Patch presence detection method based on critical basic blocks

Abstract

The application discloses a patch existence detection method based on key basic blocks, which comprises the following steps: firstly, modeling the semantics of a vulnerability function, a patch function and a target function to be detected into a function static control flow graph, and performing necessary preprocessing to minimize the influence caused by compilation confusion; then, a basic block matching algorithm is proposed, and the basic block matching is performed between the vulnerability function, the patch function and the target function respectively, so as to generate a matching basic block pair set; then, the change degree of a feature basic block related to the patch is analyzed, and the top N feature basic blocks are selected as key basic blocks for effective patch existence test; finally, the key basic blocks of the patch function and the vulnerability function are searched in the target function respectively, and it is judged whether the target function is more similar to the patch function, that is, whether the vulnerability has been patched. Through the above method, it can be quickly and accurately judged whether the vulnerability in a large-scale function to be detected has been patched.

Description

TECHNICAL FIELD

[0001] The present application relates to binary program semantic analysis, binary code similarity analysis and binary code security detection, and in particular to binary code patch existence detection. BACKGROUND

[0002] With the popularity of open source software, the code reuse of third-party libraries has increased dramatically, greatly improving the efficiency of software development in different industries. However, open source software often poses a serious threat to software security, as vulnerabilities can easily spread through code reuse. In fact, this heavy code reuse is difficult to track due to poor management. For vulnerability patching, even if the corresponding patch has been released, it is still a challenge to ensure that all vulnerabilities are patched in a timely manner for a large number of affected software products. A 2020 analysis report found that more than half of all vulnerabilities reported involved known vulnerabilities for patches released between 2002 and 2018. Delayed patching of vulnerabilities makes software products more vulnerable to serious attacks and security threats. Therefore, it is crucial to efficiently and accurately detect whether all vulnerable functions have been patched, especially for large software projects.

[0003] Current vulnerability detection methods convert all target functions to be detected into numerical feature vectors, and then compare them with the feature vectors of specific vulnerability functions to detect the target functions. If the target function is similar to the vulnerability function, it is determined to be a vulnerability function. However, these methods cannot provide a fine enough granularity to distinguish between vulnerability functions and patched patch functions, resulting in a high false positive rate due to the small amount of code modification introduced by the patch for the vulnerability. Therefore, this method requires manual detection to verify the detection results and ultimately find unpatched vulnerability functions. Obviously, this method is very inefficient.

[0004] In order to accurately detect whether a vulnerability function has been patched, domestic and foreign researchers have proposed patch detection methods.

[0005] However, these patch detection methods have a series of limitations:

[0006] 1) Most current patch detection methods require source code, which cannot meet the detection needs in most cases where source code cannot be obtained;

[0007] 2) The development of compilation technology increases the difficulty of patch detection, which will make some detection techniques ineffective;

[0008] 3) Existing patch detection techniques are difficult to achieve high detection accuracy and low time overhead at the same time, hindering their practical application. SUMMARY

[0009] The present application aims at providing a patch existence detection method based on key basic blocks to solve the above technical problems.

[0010] The present method firstly models the semantics of the vulnerability function, the patch function and the target function to be detected into function static control flow graphs, and performs necessary preprocessing to minimize the impact of compilation obfuscation; then a basic block matching algorithm is proposed to match the basic blocks between the vulnerability function, the patch function and the target function respectively, to generate a matching basic block pair set; then the degree of change of the feature basic blocks related to the patch is analyzed, and the top N feature basic blocks are selected as the key basic blocks for effective patch existence test; finally, the key basic blocks of the patch function and the vulnerability function are searched in the target function respectively, to determine whether the target function is more similar to the patch function, i.e. whether the vulnerability has been patched.

