Web reverse analysis method based on large model and dynamic feedback

Abstract

The invention relates to the technical field of Web security and artificial intelligence, and discloses a Web reverse analysis method based on a large model and dynamic feedback, which comprises the following steps: constructing an AST-LLM joint analysis engine, defining an AST node importance evaluation formula, carrying out weight quantification on AST nodes, and screening out key functions or code snippets in reverse analysis; semantic analysis is carried out through LLM in combination with context, and candidate names of confusion variables are generated; semantic similarity calculation is carried out on the key nodes screened out through weight quantification and candidate variable names generated by LLM, and semantic grouping is carried out on confusion variables associated with AST nodes through a spectral clustering algorithm; a code structure is optimized through AST node remapping, and codes are corrected through real-time interaction; a closed-loop optimization system of LLM and log instrumentation is constructed, and an optimization engine is dynamically fed back; the method has the advantages that multi-state confusion is resisted, the semantic consistency of reverse output and original logic is ensured, the problem of reverse analysis distortion in a dynamic confusion scene is solved, and the readability, the performability and the maintainability of codes are kept.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Web security and artificial intelligence, and particularly relates to a Web reverse analysis method based on a large model and dynamic feedback. BACKGROUND

[0002] Traditional Web reverse technology has many defects. Firstly, the limitation of static analysis, AST analysis depends on artificial rules, which is difficult to adapt to the continuously evolving new code obfuscation technology (control flow flattening, string encryption, etc.), and the accuracy is low. Secondly, dynamic debugging needs to manually locate encrypted functions and insert probes, which will consume too much time. The existing model has problems such as insufficient context support and lack of field fine-tuning when processing long code. SUMMARY

[0003] In view of the defects of the prior art, the present application aims to provide a Web reverse analysis method based on a large model and dynamic feedback, which is used for efficiently processing code obfuscation, encrypted parameter generation and anti-debugging confrontation scenes.

[0004] In order to achieve the above-mentioned purpose, the present application provides the following technical scheme:

[0005] A Web reverse analysis method based on a large model and dynamic feedback, comprising the steps of:

[0006] Node weight quantization: constructing an AST-LLM joint analysis engine, defining an AST node importance evaluation formula, performing weight quantization on the AST node, and screening out key functions or code segments in reverse analysis;

[0007] Obfuscated variable renaming: performing semantic analysis by LLM combined with the context to generate candidate names of obfuscated variables;

[0008] Semantic clustering and grouping: performing semantic similarity calculation on the key nodes screened out by weight quantization and the candidate variable names generated by LLM, and using a spectral clustering algorithm to realize semantic grouping of the obfuscated variables associated with the AST nodes;

[0009] Code refactoring and structure optimization: optimizing the code structure by AST node remapping, and correcting the code in real time;

[0010] Dynamic feedback optimization: constructing a closed-loop optimization system of LLM and log insertion, and a dynamic feedback optimization engine.

[0011] In the present application, preferably, the AST node importance evaluation formula is defined as:

[0012] W(n i )=0.4·freq(n i )+0.3·depth(ni )+ 0.3 · entropy(n i ),

[0013] where n i is the i-th node in the Abstract Syntax Tree (AST), such as function declaration node, variable assignment node, loop statement node, etc.

[0014] W(n i ) is a quantitative indicator of node importance, used to evaluate the importance of AST nodes in reverse analysis, the larger the value, the more important the node;

[0015] freq(n i ) is the frequency of node type, high-frequency nodes may be core functions (such as encryption function multiple calls);

[0016] depth(n i ) is the node depth, which refers to the level of n i in the AST tree structure, the root node depth is 0, and the depth increases layer by layer; deep nodes may belong to complex logic (such as nested encryption algorithms).

[0017] entropy(n i ) is the information entropy, used to measure the randomness or obfuscation degree of variable name, the larger the value, the higher the randomness; in AST node screening, high-entropy nodes that may be obfuscated (such as random variable name_0x1a2b3c) are analyzed first, and the candidate variable name generated by LLM is compared to verify the anti-obfuscation result.

