Binary vulnerability retrieval and positioning method and system based on high-dimensional vulnerability characterization

Abstract

The invention relates to the field of code vulnerability detection, in particular to a binary vulnerability retrieval and positioning method and system based on high-dimensional vulnerability characterization, and the method comprises the steps: firstly inputting a binary file, analyzing the structural information of the binary file, and analyzing a machine instruction; extracting binary file function information, generating a cross-platform basic block IR instruction sequence, constructing a control flow graph, and constructing a data dependency graph; splicing the program dependency graph feature vector and the basic block IR instruction sequence feature vector, and performing multi-modal feature fusion to generate a comprehensive high-dimensional vulnerability representation vector; and finally, inputting the high-dimensional vulnerability representation vector into an index for searching to obtain a plurality of nearest neighbor indexes and distances, converting the distances into similarity, filtering according to a similarity threshold to obtain a most similar vulnerability vector, and obtaining vulnerability information and vulnerability positions corresponding to the vulnerability vector. The problems that traditional binary vulnerability detection cross-platform and compiler optimization detection fails and the result reliability is low are solved.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of code vulnerability detection, and particularly relates to a binary vulnerability retrieval and positioning method and system based on high-dimensional vulnerability representation. BACKGROUND

[0002] Current binary vulnerability detection technology is faced with double dilemmas: static analysis method relies on graph isomorphism matching of control flow graph and call graph, and main defects are excessive attention to instruction syntax features and neglect of semantic association between operations, great change of graph structure caused by compiler optimization, and difficulty in capturing vulnerability patterns of data flow transmission across function boundaries; dynamic analysis technology can obtain semantic information through taint tracking, but is limited by path explosion problem, low code coverage, and strong environmental dependence. SUMMARY

[0003] The application provides a binary vulnerability retrieval and positioning method and system based on high-dimensional vulnerability representation, which realizes accurate vulnerability detection by innovatively converting from discrete symbols to continuous vector space, from syntax-driven to semantics-driven, from local features to global context perception, and from rigid rules to probabilistic reasoning. The method can support detection of multiple architectures and multiple formats of samples, and effectively solves the problems of cross-platform and compiler optimization detection failure and low result reliability of traditional vulnerability detection methods.

[0004] In order to achieve the above purpose, the application adopts the following technical solutions:

[0005] The binary vulnerability retrieval and positioning method based on high-dimensional vulnerability representation comprises the following steps:

[0006] Inputting a binary file, parsing binary file structure information, and parsing machine instructions using a hybrid disassembler engine;

[0007] Implementing binary semantic analysis according to instructions, extracting binary file functions, generating cross-platform basic block IR instruction sequences, constructing a control flow graph, and constructing a data dependency graph;

[0008] Converting discrete basic block IR instruction sequences into continuous vector representation to generate basic block IR instruction sequence feature vectors h seq Fusing basic block IR instruction sequences, control flow graphs, and data dependency graphs to generate program dependency graph feature vectors h graph ; splicing the program dependency graph feature vectors h graph and the basic block IR instruction sequence feature vectors h seq , and using a gated attention mechanism strategy to perform multi-modal feature fusion to generate a comprehensive high-dimensional vulnerability representation vector h vul ;

[0009] Taking all vectors h vul_keyHNSW index is constructed using Faiss, for high-dimensional vulnerability characterization vector h vul Nearest neighbor search is performed using the index, a plurality of nearest neighbor indexes and distances are obtained, the distance is converted into a similarity, a similarity threshold is set, the most similar vulnerability vector is obtained according to the similarity threshold, and vulnerability information and vulnerability positions are obtained according to the vulnerability vector.

[0010] The application further improves the implementation of binary semantic parsing according to the instructions, including:

[0011] Parsing the binary file: obtaining binary file structure information and instruction information; implementing binary semantic parsing according to the instructions, extracting binary file functions, generating cross-platform basic block IR instruction sequences, constructing a control flow graph and a data dependency graph.

[0012] The application further improves the generation of program dependency graph feature vector h graph including:

[0013] Node initialization is performed, a GATv2 convolution layer is used to aggregate neighbor information and update node representation, and then the node features of the entire graph are aggregated to obtain the program dependency graph feature vector h graph .

