Long-Range Indirect Control-Flow Prediction in Stripped Binaries via Dual Virtual Hubs and Multi-Task Graph Learning

Recovering indirect control-flow (ICF) edges is fundamental to binary security analysis, yet existing methods struggle with longrange dependencies, isolate different ICF types, and are often evaluated under protocols vulnerable to label noise and data leakage. We present ICFlowNet, a unified framework for long-range ICF prediction in stripped binaries. ICFlowNet introduces candidateaware Dual Virtual Hubs-a Global Code Hub and a Global Data Hub-to create short routing paths between distant code and data evidence, and combines them with multi-task graph learning to jointly model indirect calls, indirect tail calls, jump tables, and returns. To enable credible evaluation, we further develop a leakageaware, noise-controlled pipeline with package-level splits, functionlevel mnemonic-hash deduplication, and a clean test protocol built from dynamic positives and absolute negatives. Using this pipeline, we construct a dataset of 15, 901 unique stripped x86_64 binaries, including 1, 351 with dynamic ground truth. Experiments show that simply scaling static supervision yields only marginal gains, whereas our structural and multi-task designs are essential: Dual Virtual Hubs improve long-range F1 by up to 9.13 points, multi-task learning adds up to 5.81 points, and the final model outperforms prior baselines by more than 13 F1 on long-range indirect calls while adding only 11.44% topological overhead.

• Security and privacy → Software reverse engineering.