Cross-platform binary code block layered semantic similarity detection method and related device

Abstract

The invention discloses a cross-platform binary code block hierarchical semantic similarity detection method and a related device, and belongs to the field of code vulnerability detection.The cross-platform binary code block hierarchical semantic similarity detection method comprises the following steps that structural information of a binary file is analyzed, a machine instruction is analyzed through a hybrid disassembling engine, a basic block is extracted from the structural information of the binary file, and the basic block is extracted from the binary file; constructing a control flow graph, a data dependency graph and a function call graph; extracting instruction level semantics, basic block level semantics and function level semantics from the instruction sequence, the basic block, the control flow graph, the data dependency graph and the function call graph; according to the instruction-level semantics, the basic-block-level semantics and the function-level semantics, constructing instruction-level features, basic-block-level features and function-level features; and carrying out hierarchical similarity detection on the instruction-level features, the basic block-level features and the function-level features. The method and the related device can solve the problems of low detection efficiency and poor accuracy when a traditional vulnerability detection method is used for detecting vulnerabilities.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of code vulnerability detection, and relates to a cross-platform binary code block hierarchical semantic similarity detection method and a related device. BACKGROUND

[0002] In the field of software security, binary vulnerability detection technology is crucial, and the current mainstream method has significant defects, poor detection efficiency, syntax-driven method compiler optimization leading to instruction rearrangement, high invalid cross-architecture false positive rate, single-level analysis unable to distinguish between codes with the same function but structural variation, insufficient semantic abstraction, and symbol execution path explosion problem limiting the practical scale. SUMMARY

[0003] The purpose of the present application is to overcome the shortcomings of the prior art, and to provide a cross-platform binary code block hierarchical semantic similarity detection method and a related device, which can solve the problems of low detection efficiency and poor precision in traditional vulnerability detection methods.

[0004] To achieve the above purpose, the application discloses a cross-platform binary code block hierarchical semantic similarity detection method, comprising the following steps:

[0005] Obtain a binary file, parse the structure information of the binary file, use a hybrid disassembler engine to parse machine instructions, extract basic blocks from the structure information of the binary file, and construct a control flow graph, a data dependency graph and a function call graph;

[0006] Extract instruction-level semantics, basic block-level semantics and function-level semantics from the instruction sequence, basic blocks, control flow graph, data dependency graph and function call graph;

[0007] Construct instruction-level features, basic block-level features and function-level features according to the instruction-level semantics, basic block-level semantics and function-level semantics;

[0008] Perform hierarchical similarity detection on the instruction-level features, basic block-level features and function-level features to obtain the final detection result.

[0009] The cross-platform binary code block hierarchical semantic similarity detection method further improves in that:

[0010] Further, the process of extracting instruction-level semantics is:

[0011] According to the constant generalization, register generalization and memory operation unification in the instruction sequence, a normalized instruction sequence is generated, and the normalized instruction sequence is taken as the instruction-level semantics.

[0012] Further, the process of extracting basic block-level semantics is:

[0013] The dominance tree depth, number of successor blocks, and loop depth are calculated based on the control flow graph. The number and ratio of operand input / output operations and the number and ratio of memory read / write operations are calculated based on the data dependency graph. The dominance tree depth, number of successor blocks, loop depth, number and ratio of operand input / output operations, and number and ratio of memory read / write operations are concatenated to obtain the basic block-level semantic f. block .

[0014] Furthermore, the process of constructing instruction-level features is as follows:

[0015] Based on the instruction-level semantics, the instruction sequence is transformed into a bag-of-words representation to create k independent hash functions. The minimum value of the instruction set is calculated for each hash function, and all minimum values ​​are combined to generate the instruction-level feature H. inst The instruction-level feature H inst for:

[0016]

[0017] Among them, S j is a random permutation function, hash is a hash function, and min is the minimum value.

