Binary function boundary detection method and system based on semantic features and electronic equipment

Abstract

The invention provides a binary function boundary detection method and system based on semantic features and electronic equipment, and the method comprises the steps: disassembling a binary program with a symbol table through IDApro to construct a data set, and training an assembly code through a BERT model to judge whether the assembly code is the boundary of a binary function or not. According to the method, the recognition capability of the function can be enhanced in the disassembling process, and better effects can be achieved in the fields of vulnerability detection, malicious software analysis, software engineering reversion and the like.

Description

technical field [0001] The invention belongs to the technical field of binary code function boundary detection, in particular to a binary function boundary detection method, system and electronic equipment based on semantic features. Background technique [0002] In the field of binary function boundary identification, disassembly tools such as IDApro and BAP can be used. Among them, IDApro uses a pattern matching algorithm for function boundary detection, which has high precision and applicability, but removes the symbol table and high optimization level in disassembly. In the binary program, the function boundary is often inaccurately located, causing some functions to be unrecognizable; while BAP uses a pattern and signature matching algorithm, but the signature relies on human experience and needs to be updated dynamically. [0003] In order to solve the above problem, a neural network is cited to solve this problem. Methods such as ByteWeight use a weighted prefix tree...

AI Technical Summary

Problems solved by technology

Both efficiency and accuracy have been improved, but the LSTM neural network's information recognition results for contextual semantics are not as ideal as BERT

Images