289results about "Decompilation/disassembly" patented technology

Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include determining a learned control flow directed graph for executable code of an application by observing executions of transitions during an observation period and determining destinations of indirect transfers based on the learned control flow directed graph. Next a disassembly of the executable code is determined based on the learned control flow directed graph, the destinations of the transfers, and the executable code.

The invention discloses a method for automatically capturing semantic information of a binary code block and a related device, and relates to the technical field of computers.The method comprises the following steps that code disassembling and instruction level analysis are conducted on the binary code block, and a binary stream original instruction sequence is generated; performing semantic intermediate representation conversion and vocabulary overflow standardization on the binary stream original instruction sequence to obtain a binary code standardized instruction sequence; obtaining an instruction data dependency relationship and an instruction control dependency relationship corresponding to the binary code block, and constructing a corresponding binary code program dependency graph; semantic code node embedding is carried out on the binary code program dependency graph to generate a binary code representation vector corresponding to context semantics; and performing automatic semantic capture reasoning on the binary code representation vector corresponding to the context semantics through a pre-trained semantic understanding model to obtain semantic information of the binary code block. According to the method, the semantic information of the binary code block can be efficiently and accurately captured.

The invention provides a network security malicious code binary search method and system, and relates to the technical field of data processing, and the method comprises the steps: calculating the multi-dimensional structural similarity between a to-be-detected binary file and each standard binary reference file based on a function level control flow semantic feature vector; determining a finally matched standard binary reference file according to the multi-dimensional structural similarity; performing fine-grained difference analysis on the binary file to be detected and the finally matched standard binary reference file to obtain a fine-grained difference analysis result; and on the basis of a fine-grained difference analysis result, in combination with sensitive data operation behavior feature detection, judging whether the to-be-detected binary file is a maliciously tampered version, and positioning a malicious code injection point. According to the method, the defects that in the prior art, dependence on fixed features is too high, and compilation optimization is sensitive are overcome.

The invention discloses a multi-dimensional binary software component analysis system and method, and the system comprises a static enhanced feature extraction module which is used for extracting multi-dimensional features of a target binary system through a disassembling engine, carrying out the fusion of the multi-dimensional features to form an enhanced feature representation model, and carrying out the preliminary matching through the combination of a feature hash library; the component verification module is used for recording runtime behaviors and analyzing the behavior log to verify a static analysis result; the intelligent knowledge base linkage module is used for realizing automatic traceability and risk assessment; the false alarm filtering and confidence evaluation module is used for optimizing credibility grading of a final result, constructing a false alarm filtering mechanism based on Bayesian reasoning, integrating results of multiple analysis stages, calculating the confidence of an identification result of each component, outputting a grading report and supporting a user to screen high-credibility results as required; and comprehensiveness, accuracy and intelligence of binary software component identification are realized.

The invention discloses a cloud native security configuration system and method based on container analysis and LLM, and the system comprises a mirror image static analysis module which is used for compiling a Linux kernel and a standard library source code to extract intermediate representation, and tracking and constructing a double-layer mapping relation library from the system call to the container capability; the dynamic binary extraction module is used for executing the container mirror image and extracting a binary file of a core function; the mirror image static and dynamic association module is used for executing two-stage static binary file analysis and extracting function requirements required by system calling and mirror image for loading during container running; and the cue word construction and model fine adjustment module is used for constructing cue words, performing fine adjustment on the LLM model and generating a minimum privilege function limitation configuration file of the container. According to the method, static analysis and runtime analysis are combined, the container mirror image is thoroughly checked, the function, which is specified by a user and exceeds the original definition of the mirror image, of the LLM model is finely adjusted through the cue word, and privileged function security configuration is generated according to specific requirements.