[0014] The application further improves the node initialization, including:

[0015] Node initialization is to generate a feature vector for each node, i.e. a basic block; first, the discrete instructions of each basic block IR sequence are generated by tokenizing the operation code and operand, the discrete instructions are converted into continuous instruction sequence vector representation using a pre-trained word embedding model Word2Vec, and the basic block instruction sequence vector is aggregated to obtain a fixed-dimension basic block IR semantic feature vector f ir ; secondly, the degree of the control flow graph node, the centrality index of the node and the position of the node in the function are calculated and spliced into a control flow graph feature vector f CFG ; thirdly, the degree of the data dependency graph node, the length of the data dependency chain involved by the node and whether the node involves cyclic dependency are calculated and spliced into a data dependency graph feature vector f DDG ; the basic block IR semantic feature vector f ir , the control flow graph feature vector f CFG and the data dependency graph feature vector f DDG are spliced to form the initial feature vector of the node.

[0016] h i (0) = sigma (W·CONCAT (f ir (i) ,f CFG (i)f DDG (i) )+b)

[0017] h i (0) : initial feature vector of node i;

[0018] σ: sigmoid activation function, which "compresses" the calculation result in the parentheses to the interval (0, 1) to make it an effective probability value;

[0019] W: weight matrix;

[0020] CONCAT: vector concatenation operation;

[0021] b: bias vector, used to adjust the offset of feature distribution.

[0022] The further improvement of the application is that the GATv2 convolution layer is used to aggregate neighbor information and update node representation, which comprises:

[0023] GATv2 is a graph attention network, which aggregates neighbor information more effectively through a dynamic attention mechanism;

[0024] Attention coefficient calculation:

[0025] e ij =a T ·LeakyReLU(W·[h i ‖h j ])

[0026] e ij : attention score between node i and j;

[0027] a: parameter vector of attention mechanism;

[0028] W: weight matrix;

[0029] h i : current feature vector of node i;

[0030] h j : feature vector of neighbor node j;

[0031] ||: vector concatenation operation;

[0032] LeakyReLU: activation function, negative slope is set to 0.2;

[0033] Node feature update:

[0034]

[0035] h′ i : updated node feature;

[0036] σ: Sigmoid activation function, which "compresses" the calculation result in the parentheses to the interval (0, 1) to make it a valid probability value;

[0037] ∑: Weighted summation operation;

[0038] N i : Neighbor set of node i;

[0039] W: Weight matrix;

[0040] h j : Feature vector of neighbor node j.

[0041] Further improvement of the application is that the node feature aggregation program dependency graph feature vector h graph includes:

[0042] The node feature of the whole graph is aggregated by a double-pooling strategy to obtain the program dependency graph feature vector h grap .

[0043]

[0044] h gra : Program dependency graph feature vector;

[0045] MAX: Max-pooling operation, extracts the most significant features;

[0046] MEAN: Average pooling operation, captures overall distribution;

[0047] Vector splicing operation;

[0048] Feature of node i;

[0049] Feature matrix of all nodes;

[0050] N: Number of nodes;

[0051] L: Number of graph neural network layers.

[0052] Further improvement of the application is that a comprehensive high-dimensional vulnerability representation vector h vul is generated by using a gated attention mechanism strategy for multi-modal feature fusion, including:

[0053] The program dependency graph feature vector h graph and the basic block IR instruction sequence feature vector h seq are spliced, and a comprehensive high-dimensional vulnerability representation vector h vul;

[0054] Gate generation:

[0055] g = sigma(W g · [h grap || h seq ] + b g )

[0056] W g : weight matrix;

[0057] b g : learnable bias term;

[0058] sigma: Sigmoid activation function, which "compresses" the calculation result in the parentheses to the interval (0, 1) to make it an effective probability value;

[0059] g: gate value;

[0060] Weighted fusion:

[0061] h vul = g * h graph + (1-g) * h seq .

