SA2Pat: Enhancing Binary Security Patch Function Localization Via Security Advisory-Guided LLMs

In modern software supply chains, security patch function localization seeks to establish a precise correlation between a Common Vulnerabilities and Exposures (CVE) entry and the function in the codebase that contains its patch. Existing approaches predominantly rely on source code information. Thus, when security audits must be conducted directly on binary files, traditional source-code-based localization methods become ineffective. To address this gap, we propose SA2Pat (Security Advisory to Patch), a framework that accurately localizes security patches by learning from patterns in historical vulnerability fixes. SA2Pat first utilizes IDA Pro and BinDiff to identify pairs of modified functions between vulnerable and patched binaries. It then treats the security advisory text as a query to retrieve reference samples from a constructed external knowledge base containing historical vulnerability patches, thereby guiding a large language model (LLM) to locate the patched function. To mitigate the frequent absence of Common Weakness Enumeration (CWE) IDs in security advisories, we employ a fine-tuned SecureBERT model to predict the likely CWE ID, ensuring that the input information remains complete. Experimental results on a dataset of 364 real-world CVEs—constructed by augmenting the PatchDiscovery benchmark with recent vulnerability patches—indicate that SA2Pat improves the F1-score by 19.35 percentage points over baseline methods. An ablation study shows that removing the reference samples decreases the F1-score by 16.6 percentage points, while removing CWE information reduces it by 4.8 percentage points, demonstrating that both components contribute critically to performance. When the oracle CWE is replaced by the SecureBERT classifier’s prediction in an end-to-end setting, SA2Pat still attains an F1-score of 70.8