The invention relates to the technical field of data security detection, in particular to a data security-oriented mobile application dynamic and static dual-combination detection method and system. The method comprises the following steps: collecting basic information of a target mobile application from a plurality of heterogeneous data sources, and constructing a basic data set of the mobile application information; performing decompilation and static analysis based on the installation file in the resource library, and outputting a static risk feature vector in combination with the sensitive data operation rule set; dynamically running a target application in the controlled sandbox environment, monitoring network traffic, system calling and file operation behavior sequences, and outputting a dynamic behavior risk feature vector; and fusing the two types of feature vectors, and inputting the fused feature vectors into a risk assessment model to generate a comprehensive data security risk assessment report. According to the method, a comprehensive evaluation system is constructed by fusing static and dynamic risk features, and full-dimension coverage of the security risk of the mobile application is realized.

The invention provides a performance analysis method and device for a cross-architecture semantic equivalence instruction stream and a storage medium, and the method comprises the steps: taking a high-level language program as input, aiming at a plurality of target architectures, generating a multi-dimensional semantic equivalence instruction stream set from a high-level language form to an intermediate representation and then to an assembly code through a compiler; based on semantic equivalence instruction streams of code units with different granularities and compiler debugging information, establishing a mapping relationship between a target region in a source code and an intermediate representation and assembly codes, and forming a cross-hierarchy equivalence region fully-connected graph; and based on the semantic equivalence instruction stream set and the cross-level equivalence region fully-connected graph, automatically embedding a performance monitoring code at the boundary of the target region, and carrying out performance test on the elastic region. According to the method, the accurate performance test of the cross-architecture semantic equivalence instruction stream can be realized.

Systems, methods, and software can be used to determine source code of a software code. In some aspects, a method includes: processing a binary code by using a file encoder model to obtain a file embedding vector; and selecting one or more source code samples based on the file embedding vector and a distance function.

Disclosed in the present invention is a construction system for a big data analysis algorithm library, comprising: an analysis process construction module, an operator platform selection module, a code reverse generation module, a user code verification module, a cluster control host, and a cluster computing host. Cross-platform and cross-language algorithm fusion can be realized, and data analysis is realized in a complete and heterogeneous data analysis flow. Also disclosed in the present invention is a construction method for a big data analysis algorithm library.

The invention discloses a binary vulnerability data set expansion method and system based on cross-modal alignment, provides a hierarchical semantic fusion alignment framework, and remarkably improves the precision and expandability of binary vulnerability detection through a heterogeneous modal semantic bridging and transfer learning mechanism. A multi-modal semantic mapping channel is constructed by utilizing natural language interpretation and combining program structured analysis and constant anchor point coding, so that the semantic difference between a binary code and a source code is effectively bridged; a hierarchical attention mechanism enhances the fine-grained perception capability of cross-modal matching; furthermore, a migration framework driven by a vulnerability detection task is provided, binary vulnerability detection is mapped to a source code feature space through cross-modal alignment, a binary vulnerability data set is rapidly expanded by utilizing rich source code vulnerability data, and the data scale bottleneck is broken through.

The invention discloses a code embedding method based on a semantic embedding vector generation model, which belongs to the technical field of computers, and comprises the following steps of: obtaining a binary code block, and performing disassembling processing and code structure analysis based on different granularities to obtain a basic block corresponding to the binary code block and a control flow diagram structure feature; performing assembly instruction linear conversion and cross-instruction-set semantic embedding conversion on the basis of the basic blocks corresponding to the binary code blocks and the structural features of the control flow graph to generate a unified binary code semantic embedding vector space corresponding to a cross-instruction-set architecture; obtaining a known vulnerability sample, and performing semantic vulnerability characterization analysis and candidate vulnerability retrieval positioning to generate a candidate vulnerability code block set; and carrying out dynamic analysis verification on the candidate vulnerability code block set and identifying a corresponding vulnerability repair state so as to output a corresponding binary vulnerability code block detection report. According to the method, high-precision semantic embedding of binary codes can be realized.

