Function identification determination method, computing device and storage medium

Abstract

The embodiment of the present application provides a method for determining a function identifier, a computing device, and a storage medium. In the embodiment of the present application, multiple functions to be signed are obtained, and the features of the functions to be signed are obtained, and the features are used to describe the style of the function; based on the features, the signature of the function to be signed is generated; the semantics of the function to be signed is determined, and the semantics is used to determine the meaning of the function to be signed; based on the signature and the corresponding semantics, the identifier of the corresponding function to be signed is determined. Among them, the identifier of the corresponding function to be signed is determined according to the signature and the corresponding semantics. In this way, the identifiers of multiple functions to be signed can be determined. Therefore, unknown functions or functions in unknown files can be identified based on the identifiers of these functions. Then it is determined whether there are malicious functions or malicious codes. The determination and identification of the function identifier is realized in a relatively automated manner. It reduces manpower and time while ensuring accuracy.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method for determining a function identifier, a computing device, and a storage medium. Background Art

[0002] When facing unknown malicious code, security researchers cannot distinguish the composition of the code, and analysis is extremely time-consuming. In the context of big data, it is an impossible task to rely entirely on manual analysis. This is especially true for statically compiled code. After the code is statically compiled, the code expands by dozens of times, which is very common in malicious code. One of the purposes is to increase the difficulty of reverse analysis. How to solve this problem becomes very important. Summary of the invention

[0003] Multiple aspects of the present application provide a method for determining a function identifier, a computing device, and a storage medium, so that the identifier of a function in a code can be determined relatively quickly and accurately, thereby realizing the identification of the function in the code.

[0004] An embodiment of the present application provides a method for determining a function identifier, comprising: obtaining multiple functions to be signed, and obtaining characteristics of the functions to be signed, wherein the characteristics are used to describe the style of the functions; generating a signature of the function to be signed based on the characteristics; determining the semantics of the function to be signed, wherein the semantics are used to determine the meaning of the function to be signed; and determining the identifier of the corresponding function to be signed based on the signature and the corresponding semantics.

[0005] An embodiment of the present application also provides a computing device, including: a memory and a processor; the memory is used to store a computer program; the processor executes the computer program to: obtain multiple functions to be signed, and obtain characteristics of the functions to be signed, the characteristics are used to describe the style of the functions; based on the characteristics, generate a signature of the function to be signed; determine the semantics of the function to be signed, the semantics are used to determine the meaning of the function to be signed; determine the identifier of the corresponding function to be signed based on the signature and the corresponding semantics.

[0006] An embodiment of the present application also provides a computer-readable storage medium storing a computer program. When the computer program is executed by one or more processors, the one or more processors implement the steps in the above method.

[0007] In an embodiment of the present application, multiple functions to be signed are obtained, and features of the functions to be signed are obtained, the features are used to describe the style of the function; based on the features, a signature of the function to be signed is generated; the semantics of the function to be signed is determined, and the semantics is used to determine the meaning of the function to be signed; based on the signature and the corresponding semantics, an identifier of the corresponding function to be signed is determined.

[0008] Among them, according to the signature and the corresponding semantics, the identification of the corresponding function to be signed is determined. In this way, the identification of multiple functions to be signed can be determined. Therefore, according to the identification of these functions, unknown functions or functions in unknown files can be identified. Then it is determined whether there are malicious functions or malicious codes. The determination and identification of the function identification is realized in a relatively automated manner. It reduces manpower and time while ensuring accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0010] Figure 1 A schematic flow chart of a method for determining a function identifier according to an exemplary embodiment of the present application;

[0011] Figure 2 A schematic diagram of a function identification process of an exemplary embodiment of the present application;

[0012] Figure 3 A structural diagram of a system for determining a function identifier according to an exemplary embodiment of the present application;

[0013] Figure 4 A schematic diagram of the structure of a device for determining a function identifier provided by an exemplary embodiment of the present application;

[0014] Figure 5 A schematic diagram of the structure of a computing device provided for an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0015] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0016] As mentioned above, for unknown malicious code, especially for statically compiled code, the code expands dozens of times after being statically compiled, while the proportion of real user logic code is very low. This is very common in malicious code, and one of the purposes is to increase the difficulty of reverse analysis.

[0017] Based on this, an embodiment of the present application provides a function identification method, a computing device, and a storage medium, which determine the identification of the function in an automated manner, thereby performing function identification, thereby identifying malicious code components in the code.

[0018] The function identification process is described in detail below in conjunction with the method embodiment.

[0019] Figure 1 This is a flow chart of a method for identifying a function according to an exemplary embodiment of the present application. The method 100 provided in the embodiment of the present application is executed by a computing device, such as a cloud server. The method 100 includes the following steps:

[0020] 101: Obtain multiple functions to be signed, and obtain characteristics of the functions to be signed.

[0021] Among them, features are used to describe the style of the function.

[0022] 102: Generate a signature of the function to be signed according to the feature.

[0023] 103: Determine the semantics of the function to be signed.

[0024] Among them, semantics is used to determine the meaning of the function to be signed.

[0025] 104: Determine the identifier of the function to be signed according to the signature and the corresponding semantics.

[0026] The following is a detailed description of the above steps:

[0027] 101: Obtain multiple functions to be signed, and obtain characteristics of the functions to be signed.

[0028] Among them, the feature is used to describe the style of the function. That is, the feature can describe the appearance or form of the function, and what kind of function it is. The feature can include the prefix code of the instruction in the function (also called prefix instruction, such as lock prefix instruction), operation code, and string constant.