[0011] In order to achieve the above purpose, the present application adopts the following technical solutions:

[0012] The patch existence detection method based on key basic blocks comprises the following steps:

[0013] Step S101: based on the disassembly technology, the vulnerability function VF, the patch function PF corresponding to VF, and the executable binary file corresponding to the target function TF are disassembled to obtain the static information of the functions (static information related to functions, basic blocks, assembly instructions, and intra-function static control flow), and a function static control flow graph CFG is constructed V , CFG P , CFG T , and CFG V , CFG P , CFG T is preprocessed;

[0014] Step S102: the static control flow graphs CFG P and CFG V , CFG P and CFG T , CFG V and CFG T are matched respectively, to generate matching basic block pair sets BB PV , BB PT , and BB VT ;

[0015] Step S103: based on the matching basic block pair sets BB PV , the feature basic block sets CBB P and CBB V of the patch function PF and the vulnerability function VF are determined;

[0016] Step S104: calculating CBB P and CBB V the change degree of each feature basic block in the function; selecting the top N feature basic blocks to generate the key basic block set KBB of PF and VF P and KBB V ;

[0017] Step S105: based on the key basic block set KBB P and KBB V , calculating the similarity SIM of the functions TF and PF, VF respectively TP and SIM TV ;

[0018] Step S106: based on SIM TP and SIM TV , judging whether the vulnerability of the function TF has been repaired, if SIM TP > SIM TV , the vulnerability of the function TF has been repaired; otherwise, the vulnerability of the function TF has not been repaired

[0019] Step S107: outputting the detection result

[0020] Further, the step S101 specifically comprises: using a disassembling tool to perform reverse analysis on the binary program, and converting the input binary code into assembly code. The binary programs corresponding to the vulnerability function VF, the patch function PF and the function to be detected TF are disassembled to obtain static information of the functions, including static information related to functions, basic blocks, assembly instructions, and static control flow of the functions; and based on the static information of the functions, a static control flow graph CFG V , CFG P , CFG T is constructed. The control flow graph of the function is a directed graph, wherein each node corresponds to a basic block, and the basic block is a sequence of continuous assembly instructions without branches; each directed edge represents a control flow to the next basic block to be executed

[0021] Further, the specific steps of preprocessing the static control flow graph CFG V , CFG P , CFG T in the step S101 are as follows:

[0022] Step S201: standardizing the operands of each instruction in the function static control flow graph, and the standardization rules are as follows:

[0023] 1) register: if the operand is a specific register name, it is abstracted as “Reg”;

[0024] 2) Address: If an operand is a library function address, the operand will be replaced by the specific library function name;

[0025] If an operand is a user defined function address, the operand will be abstracted as "UDFunc"; if an operand is an address of a reference string, the operand will be replaced by the specific string, and all the capital letters in the string will be converted to lower case; in other cases, the operand will be abstracted as "Addr";

[0026] 3) Memory: If an operand is a memory, the operand will be abstracted as "Mem";

[0027] 4) Constant: If an operand is a constant, the operand will be kept unchanged;

[0028] Step S202: Simplifying the instruction sequence in each basic block in the function static control flow graph, if the instruction sequence in the basic block includes other instructions besides jmp and nop instructions, the jmp and nop instructions will be omitted;

[0029] Further, the definition of matching basic blocks in the step S102 is as follows:

[0030] For two basic blocks, if one of the following conditions is met, the two basic blocks are determined to match:

[0031] 1) The two basic blocks include the same instruction sequence;

[0032] 2) The two basic blocks include the same instruction sequence except conditional jump instructions, and the conditional jump instructions are semantically equivalent;

[0033] Further, the step S102 is specifically a method for matching basic blocks in a static control flow graph, which is based on a function static control flow graph, and uses the context relationship of the basic blocks to guide the search process of matching basic blocks, and the specific steps are as follows:

[0034] Step S301: Labeling four types of characteristic basic blocks in CFG P and CFG V Further, the four types of characteristic basic blocks are as follows:

[0035] 1) Entry basic block: the basic block is the starting basic block of the execution of the function;

[0036] 2) Exit basic block: the basic block is the termination basic block of the execution of the function;

[0037] 3) String reference basic block: the instruction sequence in the basic block includes at least one instruction containing a string reference;

[0038] 4) Function call block: The instruction sequence within this block contains at least one function call instruction;

[0039] Step S302: Compare CFG P and CFG V Based on the definition of the feature basic blocks, the matching basic blocks are identified, and an initial matching basic block set BB is constructed. PV ;

[0040] Step S303: For CFG P For the remaining basic blocks within the PF static control flow graph context information, the number of matched basic block neighbors (predecessor and successor basic blocks) is counted, and the remaining basic blocks are sorted according to this count. The basic block bb with the most matched neighbors is selected. P ;

