Research Seminar by Heng Yin | LLM-centric binary analysis

LLM-centric binary analysis

Binary analysis remains a cornerstone of cybersecurity, yet it often demands deep expertise, extensive manual effort, and tool-specific knowledge. Dr. Binary addresses these challenges by introducing an LLM-centric approach to binary analysis. Leveraging recent advances in large language models (LLMs), we propose a system where the LLM serves as both planner and analyst, orchestrating tool execution and reasoning over intermediate results. To bridge the gap between binary analysis tools and the LLM, we leverage Model Context Protocol (MCP) that exposes key capabilities—such as disassembly, taint tracking, symbolic execution, and diffing—through structured, interpretable interfaces. This setup also allows the LLM to execute autonomous analysis scripts within a sandboxed environment, guided by user intent and forensic context. We demonstrate the applicability of this framework in use cases such as ransomware analysis, patch-based triage, and backdoor detection. Our early results show promise in reducing analyst workload and enabling rapid understanding of binary behavior, even in cases involving obfuscated or unfamiliar code.

About the Speaker