Program semantic obfuscation method and system based on natural language processing

Abstract

The present invention belongs to the field of network security technology, and particularly relates to a program semantic obfuscation method and system based on natural language processing. First, a text sequence used to describe the program execution process is extracted from a procedural description text corpus, and an obfuscated corpus material library with inductive and fuzzy functions is constructed; then, a target program code fragment is vectorized, and a text sequence unrelated to the target program code fragment is selected from the obfuscated corpus material library based on semantic information as a prompt output class code, which is integrated into the target program code fragment position. The present invention integrates inductive and fuzzy semantic obfuscation corpus into the target code, generates obfuscated code with anti-semantic analysis capability, can mislead reverse analysts' understanding of the real function of the program, increase the difficulty of code understanding, and can effectively prevent legitimate software from being pirated or maliciously tampered with, and has good application prospects.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and in particular relates to a program semantic obfuscation method and system based on natural language processing. Background Art

[0002] In order to prevent legitimate software from being pirated or maliciously tampered with, software developers generally use software protection technologies such as shelling, obfuscation, and encryption to protect the software. The core idea of ​​all software protection technologies is to increase the difficulty of cracking the software as much as possible, making it difficult for software crackers to analyze the specific functions, organizational structure, working process and other implementation details of the software in a short time. Code obfuscation is a commonly used software protection method. The program before and after obfuscation remains consistent in function and behavior. The main purpose is to make it difficult for software crackers to extract the key code of the software by reverse means. Systematic research on code obfuscation can be traced back to the 1990s. According to the obfuscation principles and objects, code obfuscation technology can be divided into appearance obfuscation, control obfuscation, data obfuscation and preventive obfuscation. Appearance obfuscation is a kind of obfuscation that confuses crackers by transforming the appearance and layout of the program. Data obfuscation is an obfuscation for the transformation of numerical variables and data types. Control obfuscation is an obfuscation method that increases the complexity of the code structure by changing the control flow structure of the program code. Preventive obfuscation is an obfuscation for dedicated disassemblers or decompilers.

[0003] Code obfuscation is a hot topic in the field of network security at home and abroad. Although many research results have been achieved, including junk instruction insertion, equivalent instruction replacement, and control flow flattening, there are still some major problems that restrict the actual application effect of code obfuscation deformation technology, which need to be further studied and solved: (1) The obfuscation features are relatively obvious. The current obfuscation algorithms have the ability to resist static reverse analysis, but while protecting the program, they will introduce a large number of obfuscation features with fixed patterns, which seriously affect the security of the algorithm and cause the application effect of many obfuscation algorithms to drop sharply; (2) The obfuscation algorithm has poor resistance to semantic analysis. Resistance to semantic analysis has always been a difficulty in the design of obfuscation algorithms. Although the existing obfuscation algorithms have a certain resistance effect on static disassembly, symbolic execution, behavior monitoring, and dynamic debugging, with the introduction of concepts and methods such as hybrid execution and obfuscation analysis, the combination of dynamic and static reverse means, especially professional manual analysis, has brought huge challenges to code obfuscation algorithms. Overall, traditional code obfuscation protection methods have been unable to cope with the rapidly developing software reverse analysis and cracking methods, and it is urgent to explore new software protection ideas and methods. Summary of the invention

[0004] To this end, the present invention provides a program semantic obfuscation method and system based on natural language processing, which integrates inductive and ambiguous semantic obfuscation corpus into the target code to generate obfuscated code with anti-semantic analysis capability, which can mislead reverse analysts' understanding of the real functions of the program, increase the difficulty of code understanding, and effectively prevent legitimate software from being pirated or maliciously tampered with.

[0005] According to the design scheme provided by the present invention, a program semantic obfuscation method based on natural language processing includes the following contents:

[0006] Extract text sequences used to describe the program execution process from the process description text corpus, and build a confusion corpus material library with induction and fuzziness functions;

[0007] The target program code snippet is vectorized, and a text sequence unrelated to the target program code snippet is selected from the obfuscated corpus material library based on semantic information as a prompt output class code, which is then merged into the target program code snippet position.

[0008] As a program semantic obfuscation method based on natural language processing of the present invention, further, the process description text corpus at least includes a protocol description RFC document and an algorithm description document, and natural language processing technology is used to extract text summaries from different protocol description RFC documents and different algorithm description documents, and the extracted text summaries are used to construct an obfuscation corpus material library.

