470results about "Decompilation/disassembly" patented technology

Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include determining a learned control flow directed graph for executable code of an application by observing executions of transitions during an observation period and determining destinations of indirect transfers based on the learned control flow directed graph. Next a disassembly of the executable code is determined based on the learned control flow directed graph, the destinations of the transfers, and the executable code.

Provided in the present application are a training / application method for a representation learning model, and a device and a medium. The training method comprises: extracting a plurality of source codes from an open-source repository, and on the basis of the plurality of source codes and a large language model, generating a training sample set, wherein each sample in the training sample set comprises assembly codes and natural language text; on the basis of an assembly code data set, performing pre-training to generate an assembly coder, and on the basis of a natural language data set, performing pre-training to generate a text coder; on the basis of the training sample set and a contrastive learning algorithm, performing alignment training on the assembly coder and the text coder, so as to obtain a code representation learning model and a natural language representation learning model which are semantically aligned; and on the basis of the code representation learning model and the natural language representation learning model, which are semantically aligned, constructing a representation learning model. The method of the present application significantly improves the generalization ability and accuracy of a representation learning model, and greatly reduces dependence of the model on samples and a large volume of tagged data.

The invention provides a malicious code gene information recessive association mining method based on meta-learning, which comprises the following steps of: generating a function call graph (FCG) to obtain an attribute function call graph; training the feature extraction model based on the sequence-to-sequence mechanism by adopting meta-learning, and obtaining a key sub-graph of the function call graph from the generated attribute function call graph through the trained feature extraction model based on the sequence-to-sequence mechanism; generating a control flow graph (CFG), and obtaining an attribute control flow graph; using the optimized gene feature extraction model based on the graph structure for the generated attribute control flow graph to obtain a key sub-graph of the control flow graph; and a fine-tuning corpus is obtained through the key sub-graph of the function call graph and the key sub-graph of the control flow graph, and hidden association mining of malicious code gene information is carried out by using the fine-tuned large language model. According to the method, the recessive association of the malicious code gene information can be accurately mined, and the malicious code analysis precision and efficiency are remarkably improved.

The invention discloses a code obfuscation method, device and equipment and a storage medium, and belongs to the field of financial science and technology, and the method comprises the steps: obtaining an original byte code file corresponding to an application program source code; identifying to-be-confused data in the original byte code file, and confusing and renaming the to-be-confused data according to a mapping name of the to-be-confused data in the naming mapping table to obtain a first confused file corresponding to the original byte code file; identifying a control flow in the first confusion file, and performing confusion recombination on the identified control flow to obtain a second confusion file; and performing confusion processing on methods contained in various types in the second confusion file to obtain a target confusion file. According to the method, the maintainability and the resistance of the application program source code are enhanced, the risk that the application program source code is decompiled is reduced, the safety of the application program source code is improved, and then the safety of the application program is improved.

The invention relates to the technical field of block chain abnormal behavior detection, in particular to a block chain abnormal smart contract detection method and system based on multi-modal knowledge distillation. The multi-dimensional feature data comprises smart contract source code static logic structure features, smart contract source code dynamic execution state features and smart contract transaction data transaction mode features; and inputting the multi-dimensional feature data into an intelligent contract detection model, and detecting and outputting the abnormal state of the to-be-detected block chain intelligent contract by using the intelligent contract detection model, the intelligent contract detection model performing knowledge distillation by using a teacher-student network model architecture. According to the method, the teacher contract detector is pre-trained by using the multi-source features, so that the student contract detector can still learn transaction behavior knowledge in the absence of transaction data, fraudulent behavior detection is realized in advance, and the detection performance of the abnormal contract is improved by integrating data of different modalities.

Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include determining a learned control flow directed graph for executable code of an application by observing executions of transitions during an observation period and determining destinations of indirect transfers based on the learned control flow directed graph. Next a disassembly of the executable code is determined based on the learned control flow directed graph, the destinations of the transfers, and the executable code.

