LEB-SCFI: multi-label security-critical function identification via LLM-enhanced binary summarization

Abstract Accurate identification of security-critical functions (SCFs) in stripped binaries is essential for vulnerability detection and malware analysis. Over 54% of critical vulnerabilities originate from flaws in functions involving memory management, cryptographic operations, and system interactions. However, existing methods rely on symbolic information and fail in stripped scenarios, while single-label classification inadequately captures the multi-attribute nature of SCFs. We present LEB-SCFI as an end-to-end offline framework that integrates large language model (LLM)-guided binary summarization, hybrid static–dynamic label verification, and multi-label SCF classification. In its offline data construction and training stages, LLM-generated summaries and candidate labels provide semantic supervision, hybrid verification improves label reliability, and ISE-CFG supplies LEB-Sum with an instruction-level representation of control flow, data dependencies, and structural semantics. This design transfers LLM-derived supervision to the lightweight LEB-Sum and SCFI models, yielding a fully local inference pipeline that requires no LLM access at deployment. A 300-function human gold-label audit shows that hybrid automatic verification improves annotation Macro-F1 from 0.846 to 0.879 over raw LLM labels. Evaluated on datasets covering multiple critical domains, LEB-SCFI achieves Macro-F1 and Micro-F1 of 0.8734 and 0.8912 with 72.14% exact match ratio, significantly outperforming baselines. On the CveBinarySheet vulnerability dataset, it attains Macro-F1 and Micro-F1 scores of 0.8706 and 0.8623, respectively, supporting practical applicability and cross-dataset generalization.