[0062] The further improvement of the application is that the distance is converted into similarity, the similarity threshold is set, the most similar vulnerability vector is obtained according to the similarity threshold, and the vulnerability information and the vulnerability position are obtained according to the vulnerability vector, comprising:

[0063] All vectors h vul_db Use Faiss to build HNSW index, for high-dimensional vulnerability representation vector h vul Use the index to perform k-nearest neighbor search to obtain k nearest neighbor indexes and distances, convert the distance into similarity, set the similarity threshold to 0.85, obtain the most similar vulnerability vector according to the similarity threshold, and obtain the vulnerability information and the vulnerability position according to the vulnerability vector;

[0064] Distance calculation:

[0065]

[0066] Similarity calculation:

[0067]

[0068] The binary vulnerability retrieval and positioning system based on high-dimensional vulnerability representation comprises:

[0069] A binary file parsing unit is used for binary file input, parses binary file structure information, and parses machine instructions using a hybrid disassembly engine;

[0070] A binary semantic analysis unit is configured to implement binary semantic analysis according to instructions, extract binary file functions, generate cross-platform basic block IR instruction sequences, construct a control flow graph, and construct a data dependency graph.

[0071] A vector conversion unit is configured to convert discrete basic block IR instruction sequences into continuous vector representations to generate basic block IR instruction sequence feature vectors h seq A program dependency graph feature vector h is generated by fusing the basic block IR instruction sequence, the control flow graph, and the data dependency graph. gra ; The program dependency graph feature vector h graph and the basic block IR instruction sequence feature vector h seq are spliced together, a comprehensive high-dimensional vulnerability representation vector h is generated by using a gating attention mechanism strategy for multi-modal feature fusion. vul ;

[0072] A vulnerability retrieval and positioning unit is configured to use all vectors h vul_key from a vulnerability vector database, use Faiss to construct an HNSW index, and use the index to perform a nearest neighbor search on the high-dimensional vulnerability representation vector h vul , obtain multiple nearest neighbor indexes and distances, convert the distances into similarities, set a similarity threshold, filter to obtain the most similar vulnerability vector according to the similarity threshold, and obtain vulnerability information and a vulnerability position according to the vulnerability vector.

[0073] The further improvement of the present application is that the binary semantic analysis unit is configured to implement binary semantic analysis according to instructions, and includes:

[0074] The binary file is parsed to obtain binary file structure information and instruction information, binary semantic analysis is implemented according to the instructions, binary file functions are extracted, cross-platform basic block IR instruction sequences are generated, a control flow graph is constructed, and a data dependency graph is constructed.

[0075] Compared with the prior art, the present application has at least the following beneficial technical effects:

[0076] In order to solve the problems of cross-platform and compiler optimization detection failure, low result reliability and the like of the traditional method, the application provides a binary vulnerability retrieval and positioning method based on high-dimensional vulnerability characterization. The core of the application is to extract multiple features of samples, and to generate high-dimensional vulnerability characterization features by multi-modal fusion of the features. First, a binary file is input, the binary file structure information is parsed, and the machine instructions are parsed through a hybrid disassembler engine; second, the binary semantic analysis is realized according to the instructions, the binary file function is extracted, the cross-platform basic block IR instruction sequence is generated, the control flow graph (CFG) is constructed, and the data dependence graph (DDG) is constructed; the discrete basic block IR instruction is converted into a continuous vector representation to generate a basic block IR instruction sequence feature vector, the basic block IR instruction sequence, the control flow graph and the data dependence graph are fused to generate a program dependence graph feature vector, the program dependence graph feature vector and the basic block IR instruction sequence feature vector are spliced, and a comprehensive high-dimensional vulnerability characterization vector is generated by using a gated attention mechanism strategy for multi-modal feature fusion; finally, the HNSW index is constructed by using Faiss for the vulnerability vector database, the high-dimensional vulnerability characterization vector is input into the index for searching, a plurality of nearest neighbor indexes and distances are obtained, the distances are converted into similarities, a similarity threshold is set, the most similar vulnerability vector is obtained by filtering according to the similarity threshold, the vulnerability information and the vulnerability position are obtained according to the vulnerability vector, and the accuracy and efficiency of the vulnerability detection are improved. BRIEF DESCRIPTION OF DRAWINGS

[0077] In order to more clearly illustrate the specific embodiments of the application or the technical solutions in the prior art, the drawings needed in the following specific embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0078] Figure 1 The flow chart of the binary vulnerability retrieval and positioning method based on high-dimensional vulnerability characterization of the application.