[0029] The function to be signed may be obtained from a file. The file may record multiple functions. The file may be a binary file. The functions recorded therein are binary functions. Of course, the file is not limited thereto, and other forms of files may also record corresponding functions and obtain them.

[0030] The file can be obtained automatically or pushed manually.

[0031] For example, the server can automatically collect multiple binary files from other platforms, such as other servers, and automatically send the multiple files to the server. Alternatively, the files can be collected manually, and the source information of the files can be manually annotated. Then, the corresponding files can be sent to the server by manual triggering.

[0032] After the server obtains the file, it can obtain multiple functions from each file. Then, for the instructions in each function, it extracts the corresponding features, such as the instruction prefix code, operation code, and string constant.

[0033] It should be noted that this feature can be increased or decreased as the instructions change.

[0034] Specifically, obtaining the characteristics of the function to be signed includes: obtaining the prefix code, operation code and string constant of the instruction in the function to be signed.

[0035] Since it has been explained in the previous article, it will not be repeated here. It is only explained that when obtaining features, the corresponding feature value can be obtained according to the identifier of each feature, such as the name. Or according to the component structure in the instruction, the corresponding feature value can be obtained from the corresponding structure.

[0036] For example, for the instruction lea rsi, "%ld", the prefix code is \x48, the opcode is \x8d, the string is "%ld", and the extracted feature is \x48\x8d%ld. For the instruction lock dec dword ptr [rdx], the prefix code is \xf0, the opcode is \xff, and the extracted feature is \xf0\xff.

[0037] It should also be noted that if there is no feature in the instruction corresponding to the function, it is not necessary to obtain it. If the instruction only has prefix code and operation code, but no string constant, then the prefix code and operation code are extracted. Then for the features, it can also include prefix code and operation code. In addition, it can also include string constants. It can also include jump objects in the instruction, such as jump addresses, etc.

[0038] In addition, before feature extraction, the acquired files, such as the assembly code of binary files, can be converted into a unified intermediate language IR, thus eliminating the impact of different architectures. For example, x86 assembly code, arm assembly code, and mips assembly code can be uniformly converted into intermediate languages ​​VEX IR or LLVM IR. In order to optimize compilation, instructions can also be reconstructed to eliminate the impact of differences in compilers and compilation options. For example, instructions can be reconstructed according to preset rules and reconstructed into instructions that comply with the preset rules. For example, a certain number of instructions, etc.

[0039] 102: Generate a signature of the function to be signed according to the feature.

[0040] The signature refers to a type of information that can represent the function, and specifically may be a feature that represents the style of the function.

[0041] For example, according to the foregoing description, after obtaining the features of the above instructions, the server extracts the features from each instruction of the function, and then concatenates and combines them to form the signature of the function.

[0042] If there is a string in the operand, it will be extracted during feature extraction and can also be used as a feature. For numerical values, it is not extracted because it is impossible to distinguish whether the value is a user code variable or a compiled address value. If it is extracted, it will interfere with recognition and greatly reduce generalization.

[0043] In order to save more storage space, the signature can be encoded.

[0044] Specifically, according to the feature, the signature of the function to be signed is generated, including: encoding the prefix code, the operation code and the string constant, and generating the signature according to the encoding result.

[0045] The encoding method may include: base64 encoding (one of the encoding methods for transmitting 8-bit bytecode) and sha256 encoding (hash 256 encoding).

[0046] For example, according to the above, the server extracts the features of each instruction of the function and concatenates them. After the combination, the combination result can be encoded by base64 and / or sha256, and the encoding result corresponding to each instruction constitutes the signature of the function.

[0047] Then, for some preset instructions, when extracting features, in addition to extracting the above features, other features can be extracted in a step to divide the instruction more accurately.

[0048] In addition, the method 100 also includes: for a preset jump instruction in the function to be signed, obtaining the semantics of the jump object in the preset jump instruction; encoding the prefix code, the operation code and the semantics of the jump object, and generating a signature corresponding to the function to be signed according to the encoding result.

[0049] Among them, the preset jump instruction may include a jmp instruction. The jump object may refer to the jump address in the instruction or the jump function in the instruction, that is, the function to be jumped to. The semantics of the jump object may refer to the meaning of the function or code to which the jump address belongs, such as the role or function. The semantics may be determined by a symbol or other identifier. That is, the symbol or other identifier may have the corresponding semantics through the file itself, or it may be a symbol or identifier determined by the method provided in the embodiment of the present application.

[0050] It should be understood that more preset instructions can be set according to needs. If a call instruction is preset, its features can be extracted, such as the semantics of the call object, the semantics of the call address, etc., which will not be described in detail.

[0051] For example, according to the foregoing, the server determines that there is a jmp jump instruction in the function to be signed. The type of instruction can be determined based on the name of the instruction or other identifiers. For example, the instruction can be determined to be a jmp instruction based on the "jmp" identifier. The semantics of the jump object in the jmp jump instruction, such as the corresponding symbol, is extracted as its feature. Its prefix code and operation code can also be extracted. Then, the prefix code, operation code and semantics of the jump object can be directly spliced ​​and combined and used as the signature of the instruction. Or the results of splicing and combination are encoded as described above, and the encoding result is used as the signature of the instruction. Then, the signature of the function is composed according to the encoding results of other instructions in the function to be signed.