[0009] As a program semantic obfuscation method based on natural language processing of the present invention, further, the process of extracting text summaries includes the following contents: first, the redundant sentences describing long text information in the document are filtered out using the graph ranking TextRank algorithm to extract key sentences; then, the text summary is modeled as a sequence labeling task using the pre-trained BERT model to output the document summary.

[0010] As a program semantic obfuscation method based on natural language processing of the present invention, further, the graph sorting TextRank algorithm is used to filter the description document sentences. First, a directed structure graph is constructed, and the input long text sentence units are used as graph nodes. The nodes with similarity greater than a preset threshold are connected, and the node similarity is used to calculate the weight of the edge between the nodes; then, the score of each node in the directed structure graph is calculated, and several sentence units with the highest scores are selected as key sentences for obtaining the summary according to the size of the scores.

[0011] As a program semantic obfuscation method based on natural language processing of the present invention, further, the weight calculation formula of the edge between nodes is expressed as: Among them, w k is the word in the sentence unit, ω ji is the edge weight, sim(S i , Sj ) is a sentence S i and S j The similarity.

[0012] As a program semantic obfuscation method based on natural language processing of the present invention, further, a node score calculation formula is expressed as: Where d is the damping coefficient, In(V i ) indicates all points to node V i The node set, Out(V i ) represents node V i The node set pointed to, i, j, k represent the corresponding node labels respectively.

[0013] As a program semantic obfuscation method based on natural language processing of the present invention, further, in the text summary modeling using the pre-trained BERT model, first, markers are inserted before and after each sentence of the key sentence, and semantic features of the text are extracted; then, the extracted semantic features are input into the pre-trained BERT model, and the BERT model is used to construct a word vector describing the semantic features of the text, and a sentence unit vector representation is output corresponding to each marker position; and a fully connected layer is used to perform a linear transformation on the vector representation, and a Sigmoid activation function is used to perform binary classification and sequence labeling.

[0014] As a program semantic obfuscation method based on natural language processing of the present invention, further, in the fusion of the text sequence in the obfuscated corpus material library and the target program code, first, the target program code fragment is vectorized using natural language processing technology, wherein the content of the vectorization processing at least includes modules, functions, basic blocks and instructions in the target program code; then, the asm2vec model is used to analyze the semantic information of the target program code fragment, and the text sequence in the mixed corpus material library is fused and compiled with the target program code fragment in the compilation layer in combination with the code insertion technology.

[0015] As a program semantic obfuscation method based on natural language processing of the present invention, further, in the fusion process, the target program code is compiled into an intermediate language form, the code is sliced ​​at different granularities, the semantic information of the code fragment is compared with the semantic similarity of the text sequence in the mixed corpus material library, and a correlation matrix between the code fragment and the mixed corpus material library is constructed. The text sequence is fused with the target program code fragment according to the semantic similarity or semantic difference, and the fused and obfuscated target code is mixed compiled.

[0016] Furthermore, the present invention also provides a program semantic obfuscation system based on natural language processing, comprising: a material construction module and a code obfuscation module, wherein:

[0017] The material construction module is used to extract text sequences used to describe the program execution process from the process description text corpus, and to construct a confusion corpus material library with induction and fuzziness functions;

[0018] The code obfuscation module is used to vectorize the target program code fragment, and select text sequences that are unrelated to the target program code fragment from the obfuscation corpus material library based on semantic information as prompt output class codes, and merge them into the target program code fragment position.

[0019] Beneficial effects of the present invention:

[0020] The present invention achieves the purpose of code semantic induction and fuzzy obfuscation by constructing a large number of inductive and ambiguous text sequences and integrating them into appropriate code fragments of the target program. The steps are clear and the scheme is feasible. The present invention can solve the problems of obvious obfuscation features and poor semantic obfuscation effect that are common in traditional obfuscation algorithms. The fusion process will not destroy the original program function. The present invention has obvious advantages in program semantic obfuscation, can effectively prevent others from plagiarizing the intellectual achievements in the software, and can prevent others from purposefully tampering with the software, thereby improving the software's reverse defense capability and safety factor, and has good application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 This is a flowchart of a method for program semantic obfuscation based on natural language processing in an embodiment;

[0022] Figure 2 This is a schematic diagram of the implementation principle of code semantic obfuscation in the embodiment;

[0023] Figure 3 Schematic diagram of a BERT-based sequence labeling model in an embodiment;

[0024] Figure 4 This is a schematic diagram of the BERT model structure in the embodiment;

[0025] Figure 5 It is a schematic diagram of the code semantic induction and fuzzy processing implementation principle in the embodiment;

[0026] Figure 6 The following is a schematic diagram of the code semantic obfuscation effect in the embodiment. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and technical solutions.