The invention discloses a method for automatically capturing semantic information of a binary code block and a related device, and relates to the technical field of computers.The method comprises the following steps that code disassembling and instruction level analysis are conducted on the binary code block, and a binary stream original instruction sequence is generated; performing semantic intermediate representation conversion and vocabulary overflow standardization on the binary stream original instruction sequence to obtain a binary code standardized instruction sequence; obtaining an instruction data dependency relationship and an instruction control dependency relationship corresponding to the binary code block, and constructing a corresponding binary code program dependency graph; semantic code node embedding is carried out on the binary code program dependency graph to generate a binary code representation vector corresponding to context semantics; and performing automatic semantic capture reasoning on the binary code representation vector corresponding to the context semantics through a pre-trained semantic understanding model to obtain semantic information of the binary code block. According to the method, the semantic information of the binary code block can be efficiently and accurately captured.

The invention discloses a graph neural network-based intelligent contract bytecode similarity detection method, which comprises the following steps of: performing disassembling operation on Ethereum virtual machine bytecodes, and performing data flow analysis and control flow analysis on disassembling results to obtain a data flow graph and a control flow graph corresponding to the bytecodes; combining the data flow diagram and the control flow diagram of each external function into a byte code characteristic diagram; a large number of intelligent contracts with similar labels are adopted to train a graph neural network, vectorization operation is performed on the byte code feature graph in the training process, and feature vectors are obtained; and taking the problem contract as a reference smart contract, respectively inputting the bytecode feature maps of the reference smart contract and the to-be-detected smart contract into the trained graph neural network to respectively obtain corresponding feature vectors, comparing the Euclidean distance of the two feature vectors, and measuring to obtain the similarity of the bytecode of the two smart contracts. Compared with a traditional method, the method has higher accuracy, problem contracts can be effectively recognized, and the safety of a block chain system is enhanced.

A method for automatically analyzing a computer program. The method includes generating intermediate representation code including a sequence of intermediate representation instructions by decompiling binary code of the computer program, generating one or more intermediate representation code strings from the sequence of intermediate representation instructions, searching for reference intermediate representation code strings of a plurality of reference intermediate representation code strings in the one or more intermediate representation code strings by means of a string kernel search, wherein each reference intermediate representation code string belongs to a program component, and ascertaining the program components to which the reference intermediate representation code strings found in the one or more intermediate representation code strings by means of the string kernel comparison belong as the program components present in the computer program.

The invention provides a GNN-based cross-architecture binary program similarity detection method, apparatus and device, and relates to the technical field of information security processing. The method comprises the following steps: acquiring two binary programs to be detected, and disassembling the binary programs into a low-level virtual machine intermediate representation (LLVM) IR; constructing a program diagram based on LLVM IR; then inputting the program diagram into a FastText model to extract an LLVM IR instruction, and taking a corpus created based on the LLVM IR instruction as a vocabulary of the FastText model to perform multiple rounds of training so as to express an instruction mark as a word vector in a continuous vector space, and generating an instruction vector; according to the program diagram and the instruction vector, processing by using a global attention enhanced diagram neural network GNN to generate a diagram embedding vector with a fixed dimension; and calculating the similarity between the graph embedding vectors corresponding to the two binary programs to evaluate the similarity. According to the method, unified program representation of cross-framework binary programs can be realized, high-level semantic features are captured, and the processing efficiency of large-scale program library analysis is effectively improved.

The invention provides a binary translation system applied to an X86 program, which is used for translating a source program following X86 semantics into a target program following other semantics, and comprises a data acquisition module used for acquiring the source program; the disassembling module is used for dividing a source program into a plurality of basic blocks and analyzing subsequent basic blocks corresponding to each basic block; the backward data flow analysis module is used for sequentially analyzing each instruction in each basic block from back to front so as to obtain a target definition set and a target subsequent use set corresponding to each instruction in the source program; and the translation module is used for eliminating redundant instructions of high-order zero clearing or high-order retention of the general register generated in translation. According to the technical scheme, the register state of the general register corresponding to each instruction of the source program is analyzed through the backward data flow analysis module so as to eliminate redundant instructions generated in the translation process.

The invention belongs to the technical field of applet privacy leakage detection methods, and discloses an applet privacy leakage detection method and system based on an abstract syntax tree. Decompiling the packaged file of the applet to obtain a source code file; all the logic layer JavaScript files are converted into AST by using an expression analysis library; obtaining a calling dependency graph between a page logic layer file and a tool file layer according to the file reference relationship, obtaining a field-level binding dependency graph of the page logic layer file and the tool file layer according to a data and event binding relationship of the page rendering layer and the page logic layer, and merging the two layers to obtain a global dependency graph; finally, combining the dependency graphs to generate a global dependency relationship graph; dividing the JavaSript code into a plurality of basic blocks according to the dividing rule of the boundary of the control flow, determining the type of the edge according to the information of the boundary, and obtaining a GCFG by combining the dependency graph; and inputting the GCFG into a taint-pointer analysis module, and obtaining a privacy disclosure path according to predefined sink and source libraries and a data flow propagation rule.