[0052] It should be noted that, except for preset jump instructions, such as jmp instructions, or preset call instructions, other jump instructions and call instructions do not need to obtain or record the semantics of the subsequent jump object or the semantics of the call object (such as the semantics of the call address, or the semantics of the call function). This can remove the impact of changes in address values ​​and other changes that cause signature changes and improve generalization. However, for preset jump instructions, such as the instruction jmp loc_103353, the opcode is \xeb, the semantics of the jump object is "download_file", and the extracted feature is \xebdownload_file. If there is no corresponding feature, it will not be extracted.

[0053] In addition, in addition to specific instructions, other features can also be extracted for specific functions.

[0054] Specifically, the method 100 also includes: when the function to be signed has a preset number of instructions, the preset number is less than or equal to a quantity threshold, and the last instruction is a preset jump instruction, obtaining the semantics of the jump object in the preset jump instruction; encoding the prefix code, the operation code, and the semantics of the jump object, and generating a signature corresponding to the function to be signed based on the encoding result.

[0055] For example, according to the above, the server determines that the current function to be signed has 5 instructions according to the above method, which is equal to the quantity threshold of 5, and belongs to a short function. And the last instruction in the function is a jmp instruction, then the server can extract the jump function or jump address corresponding symbol in the instruction through the file where it is located. Prefix codes, operation codes, etc. can also be extracted. The prefix code, operation code and symbol can be directly spliced ​​and composed as the signature of the instruction. The splicing and composition results can also be encoded according to the above method, and the encoding result and the encoding results of other instructions of the function are combined to obtain the signature of the function.

[0056] For other instructions, the above symbols are not extracted. If the last instruction in the short function is another jump instruction, such as the jump instruction jnz_L_unlock_275, the operation code is \x0f\x85, because the jump instruction is not a preset jump instruction jmp, so even if there is a symbol behind it, it will not be extracted, and the extracted feature is \x0f\x85.

[0057] It should be noted that the extracted symbol can be added to the short function after the jump instruction is preset, which can effectively identify the short function and reduce the problem of short function signature conflict and function signature conflict.

[0058] 103: Determine the semantics of the function to be signed.

[0059] Among them, semantics is used to determine the meaning of the function to be signed. It can be the meaning of the function in the file or code, such as its role or function. The semantics can be determined by symbols or other identifiers. That is, the symbol or other identifier has the corresponding semantics pre-set. The symbol or other identifier can be the symbol of the object carried by the file itself.

[0060] For example, as can be seen from the foregoing, after the server obtains the function, it can determine the symbol of the function according to the symbol carried by the file where the function is located. For example, the symbol can represent the function of the function, or what it is used for, or what action it performs.

[0061] Among them, Figure 2As shown, according to the foregoing, the server obtains an automatic sample set 201 automatically pushed by other servers or cloud servers, and the set refers to the set of files to be signed as described above. Among them, sample A 2011 is a file to be signed, sample B 2012 is a file to be signed, and sample C 2013 is a file to be signed. These files determine the signature of the function in the file through the function signature 203. Among them, the semantics or symbols corresponding to the functions in the files to be signed are recorded in the record information 204. Among them, the symbol corresponding to the function in sample A 2011 is unknown or has no symbol, and is recorded as unknown, that is, there is no symbol. The symbol corresponding to the function in sample B 2012 is symbolB, and the symbol corresponding to the function in sample C 2013 is symbolC.

[0062] It should be noted that the symbol can be a symbol corresponding to a function, or the symbol corresponding to the file where the function is located can be used as the symbol of the function. As long as it can represent the semantics of the function. The symbols of functions in the same file can be the same. Each function can correspond to one symbol or multiple symbols. That is, each signature can correspond to one symbol or multiple symbols.

[0063] 104: Determine the identifier of the function to be signed according to the signature and the corresponding semantics.

[0064] Therefore, according to the previous text, after the signature and semantics are determined, the identity of the function to be signed can be determined. That is, the function can be represented by the signature and semantics, and the determined signature has the corresponding semantics. This form serves as an identity and establishes an association between the two. I will not go into details.

[0065] After the identification of multiple functions to be signed is determined, other functions can be identified. In addition, the determined signature and the corresponding semantics, that is, the identification of the function to be signed, need to be stored. It can be stored in the corresponding database for viewing and use.

[0066] Thus, the function identifier can be determined, and then it can be determined whether the function is a known function. Thus, unknown functions (i.e., undetermined functions) or modified functions, as well as unknown codes (i.e., undetermined codes) in a file can be determined. Since malicious functions or malicious codes may be hidden in these undetermined functions or codes, it is easier to find malicious functions or malicious codes only from undetermined functions or codes after the known functions are identified.

[0067] In order to better identify the function, a corresponding identification library can be established through multiple identifications for identification.

[0068] Specifically, the method 100 also includes: based on the same signature and corresponding semantics, merging the signatures and corresponding semantics of multiple functions to be signed, and counting the number of occurrences of the corresponding semantics; generating a corresponding function identification library according to the merged signatures, corresponding semantics and number of occurrences of the function to be signed to identify the function.

[0069] For example, according to the above, after the server determines the signatures and semantics of multiple functions, it can merge the same signatures and semantics, and count the number of occurrences of the corresponding semantics. Based on this, a function identification library can be generated. It records the function signatures and corresponding semantics, as well as the number of occurrences of the corresponding semantics.

