Cross-architecture binary function similarity detection method and system based on neural network

Abstract

The invention belongs to the technical field of network security, and particularly relates to a cross-architecture binary function similarity detection method and system based on a neural network, andthe method comprises the steps: traversing a binary file function list for different types of binary files, constructing and optimizing a function control flow graph, translating the program basic block byte code to obtain an intermediate representation, generating a semantic embedding vector of the basic block code, extracting function control flow graph nodes by using a breadth-first graph traversal algorithm, obtaining function embedding vectors according to semantic embedding vectors and control flow information of the nodes, and calculating the cosine distance between the function embedding vectors to measure the function similarity. The method is more beneficial to code intermediate representation, eliminates the difference between different instruction architectures, reduces the cross-architecture code similarity detection difficulty, and reduces the expansion workload and difficulty, based on a function embedding process of a PVDM model and a graph neural network, introductionof human prejudice is avoided, the improved graph neural network is faster in convergence speed and higher in overall efficiency and accuracy of the system.

Description

Technical field[0001]The invention belongs to the technical field of network security, and particularly relates to a method and system for detecting the similarity of cross-architecture binary functions based on neural networks.Background technique[0002]The same source code is compiled with different compilers and optimized configurations. For different hardware platforms, the compiled binary codes are not the same. Therefore, the binary code similarity detection will encounter its unique problems, namely, cross-compiler, cross-compilation optimized configuration and cross-compiler. Instruction structure detection problem. The main idea of ​​traditional binary code similarity detection technology is to first abstract intermediate representations for binary code fragments that are not related to the compiler, compilation optimization configuration, and instruction architecture, such as identifier sequences, abstract syntax trees, or control flow graphs. ,CFG), and then measure the si...

AI Technical Summary

Problems solved by technology

Code high-level intermediate representation analysis and comparison are difficult and inefficient

The comparison and matching algorithm directly to the CFG structure has a problem of huge overhead, and over-optimization of the vertices and structures of the CFG may improve the detection efficiency, but may lose important similarity features

The similarity model may introduce human bias. Existing research mostly uses artificially defined code features to construct intermediate representations, especially the method of constructing feature vectors based on code attribute statistics. They usually default that different attributes are not related to each other, and the similarity Contributions are the same, while the actual situation does not guarantee both

Images