The invention discloses a contract vulnerability detection method and system based on cross-granularity feature fusion and meta-learning, and relates to the technical field of block chain security, the method comprises the following steps: obtaining a source code and a compiled byte code of a contract to be detected; source code semantic features are extracted from the source code, operation code execution features are extracted from the byte code, and graph structure features are extracted after a program dependency graph is constructed from the source code; performing cross-granularity attention interaction to generate cross-granularity fusion features; performing type-aware feature modulation on the cross-granularity fusion feature and a vulnerability type identifier of the current detection task, training a classifier by adopting a meta-learning strategy, and outputting a vulnerability detection result; and in response to the vulnerability detection result that the vulnerability exists, positioning the vulnerability code position based on the graph-source code attention weight matrix generated in the cross-granularity attention interaction process, thereby solving the problem of poor generalization ability in a rare vulnerability scene with scarce samples.

Aspects of the present disclosure relate to threat detection of executable files. A plurality of static data points may be extracted from an executable file without decrypting or unpacking the executable file. The executable file may then be analyzed without decrypting or unpacking the executable file. Analysis of the executable file may comprise applying a classifier to the plurality of extracted static data points. The classifier may be trained from data comprising known malicious executable files, known benign executable files and known unwanted executable files. Based upon analysis of the executable file, a determination can be made as to whether the executable file is harmful.

The invention discloses a large language model-based understandability evaluation index-oriented decompilation code optimization method, which mainly aims at Java decompilation codes, and comprises the following steps of: firstly, designing and realizing an understandability evaluation index to realize quantitative analysis on the understandability of the decompilation codes; on the basis, a grammar correctness and semantic consistency checking mechanism is introduced in the method, on the premise that code grammar correctness and semantic consistency before and after optimization are guaranteed, optimizable fragments in codes are automatically recognized through an abstract syntax tree and added into cue words, and a large language model is guided to optimize decompiled codes. Furthermore, quantitative comparison is performed on codes before and after optimization through evaluation indexes, and an iterative optimization process is controlled based on a comparison result. According to the method, the decompilation code can be optimized, the understandability of the decompilation code is improved, an index-oriented improvement thought can be provided for a decompiler developer, and the method can be widely applied to reverse engineering, safety analysis and other scenes.

The invention discloses a static binary code taint analysis method based on a propagation action scope, and relates to the field of static binary code taint analysis, and the static binary code taint analysis method comprises the following steps: extracting a program instruction set and a control flow structure based on a disassembling result of a target binary code; calculating a value set with a source of the binary code based on the control flow graph; on the basis of the control flow diagram and the value set with the source, executing cross-function stain propagation analysis, and identifying memory positions or registers influenced by pollution in each function and propagation action ranges of the memory positions or the registers; and extracting all instruction sets using the taint data based on the taint and the propagation action range thereof. According to the method, the false alarm rate of static binary taint analysis can be reduced and the instruction set involved in the taint analysis can be reduced without increasing the analysis overhead, so that the method has important significance in improving the instrumentation efficiency and the operation efficiency of dynamic taint analysis and improving the accuracy of protocol reversion, fuzzy testing and vulnerability mining based on the taint analysis.

The invention provides an automatic vulnerability detection method based on an intermediate pseudo code and a graph neural network. The method comprises the following steps: converting an assembly code of a binary program into a pseudo code; identifying a sensitive function; constructing a data dependency graph (PDG), and extracting a data dependency sub-graph by taking the key function as a central node; generating a graph semantic embedding vector by combining a pre-training model CodeT5-small and a graph attention network (GAT), and generating a graph structure embedding vector by using a node2vec algorithm; training is carried out through a double-branch feature analysis model based on a graph convolutional neural network (GCN) and a classification model of a multi-layer perceptron (MLP); and detecting vulnerabilities by using the trained model. According to the method, the sensitive function vulnerability of the binary program can be distinguished under the condition that source codes do not exist, the accuracy and efficiency of automatic vulnerability mining are remarkably improved, the limitation of a traditional automatic vulnerability mining method is effectively solved, and the method has important practical application value.