[0070] Among them, Figure 2 As shown, the number of occurrences of the symbol is recorded in the record information 204. According to the foregoing, the symbol corresponding to the function in sample A2011 is unknown or has no symbol, recorded as unknown, and its number of occurrences is 3000 (times). The symbol corresponding to the function in sample B2012 is symbolB, and its number of occurrences is 3000 (times). The symbol corresponding to the function in sample C2013 is symbolC, and its number of occurrences is 1000 (times). The record information 204 can also record the corresponding signature. It will not be repeated here. The corresponding identification library can be generated based on the record information 204. Thereby, the function can be identified.

[0071] In order to determine and identify the function more accurately, the source of the function to be signed may be determined based on the above implementation.

[0072] Specifically, the method 100 further includes: determining a source library identifier of the identifier of the function to be signed based on the source library of the function to be signed; and determining the accuracy of the identifier of the function to be signed based on the source library identifier.

[0073] The source library refers to a library that can indicate the source of the function, such as a file library. The library can determine the source library identifier of the function or its file, such as the library name (name of the source library), version number, project, and file name.

[0074] Wherein, based on the source library of the function to be signed, the source library identifier of the identifier of the function to be signed is determined.

[0075] For example, according to the above, it can be known that the file with the function to be signed, that is, the sample, can be pushed manually. When pushing manually, the information of the source library can be filled in manually to determine the library name of the function to be signed or the file where it is located (that is, the name of the source library), version number, project, and file name, etc. Therefore, when the server obtains the file with the function to be signed pushed manually, it can obtain the information of the source library. Then record this information.

[0076] Among them, Figure 2 As shown, the library file D 2021 in the artificial sample set 202 refers to an artificially pushed file. According to the function signature 203, the signature and the corresponding semantics, as well as the number of occurrences of the semantics mentioned above, can also be obtained. In addition, the library name can also be obtained.

[0077] like Figure 2 As shown, in the record information, the symbol corresponding to library file D 2021 is symbolD, the number of occurrences is 1 (times), and the library name is library file D.

[0078] For the other samples mentioned above, since they do not have the information of the source library, the library file is recorded as X in the record information 204, indicating that there is none.

[0079] The identifier with the library name can increase the recognition accuracy of subsequent functions, that is, it has a better or higher priority.

[0080] According to the foregoing, the embodiment of the present application has two types of data sources or file samples, one type is automatically collected samples, which do not need to be pushed manually; the other type is samples of source information, which need to be pushed manually. Any type of data source can allow the process of the embodiment of the present application to be completed normally, so the embodiment of the present application has a low reliance on manual intervention and can save a lot of human resources. In addition, the specific implementation of the embodiment of the present application can be an engine in the server, such as a signature engine that can analyze samples of the order of 100,000 per day. There are already hundreds of millions of function signatures and function symbols in the function identification library, and a large number of function signatures and function symbols are added every day, ensuring the continuous growth and quality of the function library.

[0081] In addition, according to the source of the function to be signed, the priority of the identifier of the function to be signed is determined, including: based on the source library of the function to be signed, determining the source library identifier of the identifier of the function to be signed, thereby determining the corresponding priority.

[0082] Based on this, the above identifications can be prioritized, so that functions can be determined and identified more accurately and quickly during subsequent function identification.

[0083] Specifically, the method 100 further includes: determining the priority of the identification of the function to be signed according to the source of the function to be signed; and determining the accuracy of the identification of the function to be signed based on the priority.

[0084] The identification priority may also be the semantic priority.

[0085] For example, according to the above, the server determines the identification priority of the function, or the priority of the semantics, according to the source library, that is, the source of the function. The server can set the priority of the semantics with the source library to the highest priority. For example, the priority is 2. Since the priority is the highest, the semantics needs to be given priority in the subsequent function identification process. The semantics can improve the accuracy of identification.

[0086] Therefore, the method 100 further includes: determining the priority of the identification of the function to be signed according to the semantics of the function to be signed; and determining the accuracy of the identification of the function to be signed based on the priority.

[0087] This is similar to the above description, except that: for the identification of functions with semantics, the priority of the semantics is directly set, such as setting the priority to 1. The priority of functions without semantics is set to 0.

[0088] like Figure 2 As shown, in the record information 204 , it can be determined that the priority of the semantics corresponding to sample A 2011 is 0, the priority of the semantics corresponding to sample B 2012 is 1, and the priority of the semantics corresponding to sample C 2012 is 1.

[0089] The following is the process of identifying the function:

[0090] Specifically, the method 100 also includes: obtaining the function to be identified, generating a signature of the function to be identified, matching the signature of the function to be identified with signatures of multiple functions to be signed in a function identification library, and determining a matching signature; determining corresponding semantics based on the matching signature, thereby determining the identification of the function to be identified.

[0091] For example, according to the foregoing, the server can obtain a file to be identified from other servers, the file contains a function to be identified, or directly obtain the function, or the features required for the signature of the corresponding function, to generate a corresponding signature. It is also possible to receive a file to be identified sent from a user's computer, or directly send it to a function, or the features required for the signature of the corresponding function, to generate a corresponding signature. The server generates a corresponding signature according to the method described above. Then, the signature is matched with the signature determined as described above, and the corresponding semantics or symbols are determined according to the matched signature. Thus, the identification of the function can be determined based on the matched signature and semantics.

[0092] After a signature is matched, the signature may have multiple semantics or multiple symbols. If there are multiple symbols or multiple semantics, the final symbol can be determined by priority.

