpenPLC v2, and OpenPLC v3. First, PLC-Bin2Src uses platform-aware binary frontends to recover user control logic across toolchains. Then, ST-to-C conversion and shared normalization are used to reduce syntactic differences between source- and binary-side representations. Next, control-data flow graphs (CDFGs) and function call graphs (FCGs) are constructed to capture program semantics, while recovered symbols provide complementary identity evidence. Finally, PLC-Bin2Src compares these representations and combines their similarity scores to rank source candidates. We evaluate PLC-Bin2Src on PLC-BEAD. The results show that PLC-Bin2Src achieves 95.89% Recall@1, 99.66% Recall@5, and an MRR of 0.9769 across four PLC platforms.

cs.SE↗

arXiv2026

PLC-BinX: A Cross-Platform Binary Code Analysis Framework for PLC Binaries

As emerging attacks increasingly target Industrial Control Systems (ICS), the security of Programmable Logic Controllers (PLCs) has become a critical concern. Binary Code Analysis (BCA), which enables analysts to analyze compiled programs, is essential for ICS security tasks such as deployed-binary auditing. However, automated BCA for PLC binaries remains challenging due to three key issues: heterogeneous binary formats across PLC platforms, entangled program semantics with runtime code, and limited semantic representations for downstream tasks. To resolve these challenges, we present PLC-BinX, a cross-platform BCA framework for PLC binaries. PLC-BinX applies a three-stage PLC binary analysis workflow, including cross-platform reverse engineering, core function identification, and function-level semantic representation, to analyze PLC binaries from four platforms: CODESYS v3, GEB, OpenPLC v2, and OpenPLC v3. We evaluate PLC-BinX on PLC-BEAD, which contains 2,431 PLC binaries across four platforms, using two downstream tasks: toolchain prediction and functionality prediction. Experimental results show that PLC-BinX achieves 100.00% precision, recall, and F1 in toolchain prediction, and 51.43% precision, 49.38% recall, and 49.18% F1 in functionality prediction over 22 labels. These results demonstrate that PLC-BinX can transform raw PLC binaries into effective function-level semantic representations for PLC binary code analysis.

cs.SE↗

arXiv2025

Towards an Oracle for Binary Decomposition Under Compilation Variance

Third-Party Library (TPL) detection, which identifies reused libraries in binary code, is critical for software security analysis. At its core, TPL detection depends on binary decomposition-the process of partitioning a monolithic binary into cohesive modules. Existing decomposition methods, whether anchor-based or clustering-based, fundamentally rely on the assumption that reused code exhibits similar function call relationships. However, this assumption is severely undermined by Function Call Graph (FCG) variations introduced by diverse compilation settings, particularly function inlining decisions that drastically alter FCG structures. In this work, we conduct the first systematic empirical study to establish the oracle for optimal binary decomposition under compilation variance. We first develop a labeling method to create precise FCG mappings on a comprehensive dataset compiled with 17 compilers, 6 optimizations, and 4 architectures; then, we identify the minimum semantic-equivalent function regions between FCG variants to derive the ground-truth decomposition. This oracle provides the first rigorous evaluation framework that quantitatively assesses decomposition algorithms under compilation variance. Using this oracle, we evaluate existing methods and expose their critical limitations: they either suffer from under-aggregation failure or over-aggregation failure. Our findings reveal that current decomposition techniques are inadequate for robust TPL detection, highlighting the urgent need for compilation-aware approaches.

cs.SE↗