[0018] Furthermore, the process of constructing basic block-level features is as follows:

[0019] The basic block-level semantic f block Multiply the result by a random matrix, add a random offset to the result, and then use a sign function to convert it into a binary value to obtain a fixed-length binary hash code. This fixed-length binary hash code is then used as the basic block-level feature H. block Among them, the basic block-level feature H block for:

[0020] H block =sgn(W·f block +b)

[0021] Where W is a random matrix; b is a random offset; and sgn is a sign function.

[0022] Furthermore, the process of constructing function-level features is as follows:

[0023] Based on the function-level semantics, the control flow graph and the function call graph are merged to obtain a merged graph. In the merged graph, nodes contain basic blocks and functions, and edges contain control flow and call relationships. Node features are initialized by assigning initial feature vectors to each node. Multi-layer GNN propagation aggregation is used to aggregate the nodes, followed by graph-level aggregation. After multi-layer propagation, the MEAN operation is used to aggregate all node representations to generate the function-level feature H. func Among them, the function-level feature Hfunc for:

[0024] H func =MEAN({h v (l)})

[0025]

[0026] Among them, h v (l) Let N(v) be the embedding representation of node v at layer l, and let N(v) be the set of neighbors of node v. uv σ is the normalization constant, W is the weight matrix, σ is the Sigmoid activation function used to compress any real value of the calculation result within the parentheses to the (0,1) interval, and MEAN represents the average pooling operation.

[0027] Furthermore, the process of performing hierarchical similarity detection on the instruction-level features, basic block-level features, and function-level features to obtain the final detection result is as follows:

[0028] Retrieve all vulnerability information in the vulnerability database {V1,V2,…,V i}, the function feature H for obtaining information about each vulnerability func (V i ); Obtain all function-level features H extracted from the binary file. func traverse H func Obtain the corresponding function-level feature H func (f q H is calculated based on cosine similarity. func (f q ) and H func (V i The phase velocity of the function is used to select the vulnerability information corresponding to the function-level features with a similarity greater than or equal to the first similarity threshold, and the first result set is constructed accordingly.

[0029] Obtain all vulnerability information {V1,V2,…,V} from the first result set. j}, to obtain the basic block features H of each vulnerability information block (V j ); Obtain all basic block-level features H extracted from the binary file. block traverse H block Obtain the corresponding basic block-level feature H block (f q H is calculated based on Hamming distance similarity. block (f q ) and H block (V jThe similarity of the basic block features is used to select the vulnerability information corresponding to the basic block features with a similarity greater than or equal to the second similarity threshold, and the second result set is constructed accordingly.

[0030] Retrieve all vulnerability information {V1,V2,…,V} from the second result set. x}, the instruction signature H for obtaining information on each vulnerability inst (V x ); Obtain all instruction-level features H extracted from the binary file. inst Iterate through and obtain the feature H of each instruction level. inst (f q ); Jaccard similarity calculation based on MinHash features H inst (f q ) and H inst (V x The similarity of the features is used to filter out the vulnerability information corresponding to the instruction-level features whose similarity is greater than or equal to the third similarity threshold, and the final detection result is constructed based on this.

[0031] This invention discloses a cross-platform binary code block hierarchical semantic similarity detection system, comprising the following steps:

[0032] The parsing module is used to obtain binary files, parse the structural information of the binary files, parse machine instructions using a hybrid disassembler engine, extract basic blocks from the structural information of the binary files, and construct control flow graph (CFG), data dependency graph (DDG), and function call graph (CG).

[0033] The extraction module is used to extract instruction-level semantics, basic block-level semantics, and function-level semantics from the instruction sequence, basic block, control flow graph, data dependency graph, and function call graph.

[0034] The construction module is used to construct instruction-level features, basic block-level features, and function-level features based on the instruction-level semantics, basic block-level semantics, and function-level semantics.

[0035] The detection module is used to perform hierarchical similarity detection on the instruction-level features, basic block-level features, and function-level features to obtain the final detection result.