[0093] Specifically, the method 100 also includes: when there are multiple determined semantics, the final semantics is determined according to the priority, thereby determining the identification of the function to be identified; when the priorities of the determined semantics are the same, the final semantics is determined according to the number of occurrences of the semantics, thereby determining the identification of the function to be identified.

[0094] For example, according to the above, after the server matches the signature, if the signature has multiple symbols or multiple semantics, it can be selected by corresponding priority. The semantic with the highest priority is selected as the semantic of the function to be identified. If the priorities are the same, it can be selected according to the number of occurrences of the semantics, and the semantic with the highest number of occurrences is selected. In this way, the function is identified and the function is identified. I will not go into details.

[0095] Among them, Figure 2 As shown, according to the above-mentioned method, by identifying the function to be identified 205, when the symbols in the record information 204 all meet the signature of the function to be identified, the symbol symbolD with a priority of 2 is selected as the identified semantics.

[0096] If a function signature conflict occurs, the most likely function symbol for a function signature can be determined by using the symbol priority and symbol statistical occurrence count in the library.

[0097] Function identification can also be performed through FLIRT (Fast Library Identification and Recognition Technology, a library file fast identification and authentication technology) and binaryAI (an end-to-end matching algorithm tool for binary code / source code based on neural networks), but they still cannot meet actual service needs. FLIRT cannot solve the problem of function signature conflicts, and can only use static libraries to generate sig signature files. It does not support the extraction of executable file function signatures and requires many manual pre-operations. BinaryAI is too generalized, resulting in poor actual recognition results, high false positive and false negative rates, and cannot meet actual service needs. Source code is required for training, manual intervention is required, and the degree of automated library building is low. It can be verified that the identification of functions through the embodiments of the present application is significant when compared with the binaryAI example using the binary program restored using the embodiments of the present application.

[0098] The embodiments of the present application enable security researchers to focus on the main user code logic when analyzing malicious code, quickly locate malicious behavior, and greatly save the time of security researchers. For example, for a malicious sample of basic software contamination type, all library functions can be identified through automatic function recognition, and those that are not identified are user code or modified library functions, so that the malicious code can be quickly located.

[0099] Figure 3 The following is a schematic diagram of a system for determining a function identifier provided by an exemplary embodiment of the present application. Figure 3 As shown, the system 300 may include: a first device 301 and a second device 302 , and the system 300 may also include a third device 303 .

[0100] Among them, the first device 301 refers to a device that can provide computing and processing services in a network virtual environment, and can refer to a device that uses the network to determine the function identifier and identify the function. In physical implementation, the first device 301 can be any device that can provide computing services, respond to service requests, and determine the function identifier and identify the function, such as a cloud server, cloud host, virtual center, conventional server, etc., on which a database is constructed. The first device 301 is mainly composed of a processor, a hard disk, a memory, a system bus, etc., which is similar to a general computer architecture.

[0101] It should be noted that the specific implementation form of the first device 301 can be a physical device or a virtual device, which can be deployed with a signature engine to implement the function of the signature engine for determining the function identifier, and can also be deployed with a database to store the determined identifier to implement the database function. Among them, the signature engine sends the determined function identifier to the database for storage. In addition, the semantics corresponding to the signature query of the function to be identified can be queried in the database to determine the final identifier of the function, which can include the signature and the semantics.

[0102] In addition, the specific implementation form of the first device 301 can also be a distributed architecture composed of multiple physical devices or virtual devices. The distributed architecture can improve the throughput of processing tasks and facilitate expansion and reduction according to services. Among them, for the signature engine, it can be through a distributed architecture to realize the determination of the function identifier. For the database, it can also be through a distributed architecture to store the identifier and realize the database function. The signature engine sends the determined function identifier to the database for storage. In addition, the semantics corresponding to the signature query of the function to be identified can be queried in the database to determine the final identifier of the function, which can include the signature and the semantics.

[0103] The second device 302 refers to a device that can provide computing and processing services in a network virtual environment, and can refer to a device that uses a network to send and receive data. In physical implementation, the second device 302 can be any device that can provide computing services, respond to service requests, and send and receive data, such as a cloud server, a cloud host, a virtual center, a conventional server, etc., on which a database is constructed. The second device 302 mainly includes a processor, a hard disk, a memory, a system bus, etc., which is similar to a general computer architecture.

[0104] The third device 303 may be a device with certain computing capabilities, which can realize the function of sending data to the first device 301, and can also receive data sent by the first device 301. The basic structure of the third device 303 may include: at least one processor. The number of processors may depend on the configuration and type of the device with certain computing capabilities. The device with certain computing capabilities may also include a memory, which may be volatile, such as RAM, or non-volatile, such as read-only memory (ROM), flash memory, etc., or may include both types at the same time. The memory usually stores an operating system (OS), one or more application programs, and may also store program data, etc. In addition to the processing unit and the memory, the device with certain computing capabilities also includes some basic configurations, such as a network card chip, an IO bus, a display component, and some peripheral devices, etc. Optionally, some peripheral devices may include, for example, a keyboard, an input pen, etc. Other peripheral devices are well known in the art and will not be described in detail here. Optionally, the third device 303 may be an intelligent terminal, such as a mobile phone, a desktop computer, a notebook, a tablet computer, etc.