[0079] Figure 2 The high-dimensional feature extraction flow chart of the binary vulnerability retrieval and positioning method based on high-dimensional vulnerability characterization of the application.

[0080] Figure 3 The vulnerability matching flow chart of the binary vulnerability retrieval and positioning method based on high-dimensional vulnerability characterization of the application.

[0081] Figure 4 The structure block diagram of the binary vulnerability retrieval and positioning system based on high-dimensional vulnerability characterization of the application. DETAILED DESCRIPTION

[0082] In the following, only certain exemplary embodiments are simply described. As those skilled in the art can recognize, the described embodiments can be modified in various different ways without departing from the spirit or scope of the present application. Therefore, the drawings and description are to be regarded as being illustrative in nature rather than restrictive.

[0083] In the description of the present application, it is to be understood that the terms "including", "comprising", "having" and "with" when used in this specification and in the following claims indicate the presence of the described features, integers, steps, operations, elements, and / or components but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0084] It should also be understood that the terms used in the present application specification are only for the purpose of describing particular embodiments and are not intended to limit the present application. As used in the present application specification and the appended claims, the singular forms "a", "an" and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

[0085] It should be further understood that the term "and / or" used in the present application specification and the appended claims means one or more of the associated listed items as well as all possible combinations of the items and includes the combinations.

[0086] In the drawings, various structural schematic diagrams according to the disclosed embodiments of the present application are shown. These diagrams are not drawn to scale, in which certain details are exaggerated for the purpose of clarity and certain details can be omitted. The shapes of various regions, layers shown in the drawings and their relative sizes, positional relationships are only exemplary, and in actuality, they can be deviated due to manufacturing tolerances or technical limitations, and regions / layers with different shapes, sizes, relative positions can be additionally designed by those skilled in the art according to actual needs.

[0087] The embodiments of the present application are described in detail below in conjunction with the drawings.

[0088] Embodiment 1

[0089] The binary vulnerability retrieval and positioning method based on high-dimensional vulnerability characterization provided by the present application comprises the following steps:

[0090] Step S1: binary file input, parsing binary file structure information, using a hybrid disassembly engine to parse machine instructions.

[0091] Step S2: binary semantic analysis according to instructions, extracting binary file functions, generating cross-platform basic block IR instruction sequences, constructing control flow graphs (CFG), and constructing data dependency graphs (DDG).

[0092] Step S3: As Figure 2 A binary vulnerability retrieval and positioning method based on high-dimensional vulnerability representation is shown in the high-dimensional feature extraction flow chart. The discrete basic block IR instruction is converted into a continuous vector representation to generate a basic block IR instruction sequence feature vector; the basic block IR instruction sequence, the control flow graph and the data dependency graph are fused to generate a program dependency graph feature vector; the program dependency graph feature vector and the basic block IR instruction sequence feature vector are spliced together, and a comprehensive high-dimensional vulnerability representation vector is generated by using a gated attention mechanism strategy for multi-modal feature fusion.

[0093] Step S4: As Figure 3 A binary vulnerability retrieval and positioning method based on high-dimensional vulnerability representation is shown in the vulnerability matching flow chart. An HNSW (approximate nearest neighbor search algorithm) index is constructed for the vulnerability vector database using Faiss, and a plurality of similar vulnerability vectors are obtained by using the index for the high-dimensional vulnerability representation vector. A similarity threshold is set, the most similar vulnerability vector is obtained by filtering according to the similarity threshold, and vulnerability information and vulnerability positions are obtained according to the vulnerability vector.

