Looking for breakthrough ideas for innovation challenges? Try Patsnap Eureka!

Binary code similarity detection method and system based on graph matching network

A technology of binary code and detection method, which is applied in the direction of neural learning method, biological neural network model, platform integrity maintenance, etc., can solve the problems of data flow confusion robustness, can not meet the requirements of large-grained program level comparison, etc., to improve The effect of detection accuracy and rich semantic representation

Active Publication Date: 2021-09-24
HUNAN UNIV
View PDF0 Cites 0 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

[0004] Although binary code similarity detection based on graph representation learning has many advantages, there are three main limitations: 1) Lexical representation problem
Existing instruction-level embeddings, whether using artificial feature extraction or pre-training methods based on natural language processing, usually treat the entire instruction or part of the instruction (opcode, operand) as a word for processing, ignoring the lack of vocabulary (OOV ) problem, which leads to instruction-level data embedding very close to the origin and lack of data flow confusion robustness; 2) scalability problem; 3) existing methods cannot meet the large-grained program-level comparison requirements

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Binary code similarity detection method and system based on graph matching network
  • Binary code similarity detection method and system based on graph matching network
  • Binary code similarity detection method and system based on graph matching network

Examples

Experimental program
Comparison scheme
Effect test

Embodiment Construction

[0052] like figure 1 As shown, this embodiment is based on the binary code similarity detection method of the figure matching network comprises:

[0053] 1) Get the test of the test;

[0054] 2) Confused procedures for the pre-test procedures to be measured, and the process of control flow map ICFG and its instructions are obtained;

[0055] 3) Control flow map ICFG to the process of the procedure to obtain the initial feature embedded in which the basic block is embedded.

[0056] 4) The final embedding of the control flow map ICFG is controlled between the procedure of the procedure to be tested by the mismatch neural network. h G1 with h G2 ;

[0057] 5) Calculate the final embedding of the control flow map ICFG in the process of calculating the procedure to be tested in vector space h G1 with h G2 Similarity as the similarity detection result of the procedure to be tested.

[0058] In the present embodiment, step 2) includes: an instruction to obtain an instruction for the pen...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

PUM

No PUM Login to View More

Abstract

The invention discloses a binary code similarity detection method and system based on a graph matching network. The method of the invention includes obtaining a pair of programs to be tested, and disassembling the program to be tested to obtain an inter-process control flow graph ICFG and its instructions; Obtain the initial feature embedding of the basic blocks in the inter-procedural control flow graph ICFG of the program to be tested; obtain the final embedding of the inter-procedural control flow graph ICFG of the program pair under test through the graph matching neural network h G1 and h G2 ; Compute the final embedding of the interprocedural control flow graph ICFG of the program pair under test in the vector space h G1 and h G2 The similarity between them is taken as the similarity detection result of the program pair to be tested. The present invention obtains the final embedding of the inter-procedural control flow graph ICFG of the program pair to be tested through the graph matching neural network, which can obtain rich semantic representations, thereby effectively improving the detection accuracy rate, and has an important foundation for binary-based code security analysis effect.

Description

Technical field [0001] The present invention belongs to the field of Internet security, and specifically, the present invention relates to a binary code similarity detection method and system based on the map matching network. Background technique [0002] Similarity of binary code detection has important applications in many computer system safety of people's livelihood, such as vulnerability, software plagiarism, malware detection, code reconstruction, etc. With the rapid application of the Internet of Things, modern military equipment equipment, large scientific research equipment, civilian power, transportation, petrochemical, manufacturing industries have more and more dependent on information control system, the malware Problems such as code and vulnerabilities have become an important challenge for information system security. In particular, a single error of the source code level may spread on the device of hundreds or more different hardware architecture and software pla...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

Application Information

Patent Timeline
no application Login to View More
Patent Type & Authority Patents(China)
IPC IPC(8): G06F21/56G06F8/75G06N3/04G06N3/08
CPCG06F21/563G06F8/75G06N3/08G06N3/044
Inventor 刘玉玲张云
Owner HUNAN UNIV
Who we serve
  • R&D Engineer
  • R&D Manager
  • IP Professional
Why Patsnap Eureka
  • Industry Leading Data Capabilities
  • Powerful AI technology
  • Patent DNA Extraction
Social media
Patsnap Eureka Blog
Learn More
PatSnap group products