The invention provides a binary code decompiling system based on large model multi-stage fine tuning. The method comprises two stages: a first stage: a data set acquisition and construction stage: acquiring a source code data set comprising source codes and binary file pairs from an open source project and code data set, and obtaining a high-quality decompilation data set through a data preprocessing process; the second stage is a decompilation stage based on large model fine adjustment and static analysis, decompilation is carried out after a decompilation data set is compiled, an assembly code obtained after decompilation is aligned with a source code in the decompilation data set to be used for fine adjustment of the open source large model, a function call graph analysis technology is cooperated, a program context is obtained, and the open source large model is subjected to static analysis; and obtaining a final decompilation large model. Therefore, the purpose of providing a high-quality decompilation data set and an efficient decompilation algorithm is achieved.

The invention discloses a binary code semantic analysis method and device, electronic equipment and a medium. The method comprises the steps that static information and dynamic information corresponding to binary codes are determined, and a target control flow diagram is generated according to the static information and the dynamic information; wherein the static information is obtained by performing static disassembly on the binary code, and the dynamic information is obtained by performing dynamic instrumentation on the binary code; through a pre-constructed semantic model, a semantic vector is given to a node in the target control flow graph according to the static information, and a mixed feature vector corresponding to the node is obtained; through a heterogeneous attention mechanism, performing classification and antagonism analysis on nodes in the target control flow diagram according to the mixed feature vector; and disassembling the binary code according to the classification result and the antagonism analysis result to obtain a semantic analysis result of the binary code. According to the technical scheme provided by the embodiment of the invention, the semantic analysis accuracy of the binary code can be remarkably improved.

The invention relates to the field of code vulnerability detection, in particular to a binary vulnerability retrieval and positioning method and system based on high-dimensional vulnerability characterization, and the method comprises the steps: firstly inputting a binary file, analyzing the structural information of the binary file, and analyzing a machine instruction; extracting binary file function information, generating a cross-platform basic block IR instruction sequence, constructing a control flow graph, and constructing a data dependency graph; splicing the program dependency graph feature vector and the basic block IR instruction sequence feature vector, and performing multi-modal feature fusion to generate a comprehensive high-dimensional vulnerability representation vector; and finally, inputting the high-dimensional vulnerability representation vector into an index for searching to obtain a plurality of nearest neighbor indexes and distances, converting the distances into similarity, filtering according to a similarity threshold to obtain a most similar vulnerability vector, and obtaining vulnerability information and vulnerability positions corresponding to the vulnerability vector. The problems that traditional binary vulnerability detection cross-platform and compiler optimization detection fails and the result reliability is low are solved.

The invention relates to the technical field of software security, and discloses an IDA microcode-based digital multimeter customized code obfuscator construction method and system, and the method comprises the steps: carrying out the obfuscation replacement of a measurement algorithm and a data processing method in a digital multimeter code based on an instruction replacement technology; confusing a control flow of the digital multimeter based on a false control flow technology, namely obtaining a calling relation of basic blocks to reconstruct an original program, and avoiding generation of an endless loop in a symbolic execution process through a method of assigning a value to an opaque predicate in advance; randomly modifying variable names, identifiers and function names of the sensitive data information of the digital multimeter based on a variable name confusion algorithm; and carrying out decompilation and code conversion on the obfuscation algorithm based on the IDA microcode, and constructing the digital multimeter customized code obfuscator based on the IDA microcode. The method can be integrated into the development environment of the digital multimeter, the safety protection level of the digital multimeter is improved, and the measurement data is prevented from being illegally stolen.