[0105] Specifically, the first device 301 obtains multiple functions to be signed, and obtains characteristics of the functions to be signed, where the characteristics are used to describe the style of the function; generates a signature of the function to be signed based on the characteristics; determines the semantics of the function to be signed, where the semantics are used to determine the meaning of the function to be signed; and determines an identifier of the corresponding function to be signed based on the signature and the corresponding semantics.

[0106] In addition, the first device 301 is also used to store the signature and the corresponding semantics, that is, the identification.

[0107] The second device 302 sends the function to be signed to the first device 301.

[0108] In addition, the first device 301, based on the same signature and corresponding semantics, merges the signatures and corresponding semantics of multiple functions to be signed, and counts the number of occurrences of the corresponding semantics; based on the merged signatures, corresponding semantics and number of occurrences of the function to be signed, generates a corresponding function identification library to identify the function.

[0109] In addition, the first device 301 determines the priority of the identification of the function to be signed according to the source of the function to be signed; and determines the accuracy of the identification of the function to be signed based on the priority.

[0110] In addition, the first device 301 determines a source library identifier of the identifier of the function to be signed based on the source library of the function to be signed; and determines the accuracy of the identifier of the function to be signed based on the source library identifier.

[0111] In addition, the first device 301 determines the priority of the identification of the function to be signed according to the semantics of the function to be signed; and determines the accuracy of the identification of the function to be signed based on the priority.

[0112] Specifically, the first device 301 obtains the prefix code, operation code and string constant of the instruction in the function to be signed.

[0113] Specifically, the first device 301 encodes the prefix code, the operation code, and the string constant, and generates the signature according to the encoding result.

[0114] In addition, the first device 301 obtains the semantics of the jump object in the preset jump instruction in the function to be signed; encodes the prefix code, operation code and semantics of the jump object, and generates a signature corresponding to the function to be signed according to the encoding result.

[0115] In addition, the first device 301, when the function to be signed has a preset number of instructions, the preset number is less than or equal to the number threshold, and the last instruction is a preset jump instruction, obtains the semantics of the jump object in the preset jump instruction; encodes the prefix code, the operation code and the semantics of the jump object, and generates a signature corresponding to the function to be signed according to the encoding result.

[0116] In addition, the first device 301 obtains the function to be identified, generates a signature of the function to be identified, matches the signature of the function to be identified with the signatures of multiple functions to be signed in the function identification library, and determines the matching signature; determines the corresponding semantics based on the matching signature, thereby determining the identification of the function to be identified.

[0117] The third device 303 may send the function to be identified to the first device 301 .

[0118] In addition, the first device 301, when there are multiple determined semantics, determines the final semantics according to the priority, thereby determining the identification of the function to be identified; when the priorities of the determined semantics are the same, determines the final semantics according to the number of occurrences of the semantics, thereby determining the identification of the function to be identified.

[0119] In the scenario of function identification, the first device 301, such as a server, can automatically collect multiple binary files from the second device 302, such as other servers, and automatically send the multiple files to the server. Alternatively, the files can be collected manually, and the source information of the files can be manually annotated. Then, the corresponding files can be sent to the server by other servers in a manually triggered manner. That is, the sample is sent. That is, the second device 302 executes step 311: send the sample to the server. After the server obtains the file, its signature engine can obtain multiple functions from each file. Then, for the instructions in each function, the corresponding features are extracted, such as the prefix code, operation code, and string constant of the instruction. The server extracts the features in each instruction of the function and splices and combines them. After the combination, the combination result can be encoded by base64 and / or sha256, and the encoding result corresponding to each instruction constitutes the signature of the function.

[0120] After the server obtains the function, it can determine the symbol of the function according to the symbol carried by the file where the function is located. After determining the signature and semantics, the identification of the function to be signed can be determined. That is, the function can be represented by the signature and semantics, and the determined signature has the corresponding semantics. This form is used as an identification to establish an association between the two. After the server determines the signatures and semantics of multiple functions, the same signatures and the same semantics can be merged, and the number of occurrences of the corresponding semantics can be counted. The corresponding signatures and semantics are stored in the database, that is, the identification is stored. Based on this, a function identification library can be generated. It records the signature of the function and the corresponding semantics, as well as the number of occurrences of the corresponding semantics. The server can set the priority of the semantics with the source library to the highest priority. For example, the priority is 2. For the identification of the function with semantics, or directly set the priority for the semantics, such as setting the priority to 1. The semantics that do not have are set to 0.

[0121] The second device 302 can receive step 312: sending the file to be identified to the first device 301, such as a server. After the server receives the file, the server generates a corresponding signature for the function in the file through the signature engine according to the method described above. Then, through the identification stored in the database, the signature is matched with the signature determined as described above, and the corresponding semantics or symbols are determined according to the matched signature. Therefore, the identification of the function can be determined based on the matched signature and semantics.

[0122] If the signature has multiple symbols or multiple semantics, they can be selected by corresponding priorities. The semantic with the highest priority is selected as the semantic of the function to be identified. If the priorities are the same, the semantic with the highest number of occurrences can be selected according to the number of occurrences of the semantics. Thus, the function is identified and the function is identified. Then the first device 301, such as a server, executes step 313: sending the identification result to the second device 302, such as another server.

[0123] In addition, the user can also use a third device, such as a computer, to perform step 314: send the file to be identified to the first device 301, such as a server. The server then identifies the function in the file and returns the identification result. That is, the first device 301, such as a server, performs step 315: sends the identification result.

[0124] For the contents not recorded in detail here, please refer to the previous content and I will not repeat them here.