[0028] In view of the prominent problems of existing code obfuscation technologies, such as obvious obfuscation features and poor semantic analysis confrontation effects, the present invention provides a program semantic obfuscation method based on natural language processing, see Figure 1As shown, it contains the following contents:

[0029] S101, extracting a text sequence for describing the program execution process from the process description text corpus, and constructing a confusion corpus material library with induction and fuzziness functions;

[0030] S102, vectorizing the target program code snippet, and selecting a text sequence that is unrelated to the target program code snippet from the obfuscated corpus material library based on semantic information as a prompt output class code, and merging it into the target program code snippet position.

[0031] Integrate the inductive and ambiguous semantic obfuscation corpus into the target code to generate obfuscated code with the ability to resist semantic analysis. This is achieved by integrating the inductive and ambiguous text corpus into the target program to be obfuscated. The semantic information integrated into the corpus is often inconsistent with the real function of the target code, thereby misleading the reverse analyst's understanding of the real function of the program and increasing the difficulty of code understanding. See Figure 2 As shown, a large amount of obfuscated corpus is generated from a large number of algorithm description texts and protocol description texts using natural language processing models and algorithms, and the target code fragments are vectorized and annotated using the asm2vec model. The semantic correlation between the target code fragments and the text sequences is analyzed, and the obfuscated texts with inductive and obfuscated effects are integrated into the corresponding positions of the target code using code instrumentation and fusion compilation methods, thereby achieving the obfuscation purpose of semantic induction and fuzzy obfuscation of the target code.

[0032] As a program semantic obfuscation method based on natural language processing in an embodiment of the present invention, further, the process description text corpus at least includes a protocol description RFC document and an algorithm description document, and natural language processing technology is used to extract text summaries from different protocol description RFC documents and different algorithm description documents, and the extracted text summaries are used to construct an obfuscation corpus material library.

[0033] When reverse-analyzing a program, the program semantics is generally characterized from the dimensions of network behavior, file behavior, registry behavior, process behavior, thread behavior, etc. To achieve the purpose of program semantic induction and fuzzy obfuscation, a large number of obfuscated corpora need to be constructed. In the embodiment of this case, in terms of corpus construction, relying on the RFC documents of the corpus material library and typical algorithm description documents, the mature natural semantic processing method is used to process the documents in the material library, extract the text sequence describing the protocol or algorithm process in units of sentences, and annotate its semantics, and use natural language processing technology to extract a large number of text sequences describing the program execution process from the procedural description text corpus of encryption and decryption algorithms, compression algorithms, graph traversal algorithms, tree traversal algorithms, sorting algorithms, network protocol interactions, etc., that is, from the graph traversal algorithm corpus, file search algorithm corpus, AES encryption algorithm corpus, HTTP protocol corpus, DNS protocol corpus, etc. In terms of text automatic summarization and text clustering, the relevant methods and technologies of natural language processing are relatively mature and can be used to solve the obfuscated corpus construction problem involved in the present invention.

[0034] As a program semantic obfuscation method based on natural language processing in an embodiment of the present invention, further, the process of extracting text summaries includes the following contents: first, the redundant sentences of long text information in the description document are filtered using the graph sorting TextRank algorithm to extract key sentences; then, the text summary is modeled as a sequence labeling task using the pre-trained BERT model to output the document summary. Further, the graph sorting TextRank algorithm is used to filter the sentences describing the document. First, a directed structure graph is constructed, and the input long text sentence units are used as graph nodes. The nodes with similarity greater than a preset threshold are connected, and the node similarity is used to calculate the weight of the edge between the nodes; then, the score of each node in the directed structure graph is calculated, and several sentence units with the highest scores are selected according to the score size as the key sentences for obtaining the summary. Furthermore, the pre-trained BERT model is used to model the text summary. First, markers are inserted before and after each key sentence, and semantic features of the text are extracted. Then, the extracted semantic features are input into the pre-trained BERT model, and the BERT model is used to construct a word vector describing the semantic features of the text, and a sentence unit vector representation is output at each marker position. The fully connected layer is used to perform a linear transformation on the vector representation, and the Sigmoid activation function is used for binary classification and sequence labeling.