The invention provides a simulation integration method and system for an FPGA communication module. The simulation integration method comprises the following steps that S1, an IP source code of the FPGA communication module is converted into an FPGA simulation module code of a C + + language; s2, based on the FPGA simulation module code, performing interface adaptation on a system bus access part for accessing an FPGA communication module in the all-digital simulation system; s3, introducing another module which is completely the same as the FPGA communication module as a symmetric module, and performing transceiving interface cross connection on the symmetric module and the FPGA communication module; and S4, performing interface adaptation on the communication data receiving side of the symmetric module according to a bus access mode in the full-digital simulation system. The FPGA module simulation is based on the source code of the FPGA, so that the accuracy of the FPGA simulation behavior is improved.

The invention discloses a cross-platform binary code block hierarchical semantic similarity detection method and a related device, and belongs to the field of code vulnerability detection.The cross-platform binary code block hierarchical semantic similarity detection method comprises the following steps that structural information of a binary file is analyzed, a machine instruction is analyzed through a hybrid disassembling engine, a basic block is extracted from the structural information of the binary file, and the basic block is extracted from the binary file; constructing a control flow graph, a data dependency graph and a function call graph; extracting instruction level semantics, basic block level semantics and function level semantics from the instruction sequence, the basic block, the control flow graph, the data dependency graph and the function call graph; according to the instruction-level semantics, the basic-block-level semantics and the function-level semantics, constructing instruction-level features, basic-block-level features and function-level features; and carrying out hierarchical similarity detection on the instruction-level features, the basic block-level features and the function-level features. The method and the related device can solve the problems of low detection efficiency and poor accuracy when a traditional vulnerability detection method is used for detecting vulnerabilities.

This application discloses code processing methods, apparatuses, and storage media. An example method includes: obtaining a first code in low-level language and applicable to a source platform; decompiling the obtained first code to obtain an intermediate representation (IR); and then compiling the IR into a second code in low-level language and applicable to a first target platform, where the source platform and the target platform have different instruction sets.

The invention relates to the field of code vulnerability detection, in particular to a vulnerability detection method and system based on code block features. The method comprises the steps that firstly, a binary file is analyzed, and a machine instruction is analyzed through a hybrid disassembling engine; secondly, performing static linear scanning on the extracted binary file instruction, constructing a control flow graph, dividing basic blocks, extracting an operation code sequence in the basic blocks, and constructing a cross-basic-block data dependency graph and a system calling sequence called by the basic blocks; secondly, using an LSH algorithm to realize rapid filtering, performing similarity comparison on extracted basic block features and vulnerability feature library features, realizing coarse-grained matching, and screening out a matching candidate set; feature fusion is carried out on the candidate set basic block operation code sequence, the basic block data dependency graph and the system calling sequence called by the basic block, GNN fine-grained matching is carried out on the fused features, and vulnerability detection is carried out. The problems that traditional binary vulnerability detection is poor in adaptability and low in result reliability are solved.

The invention discloses a dynamic binary translation acceleration method and system, a medium and a product, and the method comprises the steps: analyzing an ELF file of a target program before executing the target program, and extracting an external dependency library and function symbol information thereof; combining function information in a function library to generate an ELF function symbol information file containing function names of all function symbols and meta information of the function names, and mapping the ELF function symbol information file into a memory; when external function search calling is carried out in the process of binary translation execution of a target program in the target architecture, hash retrieval is carried out on ELF function symbol information in the memory; and according to the retrieved function type, realizing pointer mapping from the function type to a corresponding wrapper function, and according to the retrieved packaging type, obtaining an address of a local function to be executed actually so as to realize actual calling and parameter returning of the external function. The invention aims to reduce the symbol analysis and package matching overhead in the dynamic translation initialization process and improve the starting efficiency and the overall operation performance.