[0036] The present invention discloses a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method for generating and sending trusted status alarm information.

[0037] The present invention discloses a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of the cross-platform binary code block hierarchical semantic similarity detection method.

[0038] The present invention has the following beneficial effects:

[0039] The cross-platform binary code block hierarchical semantic similarity detection method and related apparatus described in this invention, in specific operation, extracts source binary file code block features for hierarchical semantic division, and constructs hierarchical features for the hierarchical semantics. Specifically, it obtains the binary file, parses the structural information of the binary file, uses a hybrid disassembler engine to parse machine instructions, extracts basic blocks from the structural information of the binary file, and constructs control flow graphs, data dependency graphs, and function call graphs. Based on these, it constructs instruction-level features, basic block-level features, and function-level features, and then performs hierarchical similarity detection on the instruction-level features, basic block-level features, and function-level features to obtain the final detection result. This enhances the efficiency of vulnerability detection and the ability to identify complex vulnerability patterns, solving the problems of low efficiency and poor accuracy in traditional binary vulnerability detection. It can be effectively used in scenarios such as malware variants and obfuscated code; at the same time, it provides a technical foundation for security auditing, compliance inspection, and threat intelligence applications. Attached Figure Description

[0040] The accompanying drawings, which form part of this specification, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings:

[0041] Figure 1 This is a flowchart of the method of the present invention;

[0042] Figure 2 This is a flowchart illustrating the construction of hierarchical features in this invention;

[0043] Figure 3 This is a flowchart of the hierarchical similarity matching process in this invention. Detailed Implementation

[0044] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0045] In the description of this invention, it should be understood that the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0046] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0047] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes such combinations. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Additionally, the character " / " in this invention generally indicates that the preceding and following objects have an "or" relationship.

[0048] It should be understood that although terms such as first, second, third, etc., may be used in the embodiments of the present invention to describe the preset range, these preset ranges should not be limited to these terms. These terms are only used to distinguish the preset ranges from one another. For example, without departing from the scope of the embodiments of the present invention, the first preset range may also be referred to as the second preset range, and similarly, the second preset range may also be referred to as the first preset range.

[0049] Depending on the context, the word "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection." Similarly, depending on the context, the phrase "if determination" or "if detection (of the stated condition or event)" can be interpreted as "when determination," "in response to determination," "when detection (of the stated condition or event)," or "in response to detection (of the stated condition or event)."

[0050] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0051] The accompanying drawings illustrate various structural schematic diagrams according to embodiments disclosed in this invention. These drawings are not to scale, and some details have been enlarged for clarity, and some details may have been omitted. The shapes of the various regions and layers shown in the drawings, as well as their relative sizes and positional relationships, are merely exemplary and may deviate from reality due to manufacturing tolerances or technical limitations. Furthermore, those skilled in the art can design regions / layers with different shapes, sizes, and relative positions as needed.

[0052] Example 1

[0053] refer to Figure 1 The cross-platform binary code block hierarchical semantic similarity detection method of the present invention includes the following steps:

[0054] S1: Obtain the binary file, parse the structural information of the binary file, use a hybrid disassembler engine to parse machine instructions, extract basic blocks from the structural information of the binary file, and construct the control flow graph (CFG), data dependency graph (DDG), and function call graph (CG).

[0055] The process of step S1 is as follows:

[0056] S1.1: Obtain the binary file.

[0057] S1.2: Parse the structural information of the binary file.

[0058] S1.3: Use a hybrid disassembler engine to parse machine instructions.

[0059] S1.4: Divide the basic blocks according to the instructions.

[0060] S1.5: Construct a control flow graph (CFG) based on the structure information of the binary file parsed in step S1.2 and the instruction information parsed in step S1.3.