[0094] Based on the above steps and Figure 1 A binary vulnerability retrieval and positioning method based on high-dimensional vulnerability representation is shown in the flow chart. The method first inputs a binary file, parses the binary file structure information, and uses a hybrid disassembler engine to parse machine instructions. Secondly, the binary semantic analysis is realized according to the instructions, the binary file function is extracted, the cross-platform basic block IR instruction sequence is generated, the control flow graph (CFG) is constructed, and the data dependency graph (DDG) is constructed. Thirdly, the discrete basic block IR instruction is converted into a continuous vector representation to generate a basic block IR instruction sequence feature vector. The basic block IR instruction sequence, the control flow graph and the data dependency graph are fused to generate a program dependency graph feature vector. The program dependency graph feature vector and the basic block IR instruction sequence feature vector are spliced together, and a comprehensive high-dimensional vulnerability representation vector is generated by using a gated attention mechanism strategy for multi-modal feature fusion. Finally, an HNSW index is constructed for the vulnerability vector database using Faiss, and a plurality of similar vulnerability vectors are obtained by using the index for the high-dimensional vulnerability representation vector. A similarity threshold is set, the most similar vulnerability vector is obtained by filtering according to the similarity threshold, and vulnerability information and vulnerability positions are obtained according to the vulnerability vector.

[0095] Further, the specific operation steps in the above step S1 are:

[0096] S1.1: binary file input.

[0097] S1.2: parse the binary file structure information.

[0098] S1.3: use a hybrid disassembler engine to parse machine instructions.

[0099] Further, the specific operation steps in the above step S2 are:

[0100] S2.1: Construct a control flow graph (CFG) according to the binary file structure information and instruction information parsed in the above step S1.

[0101] S2.2: Collect all basic block IR instruction sequences according to the control flow graph (CFG) generated in the above step S2.1.

[0102] S2.3: Construct a data dependency graph (DDG) according to the binary file structure information and instruction information parsed in the above step S1, and the control flow graph (CFG) generated in the above step S2.1.

[0103] Further, the specific operation steps in the above step S3 are:

[0104] S3.1: According to the basic block IR instruction sequence generated in the above step S2.2, convert the discrete basic block IR instruction into a continuous vector representation to generate a basic block IR instruction sequence feature vector h seq .

[0105] S3.2: According to the basic block IR instruction sequence generated in the above step S2.2, tokenize the IR sequence of each basic block according to the operation code and operand to generate discrete instructions, convert the discrete instructions into continuous instruction sequence vector representation using a pre-trained word embedding model (Word2Vec), and aggregate the instruction sequence vectors of the basic blocks to obtain a fixed-dimensional basic block IR semantic feature vector f ir .

[0106] S3.3: According to the control flow graph (CFG) generated in the above step S2.1, calculate the degree of the control flow graph node, the centrality index of the node, and the position of the node in the function, and splice them into a control flow graph feature vector f CFG .

[0107] S3.4: According to the data dependency graph (DDG) generated in the above step S2.3, calculate the degree of the data dependency graph node, the length of the data dependency chain involved by the node, and whether the node involves a circular dependency, and splice them into a data dependency graph feature vector f DDG .

[0108] S3.5: Splice the basic block IR semantic feature vector f ir generated in the above step S3.2, the control flow graph feature vector f CFG generated in the above step S3.3, and the data dependency graph feature vector f DDG generated in the above step S3.4 to form an initial feature vector of the node.

[0109] h i (0) = σ(W·CONCAT(f ir (i) ,f CFG (i) ,f DDG (i) )+b)

[0110] S3.6: According to the above step S2.5, generate the node initial feature vector, use GATv2 (Graph Attention Network v2) convolution layer to aggregate neighbor information and update node representation.

[0111] e ij = a T ·LeakyReLU(W·[h i ‖h j ])

[0112]

[0113] S3.7: According to the updated node feature vector generated in the above step S2.6, the node features of the whole graph are aggregated by a double pooling strategy to obtain the program dependency graph feature vector h graph .

[0114]

[0115] S3.8: The program dependency graph feature vector h graph generated in the above step S3.7 and the basic block IR instruction sequence feature vector h seq generated in step S3.1 are spliced, and a comprehensive high-dimensional vulnerability representation vector h vul is generated by using a gated attention mechanism strategy for multi-modal feature fusion.