The invention relates to a malicious software detection method based on multi-feature fusion and interpretability analysis. According to the technical scheme, static features are extracted through'macroscopic-microscopic 'double paths, and a dynamic behavior knowledge graph is constructed in combination with sandbox monitoring, stain analysis and semantic abstraction and converted into feature vectors through graph embedding; multi-modal feature deep interaction and accurate classification are realized through a double-end cross attention-triple fusion-deep classification architecture; a hierarchical interpretable framework is constructed based on cross-modal causal alignment, case reasoning and anti-fact analysis, and a complete decision evidence chain is generated. The method has the advantages that comprehensive representation of the form, semantics and intention of malicious software is achieved, the detection precision and robustness are remarkably improved, meanwhile, the'black box 'dilemma of the model is solved, credible explanation is provided for security analysis, the method is suitable for complex network threat detection scenes, and it is verified through experiments that the method has good application prospects. According to the method, the detection rate of the Windows malicious software is remarkably increased, and the false alarm rate is effectively reduced.

The present invention provides a method and apparatus for recompiling decompiled code, and a storage medium. The method comprises: acquiring decompiled code: acquiring decompiled code generated by decompiling a target program; checking the decompiled code: acquiring error information generated after parsing and semantically checking the decompiled code; verifying the error information: comparing the error information with a preset ignore rule, and ignoring the error information conforming to the preset ignore rule; optimizing the decompiled code: optimizing the decompiled code on the basis of the remaining error information after ignoring; and generating a subsequent program: performing compilation on the basis of the optimized decompiled code to generate a subsequent program. The technical solution in the embodiments of the present invention can shorten the manual repair cycle from decompilation to recompilation, thereby saving a significant amount of time during security analysis of program packages.

The invention provides a firmware patch state judgment method based on graph embedding and random walk. The method comprises the steps of obtaining a target function, a vulnerability function and a patch function from target firmware; constructing a corresponding dual-channel control flow diagram based on the target function, the vulnerability function and the patch function; respectively inputting the target dual-channel control flow diagram, the vulnerability dual-channel control flow diagram and the patch dual-channel control flow diagram into a preset graph auto-encoder model for graph embedding processing to obtain a corresponding graph embedding matrix; and performing patch state judgment based on the target graph embedding matrix, the vulnerability graph embedding matrix and the patch graph embedding matrix through random walk processing, and outputting a judgment result. According to the firmware patch state judgment method based on graph embedding and random walk, on the basis of the two-channel control flow graph, dimension reduction compression is performed through the preset graph auto-encoder model, and the graph embedding matrix is constructed, so that the accuracy and efficiency of firmware patch state judgment are improved.

The invention provides a key node identification method and device in an industrial control system, equipment and a medium. The key node identification method comprises the steps of performing reverse analysis on firmware codes of control equipment to obtain a control logic configuration file; disassembling the control software firmware code to obtain a software disassembling code; performing code labeling, code slicing and code translation on the software disassembly code to obtain a class C pseudo code; performing code analysis on the class C pseudo code to obtain a software structure configuration file; performing file analysis on the control logic configuration file and the software structure configuration file to obtain a service logic relationship between the control equipment and the control software and a service logic relationship between the control equipment and the field equipment; constructing a business logic map based on the business logic relationship between the control equipment and the control software and the business logic relationship between the control equipment and the field equipment; and identifying a key control link in the service logic map, and carrying out key node positioning on the key control link. Therefore, key nodes are effectively positioned.

Embodiments of the present application provide a code repair method and device, electronic equipment, storage medium and product. The method comprises: extracting binary features of a packed file, inputting a pre-trained convolutional neural network model to obtain target packing features corresponding to the packed file, performing unpacking processing on the packed file to obtain an unpacked file; performing decompilation processing on the unpacked file to obtain decompiled code, and performing semantic recognition on the decompiled code by a language recognition model to perform symbol recovery processing to obtain symbol recovery code; performing structural processing on the logic of the symbol recovery code by abstract syntax tree technology to obtain structured code; and performing compilation repair processing on the structured code to obtain target code. The above scheme accurately identifies the target packing type by using the pre-trained convolutional neural network model, automatically performs targeted repair according to the target packing type, can accurately repair the influence of the packing tool on the readability of the code, and thus improves the accuracy of code repair.