Binary executable file function feature screening method, device and storage medium

Abstract

The present invention specifically discloses a method, device and storage medium for screening the function features of a binary executable file. The method includes the following steps: S1, using a disassembly tool to convert the binary file into assembly code, and mapping the assembly function to a vector in a high-dimensional space based on a trained neural network model; S2, converting the vector in the high-dimensional space into a hash feature value based on a local sensitive hashing algorithm, and performing a data persistence operation; S3, constructing a weight analysis function and calculating the weight factor of the assembly function, and exporting the corresponding relationship between the assembly function feature value and the weight factor in the form of a dictionary table file; S4, performing trimming and filtering according to the preset trimming requirements of the binary executable file function. The present invention calculates the corresponding weight factor based on the inverse document frequency of the assembly function feature value and its distribution in different versions and different software, and realizes trimming and filtering by controlling the screening weight value, which has the characteristics of clear logic and simple operation.

Description

Technical Field

[0001] The present invention relates to the field of computer software technology, and in particular to a method, device and storage medium for screening function features of binary executable files. Background Art

[0002] With the widespread development and application of information retrieval and text relevance recommendation services, the extraction, cutting and screening of useful information from massive data play a vital role in improving retrieval performance.

[0003] Currently, this technology has been widely applied in natural language processing combined with weighting and various text analysis problems. For example, the tf-idf (term frequency–inverse document frequency) algorithm is a common weighting technique used in information retrieval and text mining. tf-idf is a statistical method used to assess the importance of a word to a document set or a document in a corpus. Various forms of tf-idf weighting are often used by search engines as a measure or rating of the relevance between documents and user queries, used to rank and display search results. However, when faced with the problem of pruning binary executable files, we cannot simply treat each binary executable file as a document. Instead, we must treat each function within it as a text segmentation and then calculate a measure and rating of the relevance between the function and the binary executable file to determine whether the function should be retained or ignored. First, the relationship between text segmentation and the document as a whole and the relationship between functions and binary executable files are different in different scenarios. Text segmentation is the minimum semantics of a document, but the semantic functions of a function are usually composed of and determined by internal code block calls. For software composed of multiple files, a binary executable file often cannot fully express all the functional semantics of a software. In addition, the software has an iterative relationship between versions, so there are cases where functions can only express part of the version semantics. Second, there are differences in order of magnitude. The order of magnitude of the word segmentation of a document is generally around thousands and will not exceed ten thousand, but the order of magnitude of the function of a binary executable file is very common in the tens of thousands or even hundreds of thousands. Summary of the Invention

[0004] The present invention aims to provide a method, device, and storage medium for filtering binary executable file function features. The method extracts assembly function feature values ​​from binary code, analyzes the inverse document frequency of the assembly function feature values ​​and their distribution across different versions and software, and then determines whether the assembly function feature values ​​are representative of the binary executable file. Furthermore, the method calculates a measurable weight factor, thereby achieving tailoring and lightweighting of massive retrieval data by controlling the filtering weights.

[0005] Based on this, the present invention provides a method for screening function features of binary executable files, the method comprising the following steps:

[0006] S1. Use a disassembly tool to convert the binary file into corresponding assembly code, and map the assembly function corresponding to the assembly code to a vector in a high-dimensional space based on a preset trained neural network model;

[0007] S2. Convert the vector in the high-dimensional space into a hash feature value based on the locality-sensitive hashing algorithm and perform data persistence operations;

[0008] S3. Constructing a weight analysis function based on the inverse document frequency of the assembly function and its distribution in different versions and different software, calculating the weight factor of the assembly function according to the weight analysis function, and deriving the correspondence between the assembly function feature value and the weight factor in the form of a dictionary table file;

[0009] S4. Based on the assembly functions and their corresponding weight factors, tailoring and filtering are performed according to preset tailoring requirements of the binary executable file functions.

