How ocyberlab/bingraph works
BinGraph turns binary executables into function-level code property graphs, encodes and stores them, then compares graph pairs with learned models for vulnerability-related analysis. Its main workflow spans extraction, normalization/storage, pair preparation, model training, and evaluation; CVE matching is a separate analysis branch. The README documents additional ablation and graph-statistics experiments. Some implementation details are only described in the README or represented by unsampled files, so the graph omits uncertain internal wiring rather than inferring it.
Main entry points: 0-cpg.dot Raw CPG graphs · Training.py Model training · arm-clang-O0-libz.so.1.2.7.1_cpg.bin Function graph store · CVE_matching.py CVE matching
Components 21
CPG extraction
- CPG extraction
Feature_Extraction/bin_cpg_extraction.py - Joern client
utils/process/cpg_client_wrapper.py - Raw CPG graphs
data/dot_graph/0-cpg.dot
Encoding and storage
- Graph normalization
Feature_Extraction/bin_cpg_wo_cb.py - Ablation extraction
Feature_Extraction/bin_cpg.py - HDF5 encoding
Feature_Extraction/hdf5_encoding.py - Function graph store
data/cpg/arm-clang-O0-libz.so.1.2.7.1_cpg.bin
Pair learning
- Pair preparation
Model_wcb/Dataloader.py - Graph pairs
Model_wcb/Training.py - Graph model
Model_wcb/Model.py - Model training
Model_wcb/Training.py - Training metrics
Model_wcb/Metrics_evaluator.py - No-ablation model
Model/Model.py
Evaluation and analysis
- CVE matching
Evaluation/CVE/CVE_matching.py - HDF5 histograms
Evaluation/Histograms/histograms_hdf5.py - Graph metrics
Evaluation/Layers/graph_metrics.py - CVE matches
Evaluation/CVE/CVE_matching.py
Other components
- Analyst
- Binary executables
- Joern
- CVE service
Connections 22
- Analyst → CPG extraction: starts extraction
- Binary executables → CPG extraction: supplies binaries
- CPG extraction → Joern client: requests CPGs
- Joern client → Joern: queries
- Joern → Raw CPG graphs: produces graphs
- Raw CPG graphs → Graph normalization: reads graphs
- Graph normalization → Function graph store: stores encoded graphs
- Raw CPG graphs → Ablation extraction: reads graphs
- Ablation extraction → Function graph store: stores ablation data
- Function graph store → Pair preparation: loads functions
- Pair preparation → Graph pairs: forms labeled pairs
- Graph pairs → Model training: supplies batches
- Model training → Graph model: updates weights
- Model training → Training metrics: records scores
- Analyst → Model training: starts training
- Model training → No-ablation model: trains variant
- Analyst → CVE matching: starts matching
- CVE service → CVE matching: provides CVEs
- Raw CPG graphs → CVE matching: reads function names
- CVE matching → CVE matches: writes matches
- Function graph store → HDF5 histograms: reads graph data
- Raw CPG graphs → Graph metrics: reads DOT graphs