[0116] g = σ(W g ·[h graph ||h seq ]+b g )

[0117] h vul = g·h graph +(1-g)·h seq

[0118] Further, the specific operation steps in the above step S4 are:

[0119] S4.1: Take all vectors h vul_db in the vulnerability vector database in the vulnerability vector database, and use Faiss to construct HNSW index.

[0120] S4.2: High-dimensional vulnerability characterization vector h generated according to step S3.8 described above vul Using the index to perform k-nearest neighbor search, obtaining the index and distance of k nearest neighbors.

[0121]

[0122] S4.3: According to the index and distance of k nearest neighbors generated according to step S4.2 described above, set the similarity threshold to 0.85, filter the most similar vulnerability vector according to the similarity threshold, obtain the vulnerability information and vulnerability position corresponding to the vulnerability vector.

[0123]

[0124] Embodiment 2

[0125] As shown in Figure 4 , the binary vulnerability retrieval and positioning system based on high-dimensional vulnerability characterization provided by the application comprises:

[0126] A binary file parsing unit is configured to input a binary file, parse binary file structure information, and parse machine instructions using a hybrid disassembly engine.

[0127] A binary semantic parsing unit is configured to implement binary semantic parsing according to instructions, extract binary file functions, generate cross-platform basic block IR instruction sequences, construct control flow graphs, and construct data dependency graphs.

[0128] A vector conversion unit is configured to convert discrete basic block IR instruction sequences into continuous vector representations to generate basic block IR instruction sequence feature vectors h seq , and fuse the basic block IR instruction sequences, control flow graphs, and data dependency graphs to generate program dependency graph feature vectors h gra ; concatenate the program dependency graph feature vectors h graph and the basic block IR instruction sequence feature vectors h seq , and use a gated attention mechanism strategy to perform multi-modal feature fusion to generate a comprehensive high-dimensional vulnerability characterization vector h vul .

[0129] A vulnerability retrieval and positioning unit is configured to take all vectors h vul_key from a vulnerability vector database, use Faiss to construct an HNSW index, and use the index to perform nearest neighbor search on the high-dimensional vulnerability characterization vector h vul , obtain multiple nearest neighbor indexes and distances, convert the distances into similarities, set a similarity threshold, filter the most similar vulnerability vector according to the similarity threshold, and obtain vulnerability information and vulnerability positions according to the vulnerability vector.

[0130] In the embodiment, the binary semantic analysis unit is implemented according to the instructions, including:

[0131] The binary file is parsed to obtain binary file structure information and instruction information; the binary semantic analysis is implemented according to the instructions, binary file functions are extracted, cross-platform basic block IR instruction sequences are generated, a control flow graph is constructed, and a data dependency graph is constructed.

[0132] The basic principle and main features of the present application and the advantages of the present application are shown and described above, and it is obvious for those skilled in the art that the present application is not limited to the details of the above exemplary embodiments, and the present application can be implemented in other specific forms without departing from the spirit or essential characteristics of the present application. Therefore, the embodiments should be regarded as exemplary and non-limiting, the scope of the present application is defined by the appended claims rather than the above description, and all changes falling within the meaning and scope of the equivalent elements of the claims are intended to be included in the present application. Any reference signs in the claims should not be regarded as limiting the claims involved.

[0133] Furthermore, it should be understood that although the present specification is described in terms of embodiments, not every embodiment contains only one independent technical solution, and the description of the specification is only for the sake of clarity, and those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can be properly combined to form other embodiments that those skilled in the art can understand. The above is only to illustrate the technical idea of the present application, and cannot limit the protection scope of the present application, and any modification made according to the technical idea of the present application on the basis of the technical solution falls within the protection scope of the claims of the present application.