[0041] Step S304: For bb P Each front-wheel drive basic block bb A If bb A In VF memory, matching basic block bb a Then bb a Unmatched successor basic blocks are added to set C1; for bb P Each of the successor basic blocks bb C If bb C In VF memory, matching basic block bb c Then bb c Unmatched predecessor basic blocks are added to set C2; if neither C1 nor C2 is empty, the intersection of C1 and C2 is assigned to bb. P The candidate matching basic block set C is determined; otherwise, the union of C1 and C2 is assigned to C; within C, the search is performed to find the unique match with bb. P Matching basic blocks bb V If it exists, then (bb) P bb V Join BB PV ;

[0042] Step S306: Determine CFG P and CFG V All matching basic block pairs have been found. If so, end the matching and obtain the CFG. P and CFG V The set of matching basic block pairs BB PV If not, proceed to step S302;

[0043] Step S307: Repeat steps S301-S306, respectively, for CFG P and CFGT and CFG V and CFG T basic block matching, get matched basic block pair set BB PT , BB VT .

[0044] By the above steps, the matched basic block pair search of CFG P and CFG V , CFG P and CFG T , and CFG V and CFG T is completed.

[0045] Further, the process of obtaining the characteristic basic block set CBB P of the patch function PF in step S103 is that for each basic block bb P in the static control flow graph CFG P of the function PF, it is judged whether bb P is in the matched basic block pair set BB PT , if not, bb P is a characteristic basic block of the function PF, and is added into the characteristic basic block set CBB P . Using the same method, the characteristic basic block set CBB V of the function VF can be obtained.

[0046] Further, step S104 selects characteristic basic blocks in the characteristic basic block sets CBB P and CBB V to generate the key basic block sets KBB P and KBB V of the functions PF and VF, and the specific steps are as follows:

[0047] Step S401: characteristic path extraction is performed in the characteristic basic block sets CBB P and CBB V of the functions PF and VF respectively, to generate the characteristic path sets CR P and CR V ;

[0048] Step S402: a characteristic path cr P is sequentially selected from the characteristic path set CR P ;

[0049] Step S403: a characteristic path cr V is sequentially selected from the characteristic path set CR V , if the identification basic block of cr V is the same as that of cr PThe identifier basic block is a matching basic block pair (in the matching basic block set BB) PV The similarity between the two paths (inner) is calculated using the following formula: sim r :

[0050]

[0051] Among them, lcs(cr P ,cr V ) is cr P and cr V The longest common subpath, len() is used to get the length of the path;

[0052] By sorting the paths by similarity, the path with the highest similarity is selected. max .

[0053] Step S403: Based on cr P and cr max The longest common subpath lcs(cr P ,cr max ), for cr P and cr max For each basic block in the data, statistics show that it does not appear in lcs(cr) P ,cr V The number of instructions in a basic block is used as the change value of that basic block. If a basic block appears in multiple feature paths, the smallest change value is used as the final change value of that basic block.

[0054] Step S404: Based on the changed values, process the feature basic block set CBB respectively. P and CBB V The basic blocks within are sorted, and the key basic block set KBB of the top N feature basic block generating functions PF and VF is selected. P and KBB V .

[0055] Furthermore, in step S104, feature paths are extracted from the set of basic function feature blocks to generate a feature path set CR. P The process is as follows:

[0056] Step S501: For the feature basic block set CBB P Each basic block in CBB P If CBB P No predecessor basic block or its predecessor basic block in the set BB of matching basic block pairs PV If it is within the set of starting points of the feature path, then add it to the Start set.

[0057] Step S502: For each basic block cbb in the characteristic basic block set, if cbb has no successor basic block or its successor basic block is in the matching basic block pair set BB PV , add cbb to the characteristic path end point set End;

[0058] Step S503: For each start basic block start in the characteristic path start point set Start, from start, traverse each path with an end basic block in the characteristic path end point set End as the end point, if the path only has characteristic basic blocks, the path is a characteristic path, meanwhile record the predecessor basic block of the start basic block and the successor basic block of the end basic block as the identification basic blocks of the path, add the path to the characteristic path set CR.

[0059] Step S504: Repeat steps S501-S504, extract characteristic paths in the function VF characteristic basic block set CBB V , generate the characteristic path set CR V .