[0035] The construction of the code semantic obfuscation corpus is the basis of code semantic obfuscation. In the embodiment of this case, the protocol description RFC document and the algorithm description document can be used as input, and the execution process of different protocols and different algorithms can be summarized by using natural language processing technology. The extractive text summary is based on two stages. In the first stage, the information redundant sentence units in the long text are filtered out by the unsupervised TextRank graph sorting algorithm, and a small number of key sentences are extracted; the second stage is based on the pre-trained model Bert, and the text summary is modeled as a sequence labeling task. The core idea is to give each sentence unit in the short text data generated in the first stage a binary label (0 or 1) as training data, 0 represents that the sentence is not a summary sentence, and 1 represents that the sentence is a summary sentence. These labeled short documents are input into the model for training, and all sentences with labels 1 predicted by the model constitute the summary, so as to realize the automatic summary generation of long text.

[0036] Phase 1: Graph sorting TextRank algorithm, firstly takes the sentence unit of the input long text as the node V of the graph, and obtains the node V through similarity calculation i , V j The weight edge value ω ji , and finally construct a directed structure graph G. The similarity calculation is shown in Formula 1.

[0037]

[0038] Among them, w k is a word in a sentence unit. If the sentence S i and S j If the similarity result is greater than a given threshold, they are connected.

[0039] Next, calculate each node V i The fraction S(V i ), first randomly assign initial values ​​to all nodes in the graph, and then perform iterative calculations until convergence. In(V i ) indicates that all points to V i The node set, Out(V i ) indicates V i The node set pointed to; d is the damping coefficient, which represents the probability of pointing from a node in the graph to any other node. In this embodiment, the value can be 0.85. The calculation formula is as follows:

[0040]

[0041] Based on the above process, the first K sentence units with the highest scores can be selected to form a text summary.

[0042] The second stage is based on the BERT sequence tagging model. Figure 3As shown in the figure, it consists of two modules, namely the BERT module, the fully connected layer and the summary layer composed of the Sigmoid activation function. First, the special symbols cls and sep are inserted before and after each sentence unit, and then the semantic features of the text are extracted. The extracted semantic features such as text length, text string, text context, etc. are input into the pre-trained BERT module to construct a word vector describing the semantic features of the text. Each cls symbol position corresponds to the output of the vector representation of the sentence unit. The cls position output vector of the BERT module is then input into a fully connected layer for linear transformation, the vector dimension is set to 2, and then the Sigmoid activation function is used to achieve binary classification. BERT (Bidirectional Encoder Representation from Transformers) is a dynamically pre-trained language model, which belongs to the first part of the sequence labeling model. It is mainly responsible for converting feature data such as input text length, text string, text context relationship, etc. into vector form. Its main structure is as follows: Figure 4 As shown in the figure, Trm represents the encoder part of the Transformer network structure; E1, E2, ···, E n represents the model input; T1,T2,···,T n Represents the model output, i.e., a sentence vector with semantic information. The summary layer consisting of a fully connected layer and a Sigmoid activation function is the second part of the sequence annotation model to capture document-level features for extracting summaries. It can decode the sequence context features captured by the BERT model. For each sentence representation, the final prediction score Y is calculated. i , so the loss of the entire model is all Y i For manual annotation Y * The binary classification entropy and summary layer formula of (0,1) is as follows: i =σ(W o T i +b o ).

[0043] As a program semantic obfuscation method based on natural language processing in an embodiment of the present invention, further, in the fusion of the text sequence in the obfuscated corpus material library and the target program code, first, the target program code fragment is vectorized using natural language processing technology, wherein the content of the vectorization processing at least includes modules, functions, basic blocks and instructions in the target program code; then, the asm2vec model is used to analyze the semantic information of the target program code fragment, and the text sequence in the mixed corpus material library is fused and compiled with the target program code fragment in the compilation layer in combination with the code insertion technology.