[0018] In the present application, preferably, the entropy(n i ) information entropy is calculated based on the frequency of variable name associated with the AST node:

[0019] entropy(n i ) = -∑ c∈chars(v) p(c)log2p(c),

[0020] where v is the variable name or string in node n i , such as obfuscated variable name v = "_0x1a2b3c" or clear variable name v = "lx111"

[0021] c is a single character in the variable name v, such as v = "lx111", then c is 'l', 'x', '1', '1', '1' in turn.

[0022] chars(v) is the set of all unique characters in the variable name v. For example, v = "lx111", chars(v) = {'l', 'x', '1'}.

[0023] p(c) is the probability of character c appearing in variable name v,

[0024]

[0025] log2p(c) is used to measure the information amount of character c. If p(c) = 0.5, then log2(0.5) = -1.

[0026] In the present application, preferably, the semantic analysis of the obfuscated variable is performed by LLM combined with context, the actual use of the variable in the code (such as encryption / decryption operation, data storage, etc.) is analyzed, and the variable candidate name is generated according to the actual use.

[0027] In the present application, preferably, the formula for calculating semantic similarity is:

[0028] Clu(v i ,v j ) = |Sim(v i ,v j ) - Sim LLM (v i ,v j )| + 0.5·KL(p(v i ),p(v j ))

[0029] where Clu(v i ,v j ) refers to the cluster membership of node variables vi and vj;

[0030] Sim(vi,vj) refers to the word vector similarity, which is a static semantic similarity calculated based on the word vector model (Word2Vec), and the formula is as follows:

[0031]

[0032] Sim LLM (v i ,v j ) refers to the dynamic semantic similarity generated by a large language model (LLM), for example, the score of variable correlation obtained by DeepSeek;

[0033] KL(p(v i ),p(v j )) is the KL divergence of variable name probability distribution, which is calculated based on the formula of character distribution:

[0034] where p(c) and q(c) are the character distributions of variables v i and v jThe probability of the occurrence of the middle character c. The smaller the formula calculation result is, the more matched the static semantics and the dynamic semantics are. The larger the difference is, the more potential semantic conflicts exist, and the worse the clustering effect is.

[0035] In the present application, preferably, the AST node remapping is to reversely map the grouping result of the variable name after semantic clustering to the original AST structure, replace the obfuscated variable name (such as replacing _0x1a2b3c with encryptKey), trigger the variable renaming update strategy through the weight threshold, and form a bidirectional data flow.

[0036] In the present application, preferably, based on the combination of semantic clustering and the syntax structure of the AST node (such as the function call chain and the variable scope), the inter-cluster association is established and the code block is reconstructed (such as merging the same encryption operation and splitting the heterogeneous function module), so that the code readability and the execution efficiency are improved.

[0037] In the present application, preferably, the LLM can capture errors (such as type mismatch and undefined variable) in the code execution in real time through a lightweight verifier (such as symbolic execution) or in combination with an external interpreter (such as DeepSeek calling a Nodejs sandbox, a Java virtual machine, etc.). Therefore, through the real-time interaction mechanism, the code runtime stack information is monitored, and if a logical conflict is detected, the AST analysis layer is immediately fed back, the semantic clustering parameters are adjusted, and the specific defect position is located based on the context, so that the LLM automatically corrects the code.

[0038] In the present application, preferably, the dynamic feedback optimization includes:

[0039] Automatic instrumentation construction: based on the code generated by the AST-LLM joint analysis engine, log code is automatically inserted through the weight node type (such as function declaration and variable assignment), dynamic execution is collected, and key variables and function calls are tracked;

[0040] Collecting dynamic feedback data: collecting key data types, including exception information (undefined variable, type error), variable value snapshot (recording the value and type of the variable at runtime), function call chain (tracking the execution order and parameters of the function), code coverage, and storing the logs and errors as structured data for subsequent joint LLM analysis and correction;

[0041] Dynamic feedback optimization engine: analyzing the logs through the LLM optimization module and generating suggestions, dynamically feeding back and adjusting the code.