[0060] Further, in step S105, based on the key basic block set, calculate the similarity between functions TF and PF and VF respectively, the specific steps are as follows:

[0061] Step S601: Take the basic blocks of functions PF and TF located in the matching basic block pair set BB PT as the cutting point, divide CFG P and CFG T into the sub control flow graph set SubCFG P and SubCFG T , meanwhile record the basic blocks in each sub control flow graph in the sub control flow graph set which are in the matching basic block set as the identification basic blocks of the sub control flow graph;

[0062] Step S602: Sequentially select a key basic block kbb P in the key basic block set KBB P of function PF;

[0063] Step S603: Confirm the sub control flow graph subcfg P in which kbb P is located in the sub control flow graph set SubCFG P , based on the identification basic block of the sub control flow graph, search the corresponding sub control flow graph subcfg T in the TF sub control flow graph set, the basic blocks in the sub control flow graph are the search range of the key basic block kbb P ;

[0064] Step S604: For subcfgT for each basic block bb T , kbb P is calculated using the following formula: T and the similarity sim of bb

[0065]

[0066] Based on these similarities, find the most similar basic block bb P to kbb sim , and record the similarity sim max ;

[0067] Step S605: Weighted calculation is performed with the change value of the key basic block as the weight, so as to obtain the similarity between functions PF and TF. The calculation formula is:

[0068]

[0069] Step S606: Repeat steps S601-S605, and calculate the similarity SIM V between functions TF and VF based on the key basic block set KBB TV .

[0070] Compared with the prior art, the present application has the following beneficial effects:

[0071] 1) The method of the present application can be applied to the scenario where the source code is not available, and does not depend on the source code, having better applicability;

[0072] 2) The method of the present application can cope with the confusion caused by compilation by standardizing the control flow graph, and reduce the influence of code unrelated to the patch on the detection accuracy;

[0073] 3) The method of the present application can fully represent the semantic information of the patch and the vulnerability by extracting the key basic blocks of the patch function and the vulnerability function as patch features and vulnerability features, significantly improving the detection accuracy;

[0074] 4) The method of the present application provides an effective large-scale patch existence detection method, that is, by analyzing each pair of vulnerability function and patch function and extracting general features unrelated to the target function to be detected, the detection efficiency can be greatly improved, which is more in line with actual requirements. BRIEF DESCRIPTION OF DRAWINGS

[0075] Figure 1 is a flowchart of the patch existence detection method based on key basic blocks of the present application. DETAILED DESCRIPTION

[0076] The specific embodiments of the patch existence detection method based on key basic blocks of the present application will be described in detail below with reference to the accompanying drawings.

[0077] Figure 1 The whole flow chart of the patch existence detection method based on key basic blocks of the application;

[0078] The patch existence detection method based on key basic blocks of the application comprises the following steps:

[0079] Step S101: Based on the disassembly technology, the vulnerability function VF, the patch function PF corresponding to the vulnerability function VF, and the executable binary file corresponding to the to-be-detected function TF are disassembled to obtain the static information of the functions (the static information related to the functions, basic blocks, assembly instructions, and static control flow in the functions), and a static control flow graph CFG of the functions is constructed V , CFG P , CFG T , and the CFG V , CFG P , CFG T , is preprocessed.

[0080] Specifically, the binary program is reversely analyzed by using a disassembly tool, and the input binary code is converted into assembly code. The binary programs corresponding to the vulnerability function VF, the patch function PF, and the to-be-detected function TF are disassembled to obtain the static information of the functions, including the static information related to the functions, basic blocks, assembly instructions, and static control flow of the functions; and based on the static information of the functions, a static control flow graph CFG V , CFG P , CFG T is constructed. The control flow graph of the functions is a directed graph, wherein each node corresponds to a basic block, and the basic block is a sequence of continuous assembly instructions without branches; each directed edge represents a control flow, and the control flow flows to the next basic block to be executed.