[0125] In the above embodiment, the first device 301, the second device 302 and the third device 303 are connected to the network. If the first device 301, the second device 302 and the third device 303 are connected for communication, the network standard of the mobile network can be any one of 2G (GSM), 2.5G (GPRS), 3G (WCDMA, TD-SCDMA, CDMA2000, UTMS), 4G (LTE), 4G+ (LTE+), WiMax, 5G, etc.

[0126] Figure 4 A schematic diagram of a structure framework of a device for determining a function identifier provided by an exemplary embodiment of the present application. The device 400 can be applied to a computing device, such as a server. The device 400 includes: an acquisition module 401, a generation module 402, and a determination module 403; the functions of each module are described in detail below:

[0127] The acquisition module 401 is used to acquire multiple functions to be signed and acquire characteristics of the functions to be signed.

[0128] The feature is used to describe the style of the function.

[0129] The generation module 402 is used to generate a signature of the function to be signed according to the feature.

[0130] The determination module 403 is used to determine the semantics of the function to be signed.

[0131] Among them, semantics is used to determine the meaning of the function to be signed.

[0132] The determination module 403 is used to determine the identifier of the function to be signed according to the signature and the corresponding semantics.

[0133] In addition, the device 400 also includes: a merging module, which is used to merge the signatures and corresponding semantics of multiple functions to be signed based on the same signature and corresponding semantics, and count the number of occurrences of the corresponding semantics; a generating module 402, which is also used to generate a corresponding function identification library based on the merged signatures, corresponding semantics and number of occurrences of the function to be signed, so as to identify the function.

[0134] In addition, the determination module 403 is further used to determine the priority of the identification of the function to be signed according to the source of the function to be signed; the determination module 403 is further used to determine the accuracy of the identification of the function to be signed based on the priority.

[0135] In addition, the determination module 403 is also used to determine the source library identifier of the identifier of the function to be signed based on the source library of the function to be signed; the determination module 403 is also used to determine the accuracy of the identifier of the function to be signed based on the source library identifier.

[0136] In addition, the determination module 403 is further used to determine the priority of the identification of the function to be signed according to the semantics of the function to be signed; and determine the accuracy of the identification of the function to be signed based on the priority.

[0137] Specifically, the acquisition module 401 is used to obtain the prefix code, operation code and string constant of the instruction in the function to be signed.

[0138] Specifically, the generating module 402 is used to encode the prefix code, the operation code and the string constant, and generate a signature according to the encoding result.

[0139] In addition, the acquisition module 401 is used to obtain the semantics of the jump object in the preset jump instruction in the function to be signed; the generation module 402 is also used to encode the prefix code, operation code and the semantics of the jump object, and generate the signature of the corresponding function to be signed according to the encoding result.

[0140] In addition, the acquisition module 401 is used to obtain the semantics of the jump object in the preset jump instruction when the function to be signed has a preset number of instructions, the preset number is less than or equal to the number threshold, and the last instruction is a preset jump instruction; the generation module 402 is also used to encode the prefix code, operation code and the semantics of the jump object, and generate the signature of the corresponding function to be signed according to the encoding result.

[0141] In addition, the device 400 also includes: a matching module, which is used to obtain the function to be identified, generate a signature of the function to be identified, match the signature of the function to be identified with the signatures of multiple functions to be signed in the function identification library, and determine the matching signature; a determination module 403, which is also used to determine the corresponding semantics based on the matching signature, thereby determining the identification of the function to be identified.

[0142] In addition, the determination module 403 is also used to determine the final semantics according to the priority when there are multiple determined semantics, thereby determining the identification of the function to be identified; when the priorities of the determined semantics are the same, the final semantics are determined according to the number of occurrences of the semantics, thereby determining the identification of the function to be identified.

[0143] For details of the device 400 that are not fully described, please refer to the above description and will not be repeated here.

[0144] The above describes Figure 4 The internal functions and structure of the device 400 shown, in one possible design, Figure 4 The structure of the device 400 shown can be implemented as a computing device, such as a server. Figure 5 As shown, the device 500 may include: a memory 501, a processor 502;

[0145] The memory 501 is used to store computer programs.

[0146] Processor 502 is used to execute a computer program to: obtain multiple functions to be signed, and obtain characteristics of the functions to be signed, the characteristics are used to describe the style of the function; generate a signature of the function to be signed according to the characteristics; determine the semantics of the function to be signed, the semantics are used to determine the meaning of the function to be signed; determine the identifier of the corresponding function to be signed according to the signature and the corresponding semantics.

[0147] In addition, processor 502 is also used to merge the signatures and corresponding semantics of multiple functions to be signed based on the same signature and corresponding semantics, and count the number of occurrences of the corresponding semantics; based on the merged signatures, corresponding semantics and number of occurrences of the function to be signed, generate a corresponding function identification library to identify the function.

[0148] In addition, the processor 502 is further configured to determine the priority of the identification of the function to be signed according to the source of the function to be signed; and determine the accuracy of the identification of the function to be signed based on the priority.

[0149] In addition, the processor 502 is further configured to determine a source library identifier of the identifier of the function to be signed based on the source library of the function to be signed; and determine the accuracy of the identifier of the function to be signed based on the source library identifier.

[0150] In addition, the processor 502 is further configured to determine the priority of the identification of the function to be signed according to the semantics of the function to be signed; and determine the accuracy of the identification of the function to be signed based on the priority.