[0061] S1.6: Construct a data dependency graph (DDG) based on the binary file structure information parsed in step S1.2, the instruction information parsed in step S1.3, and the control flow graph (CFG) generated in step S2.5;

[0062] S1.7: Construct a function call graph (CG) based on the binary file structure information parsed in step S1.2 and the instruction information parsed in step S1.3.

[0063] S2: Extract instruction-level semantics, basic block-level semantics, and function-level semantics from the instruction sequence, basic block, control flow graph, data dependency graph, and function call graph.

[0064] The process of step S2 is as follows:

[0065] S2.1: Based on the instruction information parsed in step S1.3, the constant generalization, register generalization, and memory operation in the instruction sequence of the binary file disassembly are uniformly generated into a normalized instruction sequence, and the normalized instruction sequence is used as instruction-level semantics.

[0066] S2.2: Based on the control flow graph generated in step S1.5 and the data dependency graph generated in step S1.6, calculate the dominance tree depth, number of successor blocks, and loop depth of the control flow graph extracted from the binary file; calculate the number and ratio of operand input / output operations and the number and ratio of memory read / write operations based on the data dependency graph extracted from the binary file; concatenate the dominance tree depth, number of successor blocks, loop depth, number and ratio of operand input / output operations, and number and ratio of memory read / write operations to generate basic block-level semantic features f. block .

[0067] S2.3: Extract function-level semantics based on the control flow graph generated in step S1.5 and the function call graph generated in step S1.7. The function-level semantics include the function call graph and control flow graph extracted from the binary file.

[0068] S3: Construct instruction-level features, basic block-level features, and function-level features based on the instruction-level semantics, basic block-level semantics, and function-level semantics.

[0069] refer to Figure 2 The process of step S3 is as follows:

[0070] S3.1: Based on the instruction-level semantics of the binary file generated in step S2.1, the instruction sequence is converted into a bag-of-words representation, k independent hash functions are created, the minimum value of the instruction set is calculated for each hash function, and all minimum values ​​are combined to generate the instruction-level feature H. inst .

[0071]

[0072] Among them, Sj is a random permutation function, hash is a hash function, and min is the minimum value.

[0073] S3.2: Based on the basic block-level semantic features f of the binary file generated in step S2.2 block The basic block-level semantic features f block Multiplying with a random matrix completes the projection of the eigenvectors onto multiple random directions.

[0074] S3.3: Based on the projection result generated in step S3.2, add a random offset to the projection result to increase the randomness of the hash.

[0075] S3.4: Based on the projection result generated in step S3.3, the projection result is converted into binary value using a sign function to obtain a fixed-length binary hash code. This fixed-length binary hash code is then used as the basic block-level feature H. block .

[0076] H block =sgn(W·f block +b)

[0077] Where W is a random matrix; b is a random offset; and sgn is a sign function.

[0078] S3.5: Based on the function-level semantics of the binary file generated in step S2.3, merge the control flow graph and the function call graph. Nodes contain basic blocks and functions, and edges contain control flow and call relationships.

[0079] S3.6: Based on the graph merging result generated in step S3.5, initialize the node features and assign an initial feature vector to each node.

[0080] S3.7: Based on the results of initializing the node feature vectors in step S3.6, use multi-layer GNN propagation and aggregation, and the node continuously aggregates neighbor information.

[0081]

[0082] S3.8: Based on the node aggregation update result of step S3.7, perform graph-level aggregation. After multiple propagations, use the MEAN operation to aggregate all node representations to generate function-level features H. func .

[0083] H func =MEAN({h v (l)})

[0084] Among them, h v (l)Let N(v) be the embedding representation of node v at layer l, and let N(v) be the set of neighbors of node v. uv σ is the normalization constant, W is the weight matrix, σ is the Sigmoid activation function used to compress any real value of the calculation result within the parentheses to the (0,1) interval, and MEAN represents the average pooling operation.

[0085] S4: Perform hierarchical similarity detection on the instruction-level features, basic block-level features, and function-level features to obtain the final detection result.