[0042] In the present application, preferably, the dynamic feedback optimization engine specifically further includes:

[0043] Variable name correction: if a variable always stores fixed information at runtime, the candidate name of the variable is replaced from a general name to a semantic name;

[0044] Critical path repair: according to the code coverage result, the code block with high frequency execution but anti-obfuscation failure is preferentially processed;

[0045] Weight adjustment: if a node frequently triggers an error in dynamic execution, the weight thereof is increased to finely analyze.

[0046] Compared with the prior art, the beneficial effects of the present application are:

[0047] The method of the present application realizes real-time mutual verification of the semantic reasoning capability of the LLM and the AST analysis result through a dynamic feedback mechanism, dynamically corrects the node weight and adjusts the variable renaming strategy in the analysis process, thereby resisting polymorphic obfuscation, ensuring the semantic consistency of the reverse output and the original logic, and solving the reverse analysis distortion problem in the dynamic obfuscation scenario.

[0048] The present application realizes the collaborative optimization of analysis and reconstruction through the AST-LLM joint engine and the dynamic feedback closed loop, so that the LLM output is constrained by the AST node weight, and the AST analysis granularity is reversely optimized by using the semantic clustering result of the LLM, finally maintaining the readability, executability and maintainability of the code. BRIEF DESCRIPTION OF DRAWINGS

[0049] Fig. 1 A flowchart of a web reverse analysis method based on a large model and dynamic feedback according to the present application.

[0050] Fig. 2 A flowchart of code reconstruction and structure optimization in a web reverse analysis method based on a large model and dynamic feedback according to the present application.

[0051] Fig. 3 A flowchart of dynamic feedback optimization in a web reverse analysis method based on a large model and dynamic feedback according to the present application. DETAILED DESCRIPTION

[0052] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in the description herein is for describing particular embodiments only and is not intended to be limiting of the application. As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0054] Reference will now be made to the drawings, in which Figs. 1 to 3 A preferred embodiment of the present application provides a web reverse analysis method based on large models and dynamic feedback, mainly used to solve the current problems of web reverse, including the following steps:

[0055] Node weight quantization: an AST-LLM joint analysis engine is constructed, an AST node importance evaluation formula is defined, the AST nodes are weighted, and key functions or code fragments in reverse analysis are screened out;

[0056] Obfuscated variable renaming: semantic analysis is performed by LLM combined with context to generate candidate names of obfuscated variables;

[0057] Semantic clustering and grouping: semantic similarity calculation is performed on the key nodes screened out by weight quantization and the candidate variable names generated by LLM, and a spectral clustering algorithm is used to realize semantic grouping of the obfuscated variables associated with the AST nodes;

[0058] Code refactoring and structure optimization: the code structure is optimized by AST node remapping, and the code is corrected in real time;

[0059] Dynamic feedback optimization: a closed-loop optimization system of LLM and log insertion is constructed, and a dynamic feedback optimization engine is constructed.

[0060] In the present embodiment, the specific steps of defining the AST node importance evaluation formula and performing node weight quantization are as follows:

[0061] The AST node importance evaluation formula is defined to realize quantitative analysis of node weight, screen out key functions or code fragments in reverse analysis, and solve the problem of difficulty in positioning key logic in obfuscated code.

[0062] The AST node importance evaluation formula is defined as follows:

[0063] W(n i )=0.4·freq(n i )+0.3·depth(n i )+0.3·entropy(n i )

[0064] Wherein, n iis the i-th node in the Abstract Syntax Tree (AST), such as function declaration node, variable assignment node, loop statement node, etc.

[0065] W(n i ) is a quantitative indicator of node importance, used to evaluate the importance of AST nodes in reverse analysis, the larger the value, the more important the node;

[0066] freq(n i ) is the frequency of node type, high-frequency nodes may be core functions (such as encryption function calls multiple times);

[0067] depth(n i ) is the node depth, which refers to the level of n i in the AST tree structure, the root node depth is 0, and the depth increases layer by layer; deep nodes may belong to complex logic (such as nested encryption algorithms).