[0151] Specifically, processor 502 is specifically used to obtain the prefix code, operation code and string constant of the instruction in the function to be signed.

[0152] Specifically, the processor 502 is specifically configured to encode the prefix code, the operation code, and the string constant, and generate a signature according to the encoding result.

[0153] In addition, processor 502 is also used to obtain the semantics of the jump object in the preset jump instruction in the function to be signed; encode the prefix code, operation code and the semantics of the jump object, and generate the signature of the corresponding function to be signed according to the encoding result.

[0154] In addition, processor 502 is also used to obtain the semantics of the jump object in the preset jump instruction when the function to be signed has a preset number of instructions, the preset number is less than or equal to the number threshold, and the last instruction is a preset jump instruction; encode the prefix code, operation code and the semantics of the jump object, and generate the signature of the corresponding function to be signed according to the encoding result.

[0155] In addition, processor 502 is also used to obtain the function to be identified, generate a signature of the function to be identified, match the signature of the function to be identified with the signatures of multiple functions to be signed in the function identification library, and determine the matching signature; determine the corresponding semantics based on the matching signature, thereby determining the identification of the function to be identified.

[0156] In addition, processor 502 is also used to determine the final semantics according to the priority when there are multiple determined semantics, thereby determining the identification of the function to be identified; when the priorities of the determined semantics are the same, the final semantics are determined according to the number of occurrences of the semantics, thereby determining the identification of the function to be identified.

[0157] An embodiment of the present invention provides a computer storage medium, which, when a computer program is executed by one or more processors, causes the one or more processors to implement Figure 1-Figure 2 The steps of a method for determining a function identifier in the method embodiment will not be described in detail.

[0158] In addition, in some of the processes described in the above embodiments and the accompanying drawings, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel, and the sequence numbers of the operations, such as 101, 102, 103, etc., are only used to distinguish between different operations, and the sequence numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

[0159] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0160] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by adding a necessary general hardware platform, and of course can also be implemented by combining hardware and software. Based on such an understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a computer product, and the present invention can be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0161] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable multimedia data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable multimedia data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0162] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable multimedia data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0163] These computer program instructions may also be loaded onto a computer or other programmable multimedia data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0164] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0165] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0166] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0167] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for determining a function identifier, characterized in that: include: Get multiple functions to be signed, and get the prefix code, operation code and string constant of the instruction in the functions to be signed; Encode the prefix code, the operation code and the string constant, and generate the signature of the function to be signed according to the encoding result; Determining the semantics of the function to be signed, wherein the semantics is used to determine the meaning of the function to be signed; According to the signature and the corresponding semantics, an identifier of the function to be signed is determined.

2. The method according to claim 1, characterized in that The method further comprises: Based on the same signature and corresponding semantics, merge the signatures and corresponding semantics of multiple functions to be signed, and count the number of occurrences of the corresponding semantics; According to the merged signature of the function to be signed, the corresponding semantics and the number of occurrences, a corresponding function identification library is generated to identify the function.

3. The method according to claim 1, characterized in that The method further comprises: Determining the priority of the identifier of the function to be signed according to the source of the function to be signed; Based on the priority, the accuracy of the identification of the function to be signed is determined.

4. The method according to claim 1 or 3, characterized in that: The method further comprises: Based on the source library of the function to be signed, determining the source library identifier of the identifier of the function to be signed; Based on the source library identifier, the accuracy of the identifier of the function to be signed is determined.

5. The method according to claim 1, characterized in that The method further comprises: Determine the priority of the identifier of the function to be signed according to the semantics of the function to be signed; Based on the priority, the accuracy of the identification of the function to be signed is determined.

6. The method according to claim 1, characterized in that The method further comprises: For the preset jump instruction in the function to be signed, obtain the semantics of the jump object in the preset jump instruction; The prefix code, the operation code and the semantics of the jump object are encoded, and a signature of the function to be signed is generated according to the encoding result.

7. The method according to claim 6, characterized in that The method further comprises: When the function to be signed has a preset number of instructions, the preset number is less than or equal to the number threshold, and the last instruction is a preset jump instruction, the semantics of the jump object in the preset jump instruction is obtained; The prefix code, the operation code and the semantics of the jump object are encoded, and a signature of the function to be signed is generated according to the encoding result.

8. The method according to claim 1, characterized in that The method further comprises: Obtaining a function to be identified, generating a signature of the function to be identified, matching the signature of the function to be identified with signatures of multiple functions to be signed in a function identification library, and determining a matching signature; The corresponding semantics is determined according to the matching signature, thereby determining the identity of the function to be identified.

9. The method according to claim 8, characterized in that The method further comprises: When there are multiple determined semantics, the final semantics is determined according to the priority, thereby determining the identification of the function to be identified; When the priorities of the determined semantics are the same, the final semantics are determined according to the number of occurrences of the semantics, thereby determining the identification of the function to be identified.

10. A computing device, characterized in that include: Memory, processor; The memory is used to store computer programs; The processor executes the computer program to: Get multiple functions to be signed, and get the prefix code, operation code and string constant of the instruction in the functions to be signed; Encode the prefix code, the operation code and the string constant, and generate the signature of the function to be signed according to the encoding result; Determining the semantics of the function to be signed, wherein the semantics is used to determine the meaning of the function to be signed; According to the signature and the corresponding semantics, an identifier of the function to be signed is determined.

11. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by one or more processors, the one or more processors are caused to implement the steps in the method according to any one of claims 1 to 9.

Images