🤖 AI Summary
Industrial critical infrastructure software is often deployed as stripped, unsigned binaries, rendering traditional software composition analysis ineffective and challenging existing methods to jointly capture structural and behavioral semantics. This work proposes a semantics-enhanced neuro-symbolic framework that integrates abstract interpretation with a reflective prompting mechanism to constrain a local large language model and suppress hallucinations. It employs a surjective transformation to compress code property graphs into typed software supply chain knowledge graphs and introduces a domain-adapted Graphormer with embedding-space subgraph matching to enable global risk reasoning and zero-day/APT attack identification in opaque binaries. Evaluated on three progressively challenging benchmarks and a hybrid physical-virtual platform comprising real devices from five industrial control vendors, the approach significantly improves detection rates for high-severity CVEs and semantic fidelity while substantially reducing false positives.
📝 Abstract
Automated vulnerability detection in critical-infrastructure software confronts a fundamental barrier: industrial software is routinely deployed as stripped, symbol-free binaries that deprive conventional Software Composition Analysis of the source-level transparency it requires. Existing binary analysis techniques close this Semantic Gap only partially -- graph-based detectors preserve structural syntax but discard behavioral semantics, while large language models supply rich semantic cues at the cost of unstable, hallucination-prone inference. To address this gap, we present a semantic-enhanced neuro-symbolic framework that reconstructs behavioral semantics directly from opaque binaries and performs tractable global risk reasoning. Three tightly coupled mechanisms drive this capability: (1) abstract interpretation combined with a reflexive prompting pipeline that structurally constrains a local LLM agent, effectively suppressing hallucinations; (2) a surjective transformation that compresses raw Code Property Graphs into typed Software Supply Chain Knowledge Graphs amenable to scalable reasoning; and (3) a domain-adapted Graphormer that captures long-range vulnerability propagation, augmented by embedding-space subgraph matching to uncover zero-day and APT-style attack patterns. Evaluated across three benchmarks of increasing domain specificity, the framework consistently outperforms all baselines on detection accuracy, semantic lifting fidelity, and APT fingerprint matching. Deployment on a hybrid virtual-physical testbed incorporating production-grade hardware from five ICS vendors further confirms strong detection coverage of high-impact CVEs while substantially reducing false-positive rates relative to leading commercial tools.