[0086] refer to Figure 3 The specific operation of step S4 is as follows:

[0087] S41: Retrieve all vulnerability information in the vulnerability database {V1,V2,…,V...} i}, the function feature H for obtaining information about each vulnerability func (V i ); Obtain all function-level features H extracted from the binary file. func traverse H func Obtain the corresponding function-level feature H func (f q H is calculated based on cosine similarity. func (f q ) and H func (V i The phase velocity of the function is used to select the vulnerability information corresponding to the function-level features with a similarity greater than or equal to the first similarity threshold, and the first result set is constructed accordingly.

[0088]

[0089] S42: Obtain all vulnerability information {V1,V2,…,V} from the first result set. j}, to obtain the basic block features H of each vulnerability information block (V j ); Obtain all basic block-level features H extracted from the binary file. block traverse H block Obtain the corresponding basic block-level feature H block (f q H is calculated based on Hamming distance similarity. block (f q ) and H block (V j The similarity of the basic block features is used to select the vulnerability information corresponding to the basic block features with a similarity greater than or equal to the second similarity threshold, and the second result set is constructed accordingly.

[0090]

[0091] S43: Obtain all vulnerability information {V1,V2,…,V} from the second result set. x}, the instruction signature H for obtaining information on each vulnerability inst (V x ); Obtain all instruction-level features H extracted from the binary file. inst Iterate through and obtain the feature H of each instruction level. inst (f q ); Jaccard similarity calculation based on MinHash features H inst (f q ) and H inst (V x The similarity of the features is used to filter out the vulnerability information corresponding to the instruction-level features whose similarity is greater than or equal to the third similarity threshold, and the final detection result is constructed based on this.

[0092]

[0093] Preferably, the first similarity threshold is 0.7; the second similarity threshold is 0.6; and the third similarity threshold is 0.85.

[0094] Example 2

[0095] The cross-platform binary code block hierarchical semantic similarity detection system of the present invention includes the following steps:

[0096] The parsing module is used to obtain binary files, parse the structural information of the binary files, parse machine instructions using a hybrid disassembler engine, extract basic blocks from the structural information of the binary files, and construct control flow graph (CFG), data dependency graph (DDG), and function call graph (CG).

[0097] The extraction module is used to extract instruction-level semantics, basic block-level semantics, and function-level semantics from the instruction sequence, basic block, control flow graph, data dependency graph, and function call graph.

[0098] The construction module is used to construct instruction-level features, basic block-level features, and function-level features based on the instruction-level semantics, basic block-level semantics, and function-level semantics.

[0099] The detection module is used to perform hierarchical similarity detection on the instruction-level features, basic block-level features, and function-level features to obtain the final detection result.

[0100] The module division in this embodiment is illustrative and represents only one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional modules in each embodiment of this application can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0101] Example 3

[0102] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the cross-platform binary code block hierarchical semantic similarity detection method. For example, the method includes: acquiring a binary file; parsing the structural information of the binary file; parsing machine instructions using a hybrid disassembler engine; extracting basic blocks from the structural information of the binary file; and constructing a control flow graph (CFG), a data dependency graph (DDG), and a function call graph (CG); extracting instruction-level semantics, basic block-level semantics, and function-level semantics from the instruction sequence, basic blocks, control flow graph, data dependency graph, and function call graph; constructing instruction-level features, basic block-level features, and function-level features based on the instruction-level semantics, basic block-level semantics, and function-level semantics; and performing hierarchical similarity detection on the instruction-level features, basic block-level features, and function-level features to obtain the final detection result. The memory may include main memory, such as high-speed random access memory (RAM), or non-volatile memory, such as at least one disk storage device. The processor, network interface, and memory are interconnected via an internal bus, which may be an industry-standard architecture bus, a peripheral component interconnection standard bus, or an extended industry-standard architecture bus. The bus can be categorized as an address bus, data bus, or control bus. The memory stores programs; specifically, the program may include program code, which includes computer operation instructions. The memory may include main memory and non-volatile memory, and provides instructions and data to the processor.

