Software vulnerability analysis method and system based on pcode and bert

Abstract

The application belongs to the field of network security, and relates to a software vulnerability analysis method and system based on PCODE and Bert. A vulnerability analysis framework is constructed, the input binary program content is decompiled to generate a pcode intermediate language, and the pcode intermediate language is mapped, feature extracted and classified by using a Bert neural network. Corpus data sets, training data sets and test data sets are collected, the Bert neural network in the framework is pre-trained by using the corpus data sets in turn, the training data sets are used to train the Bert neural network to learn vulnerability semantic features to generate a vulnerability analysis model, and the performance of the vulnerability analysis model is evaluated and optimized by using the test data sets to generate a final vulnerability analysis model. The framework of the final vulnerability analysis model is used to identify the vulnerability categories in a target binary program file. The application can find meaningful information and vulnerabilities in program code segments, improve the software vulnerability analysis effect of cross-architecture and multiple types, and improve the efficiency and accuracy.

Description

Technical Field

[0001] This invention belongs to the field of cyberspace security technology, and specifically relates to a software vulnerability analysis method and system based on PCODE and BERT. Background Technology

[0002] The development of internet technology has led to a rapid increase in the quantity and variety of software, bringing convenience but also security risks. Attackers are exploiting an increasing number of vulnerabilities, posing a threat to cyberspace security. Therefore, the importance of software vulnerability analysis technology is self-evident. For example, the Heartbleed vulnerability exposed in OpenSSL in 2014 has affected billions of internet users. However, manually analyzing the vast number of vulnerabilities is extremely time-consuming and labor-intensive. Therefore, research into intelligent software vulnerability analysis is urgently needed.

[0003] Traditional software vulnerability analysis methods are mainly divided into static vulnerability analysis, dynamic vulnerability analysis, and hybrid methods. Static vulnerability analysis methods have the advantage of speed but usually have a high false positive rate. Dynamic vulnerability analysis methods can accurately locate vulnerabilities, but for large-scale software systems, this method often requires a lot of resources. Combined static and dynamic vulnerability analysis methods have better detection efficiency and accuracy, but are usually applicable to specific vulnerability types. Currently, much research is conducted at the source code level. However, in real-world cyberspace, most software is packaged as binary programs and provided to users. Especially with the proliferation of IoT devices, it is almost impossible to find the corresponding source code for software vulnerability analysis of commonly used IoT devices. Therefore, the closed-source nature of software limits the above methods. Furthermore, IoT devices have diverse architectures; the same program can be compiled into different architectures with significantly different assembly languages. Therefore, disclosed vulnerabilities applied to different architectures may continue to compromise cyberspace security. Summary of the Invention

[0004] To this end, the present invention provides a software vulnerability analysis method and system based on PCODE and BERT. The method uses the intermediate language PCODE to perform software vulnerability analysis, while using the BERT model to learn features from code snippets in the training set, and predicts software vulnerabilities based on the output of the classifier. This method can improve the effectiveness of cross-architecture and multi-type software vulnerability analysis and effectively ensure cyberspace security performance.

[0005] According to the design scheme provided by this invention, a software vulnerability analysis method based on PCODE and BERT is provided, comprising the following:

[0006] A vulnerability analysis framework is constructed, which is used to decompile the contents of the input binary program file to generate pcode intermediate language, and the BERT neural network is used to perform vector mapping, feature extraction and classification of the pcode intermediate language;

[0007] We collect an unlabeled procedural corpus dataset for pre-training the BERT neural network in the framework using vector mapping, a training dataset for training the BERT neural network in the framework to learn software vulnerability semantic features to generate a vulnerability analysis model, and a test dataset for evaluating and tuning the generated vulnerability analysis model. First, we pre-train the BERT neural network in the framework using the corpus dataset. Then, we use the training dataset to train the BERT neural network in the framework to learn software vulnerability semantic features to generate a vulnerability analysis model. Finally, we use the test dataset to evaluate and tune the performance of the vulnerability analysis model and generate the final vulnerability analysis model for predicting the vulnerability of the target software.

[0008] A vulnerability analysis framework containing the final generated vulnerability analysis model is used to identify vulnerability categories in target binary files.