The invention provides a network security malicious code binary search method and system, and relates to the technical field of data processing, and the method comprises the steps: calculating the multi-dimensional structural similarity between a to-be-detected binary file and each standard binary reference file based on a function level control flow semantic feature vector; determining a finally matched standard binary reference file according to the multi-dimensional structural similarity; performing fine-grained difference analysis on the binary file to be detected and the finally matched standard binary reference file to obtain a fine-grained difference analysis result; and on the basis of a fine-grained difference analysis result, in combination with sensitive data operation behavior feature detection, judging whether the to-be-detected binary file is a maliciously tampered version, and positioning a malicious code injection point. According to the method, the defects that in the prior art, dependence on fixed features is too high, and compilation optimization is sensitive are overcome.

The invention discloses a multi-dimensional binary software component analysis system and method, and the system comprises a static enhanced feature extraction module which is used for extracting multi-dimensional features of a target binary system through a disassembling engine, carrying out the fusion of the multi-dimensional features to form an enhanced feature representation model, and carrying out the preliminary matching through the combination of a feature hash library; the component verification module is used for recording runtime behaviors and analyzing the behavior log to verify a static analysis result; the intelligent knowledge base linkage module is used for realizing automatic traceability and risk assessment; the false alarm filtering and confidence evaluation module is used for optimizing credibility grading of a final result, constructing a false alarm filtering mechanism based on Bayesian reasoning, integrating results of multiple analysis stages, calculating the confidence of an identification result of each component, outputting a grading report and supporting a user to screen high-credibility results as required; and comprehensiveness, accuracy and intelligence of binary software component identification are realized.

The invention discloses a cloud native security configuration system and method based on container analysis and LLM, and the system comprises a mirror image static analysis module which is used for compiling a Linux kernel and a standard library source code to extract intermediate representation, and tracking and constructing a double-layer mapping relation library from the system call to the container capability; the dynamic binary extraction module is used for executing the container mirror image and extracting a binary file of a core function; the mirror image static and dynamic association module is used for executing two-stage static binary file analysis and extracting function requirements required by system calling and mirror image for loading during container running; and the cue word construction and model fine adjustment module is used for constructing cue words, performing fine adjustment on the LLM model and generating a minimum privilege function limitation configuration file of the container. According to the method, static analysis and runtime analysis are combined, the container mirror image is thoroughly checked, the function, which is specified by a user and exceeds the original definition of the mirror image, of the LLM model is finely adjusted through the cue word, and privileged function security configuration is generated according to specific requirements.

The invention relates to the technical field of data security detection, in particular to a data security-oriented mobile application dynamic and static dual-combination detection method and system. The method comprises the following steps: collecting basic information of a target mobile application from a plurality of heterogeneous data sources, and constructing a basic data set of the mobile application information; performing decompilation and static analysis based on the installation file in the resource library, and outputting a static risk feature vector in combination with the sensitive data operation rule set; dynamically running a target application in the controlled sandbox environment, monitoring network traffic, system calling and file operation behavior sequences, and outputting a dynamic behavior risk feature vector; and fusing the two types of feature vectors, and inputting the fused feature vectors into a risk assessment model to generate a comprehensive data security risk assessment report. According to the method, a comprehensive evaluation system is constructed by fusing static and dynamic risk features, and full-dimension coverage of the security risk of the mobile application is realized.

The invention provides a performance analysis method and device for a cross-architecture semantic equivalence instruction stream and a storage medium, and the method comprises the steps: taking a high-level language program as input, aiming at a plurality of target architectures, generating a multi-dimensional semantic equivalence instruction stream set from a high-level language form to an intermediate representation and then to an assembly code through a compiler; based on semantic equivalence instruction streams of code units with different granularities and compiler debugging information, establishing a mapping relationship between a target region in a source code and an intermediate representation and assembly codes, and forming a cross-hierarchy equivalence region fully-connected graph; and based on the semantic equivalence instruction stream set and the cross-level equivalence region fully-connected graph, automatically embedding a performance monitoring code at the boundary of the target region, and carrying out performance test on the elastic region. According to the method, the accurate performance test of the cross-architecture semantic equivalence instruction stream can be realized.