[0103] Example 4

[0104] A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of a cross-platform binary code block hierarchical semantic similarity detection method, comprising: acquiring a binary file; parsing the structural information of the binary file; parsing machine instructions using a hybrid disassembler engine; extracting basic blocks from the structural information of the binary file; and constructing a control flow graph (CFG), a data dependency graph (DDG), and a function call graph (CG); extracting instruction-level semantics, basic block-level semantics, and function-level semantics from the instruction sequence, basic blocks, control flow graph, data dependency graph, and function call graph; constructing instruction-level features, basic block-level features, and function-level features based on the instruction-level semantics, basic block-level semantics, and function-level semantics; and performing hierarchical similarity detection on the instruction-level features, basic block-level features, and function-level features to obtain a final detection result. Specifically, the computer-readable storage medium includes, but is not limited to, volatile memory and / or non-volatile memory. The volatile memory may include random access memory (RAM) and / or cache memory, etc. The non-volatile memory may include read-only memory (ROM), hard disk, flash memory, optical disk, magnetic disk, etc.

[0105] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0106] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0107] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0108] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0109] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and disclosure of the invention. This application is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the following claims.

[0110] It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

[0111] The above description is merely a preferred embodiment of the present invention and does not constitute any limitation on the present invention. Any simple modifications, alterations, or equivalent structural changes made to the above embodiments based on the technical essence of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A cross-platform binary code block hierarchical semantic similarity detection method, characterized in that, Includes the following steps: Obtain the binary file, parse the structural information of the binary file, use a hybrid disassembler engine to parse the machine instructions, extract basic blocks from the structural information of the binary file, and construct the control flow graph (CFG), data dependency graph (DDG), and function call graph (CG); Extract instruction-level semantics, basic block-level semantics, and function-level semantics from the instruction sequence, basic block, control flow graph, data dependency graph, and function call graph; Instruction-level features, basic block-level features, and function-level features are constructed based on the instruction-level semantics, basic block-level semantics, and function-level semantics. The instruction-level features, basic block-level features, and function-level features are subjected to hierarchical similarity detection to obtain the final detection results.

2. The cross-platform binary code block hierarchical semantic similarity detection method according to claim 1, characterized in that, The process of extracting instruction-level semantics is as follows: A standardized instruction sequence is generated by uniformly generating constant generalization, register generalization, and memory operations in the instruction sequence, and the standardized instruction sequence is used as instruction-level semantics.

3. The cross-platform binary code block hierarchical semantic similarity detection method according to claim 1, characterized in that, The process of extracting basic block-level semantics is as follows: The dominance tree depth, number of successor blocks, and loop depth are calculated based on the control flow graph. The number and ratio of operand input / output operations and the number and ratio of memory read / write operations are calculated based on the data dependency graph. The dominance tree depth, number of successor blocks, loop depth, number and ratio of operand input / output operations, and number and ratio of memory read / write operations are concatenated to obtain the basic block-level semantic f. block .

4. The cross-platform binary code block hierarchical semantic similarity detection method according to claim 1, characterized in that, The process of constructing instruction-level features is as follows: Based on the instruction-level semantics, the instruction sequence is transformed into a bag-of-words representation to create k independent hash functions. The minimum value of the instruction set is calculated for each hash function, and all minimum values ​​are combined to generate the instruction-level feature H. inst The instruction-level feature H inst for: Among them, S j is a random permutation function, hash is a hash function, and min is the minimum value.

5. The cross-platform binary code block hierarchical semantic similarity detection method according to claim 1, characterized in that, The process of constructing basic block-level features is as follows: The basic block-level semantic f block Multiply the result by a random matrix, add a random offset to the result, and then use a sign function to convert it into a binary value to obtain a fixed-length binary hash code. This fixed-length binary hash code is then used as the basic block-level feature H. block Among them, the basic block-level feature H block for: H block =sgn(W·f block +b) Where W is a random matrix; b is a random offset; and sgn is a sign function.

