Binary vulnerability detection method and system based on executable program and storage medium

Abstract

The invention discloses a binary vulnerability detection method and system based on an executable program and a storage medium. The method comprises the following steps: collecting an executable program with a known vulnerability, employing an angr framework supporting a VEX intermediate language to traverse the execution flow of the executable program, and translating the executable program intoa VEX text; cutting the VEX text into a plurality of text fragments, extracting keywords of the text fragments, and serializing all the text fragments; converting the keywords of the serialized text fragment into a text vector with context semantics by using Word2Vec; and converting the text vector into a digital vector, storing a file as input of a Bi-LSTM network model, respectively setting a training data set and a verification data set to train and verify the Bi-LSTM network model, and returning error rates and related record dictionaries on the training set and the verification set. According to the method, the intermediate language VEX IR is introduced into vulnerability detection, so that the execution flow of the program is recovered to a certain extent, and understanding of logicsemantics and context information of the program and establishment of a corresponding vulnerability model by a subsequent algorithm are facilitated .

Description

technical field [0001] The invention relates to the field of loophole detection, in particular to a binary loophole detection method and system based on an executable program. Background technique [0002] Vulnerability detection technology is an important method and basic means to improve software quality and security and reduce software security vulnerabilities, and has attracted extensive attention and high attention from academia and industry. In order to realize the automation of vulnerability discovery, the vulnerability discovery technology based on machine learning (Machine Learning, ML) has attracted extensive attention. [0003] The research on exploiting vulnerability mining can be divided into source code level and binary level according to the different levels of vulnerability mining. [0004] Vulnerability mining technologies at the source code level mainly include control flow analysis and symbolic execution. [0005] Control flow analysis technology does no...

AI Technical Summary

Problems solved by technology

[0012] Purpose of the invention: In order to overcome the deficiencies of the prior art, the present invention provides a binary vulnerability detection method based on an executable program, which can solve the problem of high false positive and false negative rates in the prior art of vulnerability mining tools that rely on code auditing , the problem that the vulnerability cannot be precisely located

Images