[0081] The specific steps of preprocessing the static control flow graph CFG V , CFG P , CFG T are as follows:

[0082] Step S201: The operands of each instruction in the function static control flow graph are standardized, and the standardization rules are as follows:

[0083] 1) Register: if the operand is a specific register name, it is abstracted as “Reg”;

[0084] 2) Address: if an operand is a library function address, the operand is replaced with a specific library function name;

[0085] If one operand is a user defined function address, the operand is abstracted as "UDFunc"; if one operand is an address of a reference string, the operand is replaced by the concrete string, and all capital letters in the string are converted to lower case; in other cases, the operand is abstracted as "Addr";

[0086] 3) Memory: if the operand is a memory, it is abstracted as "Mem";

[0087] 4) Constant: if the operand is a constant, it remains unchanged;

[0088] Step S202: simplifying the instruction sequence in each basic block in the function static control flow graph, if the instruction sequence in the basic block includes other instructions in addition to jmp and nop instructions, the jmp and nop instructions are omitted;

[0089] Step S102: respectively matching basic blocks in the static control flow graphs CFG P and CFG V , CFG P and CFG T , CFG V and CFG T to generate the matched basic block pair sets BB PV , BB PT , and BB VT .

[0090] Specifically, the definition of matching basic blocks in step S102 is as follows:

[0091] For two basic blocks, if one of the following conditions is met, the two basic blocks are determined to be matched:

[0092] 1) the two basic blocks contain the same instruction sequence;

[0093] 2) the two basic blocks contain the same instruction sequence except conditional jump instructions, and the conditional jump instructions are semantically equivalent;

[0094] The method of matching basic blocks in two static control flow graphs is based on the function static control flow graph, and the context relationship of the basic blocks is used to guide the search process of matching basic blocks, and the specific steps are as follows:

[0095] Step S301: labeling four types of special basic blocks in CFG P and CFG V :

[0096] 1) entry basic block: the basic block is the starting basic block of the function execution;

[0097] 2) Exit block: This block is the termination block where the function ends execution;

[0098] 3) String reference basic block: The instruction sequence within this basic block contains at least one instruction that contains a string reference;

[0099] 4) Function call block: The instruction sequence within this block contains at least one function call instruction;

[0100] Step S302: Compare CFG P and CFG V Within the special basic blocks, based on the definition of matching basic blocks, matching basic block pairs are identified, and an initial matching basic block set BB is constructed. PV ;

[0101] Step S303: For CFG P For the remaining basic blocks, count the number of matched basic block neighbors (predecessor and successor basic blocks) for each basic block, sort the remaining basic blocks according to this count, and select the basic block bb with the most matched neighbors. P ;

[0102] Step S304: For bb P Each front-wheel drive basic block bb A If bb A In VF memory, matching basic block bb a Then bb a Unmatched successor basic blocks are added to set C1; for bb P Each of the successor basic blocks bb C If bb C In VF memory, matching basic block bb c Then bb c Unmatched predecessor basic blocks are added to set C2; if neither C1 nor C2 is empty, the intersection of C1 and C2 is assigned to bb. P The candidate matching basic block set C is determined; otherwise, the union of C1 and C2 is assigned to C; within C, the unique match with bb is searched. P Matching basic blocks bb V If it exists, then (bb) P bb V Join BB PV ;

[0103] Step S306: Determine CFG P and CFG V All matching basic block pairs have been found. If so, end the matching and obtain CFG. P and CFG V The set of matching basic block pairs BBPV If not, go to step S302;

[0104] Step S307: repeat steps S301-S306 to perform basic block matching for CFG P and CFG T , respectively, to obtain a set of matched basic block pairs BB V , BB T . PT VT .

[0105] Step S103: based on the set of matched basic block pairs BB PV , determine the sets of characteristic basic blocks CBB P and CBB V of the patch function PF and the vulnerability function VF, respectively;

[0106] Specifically, the process of obtaining the set of characteristic basic blocks CBB P of the patch function PF is as follows: for each basic block bb P within the static control flow graph CFG P of the function PF, determine whether bb P is within the set of matched basic block pairs BB PT ; if not, add bb P to the set of characteristic basic blocks CBB P of the function PF. Using the same method, the set of characteristic basic blocks CBB V of the function VF can be obtained.

[0107] Step S104: calculate the change degree of each characteristic basic block within CBB P and CBB V ; select the top N characteristic basic blocks in terms of the change degree to generate the sets of key basic blocks KBB P and KBB V of the functions PF and VF, respectively.