[0009] As a software vulnerability analysis method based on PCODE and BERT in this invention, the vulnerability analysis framework further utilizes a decompilation tool to decompile the input into pcode intermediate language, and performs normalization and standardization preprocessing on the decompiled pcode intermediate language to obtain a unified format intermediate language representation as input to the BERT neural network model.

[0010] As a software vulnerability analysis method based on PCODE and BERT in this invention, the preprocessing further includes: normalizing the instruction sequence and invalid instructions in the program code segment; and normalizing the function names and variables in the program code segment.

[0011] As a software vulnerability analysis method based on PCODE and BERT in this invention, further, in the BERT neural network in the vulnerability analysis framework, the intermediate language representation of PCODE is mapped to the vector space by the embedding layer, and the embedded vector is extracted by a series of Transformer encoders through continuous iteration and backpropagation, and the extracted features are classified by a classifier.

[0012] As a software vulnerability analysis method based on PCODE and BERT in this invention, the BERT neural network model further utilizes cross-entropy as a loss function during model training to evaluate the difference between the current probability distribution of the model and the true distribution of the dataset.

[0013] As a software vulnerability analysis method based on PCODE and BERT in this invention, each Transformer encoder extracts the contextual semantic features of the current node by reading a fixed-length input, and uses a self-attention mechanism to fuse the contextual semantic features of the current node into a vector space, which is then used as the output vector of the current layer to propagate to the next layer.

[0014] As a software vulnerability analysis method based on PCODE and BERT in this invention, a classifier is further constructed using two fully connected layers and a softmax layer, wherein the softmax activation function is expressed as: Where i represents a single category in the number of categories k, v i This represents the value corresponding to category i.

[0015] Furthermore, this invention also provides a software vulnerability analysis system based on PCODE and BERT, comprising: a framework construction module, a model generation module, and a target identification module, wherein,

[0016] The framework building module is used to build a vulnerability analysis framework. This framework is used to decompile the contents of the input binary program file to generate pcode intermediate language, and to use the Bert neural network to perform vector mapping, feature extraction and classification on the pcode intermediate language.

[0017] The model generation module collects an unlabeled procedural corpus dataset for pre-training the BERT neural network vector mapping in the framework, a training dataset for training the BERT neural network in the framework to learn software vulnerability semantic features to generate a vulnerability analysis model, and a test dataset for evaluating and tuning the generated vulnerability analysis model. First, the corpus dataset is used to pre-train the BERT neural network in the framework. Then, the training dataset is used to train the BERT neural network in the framework to learn software vulnerability semantic features to generate a vulnerability analysis model. Finally, the test dataset is used to evaluate and tune the performance of the vulnerability analysis model and generate the final vulnerability analysis model for predicting the vulnerability of the target software.

[0018] The target identification module is used to identify vulnerability categories in target binary files using a vulnerability analysis framework containing the final generated vulnerability analysis model.

[0019] The beneficial effects of this invention are:

[0020] This invention utilizes pcode, a middle ground between high-level languages ​​and low-level assembly languages, fully leveraging pcode's cross-architecture applicability. Simultaneously, it employs a BERT neural network on the pcode intermediate language to perform sequence learning on a dataset of binary files containing multiple vulnerabilities. By learning the characteristic patterns of vulnerabilities, it predicts software vulnerabilities, enabling the discovery of meaningful information and vulnerabilities in program code snippets without accessing the original source code. This allows for semantic learning across different program architectures, improving the efficiency and accuracy of vulnerability identification and effectively ensuring cyberspace security. Furthermore, experiments on real-world datasets verify that this solution can efficiently and accurately uncover vulnerabilities in files, demonstrating promising application prospects. Attached image description:

[0021] Figure 1 This is a schematic diagram of the software vulnerability analysis method based on PCODE and BERT in the embodiment;

[0022] Figure 2 This is a schematic diagram illustrating the principle of software vulnerability analysis in the embodiment;

[0023] Figure 3 This is a schematic diagram showing the comparison before and after preprocessing in the embodiment;

[0024] Figure 4 This is a schematic diagram of the BERT model structure in the embodiment;

[0025] Figure 5 This is a schematic diagram of the transformer-encoder structure in the embodiment. Detailed implementation method:

[0026] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described in detail below with reference to the accompanying drawings and technical solutions.