[0068] entropy(n i ) is the information entropy, used to measure the randomness or degree of confusion of variable names, the larger the value, the higher the randomness; in AST node screening, high-entropy nodes that may be confused (such as random variable name_0x1a2b3c) are analyzed first, and the candidate variable names generated by LLM are compared to verify the anti-confusion results.

[0069] Where entropy(n i ) information entropy is calculated based on the frequency of variable names associated with AST nodes:

[0070]

[0071] Where, v is the variable name or string in node n i , such as obfuscated variable name v = "_0x1a2b3c" or clear variable name v = "lx111"

[0072] c is a single character in variable name v, such as v = "lx111", then c is 'l', 'x', '1', '1', '1' in turn.

[0073] chars(v) is the set of all unique characters in variable name v. For example, v = "lx111", chars(v) = {'l', 'x', '1'}.

[0074] p(c) is the probability of character c appearing in variable name v,

[0075]

[0076] log2p(c) is used to measure the information content of character c. If p(c) = 0.5, then log2(0.5) = -1.

[0077] In a specific embodiment, when the string v = "_0x1a2b3c", first count the frequency of each character, and the frequency of each character is 1. The total length of the string is 9, and the probability of each character is 1 / 9 ≈ 0.111

[0078] Calculate the information content of a single character: p(c)log2p(c) = 0.111*log2(0.111) ≈ -0.352

[0079] Accumulate the entropy values of all characters: entropy(n i ) = -∑9-0.352 = 3.168

[0080] The entropy value exceeds 2.5, which can represent that the variable name is completely random.

[0081] Through the entropy value calculation, the automatic identification of the obfuscated code is realized, which provides a key input for the subsequent LLM anti-obfuscation and dynamic verification.

[0082] In the present embodiment, the semantic analysis of the obfuscated variable is performed by LLM combined with the context, the actual use of the variable in the code (such as encryption / decryption operation, data storage, etc.) is analyzed, and the variable candidate name is generated according to the actual use. For example, if the variable _0x1a2b3c is used to store an encryption key, the generated candidate name may be encryptKey.

[0083] In the present embodiment, the specific steps of the obfuscated variable renaming are as follows:

[0084] Semantic clustering and grouping: for the key nodes screened by weight quantization and the candidate variable names generated by LLM, semantic similarity calculation is performed, and spectral clustering algorithm is used to realize semantic grouping of the obfuscated variables associated with the AST nodes. The formula for calculating the semantic similarity is:

[0085] Clu(v i ,v j ) = |Sim(v i ,v j )-Sim LLM (v i ,v j )| + 0.5·KL(p(v i ),p(v j ))

[0086] Where Clu(v i ,v j ) refers to the clustering attribution of the node variables vi and vj.

[0087] Sim(vi,vj) refers to the word vector similarity, a static semantic similarity calculated based on the Word2Vec model, with the formula as follows:

[0088]

[0089] Sim LLM (v i ,v j ) refers to the dynamic semantic similarity generated by a large language model (LLM), such as the score obtained by DeepSeek to associate variables;

[0090] KL(p(v i ),p(v j )) is the KL divergence of variable name probability distribution, calculated based on the character distribution formula:

[0091]

[0092] where p(c) and q(c) are the probabilities of character c appearing in variables v i and v j . The smaller the formula calculation result is, the more matched the static semantics and dynamic semantics are. The greater the difference is, the more likely there is a potential semantic conflict, and the worse the clustering effect is. Assuming that variable v_i="_0x1a2b3c" (candidate name encryptKey) and v_j="_0x4d5e6f" (candidate name decryptKey):

[0093] Word vector similarity: Sim(vi,vj)=0.92.

[0094] LLM similarity: Sim LLM (vi,vj)=0.95.

[0095] KL divergence: KL=0.1.

[0096] Clustering score: |0.92-0.95|+0.5*0.1=0.03+0.05=0.08, resulting in being grouped into the same group.