[0108] Specifically, the process includes the following steps:

[0109] Step S401: perform characteristic path extraction in the sets of characteristic basic blocks CBB P and CBB V of the functions PF and VF, respectively, to generate the sets of characteristic paths CR P and CR V ;

[0110] Step S402: sequentially select a characteristic path cr P from the set of characteristic paths CR P ;

[0111] ​Step S403: From the feature path set CR V Select a feature path cr in sequence V If cr V The basic block of the identifier and cr P The identifier basic block is a matching basic block pair (in the matching basic block set BB) PV The similarity between the two paths (inner) is calculated using the following formula: sim r :

[0112]

[0113] Among them, lcs(cr P ,cr V ) is cr P and cr V The longest common subpath, len() is used to get the length of the path;

[0114] By sorting the paths by similarity, the path with the highest similarity is selected. max .

[0115] Step S403: Based on cr P and cr max The longest common subpath lcs(cr P ,cr max ), for cr P and cr max For each basic block in the data, statistics show that it does not appear in lcs(cr) P ,cr V The number of instructions in a basic block is used as the change value of that basic block. If a basic block appears in multiple feature paths, the smallest change value is used as the final change value of that basic block.

[0116] Step S404: Based on the changed values, process the feature basic block set CBB respectively. P and CBB V The basic blocks within are sorted, and the key basic block set KBB of the top N feature basic block generating functions PF and VF is selected. P and KBB V .

[0117] Step S105: Based on the Key Basic Block Set KBB P and KBB V Calculate the similarity SIM between functions TF and PF, and VF respectively. TP and SIM TV .

[0118] Specifically, the steps are as follows:

[0119] Step S601: Using the functions PF and TF located in the matching basic block pair set BB PT Using the basic blocks within as cutting points, CFG P and CFG T Divide into a set of sub-control flow graphs (SubCFG) P and SubCFG T At the same time, the basic block in the matching basic block set within each sub-control flow graph set is recorded as the identifier basic block of that sub-control flow graph;

[0120] Step S602: Sequentially select the set of key basic blocks (KBB) for function PF. P A key basic block kbb P ;

[0121] Step S603: Confirm kbb P In the sub-control flow graph set SubCFG P The sub-control flow graph in which it is located (subcfg) P Based on the identifier basic block of the sub-control flow graph, the corresponding sub-control flow graph (subcfg) is searched in the set of sub-control flow graphs in TF. T The basic blocks within this sub-control flow graph are critical basic blocks (kbb). P The search scope;

[0122] Step S604: For subcfg T Each basic block within bb T Calculate kbb using the following formula P and bb T Similarity sim:

[0123]

[0124] Based on these similarities, search for kbb P Most similar basic block bb sim And record its similarity sim max ;

[0125] Step S605: Using the changes in key basic blocks as weights, perform a weighted calculation to obtain the similarity between functions PF and TF. The calculation formula is:

[0126]

[0127] Step S606: Repeat steps S601-S605, based on the key basic block set KBB. V Calculate the similarity SIM between functions TF and VF. TV .