Claims

1. A binary vulnerability retrieval and localization method based on high-dimensional vulnerability representation, characterized in that, include: Binary file input, parsing binary file structure information, and using a hybrid disassembler engine to parse machine instructions; Based on the instructions, binary semantic parsing is performed to extract binary file functions, generate cross-platform basic block IR instruction sequences, construct control flow graphs, and construct data dependency graphs. The discrete basic block IR instruction sequence is converted into a continuous vector representation to generate the feature vector h of the basic block IR instruction sequence. seq The basic block IR instruction sequence, control flow graph, and data dependency graph are fused to generate a program dependency graph feature vector h. graph ; the feature vector h of the program dependency graph graph and the feature vector h of the basic block IR instruction sequence seq By concatenating the features, a gating attention mechanism is used to fuse multimodal features and generate a comprehensive high-dimensional vulnerability representation vector h. vul ; Take all vectors h from the vulnerability vector database vul_key Using Faiss to construct the HNSW index for high-dimensional vulnerability representation vectors h vul Nearest neighbor search is performed using an index to obtain the indices and distances of multiple nearest neighbors. The distances are converted into similarities, a similarity threshold is set, and the most similar vulnerability vectors are filtered based on the similarity threshold. Vulnerability information and vulnerability locations are then obtained based on the vulnerability vectors.

2. The binary vulnerability retrieval and localization method based on high-dimensional vulnerability representation according to claim 1, characterized in that, Binary semantic parsing is performed based on instructions, including: Binary file parsing: Obtain binary file structure information and instruction information; perform binary semantic parsing based on instructions, extract binary file functions, generate cross-platform basic block IR instruction sequences, construct control flow graphs, and construct data dependency graphs.

3. The binary vulnerability retrieval and localization method based on high-dimensional vulnerability representation according to claim 1, characterized in that, Generate the feature vector h of the program dependency graph graph include: Node initialization is performed, and GATv2 convolutional layers are used to aggregate neighbor information and update node representations. Then, the node features of the entire graph are aggregated to obtain the program dependency graph feature vector h. graph .

4. The binary vulnerability retrieval and location method based on high-dimensional vulnerability representation according to claim 3, characterized in that, Node initialization includes: Node initialization involves generating a feature vector for each node, i.e., a basic block. First, the IR sequence of each basic block is segmented according to its opcode and operands to generate discrete instructions. A pre-trained word embedding model, Word2Vec, is used to convert these discrete instructions into continuous instruction sequence vectors. Finally, the instruction sequence vectors of the basic blocks are aggregated to obtain a fixed-dimensional basic block IR semantic feature vector f. ir Next, calculate the degree of each node in the control flow graph, the centrality index of each node, and the position of each node in the function, and concatenate them into a control flow graph eigenvector f. CFG Next, the degree of each node in the data dependency graph, the length of the data dependency chain involved in the node, and whether the node involves a circular dependency are calculated and concatenated into a feature vector f of the data dependency graph. DDG ; the basic block IR semantic feature vector f ir , control flow graph eigenvector f CFG Data dependency graph feature vector f DDG These are then concatenated to form the initial feature vector of the node; h i (0) =σ(W·CONCAT(f ir (i) ,f CFG (i) ,f DDG (i) )+b) h i (0) : The initial feature vector of node i; σ: is the Sigmoid activation function, which "compresses" any real value of the calculation result within the parentheses into the (0,1) interval, making it a valid probability value; W: Weight matrix; CONCAT: Vector concatenation operation; b: Bias vector, used to adjust the offset of the feature distribution.

5. The binary vulnerability retrieval and location method based on high-dimensional vulnerability representation according to claim 3, characterized in that, Using GATv2 convolutional layers to aggregate neighbor information and update node representations includes: GATv2 is a graph attention network that aggregates neighbor information more effectively through a dynamic attention mechanism. Attention coefficient calculation: e ij =a T ·LeakyReLU(W·[h i ‖h j ]) e ij Attention scores before nodes i and j; a: The parameter vector of the attention mechanism; W: Weight matrix; h i : The current feature vector of node i; h j : The feature vector of neighbor node j; ||: Vector concatenation operation; LeakyReLU: Activation function with a negative slope of 0.2; Node feature update: h′ i Updated node features; σ: is the Sigmoid activation function, which "compresses" any real value of the calculation result within the parentheses into the (0,1) interval, making it a valid probability value; ∑: Weighted summation operation; N i The set of neighbors of node i; W: Weight matrix; h j : The feature vector of neighbor node j.