[0044] How to integrate obfuscated corpus code into the target program without destroying the original function of the target program to achieve the purpose of semantic obfuscation and fuzziness. In the technical solution of the present invention, a mature API function association analysis method and asm2vec model are selected to analyze the program semantics. API function association analysis and asm2vec model are often used for program semantic analysis and comparison. They are widely used and have good effects. They can complete the semantic annotation of program fragments, such as file creation code, process creation code, data encryption code, etc. Then, a text sequence that is contrary to or irrelevant to its semantics is selected from the obfuscated corpus. By inserting functions such as print and OutputDebugString that do not affect the program function, the obfuscated corpus text is used as a parameter of the above function and integrated into the target code, making it difficult for reverse analysts to effectively associate the real function of the program with the prompt text, so as to achieve the purpose of code semantic induction and fuzziness. The method and model used in the above process are mature and reliable, and the fusion process will not destroy the original program function. Code semantics induced fusion based on semantic analysis uses vectorized abstract representation models of code features and behaviors such as asm2vec to perform semantic analysis on the target code fragments, and uses API functions such as print and OutputDebugString that have no effect on program functions to take text sequences with semantic induction or fuzzy effects in the corpus as prompt output class codes and fuse them into the corresponding fragment positions of the target program.

[0045] Furthermore, during the fusion process, the target program code is compiled into an intermediate language form, the code is sliced ​​at different granularities, the semantic information of the code fragments is compared with the semantic similarity of the text sequences in the mixed corpus material library, a correlation matrix between the code fragments and the mixed corpus material library is constructed, the text sequence is fused with the target program code fragments according to the semantic similarity or semantic difference, and the fused and obfuscated target code is hybrid compiled.

[0046] The core steps of code semantic induction and obfuscation are: using natural language processing technology to vectorize the modules, functions, basic blocks, and instructions of the target program, using the asm2vec model to analyze the code semantic information, and at the compilation level, using code instrumentation to merge the text obfuscation corpus with the target code, so that the normal code and the obfuscated disguised code have good semantic coupling, truly realizing the organic fusion of the target code and the obfuscated code.

[0047] Code semantics induction and fuzzy processing implementation framework such as Figure 5As shown, the framework input is the target code to be protected and obfuscated, and the output is the code after semantic obfuscation. The underlying framework is supported by the text obfuscation corpus and the compilation environment library. The text obfuscation corpus provides massive corpus support for code semantic obfuscation, and the compilation environment library provides a rich compilation platform for code fusion compilation. First, compile the target code into an intermediate language form, slice the code from different granularities such as modules, functions, basic blocks, instructions, etc., use natural language processing technology to analyze the semantic information of the code fragments, compare the semantic similarity with the obfuscation corpus, and build a correlation matrix between the code fragments and the corpus. Different correlation calculation methods can be defined according to different code obfuscation requirements. It can be measured by semantic similarity or semantic difference. The difference measurement method can sometimes induce camouflage effects. Then, use the intermediate language plug-in interface to deeply fuse the obfuscated corpus with the target code. Finally, use the fusion compilation technology to mix and compile the obfuscated target code. The program obfuscation effect based on natural language processing is shown in the figure below. Figure 6 As shown in the figure, according to the principle of semantic relevance, the target program and the obfuscation corpus are integrated and compiled to generate a program with semantic obfuscation effect without obvious obfuscation features. When software crackers dynamically debug or reverse analyze the code, the obfuscated corpus text can be used to induce and obfuscate the real function of the code, increasing the difficulty of reverse analysis of the code.

[0048] Furthermore, based on the above method, an embodiment of the present invention also provides a program semantic obfuscation system based on natural language processing, comprising: a material construction module and a code obfuscation module, wherein:

[0049] The material construction module is used to extract text sequences used to describe the program execution process from the process description text corpus, and to construct a confusion corpus material library with induction and fuzziness functions;

[0050] The code obfuscation module is used to vectorize the target program code fragment, and select text sequences that are unrelated to the target program code fragment from the obfuscation corpus material library based on semantic information as prompt output class codes, and merge them into the target program code fragment position.