[0027] Software vulnerability analysis protects software systems by uncovering vulnerabilities. Software vulnerability analysis tasks take source code or binary files as input and predict software vulnerabilities through analysis. This task is crucial for maintaining cyberspace security, but existing methods suffer from problems such as vulnerabilities spanning different architectures and types, and the vulnerability of closed-source software. This invention provides a software vulnerability analysis method based on PCODE and BERT. See [link to relevant documentation]. Figure 1 As shown, it contains the following content:

[0028] S101. Construct a vulnerability analysis framework, use this framework to decompile the contents of the input binary program file to generate pcode intermediate language, and use the Bert neural network to perform vector mapping, feature extraction and classification on the pcode intermediate language.

[0029] S102. Collect an unlabeled program corpus dataset for pre-training the BERT neural network vector mapping in the framework, a training dataset for training the BERT neural network in the framework to learn software vulnerability semantic features to generate a vulnerability analysis model, and a test dataset for evaluating and optimizing the generated vulnerability analysis model. First, the corpus dataset is used to pre-train the BERT neural network in the framework. Then, the training dataset is used to train the BERT neural network in the framework to learn software vulnerability semantic features to generate a vulnerability analysis model. Finally, the test dataset is used to evaluate and optimize the performance of the vulnerability analysis model and generate the final vulnerability analysis model for predicting the vulnerability of the target software.

[0030] S103. Use a vulnerability analysis framework containing the final generated vulnerability analysis model to identify vulnerability categories in the target binary program file.

[0031] BERT is a pre-trained context classification model with a network architecture based on the Transformer encoder. One of the biggest challenges in software vulnerability analysis is the difficulty in collecting a large enough sample size to meet the training requirements of neural networks; BERT effectively addresses this problem. The BERT model is first pre-trained on a large unlabeled corpus to learn language structure, and then fine-tuned for specific downstream tasks to solve some NLP tasks (such as sentiment classification), achieving better results than training only on the training set. Furthermore, compared to the shallow memory mechanisms relied upon by traditional models, the self-attention mechanism in the Transformer is less likely to ignore important information in longer sequences, thus showing a significant advantage in extracting contextual semantics from structured text. Additionally, BERT employs a sequence-to-sequence architecture, encoding the context of tokens into their word vectors, thereby achieving better semantic awareness of the context.

[0032] In this embodiment, software vulnerability analysis is performed using the intermediate language PCODE, while the BERT model is used to learn features from code snippets in the training set. Based on the output of the classifier, software vulnerabilities are predicted, which can improve the effectiveness of cross-architecture and multi-type software vulnerability analysis and effectively ensure cyberspace security performance.

[0033] In the vulnerability analysis framework, a decompilation tool is used to decompile the input into pcode intermediate language, and the decompiled pcode intermediate language is preprocessed to be normalized and standardized to obtain a unified format intermediate language representation as input to the BERT neural network model.

[0034] Ghidra, a decompilation tool, is a software reverse engineering framework developed for cybersecurity tasks. Using it to reverse engineer binary files allows cybersecurity professionals to better understand potential vulnerabilities in networks and systems. As an open-source reverse engineering tool, Ghidra supports different processor architectures, and researchers can develop corresponding plugins to suit different research needs. For experts engaged in binary security research, the open-source Ghidra decompilation engine, due to its excellent extensibility, can customize suitable analysis tools for current software to meet research needs. Ghidra also provides many useful tools in its user interface, and its good interactivity facilitates user operation. Furthermore, for large-scale binary file analysis needs, Ghidra offers a headless startup mode, allowing users to perform batch analysis through the interface. Pcode, used by Ghidra, is machine-independent and designed to emulate general-purpose processors. By analyzing in the middle ground between low-level machine-specific assembly language and high-level programming languages, meaningful information and vulnerabilities in a given program can be discovered without providing access to the original source code. A basic pcode operation unit mainly consists of two parts: an opcode and a node variable.