6. The binary vulnerability retrieval and localization method based on high-dimensional vulnerability representation according to claim 3, characterized in that, Node feature aggregation yields the program dependency graph feature vector h. gra include: The feature vector h of the program dependency graph is obtained by aggregating the node features of the entire graph using a dual-pooling strategy. gra ; h graph : Feature vectors of the program dependency graph; MAX: Max pooling operation, extracts the most salient features; MEAN: Average pooling operation, capturing the overall distribution; Vector concatenation operation; Features of node i; Feature matrix of all nodes; N: Number of nodes; L: Number of layers in the graph neural network.

7. The binary vulnerability retrieval and localization method based on high-dimensional vulnerability representation according to claim 1, characterized in that, A gated attention mechanism is used to fuse multimodal features and generate a comprehensive high-dimensional vulnerability representation vector h. vul ,include: The feature vector h of the program dependency graph graph and the feature vector h of the basic block IR instruction sequence seq By concatenating the features, a gating attention mechanism is used to fuse multimodal features and generate a comprehensive high-dimensional vulnerability representation vector h. vul ; Gating generation: g=σ(W g ·[h grap ||h seq ]+b g ) W g Weight matrix; b g Learnable bias terms; σ: is the Sigmoid activation function, which "compresses" any real value of the calculation result within the parentheses into the (0,1) interval, making it a valid probability value; g: Gating value; Weighted fusion: h vul =g·h graph +(1-g)·h seq 。 8. The binary vulnerability retrieval and location method based on high-dimensional vulnerability representation according to claim 1, characterized in that, The distance is converted into a similarity score. A similarity threshold is set, and the most similar vulnerability vectors are filtered based on the similarity threshold. Vulnerability information and location are then obtained from the vulnerability vectors, including: Take all vectors h from the vulnerability vector database vul_db Using Faiss to construct the HNSW index for high-dimensional vulnerability representation vectors h vul Use the index to perform k-nearest neighbor search, obtain the index and distance of the k nearest neighbors, convert the distance into similarity, set the similarity threshold to 0.85, filter according to the similarity threshold to obtain the most similar vulnerability vector, and then use the vulnerability information and vulnerability location of the vulnerability vector. Distance calculation: Similarity calculation:

9. A binary vulnerability retrieval and location system based on high-dimensional vulnerability representation, characterized in that, include: The binary file parsing unit is used for binary file input, parsing binary file structure information, and using a hybrid disassembler engine to parse machine instructions. The binary semantic parsing unit is used to perform binary semantic parsing based on instructions, extract binary file functions, generate cross-platform basic block IR instruction sequences, construct control flow graphs, and construct data dependency graphs. The vector transformation unit is used to convert discrete basic block IR instruction sequences into continuous vector representations to generate feature vectors h of the basic block IR instruction sequences. seq The basic block IR instruction sequence, control flow graph, and data dependency graph are fused to generate a program dependency graph feature vector h. graph ; the feature vector h of the program dependency graph grap and the feature vector h of the basic block IR instruction sequence seq By concatenating the features, a gating attention mechanism is used to fuse multimodal features and generate a comprehensive high-dimensional vulnerability representation vector h. vul ; The vulnerability retrieval and location unit is used to retrieve all vectors h from the vulnerability vector database. vul_key Using Faiss to construct the HNSW index for high-dimensional vulnerability representation vectors h vul Nearest neighbor search is performed using an index to obtain the indices and distances of multiple nearest neighbors. The distances are converted into similarities, a similarity threshold is set, and the most similar vulnerability vectors are filtered based on the similarity threshold. Vulnerability information and vulnerability locations are then obtained based on the vulnerability vectors.

10. The binary vulnerability retrieval and location system based on high-dimensional vulnerability representation according to claim 9, characterized in that, The binary semantic parsing unit performs binary semantic parsing according to instructions, including: Binary file parsing: Obtain binary file structure information and instruction information; perform binary semantic parsing based on instructions, extract binary file functions, generate cross-platform basic block IR instruction sequences, construct control flow graphs, and construct data dependency graphs.

Images