[0051] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0052] Based on the above method and / or system, an embodiment of the present invention also provides a server, including: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the above method.

[0053] Based on the above method and / or system, an embodiment of the present invention further provides a computer-readable medium having a computer program stored thereon, wherein the above method is implemented when the program is executed by a processor.

[0054] In all examples shown and described herein, any specific values ​​should be interpreted as merely exemplary and not as limiting, and thus other examples of the exemplary embodiments may have different values.

[0055] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0056] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A program semantic obfuscation method based on natural language processing, It is characterized in that Contains the following: A text sequence for describing the program execution process is extracted from a process description text corpus, and a confusion corpus material library with induction and fuzzification functions is constructed, wherein the process description text corpus at least includes a protocol description RFC document and an algorithm description document, and natural language processing technology is used to extract text summaries from different protocol description RFC documents and different algorithm description documents, and the extracted text summaries are used to construct a confusion corpus material library; wherein the process of extracting text summaries comprises: first, using a graph sorting TextRank algorithm to filter out redundant sentences of long text information in the description document and extract key sentences; then, using a pre-trained BERT model to model the text summary as a sequence labeling task and output a document summary; using a graph sorting TextRank algorithm to extract key sentences; and finally, using a pre-trained BERT model to model the text summary as a sequence labeling task and output a document summary. In the method of filtering the sentences of the description document, first, a directed structure graph is constructed, and the input long text sentence units are used as graph nodes. The nodes with similarity greater than the preset threshold are connected, and the weight of the edge between the nodes is calculated using the node similarity; then, the score of each node in the directed structure graph is calculated, and several sentence units with the highest scores are selected as the key sentences for obtaining the summary according to the score size; in the text summary modeling using the pre-trained BERT model, first, markers are inserted before and after each sentence of the key sentence, and semantic features of the text are extracted; then, the extracted semantic features are input into the pre-trained BERT model, and the BERT model is used to construct a word vector describing the semantic features of the text, and the sentence unit vector representation is output corresponding to each marker position; and Use the fully connected layer to perform linear transformation on the vector representation, and use the Sigmoid activation function to perform binary classification and sequence labeling; The target program code fragment is vectorized, and a text sequence unrelated to the target program code fragment is selected from the obfuscated corpus material library according to semantic information as a prompt output class code, and is integrated into the target program code fragment position, wherein the text sequence in the obfuscated corpus material library is integrated with the target program code. First, the target program code fragment is vectorized using natural language processing technology, wherein the content of the vectorization processing at least includes modules, functions, basic blocks and instructions in the target program code; then, the asm2vec model is used to analyze the semantic information of the target program code fragment, and the text sequence in the mixed corpus material library is integrated and compiled with the target program code fragment at the compilation layer in combination with the code insertion technology; and in the fusion process, the target program code is compiled into an intermediate language form, the code is sliced ​​at different granularities, the semantic information of the code fragment is compared with the semantic similarity of the text sequence in the mixed corpus material library, the correlation matrix between the code fragment and the mixed corpus material library is constructed, the text sequence is plugged and integrated with the target program code fragment according to semantic similarity or semantic difference, and the fused and obfuscated target code is mixed and compiled.

2. The program semantic obfuscation method based on natural language processing according to claim 1, It is characterized in that The weight calculation formula of the edge between nodes is expressed as: Among them, w k is the word in the sentence unit, ω ji is the edge weight, sim(S i , S j ) is a sentence S i and S j The similarity.

3. The program semantic obfuscation method based on natural language processing according to claim 2, It is characterized in that The node score calculation formula is expressed as: Where d is the damping coefficient, In(V i ) indicates all points to node V i The node set, Out(V i ) represents the node V i The node set pointed to, i, j, k represent the corresponding node numbers respectively.

4. A program semantic obfuscation system based on natural language processing, It is characterized in that The method according to claim 1 is implemented, comprising: a material construction module and a code obfuscation module, wherein: The material construction module is used to extract text sequences used to describe the program execution process from the process description text corpus, and to construct a confusion corpus material library with induction and fuzziness functions; The code obfuscation module is used to vectorize the target program code fragment, and select text sequences that are unrelated to the target program code fragment from the obfuscation corpus material library based on semantic information as prompt output class codes, and merge them into the target program code fragment position.

Images