[Paper Review] XFL: Naming Functions in Binaries with Extreme Multi-label Learning

James Patrick-Evans, Moritz Dannehl+1 more|arXiv (Cornell University)|Jul 28, 2021

Machine Learning in Bioinformatics4 citations

TL;DR

This paper introduces XFL, an extreme multi-label learning framework that predicts function name tokens in stripped binaries by leveraging Dexter, a novel function embedding combining static analysis, call graph context, and global binary features. XFL achieves 83.5% precision on a 10,047-binary Debian dataset, outperforming prior methods by effectively modeling rare function names through token-level labeling.

ABSTRACT

Reverse engineers benefit from the presence of identifiers such as function names in a binary, but usually these are removed for release. Training a machine learning model to predict function names automatically is promising but fundamentally hard: unlike words in natural language, most function names occur only once. In this paper, we address this problem by introducing eXtreme Function Labeling (XFL), an extreme multi-label learning approach to selecting appropriate labels for binary functions. XFL splits function names into tokens, treating each as an informative label akin to the problem of tagging texts in natural language. We relate the semantics of binary code to labels through DEXTER, a novel function embedding that combines static analysis-based features with local context from the call graph and global context from the entire binary. We demonstrate that XFL/DEXTER outperforms the state of the art in function labeling on a dataset of 10,047 binaries from the Debian project, achieving a precision of 83.5%. We also study combinations of XFL with alternative binary embeddings from the literature and show that DEXTER consistently performs best for this task. As a result, we demonstrate that binary function labeling can be effectively phrased in terms of multi-label learning, and that binary function embeddings benefit from including explicit semantic features.

Motivation & Objective

• Address the challenge of predicting meaningful function names in stripped binaries where source code and debugging information are absent.
• Overcome the fundamental limitation of traditional function naming models that fail on rare or unseen function names due to class imbalance and unbounded label space.
• Enable accurate prediction of function names even for previously unseen functions by decomposing names into reusable, descriptive tokens.
• Develop a robust function embedding (Dexter) that integrates static analysis, local call graph context, and global binary structure to improve semantic representation.
• Demonstrate that multi-label learning with controlled label vocabulary outperforms whole-name classification in binary function naming tasks.

Proposed method

• Split function names into individual tokens (e.g., 'make_smooth_colormap' → {make, smooth, color, map}) to transform the problem into multi-label classification.
• Introduce Dexter, a function embedding that combines low-level static analysis features (e.g., instruction patterns, register usage) with local call graph context and global binary-level statistics.
• Train an extreme multi-label learning (XML) model using Dexter embeddings to predict the set of relevant label tokens for each function.
• Use a semi-supervised learning strategy to handle the long-tail distribution of labels, ensuring sufficient training samples per label despite high sparsity.
• Evaluate the model on a dataset of 10,047 stripped binaries from Debian, using precision as the primary metric for label prediction.
• Compare Dexter against existing binary code embeddings (e.g., Asm2Vec, SAFE, PalmTree) and show consistent superiority in function name token prediction.

Experimental results

Research questions

• RQ1 Can decomposing function names into tokens reduce the class imbalance problem in binary function naming and improve model generalization?
• RQ2 To what extent can a function embedding that combines static analysis, local calling context, and global binary structure improve the performance of function name prediction?
• RQ3 Does extreme multi-label learning outperform traditional single-label classification for function naming in binaries with highly imbalanced name distributions?
• RQ4 How does the proposed Dexter embedding compare to existing binary code embeddings in terms of predictive performance for function name token prediction?
• RQ5 Can the model generalize to predict function names for functions not seen during training, particularly those with unique or rare names?

Key findings

• XFL achieves a precision of 83.5% on the 10,047-binary Debian dataset, significantly outperforming state-of-the-art methods for function name prediction.
• The label distribution after tokenization shows a much more balanced distribution compared to whole-function-name classification, reducing the long-tail problem.
• Dexter embeddings consistently outperform all evaluated baseline binary code embeddings (e.g., Asm2Vec, SAFE, PalmTree) in predicting function name tokens.
• The integration of static analysis features with local and global context in Dexter leads to more semantically meaningful function representations than syntax-only or raw instruction-based embeddings.
• XFL successfully predicts function name tokens for functions not present in the training set, demonstrating generalization to unseen function names.
• The model remains robust to common obfuscation techniques that alter function structure, as long as semantic and syntactic features remain sufficiently preserved.