The invention discloses a smart contract decompilation code optimization method and a smart contract decompilation code optimization system, which are used for solving the technical problem that an existing smart contract decompilation code optimization method cannot provide a more comprehensive optimization scheme. The method comprises the steps of obtaining a to-be-optimized smart contract decompilation code, and constructing a contract dependency graph based on the to-be-optimized smart contract decompilation code; performing fragment extraction on the contract dependency graph to generate a variable method code context; generating a plurality of thinking chain prompts based on the contract dependency graph; performing code optimization on the to-be-optimized smart contract decompilation code by adopting a large language model according to a variable method code context, a plurality of thinking chain prompts, a preset variable type reasoning candidate set and a preset contract attribute reasoning candidate set, and outputting an intermediate smart contract decompilation code; and performing consistency check on the middle smart contract decompilation code according to the to-be-optimized smart contract decompilation code by adopting a preset program analysis and verification technology, and determining a target smart contract decompilation code.

The invention relates to a webpage tampering detection method based on a block chain technology, and the method comprises the steps: S1, initializing distributed storage nodes, synchronizing block chain data between different storage nodes, and verifying the data integrity and legality of a newly added node; s2, carrying out data acquisition on a webpage to be detected, and representing the content of the webpage to be detected as a computable data structure; s3, performing hash operation on the data structure to generate a unique digital fingerprint; s4, constructing a transaction by using the digital fingerprint, and performing propagation and verification; s5, constructing a new block, and performing broadcasting and verification; and S6, regularly verifying the record on the block chain according to requirements to determine whether the webpage is tampered or not. The invention further provides a webpage tampering detection device based on the block chain technology and a storage medium.

Systems, methods, and software can be used to determine source code of a software code. In some aspects, a method includes: processing a binary code by using a file encoder model to obtain a file embedding vector; and selecting one or more source code samples based on the file embedding vector and a distance function.

Disclosed in the present invention is a construction system for a big data analysis algorithm library, comprising: an analysis process construction module, an operator platform selection module, a code reverse generation module, a user code verification module, a cluster control host, and a cluster computing host. Cross-platform and cross-language algorithm fusion can be realized, and data analysis is realized in a complete and heterogeneous data analysis flow. Also disclosed in the present invention is a construction method for a big data analysis algorithm library.

The invention belongs to the technical field of information security, and particularly relates to a reinforcing method and device for a swan application. The method comprises the steps of obtaining a to-be-reinforced swan gap application, wherein the swan gap application comprises at least one first byte code file; decompiling the first byte code file into an editable first file, and modifying and reinforcing the first file to generate a second file; and compiling the second file into a second byte code file, and generating the reinforced swan application based on the second byte code file. The invention provides an application reinforcement scheme which is available for a swan-gap system and has better performance.

The invention discloses a model training and task execution method and device, a storage medium and equipment. The model training method comprises the steps of obtaining an advanced reduced instruction set ARM machine code and inputting the ARM machine code into a disassembling model, performing mask processing on part of instruction data contained in the ARM machine code to obtain first mask data, determining a first feature corresponding to the first mask data, and performing mask processing on at least part of data units contained in the instruction data to obtain a second feature corresponding to the first feature; obtaining second mask data, and determining a second feature of the second mask data; determining predicted position information according to the first feature, and predicting a masked data unit in each piece of instruction data according to a second feature corresponding to each piece of instruction data; and training the disassembling model according to the deviation between the predicted value and the actual value corresponding to the masked data unit and the deviation between the predicted position information and the actual position information corresponding to the masked instruction data.

The invention discloses a binary vulnerability data set expansion method and system based on cross-modal alignment, provides a hierarchical semantic fusion alignment framework, and remarkably improves the precision and expandability of binary vulnerability detection through a heterogeneous modal semantic bridging and transfer learning mechanism. A multi-modal semantic mapping channel is constructed by utilizing natural language interpretation and combining program structured analysis and constant anchor point coding, so that the semantic difference between a binary code and a source code is effectively bridged; a hierarchical attention mechanism enhances the fine-grained perception capability of cross-modal matching; furthermore, a migration framework driven by a vulnerability detection task is provided, binary vulnerability detection is mapped to a source code feature space through cross-modal alignment, a binary vulnerability data set is rapidly expanded by utilizing rich source code vulnerability data, and the data scale bottleneck is broken through.

