IRIS: A Generalizable and Context-Aware Framework for Binary Vulnerability Detection

The security of Internet of Things (IoT) devices has become a critical concern as they are increasingly deployed in diverse and sensitive environments. Firmware vulnerabilities—particularly in closed-source, architecturally diverse binaries—pose severe risks and are difficult to detect due to the lack of source code and platform heterogeneity. Existing binary analysis approaches either rely on dynamic execution with limited path coverage or static techniques with poor generalizability. In this work, we propose IRIS, a general and context-aware framework for binary vulnerability detection. IRIS lifts binaries into an intermediate representation (IR) for platform-independent analysis and applies path-sensitive, inter-procedural slicing to extract semantically meaningful code regions. These slices are encoded using a Bidirectional Gated Recurrent Unit (BiGRU) with attention model that captures local semantics and contextual dependencies within inter-procedural code slices. We evaluate IRIS on a curated dataset from the SARD benchmark, focusing on IoT-relevant vulnerabilities such as buffer overflows and command injection. IRIS achieves 95.6% accuracy and a 92.8% F1-score, outperforming several representative neural baselines. These results demonstrate the effectiveness of IRIS in binary vulnerability detection.