Claims

1. A patch presence detection method based on critical basic blocks, characterized in that, Includes the following steps: Step S101: Based on disassembly technology, disassemble the vulnerable function VF, the corresponding patch function PF, and the executable binary file corresponding to the function TF to be detected, obtain the static information of the functions, and construct the function static control flow graph CFG. V CFG P CFG T And the static control flow graph (CFG) of the function. V CFG P CFG T Preprocessing is performed; Step S102: Perform static control flow graph (CFG) analysis on each of the following steps. P and CFG V CFG P and CFG T CFG V and CFG T Perform basic block matching to generate a set BB of matching basic block pairs. PV BB PT , and BB VT The specific steps are as follows: Step S301: For CFG P and CFG V The four types of special basic blocks are labeled as follows: 1) Entry block: This is the starting block for the function to begin execution; 2) Exit block: This block is the termination block where the function ends execution; 3) String reference basic block: The instruction sequence within this basic block contains at least one instruction that contains a string reference; 4) Function call block: The instruction sequence within this block contains at least one function call instruction; Step S302: Compare CFG P and CFG V Within the special basic blocks, based on the definition of matching basic blocks, matching basic block pairs are identified, and an initial matching basic block set BB is constructed. PV ; Step S303: For CFG P For the remaining basic blocks, count the number of matched basic block neighbors for each basic block. Basic block neighbors include predecessor and successor basic blocks. Based on this count, sort the remaining basic blocks and select the basic block bb with the most matched neighbors. P ; Step S304: For bb P Each front-end basic block bb A If bb A In VF memory, matching basic block bb a Then bb a Unmatched successor basic blocks are added to set C1; for bb P Each of the successor basic blocks bb C If bb C In VF memory, matching basic block bb c Then bb c Unmatched predecessor basic blocks are added to set C2; if neither C1 nor C2 is empty, the intersection of C1 and C2 is assigned to bb. P The candidate matching basic block set C is determined; otherwise, the union of C1 and C2 is assigned to C; within C, the search is performed to find the unique match with bb. P Matching basic blocks bb V If it exists, then (bb) P bb V Join BB PV ; Step S306: Determine CFG P and CFG V All matching basic block pairs have been found. If so, end the matching and obtain the CFG. P and CFG V The set of matching basic block pairs BB PV If not, proceed to step S302; Step S307: Repeat steps S301-S306, respectively, for CFG P and CFG T and CFG V and CFG T Perform basic block matching to obtain the set BB of matching basic block pairs. PT BB VT ; Complete CFG by following the steps above. P and CFG V CFG P and CFG T and CFG V and CFG T The search for matching basic block pairs; Step S103: Based on the set of matching basic block pairs BB PV Determine the characteristic basic block set CBB for the patch function PF and the vulnerability function VF. P and CBB V ; Step S104: Calculate CBB P and CBB V The degree of change of each feature basic block is calculated; the top N feature basic blocks with the highest degree of change are selected to generate the key basic block set KBB for PF and VF. P and KBB V ; Step S105: Based on the Key Basic Block Set KBB P and KBB V Calculate the similarity SIM between functions TF and PF, and VF respectively. TP and SIM TV ; Step S106: Based on SIM TP and SIM TV To determine whether the vulnerability in the function TF has been patched, if SIM TP SIM TV If yes, then the vulnerability in TF has been patched; otherwise, the vulnerability in TF has not been patched. Step S107: Output the detection results.

2. The method according to claim 1, characterized in that, In step S101, the disassembly technique refers to using a disassembler to reverse engineer a binary program, converting the input binary code into assembly code. This involves disassembling the binary programs corresponding to the vulnerable function VF, the patch function PF, and the function to be detected TF, to obtain the static information of the functions. This static information includes information related to the function, basic blocks, assembly instructions, and the static control flow of the function. Based on this static information, a static control flow graph (CFG) is constructed. V CFG P CFG T The control flow graph of a function is a directed graph, where each node corresponds to a basic block, which is a continuous sequence of assembly instructions without branches; each directed edge represents a control flow, which flows to the next basic block to be executed.

3. The method according to claim 1, characterized in that, In step S101, the static control flow graph (CFG) is processed. V CFG P CFG T The specific steps for preprocessing are as follows: Step S201: Standardize the operands of each instruction within the static control flow graph of the function. The standardization rules are as follows: 1) Registers: If the operand is a specific register name, it is abstracted as "Reg"; 2) Address: If an operand is the address of a library function, then that operand will be replaced with the specific library function name; If an operand is the address of a user-defined function, it is abstracted as "UDFunc"; if an operand is the address of a reference string, it is replaced with the actual string and all uppercase letters in the string are converted to lowercase; otherwise, the operand is abstracted as "Addr". 1) Memory: If the operand is memory, it is abstracted as "Mem"; 2) Constants: If the operand is constant, it remains unchanged; Step S202: Simplify the instruction sequence in each basic block of the function's static control flow graph. If the instruction sequence in the basic block includes other instructions besides jmp and nop, then omit the jmp and nop instructions.

4. The method according to claim 1, characterized in that, The definition of the matching basic block in step S102 is: For two basic blocks, they are considered to match if one of the following conditions is met: 1) The two basic blocks contain the exact same sequence of instructions; 2) Apart from the conditional jump instruction, the two basic blocks contain the exact same instruction sequence, and the conditional jump instructions are semantically equivalent.