[0035] (1) Opcode. The action of a pcode is determined by the type of opcode. The pcode opcode defines the arithmetic or logical operation executed by a general-purpose processor and is a simulation of machine instructions. All pcode operations follow the basic instruction specification. A pcode operation takes one or more node variables as input and generates a node variable as output. That is to say, the operands of a pcode opcode are not fixed. For example, the move opcode can be used as a unary opcode or a binary opcode. A total of 63 opcodes are defined in pcode, which can be classified into several categories such as data movement, arithmetic operations, logical operations, and floating-point comparisons.

[0036] (2) Node Variables. A node variable is an abstract representation of a register or memory space. It consists of a triple (address space, offset, size). Therefore, in pcode, a data region can be located using the starting address and size of the parameter. Node variables themselves have no type; a single pcode operation forces each node variable to be interpreted as an integer, floating-point, or boolean type. All data operations in the pcode language are implemented using node variables. Pcode uses a static single assignment (SSA) model to define all node variables, which means that there is no indirect influence between instructions that contain node variables.

[0037] (3) Address Space. The address space of Pcode is an abstract generalization of Random Access Memory (RAM) that interacts directly with the CPU. Simply put, it can be understood as a sequence of indexed bytes that can be read and written through Pcode operations. It is used to abstractly simulate the memory space accessible to the processor and the space for modeling the processor's general-purpose registers. There are three address spaces in Pcode: 1) Constant Address Space: Used to encode any constant values ​​required for Pcode operations, named `const`. 2) Register Address Space: Used to encode the space for modeling the processor's general-purpose registers, named `register`. 3) Unique Address Space: Used to store intermediate values ​​when modeling instruction behavior; it can be abstractly viewed as an infinite array, named `unique`.

[0038] Ghidra, as an open-source decompilation engine, offers better extensibility. pcode, as an intermediate language, boasts excellent cross-architecture applicability. Furthermore, leveraging the powerful Ghidra decompilation engine, it provides excellent decompilation and parsing capabilities for architectures such as MIPS and PowerPC (many decompilation tools perform poorly on MIPS). pcode has well-defined data definitions, clear data flow and control flow, and compared to assembly language and other intermediate languages, it offers better understanding of program semantics and improved readability. However, the native pcode currently suffers from compilation noise and variable definitions, which can negatively impact deep learning. This solution addresses these issues effectively through preprocessing such as normalization and standardization, and utilizes deep learning to better understand program context semantics and classify software vulnerabilities.

[0039] As a software vulnerability analysis method based on PCODE and BERT in this embodiment of the invention, the preprocessing further includes: normalizing the instruction sequences and invalid instructions in the program code segment; and normalizing the function names and variables in the program code segment. Further, in the BERT neural network within the vulnerability analysis framework. Further, during model training, the BERT neural network model uses cross-entropy as a loss function to evaluate the difference between the current probability distribution of the model and the true distribution of the dataset. Further, each Transformer encoder, by reading a fixed-length input, extracts the contextual semantic features of the current node, and uses a self-attention mechanism to fuse the contextual semantic features of the current node into a vector space, which is then propagated to the next layer as the output vector of the current layer.

[0040] See Figure 2As shown, the source file or binary file is taken as input and decompiled into the intermediate language pcode using the Ghidra decompilation tool. The result is then normalized and standardized to eliminate differences caused by factors such as compilation noise, improve the semantic information of the pcode, and map it into a vector space. It is then input into an attention neural network to learn the semantic information of the program context. Finally, the system uses the output of the neural network as the basis for classifying vulnerability categories.

[0041] To eliminate the impact of constants, register names, compilation noise, and other factors in decompiled code on the learning of program semantics, this paper proposes a normalized and standardized representation method for decompiled code on the pcode intermediate language, enabling neural networks to focus more on learning program context logic and semantics. Figure 3 In the image, (a) is the pcode code snippet after the program has been decompiled, and (b) is the code snippet after normalization and standardization.