[0097] In this embodiment, the specific steps of code refactoring and structure optimization include:

[0098] Code refactoring, AST node remapping: the AST node remapping is to reverse map the variable name grouping results after semantic clustering to the original AST structure, replace the obfuscated variable name (such as replacing _0x1a2b3c with encryptKey), trigger the variable renaming update strategy through the weight threshold, and form a bidirectional data flow.

[0099] Code structure optimization, logic adjustment: Based on semantic clustering and AST node syntax structure (such as function call chain, variable scope), the association between clusters is established and the code block is reconstructed (such as merging similar encryption operations, splitting heterogeneous function modules), which improves the readability and execution efficiency of the code.

[0100] Code correction: LLM can capture errors (such as type mismatch, undefined variables, etc.) in code execution in real time through lightweight verifiers (such as symbolic execution) or in combination with external interpreters (such as DeepSeek calling Nodejs sandbox, Java virtual machine, etc.). Therefore, through the real-time interaction mechanism, the runtime stack information of the code is monitored, and if a logical conflict is detected, the AST parsing layer is immediately fed back, the semantic clustering parameters are adjusted, and the specific defect location is located based on the context. Let LLM automatically correct the code.

[0101] In the embodiment, the dynamic feedback optimization includes:

[0102] Automatic instrumentation construction: Based on the code generated by the AST-LLM joint analysis engine, log code is automatically inserted through weight node types (such as function declaration, variable assignment), dynamic execution is collected, and key variables and function calls are tracked;

[0103] Collect dynamic feedback data: Collect key data types, including exception information (undefined variables, type errors), variable value snapshots (record variable values and types at runtime), function call chains (track function execution order and parameters), code coverage, and store logs and errors as structured data for subsequent joint LLM analysis and correction;

[0104] Dynamic feedback optimization engine: Analyze logs and generate suggestions through the LLM optimization module, dynamically feedback and adjust the code.

[0105] In the embodiment, the dynamic feedback optimization engine specifically further includes:

[0106] Variable name correction: If a variable always stores fixed information at runtime, replace its candidate name from a general name to a semantic name;

[0107] Key path repair: According to the code coverage result, preferentially process the code block with high frequency execution but failed anti-obfuscation;

[0108] Weight adjustment: If a node frequently triggers errors in dynamic execution, increase its weight for more detailed analysis.

[0109] By repeating the above steps, the accuracy of the anti-obfuscation engine can be gradually optimized, and finally the code recovery with high restoration degree is realized.

[0110] In some preferred embodiments of the present application, a computer readable storage medium is provided, which stores a computer program. The computer program, when executed by a processor, causes the processor to perform the steps of the method as described in the above embodiments.

[0111] The functions described above can be implemented in software or computer program product, which is stored in one kind of computer readable storage medium when sold or used as an independent product. Based on this understanding, the technical solutions of the present application or the parts of the technical solutions that essentially contribute to the prior art can be embodied in the form of software product, which is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0112] The above description is a detailed description of the preferred embodiments of the present application, but the embodiments are not intended to limit the scope of the patent application of the present application. Any equivalent changes or modifications made under the technical spirit of the present application should be included in the patent scope of the present application.

Claims

1. A Web reverse analysis method based on a large model and dynamic feedback, characterized by: Including steps: Node weight quantification: Build an AST-LLM joint parsing engine, define the AST node importance evaluation formula, quantify the weight of AST nodes, and screen out key functions in reverse analysis; Obfuscated variable renaming: LLM is used to perform semantic analysis in combination with the context to generate candidate names for obfuscated variables; Semantic clustering and grouping: Calculate the semantic similarity between the key nodes selected by weight quantization and the candidate variable names generated by LLM, and use the spectral clustering algorithm to semantically group the confounding variables associated with AST nodes; Code refactoring and structural optimization: Optimize code structure through AST node remapping and correct code through real-time interaction; Dynamic feedback optimization: Build a closed-loop optimization system for LLM and log instrumentation, and a dynamic feedback optimization engine.