The invention relates to a memory horse detection method and device, electronic equipment and a readable medium, and the method comprises the steps: monitoring a call event in a system, and determining a suspicious class on a JVM (Java Virtual Machine) which is subjected to abnormal call under the condition that abnormal call is detected; decompiling the suspicious class to obtain a Java source code of the suspicious class; the initial score of the Java source code on each evaluation dimension is output through a preset language model, and each evaluation dimension is a plurality of dimensions used for evaluating whether memory horse features exist in the code or not; and performing comprehensive calculation on each initial score according to a preset scoring rule to obtain a total evaluation score, and determining a memory horse detection result of the suspicious class through the total evaluation score. According to the method, after the abnormal calling behavior of the system is detected, the suspicious class is found out, then the Java source code of the suspicious class is evaluated from multiple dimensions, whether the memory horse features exist in the suspicious class or not is determined, and the problem that the memory horse features in the Java class cannot be comprehensively detected is solved.

The invention relates to a static analysis-based Pascal-like binary program structured information extraction method, which specifically comprises the following steps of: (1) preliminarily reading basic attributes in a binary file compiled by a Pascal-like by a script and other tools, (2) finding all functions for creating class objects through an obtained construction characteristic function and a control flow analysis technology, and (3) extracting the structured information of the Pascal-like binary program. (3) recursively identifying a member object definition relationship in a binary file and an inheritance relationship between classes by taking a basic object address as a base address and combining a data analysis technology, (4) confirming a corresponding construction function name and a corresponding parameter type and name by combining a result of script automatic generation, and (5) searching a corresponding class interface according to an analysis result, and performing classification and classification on the corresponding construction function. And the code restoration logic is consistent with the original binary file behavior. Accurate restoration of class structures, interfaces and functions is achieved, and therefore the efficiency and accuracy of reverse analysis are improved.

The invention discloses a code embedding method based on a semantic embedding vector generation model, which belongs to the technical field of computers, and comprises the following steps of: obtaining a binary code block, and performing disassembling processing and code structure analysis based on different granularities to obtain a basic block corresponding to the binary code block and a control flow diagram structure feature; performing assembly instruction linear conversion and cross-instruction-set semantic embedding conversion on the basis of the basic blocks corresponding to the binary code blocks and the structural features of the control flow graph to generate a unified binary code semantic embedding vector space corresponding to a cross-instruction-set architecture; obtaining a known vulnerability sample, and performing semantic vulnerability characterization analysis and candidate vulnerability retrieval positioning to generate a candidate vulnerability code block set; and carrying out dynamic analysis verification on the candidate vulnerability code block set and identifying a corresponding vulnerability repair state so as to output a corresponding binary vulnerability code block detection report. According to the method, high-precision semantic embedding of binary codes can be realized.

The invention discloses a contract vulnerability detection method and system based on cross-granularity feature fusion and meta-learning, and relates to the technical field of block chain security, the method comprises the following steps: obtaining a source code and a compiled byte code of a contract to be detected; source code semantic features are extracted from the source code, operation code execution features are extracted from the byte code, and graph structure features are extracted after a program dependency graph is constructed from the source code; performing cross-granularity attention interaction to generate cross-granularity fusion features; performing type-aware feature modulation on the cross-granularity fusion feature and a vulnerability type identifier of the current detection task, training a classifier by adopting a meta-learning strategy, and outputting a vulnerability detection result; and in response to the vulnerability detection result that the vulnerability exists, positioning the vulnerability code position based on the graph-source code attention weight matrix generated in the cross-granularity attention interaction process, thereby solving the problem of poor generalization ability in a rare vulnerability scene with scarce samples.

Aspects of the present disclosure relate to threat detection of executable files. A plurality of static data points may be extracted from an executable file without decrypting or unpacking the executable file. The executable file may then be analyzed without decrypting or unpacking the executable file. Analysis of the executable file may comprise applying a classifier to the plurality of extracted static data points. The classifier may be trained from data comprising known malicious executable files, known benign executable files and known unwanted executable files. Based upon analysis of the executable file, a determination can be made as to whether the executable file is harmful.