6. The cross-platform binary code block hierarchical semantic similarity detection method according to claim 1, characterized in that, The process of constructing function-level features is as follows: Based on the function-level semantics, the control flow graph and the function call graph are merged to obtain a merged graph. In the merged graph, nodes contain basic blocks and functions, and edges contain control flow and call relationships. Node features are initialized by assigning initial feature vectors to each node. Multi-layer GNN propagation aggregation is used to aggregate the nodes, followed by graph-level aggregation. After multi-layer propagation, the MEAN operation is used to aggregate all node representations to generate the function-level feature H. func Among them, the function-level feature H func for: H func =MEAN({h v (l) }) Among them, h v (l) Let N(v) be the embedding representation of node v at layer l, and let N(v) be the set of neighbors of node v. uv σ is the normalization constant, W is the weight matrix, σ is the Sigmoid activation function used to compress any real value of the calculation result within the parentheses to the (0,1) interval, and MEAN represents the average pooling operation.

7. The cross-platform binary code block hierarchical semantic similarity detection method according to claim 1, characterized in that, The process of performing hierarchical similarity detection on the instruction-level features, basic block-level features, and function-level features to obtain the final detection result is as follows: Retrieve all vulnerability information in the vulnerability database {V1,V2,…,V i }, the function feature H for obtaining information about each vulnerability func (V i ); Obtain all function-level features H extracted from the binary file. func traverse H func Obtain the corresponding function-level feature H func (f q H is calculated based on cosine similarity. func (f q ) and H func (V i The phase velocity of the function is used to select the vulnerability information corresponding to the function-level features with a similarity greater than or equal to the first similarity threshold, and the first result set is constructed accordingly. Obtain all vulnerability information {V1,V2,…,V} from the first result set. j }, to obtain the basic block features H of each vulnerability information block (V j ); Obtain all basic block-level features H extracted from the binary file. block traverse H block Obtain the corresponding basic block-level feature H block (f q H is calculated based on Hamming distance similarity. block (f q ) and H block (V j The similarity of the basic block features is used to select the vulnerability information corresponding to the basic block features with a similarity greater than or equal to the second similarity threshold, and the second result set is constructed accordingly. Retrieve all vulnerability information {V1,V2,…,V} from the second result set. x }, the instruction signature H for obtaining information on each vulnerability inst (V x ); Obtain all instruction-level features H extracted from the binary file. inst Iterate through and obtain the feature H of each instruction level. inst (f q ); Jaccard similarity calculation based on MinHash features H inst (f q ) and H inst (V x The similarity of the features is used to filter out the vulnerability information corresponding to the instruction-level features whose similarity is greater than or equal to the third similarity threshold, and the final detection result is constructed based on this.

8. A cross-platform binary code block hierarchical semantic similarity detection system, characterized in that, Includes the following steps: The parsing module is used to obtain binary files, parse the structural information of the binary files, parse machine instructions using a hybrid disassembler engine, extract basic blocks from the structural information of the binary files, and construct control flow graph (CFG), data dependency graph (DDG), and function call graph (CG). The extraction module is used to extract instruction-level semantics, basic block-level semantics, and function-level semantics from the instruction sequence, basic block, control flow graph, data dependency graph, and function call graph. The construction module is used to construct instruction-level features, basic block-level features, and function-level features based on the instruction-level semantics, basic block-level semantics, and function-level semantics. The detection module is used to perform hierarchical similarity detection on the instruction-level features, basic block-level features, and function-level features to obtain the final detection result.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method for generating and sending trusted status alarm information as described in any one of claims 1.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the cross-platform binary code block hierarchical semantic similarity detection method as described in any one of claims 1.

Images