2. A Web reverse analysis method based on a large model and dynamic feedback according to claim 1, characterized in that: The AST node importance evaluation formula is defined as: W(n i )=0.4·freq(n i )+0.3·depth(n i )+0.3·entropy(n i ), Among them, n i is the i-th node in the abstract syntax tree (AST); W(n i ) is a quantitative indicator of node importance, which is used to evaluate the importance of AST nodes in reverse analysis. The larger the value, the more important the node. i ) is the frequency of occurrence of the node type. High-frequency nodes may be core functions; depth(n i ) is the node depth, which refers to n i In the AST tree structure, the root node depth is 0 and increases layer by layer; entropy(n i ) is information entropy, which is used to measure the randomness and confusion of variable names. The larger the value, the higher the randomness.

3. A Web reverse analysis method based on a large model and dynamic feedback according to claim 2, characterized in that: Calculate entropy(n) based on the frequency of occurrence of variable names associated with AST nodes i ) Information entropy: entropy(n i )=-∑ c∈chars(v) p(c)log2p(c), Where v is the node n i , c is a single character in the variable name v, chars(v) is the set of all non-repeating characters in the variable name v, p(c) is the probability of character c appearing in the variable name v, log2p(c) is used to measure the amount of information of character c.

4. A Web reverse analysis method based on a large model and dynamic feedback according to claim 1, characterized in that: LLM combines context to perform semantic analysis of obfuscated variables, analyzes the actual use of variables in the code, and generates candidate variable names based on the actual use.

5. A Web reverse analysis method based on a large model and dynamic feedback according to claim 4, characterized in that: The formula for calculating semantic similarity is: Clue(v i ,in j )=|Sim(v i ,in j )-Sim LLM (in i ,in j )|+0.5·KL(p(v i ),p(in j )) Among them, Clu(v i ,v j ) refers to the clustering of node variables vi and vj; Sim(vi,vj) refers to the word vector similarity, which is the static semantic similarity calculated based on the word vector model (Word2Vec). The formula is as follows: Sim LLM (v i ,v j ) refers to the dynamic semantic similarity generated by the Large Language Model (LLM), such as the score of variable association obtained by DeepSeek; KL(p(v i ),p(v j )) is the KL divergence of the probability distribution of variable names, based on the character distribution calculation formula: Where p(c) and q(c) are variables v i and v j The probability of character c appearing in .

6. A Web reverse analysis method based on a large model and dynamic feedback according to claim 1, characterized in that: The AST node remapping is to reversely map the variable name grouping results after semantic clustering to the original AST structure, replace the obfuscated variable names, trigger the variable renaming update strategy through the weight threshold, and form a bidirectional data flow.

7. A Web reverse analysis method based on a large model and dynamic feedback according to claim 1, characterized in that: Based on the combination of semantic clustering and grammatical structure of AST nodes, inter-cluster associations are established and code blocks are reconstructed.

8. The Web reverse analysis method based on large model and dynamic feedback according to claim 1 is characterized in that: LLM can capture errors in code execution in real time through lightweight verifiers.

9. A Web reverse analysis method based on a large model and dynamic feedback according to claim 1, characterized in that: The dynamic feedback optimization includes: Automated instrumentation construction: Based on the code generated by the AST-LLM joint parsing engine, log code is automatically inserted through weighted node types, dynamic execution collection traces are collected, and key variables and function calls are tracked; Collect dynamic feedback data: Collect key data types, including exception information, variable value snapshots, function call chains, and code coverage. Logs and errors are stored as structured data for subsequent joint LLM analysis and correction. Dynamic feedback optimization engine: The LLM optimization module analyzes logs and generates suggestions, providing dynamic feedback and adjusting code.

10. A Web reverse analysis method based on a large model and dynamic feedback according to claim 9, characterized in that: The dynamic feedback optimization engine also includes: Variable name correction: If a variable always stores fixed information at runtime, its candidate name is replaced from a general name to a semantic name; Critical path repair: Based on the code coverage results, prioritize code blocks that are frequently executed but fail deobfuscation; Weight adjustment: If a node frequently triggers errors during dynamic execution, increase its weight for more refined analysis.

Images