5. The method according to claim 1, characterized in that, In step S103, the characteristic basic block set CBB of the patch function PF is obtained. P The process is for the static control flow graph (CFG) of function PF. P Each basic block within bb P， Judge bb P Is it in the set BB of matching basic block pairs? PT If not, then bb P It is a characteristic basic block of function PF, added to the characteristic basic block set CBB P Using the same method, we can obtain the set of characteristic basic blocks CBB of the function VF. V .

6. The method according to claim 1, characterized in that, The feature basic block set CBB in step S104 P and CBB V Selecting feature basic blocks to generate the key basic block set KBB for PF and VF P and KBB V The specific steps are as follows: Step S401: In the feature basic block set CBB of functions PF and VF respectively P and CBB V Feature path extraction is performed to generate a feature path set CR. P and CR V ; Step S402: From the feature path set CR P Select a feature path cr in sequence P ; Step S403: From the feature path set CR V In the sequence of steps, select a feature path crV. If the identifier base block of crV and the identifier base block of crP are a matching base block pair, i.e., within the matching base block set BBPV, then use the following formula to calculate the similarity sim between the two paths. r : in, It is cr P and cr V The longest common sub-path, Used to get the length of the path; By sorting the paths by similarity, the path with the highest similarity is selected. max ; Step S403: Based on cr P and cr max Longest common subpath For cr P and cr max For each basic block in the data, statistics do not appear. The number of instructions is used as the change value of the basic block. If a basic block appears in multiple feature paths, the smallest change value is used as the final change value of the basic block. Step S404: Based on the changed values, process the feature basic block set CBB respectively. P and CBB V The basic blocks within are sorted, and the key basic block set KBB of the top N feature basic block generating functions PF and VF is selected. P and KBB V .

7. The method according to claim 6, characterized in that, In step S104, the process of extracting feature paths from the set of basic function feature blocks and generating a feature path set is as follows: Step S501: For the feature basic block set CBB P Each basic block in CBB P If CBB P No predecessor basic block or its predecessor basic block in the set BB of matching basic block pairs PV If it is within the set of starting points of the feature path, then add it to the Start set. Step S502: For each basic block cbb in the feature basic block set, if cbb has no successor basic block or its successor basic block is in the matching basic block pair set BB PV If it is within the specified range, then add it to the feature path endpoint set End; Step S503: For each starting basic block `start` in the feature path starting set `Start`, starting from `start`, traverse each path whose endpoint is the ending basic block in the feature path ending set `End`. If the path contains only feature basic blocks, then the path is a feature path. Simultaneously, record the predecessor basic block of the starting basic block and the successor basic block of the ending basic block as the identifier basic blocks of the path, and add them to the feature path CR. P middle; Step S504: Repeat steps S501-S504, in the feature basic block set CBB of function VF. V Feature path extraction is performed to generate a feature path set CR. V .

8. The method according to claim 1, characterized in that, In step S105, based on the set of key basic blocks, the similarity between functions TF and PF and VF is calculated respectively. The specific steps are as follows: Step S601: Using the functions PF and TF located in the matching basic block pair set BB PT Using the basic blocks within as cutting points, CFG P and CFG T Divide into a set of sub-control flow graphs (SubCFG) P and SubCFG T At the same time, the basic block in the matching basic block set within each sub-control flow graph set is recorded as the identifier basic block of that sub-control flow graph; Step S602: Sequentially select the set of key basic blocks (KBB) for function PF. P A key basic block kbb P ; Step S603: Confirm kbb P In the sub-control flow graph set SubCFG P The sub-control flow graph in which it is located (subcfg) P Based on the identifier basic block of the sub-control flow graph, the corresponding sub-control flow graph (subcfg) is searched in the set of sub-control flow graphs in TF. T , The basic block within this sub-control flow graph is the critical basic block kbb. P The search scope; Step S604: For subcfg T Each basic block within bb T Calculate kbb using the following formula P and bb T Similarity sim: Based on these similarities, search for kbb P Most similar basic block bb sim And record its similarity sim max ; Step S605: Using the change value of the key basic block as the weight, perform a weighted calculation to obtain the similarity between functions PF and TF. The calculation formula is as follows: Step S606: Repeat steps S601-S605, based on the key basic block set KBB. V Calculate the similarity SIM between functions TF and VF. TV .

Images