[0042] The program code snippet is mainly divided into the region that implements the function's functionality, the region where the processor prepares for executing the function, and the cleanup region when the function execution ends. To enable the subsequent neural network to learn the program's semantics, the standardization process in this solution mainly includes the following steps during preprocessing:

[0043] (1) Normalization of the general region: When entering a function body, the compiler performs a series of operations to allocate stack space for the new function, assign the value of ebp to esp, move the esp register pointer down, and set the flag register, such as... Figure 3 Lines 1-11 in Figure 3a; upon exiting a function, the compiler stores the function's return value, destroys the memory allocated for the function body, and resets the flag register, as shown in lines 32-37 in Figure 3a. These instruction sequences are meaningless for the neural network to learn the vulnerability model, therefore they need to be removed.

[0044] (2) Removal of invalid instructions: After the function body statements are executed, the eax register mainly stores the function's return value, which is not very helpful for neural network learning vulnerability patterns, so these instructions need to be removed. Figure 3 The line corresponding to row 31 shown in Figure 'a' is deleted during the normalization process.

[0045] Due to the lack of debugging information, the decompiled code lacks information such as variable names, function names, and register names. However, this information is of significant value in software vulnerability analysis. Therefore, this solution standardizes the pcode decompiled code snippets to recover this information. The standardization process mainly includes the following:

[0046] (1) Function name standardization: For function calls within a function body, a unified naming method is used to replace address offsets in the decompiled code. For user-defined sub-functions, they are named sequentially according to the order of function calls, such as... Figure 3 The address offset 0x401460 that appears in line 29 shown in Figure a corresponds to Figure 3 Line 19, as shown in b, is replaced with the user-defined function name `fun1` in the order of its appearance. For system function calls, the program's function table is searched to find the system call function name corresponding to the address offset, and then the address offset is replaced with the function name, such as... Figure 3 Lines 14 and 26, as shown in line a, are... Figure 3 Replace lines 4 and 16 shown in b with the system call function names memcpy and printLine.

[0047] (2) Variable standardization, in terms of variables, aims to make the neural network focus more on the variable types of program operations rather than the specific values ​​of variables during the learning process. Therefore, in the process of normalization and standardization, the specific values ​​of variables will be eliminated as much as possible. The Ghidra decompiler maintains a register mapping table, which maps commonly used registers to constants, such as mapping the ESP register to register 0x10. In the process of standardization, the mapping table is used to restore the names of registers, for example... Figure 3 Line 18, shown in diagram a, identifies register 0x0 as the EAX register, therefore in Figure 3 Line 8, shown in b, is replaced with eax; for const types, since the specific constant value or address offset value has little impact on the semantic pattern learning of the program context, it is normalized and replaced. In this solution, we can first distinguish whether its type is constant or address offset. For constant types, this paper uses const fields for replacement, for example... Figure 3 Line 3 as shown in b; for address offset types, use address-offset as a replacement, such as... Figure 3 Line 15, shown in b. For unique types, because the pcode intermediate language uses the SSA naming convention to name variables, meaning each variable has one and only one definition, and the variable value is independent of its position in the code, it is named in decimal form according to the order in which it appears in the code snippet, for example... Figure 3 In line 6 shown in b, (unique,0x3a0) is renamed to (unique,1).

[0048] In this proposed solution, the BERT model can be constructed by concatenating the encoder feature extractors of 12 Transformers. The overall framework of the BERT model is as follows: Figure 4 As shown in the diagram, each Transformer-encoder module consists of a self-attention mechanism layer and a feedforward neural network layer, and it takes a fixed-length input. The self-attention mechanism layer fuses the contextual semantic information of the current node into the input vector and propagates it as the output vector of the current layer to the next layer. In the BERT model constructed in this paper, there are 12 stacked Transformer blocks, each of which has a feedforward network containing 768 hidden units and 12 attention heads, as shown in the diagram. Figure 5 As shown.

[0049] When calculating the attention mechanism, Transformer can define three auxiliary matrices: Q, K, and V. The similarity between the Q matrix and each K matrix is ​​used as a weight, and all V matrices are weighted and summed. For vectors with larger dimensions, the attention calculation result will be larger, causing the neural network to pay equal attention to that region; therefore, it will be divided by... To eliminate these kinds of effects.

