Cross-platform binary code similarity detection method based on semantic space alignment

Abstract

The invention provides a cross-platform binary code similarity detection method based on semantic space alignment. The cross-platform binary code similarity detection method comprises the following steps: firstly, constructing a cross-platform binary code function library; compiling each function in the open source library through a compiler, and obtaining disassembly text codes through different optimization options; then training a single-platform code semantic embedding model by adopting a Bert model; enabling the trained Bert model to be capable of identifying platform code semantics; the method comprises the following steps of: training a semantic alignment model based on Control Learning; and finally, constructing a quick search database based on the locality sensitive hashing technology. After high-dimensional vectors are converted into low-dimensional vectors, similar vector results are obtained by using a matching method; the matching result is analyzed, and the experimental model is evaluated; according to the method, the similarity matching problem of the same source codes under different platforms such as x86 and ARM is solved, and identification of the same semantics under the different platforms is realized.

Description

technical field [0001] The invention belongs to the fields of loophole detection, copyright disputes, malicious software analysis and the like, and in particular relates to a method for similarity detection of cross-platform binary codes based on semantic space alignment. Background technique [0002] Previous cross-instruction architecture binary code similarity research usually requires manual selection of binary code features for basic block embedding. These features not only require professional knowledge, but also have less embedding information, which cannot fully express the semantics of binary code. Such as Gemini, Genius. [0003] In order to solve the above problems, SAFE, Asm2vec, PalmTree and other methods apply the method based on static word representation to binary code. These methods, combined with techniques in NLP, greatly increase the information capacity in basic block embeddings by normalizing the content in basic blocks as input into the model. Howeve...

AI Technical Summary

Problems solved by technology

However, these methods are not suitable for basic block embedding across instruction architectures, because there are independent semantic representation methods in different instruction architectures.

Images