ParserHunter: Identify parsing functions in binary code

marco scapin et al.

Journal of Systems and Software2026https://doi.org/10.1016/j.jss.2026.112783article
AJG 2
Weight
0.50

What the paper says

Parsing and validation functions are crucial because they process untrusted data, e.g., user inputs. Due to their complexity, these functions are highly susceptible to bugs, making them a primary target for security audits. However, identifying such functions within a binary is time-intensive and challenging, given the numerous functions typically present and the lack of source code or supporting documentation. This paper presents an AI-based methodology for identifying functions with parser-like behavior and complex processing logic within a binary. Our methodology analyzes each binary by identifying its functions, extracting their Control Flow Graphs (CFGs), and enriching them with features derived from an embedding model that captures both structural and semantic aspects of their behavior. These annotated CFGs are the input to a Graph Neural Network trained to identify parsing functions. We implement this methodology in the tool ParserHunter, which allows users to train the model on labeled data, query the model with unseen binaries, and accommodate a symbolic execution phase on the processed binary through a user interface. Our experiments on ten real-world projects from GitHub show that our tool effectively identifies parsers in binaries.

Open paper page →

Cite this paper

https://doi.org/https://doi.org/10.1016/j.jss.2026.112783

Or copy a formatted citation

@article{marco2026,
  title        = {{ParserHunter: Identify parsing functions in binary code}},
  author       = {marco scapin et al.},
  journal      = {Journal of Systems and Software},
  year         = {2026},
  doi          = {https://doi.org/https://doi.org/10.1016/j.jss.2026.112783},
}

Paste directly into BibTeX, Zotero, or your reference manager.

Flag this paper

ParserHunter: Identify parsing functions in binary code

Flags are reviewed by the Arbiter methodology team within 5 business days.


Evidence weight

0.50

Balanced mode · F 0.40 / M 0.15 / V 0.05 / R 0.40

F · citation impact0.50 × 0.4 = 0.20
M · momentum0.50 × 0.15 = 0.07
V · venue signal0.50 × 0.05 = 0.03
R · text relevance †0.50 × 0.4 = 0.20

† Text relevance is estimated at 0.50 on the detail page — for your query’s actual relevance score, open this paper from a search result.