[0050]

[0051] The BERT model consists of two phases: pre-training and fine-tuning. In the pre-training phase, the BERT model is trained to predict masked words from given sentences in the dataset. In this case, the Google Code dataset can be chosen as the pre-training dataset. Through pre-training on a large number of pcode snippets, the model learns to predict which words belong to a specific position, thus learning the structural characteristics of the pcode language. After the pre-training phase, BERT will be fine-tuned for a specific task; in this case, software vulnerability analysis. First, the parameters from the pre-training process are loaded into the model, remaining unchanged during the pre-training process—this step is called freezing. Then, for the software vulnerability sub-task, the pre-processed training set is input into the model for training. The loaded parameters will continuously change as training progresses, making them more suitable for the software vulnerability analysis task—this process is called fine-tuning.

[0052] After the neural network learns the features, a classifier is needed to map the feature vectors to labels. In this solution, a classifier can be built using two fully connected layers and softmax. This is because the output of the neural network is in multiple ranges and cannot be directly compared as the probability of classification. Furthermore, it cannot propagate backwards. Therefore, a softmax activation function is needed to map its output to the (0, 1) interval.

[0053] Let there be k categories S. i If i∈(0,k], then the formula for softmax is as follows:

[0054]

[0055] Where i represents a category in k, v i This represents the value corresponding to that category. The softmax result is between 0 and 1, and the sum of the values ​​of all categories is 1.

[0056] Finally, by using cross-entropy as the model's loss function, the difference between the probability distribution obtained by the neural network and the true distribution on the dataset is evaluated. The smaller the loss value, the closer the neural network's prediction is to the true values ​​on the dataset. Therefore, reducing the value of the loss function can improve the accuracy of the prediction model. Furthermore, based on the above method, this embodiment of the invention also provides a software vulnerability analysis system based on PCODE and BERT, comprising: a framework construction module, a model generation module, and a target recognition module, wherein...

[0057] The framework building module is used to build a vulnerability analysis framework. This framework is used to decompile the contents of the input binary program file to generate pcode intermediate language, and to use the Bert neural network to perform vector mapping, feature extraction and classification on the pcode intermediate language.

[0058] The model generation module collects an unlabeled procedural corpus dataset for pre-training the BERT neural network vector mapping in the framework, a training dataset for training the BERT neural network in the framework to learn software vulnerability semantic features to generate a vulnerability analysis model, and a test dataset for evaluating and tuning the generated vulnerability analysis model. First, the corpus dataset is used to pre-train the BERT neural network in the framework. Then, the training dataset is used to train the BERT neural network in the framework to learn software vulnerability semantic features to generate a vulnerability analysis model. Finally, the test dataset is used to evaluate and tune the performance of the vulnerability analysis model and generate the final vulnerability analysis model for predicting the vulnerability of the target software.

[0059] The target identification module utilizes a vulnerability analysis framework containing the final generated vulnerability analysis model to identify vulnerability categories in target binary program files. By using a neural network in the pcode intermediate language to perform sequence learning on a dataset of binary files containing multiple vulnerabilities, software vulnerabilities are predicted through learning the characteristic patterns of vulnerabilities. Furthermore, through data experiments on real datasets, this solution can efficiently and accurately uncover vulnerabilities in files, demonstrating promising application prospects.

[0060] Unless otherwise specifically stated, the relative steps, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0061] Based on the system described above, embodiments of the present invention also provide a server, including: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method described above.

[0062] Based on the system described above, embodiments of the present invention also provide a computer-readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method described above.

[0063] The device provided in this embodiment of the invention has the same implementation principle and technical effect as the aforementioned system embodiment. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the aforementioned system embodiment.

[0064] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the systems and devices described above can be referred to the corresponding process in the foregoing system embodiments, and will not be repeated here.

[0065] In all examples shown and described herein, any specific values ​​should be interpreted as merely exemplary and not as limitations; therefore, other examples of exemplary embodiments may have different values.

[0066] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0067] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, system products, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0068] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices, and mechanisms can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the shown or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0069] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0070] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the system described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0071] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A software vulnerability analysis method based on PCODE and BERT, characterized in that, Includes the following content: A vulnerability analysis framework is constructed, which is used to decompile the contents of the input binary program file to generate pcode intermediate language. The BERT neural network is then used to perform vector mapping, feature extraction, and classification on the pcode intermediate language. Specifically, in the vulnerability analysis framework, a decompilation tool is used to decompile the input into pcode intermediate language, and the decompiled pcode intermediate language is preprocessed to be normalized and standardized to obtain a unified format intermediate language representation as input to the BERT neural network model. We collect an unlabeled procedural corpus dataset for pre-training the BERT neural network in the framework using vector mapping, a training dataset for training the BERT neural network in the framework to learn software vulnerability semantic features to generate a vulnerability analysis model, and a test dataset for evaluating and tuning the generated vulnerability analysis model. First, we pre-train the BERT neural network in the framework using the corpus dataset. Then, we use the training dataset to train the BERT neural network in the framework to learn software vulnerability semantic features to generate a vulnerability analysis model. Finally, we use the test dataset to evaluate and tune the performance of the vulnerability analysis model and generate the final vulnerability analysis model for predicting the vulnerability of the target software. A vulnerability analysis framework containing the final generated vulnerability analysis model is used to identify vulnerability categories in target binary files.

2. The software vulnerability analysis method based on PCODE and BERT according to claim 1, characterized in that, Preprocessing includes: normalizing instruction sequences and invalid instructions in the program code segment; and normalizing function names and variables in the program code segment.

3. The software vulnerability analysis method based on PCODE and BERT according to claim 1, characterized in that, In the BERT neural network within the vulnerability analysis framework, an embedding layer is used to map the PCODE intermediate language representation into a vector space. Several cascaded Transformer encoders are used to extract features from the embedded vectors through continuous iteration and backpropagation. Finally, a classifier is used to classify the vectors based on the extracted features.

4. The software vulnerability analysis method based on PCODE and BERT according to claim 3, characterized in that, In the vulnerability analysis framework, the BERT neural network uses cross-entropy as a loss function during training to evaluate the difference between the model's current probability distribution and the true distribution of the dataset.

5. The software vulnerability analysis method based on PCODE and BERT according to claim 3, characterized in that, Each Transformer encoder reads a fixed-length input, extracts the contextual semantic features of the current node, and uses a self-attention mechanism to fuse the contextual semantic features of the current node into a vector space, which is then used as the output vector of the current layer to propagate to the next layer.

6. The software vulnerability analysis method based on PCODE and BERT according to claim 3, characterized in that, A classifier is constructed using two fully connected layers and a softmax layer, where the softmax activation function is expressed as: ， Where i represents a single category in the number of categories k, v i This represents the value corresponding to category i.

7. A software vulnerability analysis system based on PCODE and BERT, characterized in that, It includes: a framework building module, a model generation module, and an object recognition module, among which, The framework construction module is used to build a vulnerability analysis framework. This framework is used to decompile the contents of the input binary program file to generate pcode intermediate language, and to use a BERT neural network to perform vector mapping, feature extraction and classification on the pcode intermediate language. In the vulnerability analysis framework, a decompilation tool is used to decompile the input into pcode intermediate language, and the decompiled pcode intermediate language is preprocessed to be normalized and standardized to obtain a unified format intermediate language representation as input to the BERT neural network model. The model generation module collects an unlabeled procedural corpus dataset for pre-training the BERT neural network vector mapping in the framework, a training dataset for training the BERT neural network in the framework to learn software vulnerability semantic features to generate a vulnerability analysis model, and a test dataset for evaluating and tuning the generated vulnerability analysis model. First, the corpus dataset is used to pre-train the BERT neural network in the framework. Then, the training dataset is used to train the BERT neural network in the framework to learn software vulnerability semantic features to generate a vulnerability analysis model. Finally, the test dataset is used to evaluate and tune the performance of the vulnerability analysis model and generate the final vulnerability analysis model for predicting the vulnerability of the target software. The target identification module is used to identify vulnerability categories in target binary files using a vulnerability analysis framework containing the final generated vulnerability analysis model.

8. A server, comprising: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to perform the method according to any one of claims 1 to 6.

9. A computer-readable medium having a computer program stored thereon that is executed by a processor, the computer program being used to perform the method according to any one of claims 1 to 6.

Images