[0010] Preferably, the specific implementation of step S1 is:

[0011] S11. Use the IDA disassembly tool to convert the input binary file code fragment into the corresponding assembly code;

[0012] S12. Use a preset trained neural network model to map the assembly function corresponding to the assembly code into a 128-dimensional vector.

[0013] Preferably, the weight analysis function in step S3 is expressed as:

[0014] W=idf*T

[0015] In the formula, W represents the weight factor of the function, idf represents the inverse document frequency of the function, and T represents the comprehensive value of the frequency of occurrence of the function in different versions and different software.

[0016] Preferably, the specific implementation of step S4 is:

[0017] S41, read the dictionary table file and load it into memory;

[0018] S42, querying weight factors corresponding to all assembly functions based on the dictionary table file;

[0019] S43 , sorting in descending order based on the weight factors corresponding to all assembly functions, and performing trimming and filtering of the assembly functions according to preset trimming requirements of the binary executable file functions.

[0020] The present invention also provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the program, the steps of the above-mentioned binary executable file function feature screening method are implemented.

[0021] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned binary executable file function feature screening method are implemented.

[0022] Compared with the prior art, the binary executable file function feature screening method provided by the present invention is to extract the assembly function feature value from the binary code, comprehensively analyze the inverse document frequency of the assembly function feature value and its distribution in different versions and different software, and then analyze whether the assembly function feature value is representative for the binary executable file, and calculate its measurable corresponding weight factor, and then achieve the trimming and lightweighting of massive retrieval data by controlling the screening weight value. The present invention fully considers the inverse document frequency of the assembly function and its distribution in different versions and different software, and has good test results. At the same time, the use of a local sensitive hash algorithm to extract the assembly function feature value and the use of open addressing can solve the hash collision problem and optimize the extraction process of the assembly function feature value; moreover, the present invention is configured and loaded into the system that needs to be trimmed and screened by means of a dictionary table file, with low memory overhead and low coupling. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 The present invention is a flowchart of a method for screening binary executable file function features. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the technical solution of the present invention, the present invention is further described in detail below with reference to the accompanying drawings.

[0025] like Figure 1 As shown, a method for screening function features of a binary executable file comprises the following steps:

[0026] S1. Use a disassembly tool to convert the binary file into corresponding assembly code, and map the assembly function corresponding to the assembly code to a vector in a high-dimensional space based on a preset trained neural network model;

[0027] Specifically:

[0028] S11. Use the IDA disassembly tool to convert the input binary file code fragment into the corresponding assembly code;

[0029] S12. Use a preset trained neural network model to map the assembly function corresponding to the assembly code into a 128-dimensional vector.

[0030] In this step, the disassembly tool is IDA, or other disassembly tools that can convert input binary files into assembly code output. The pre-trained neural network model is a prior art and will not be described here. It only needs to map the input assembly function into a 128-dimensional vector, which is represented by the code Model(input: assembly functions, output: υ∈R 128 ).

[0031] S2. Convert the vectors in the high-dimensional space into hash features based on the locality-sensitive hashing algorithm and perform data persistence operations;

[0032] In this step, the locality sensitive hashing algorithm is a hash function that does not change the similarity. That is, the input is a high-dimensional vector and the output is a hash value. If the two vectors are similar in the original data space, then the hash values ​​after the hash function conversion will also have a high similarity; on the contrary, if the two vectors are dissimilar in the original data space, then the hash values ​​after the hash function conversion should still have no similarity. Its definition formula is as follows:

[0033] Goal: Find a hash function h()such that:

[0034] if sim(C1, C2) is high, then with high prob.h(C1)=h(C2)

[0035] if sim(C1, C2) is low, then with high prob.h(C1)≠h(C2)

[0036] Extracting assembly function eigenvalues ​​based on the locality-sensitive hashing algorithm and adopting open addressing can effectively solve the hash collision problem and optimize the extraction process of assembly function eigenvalues.

[0037] S3. Constructing a weight analysis function based on the inverse document frequency of the assembly function and its distribution in different versions and different software, calculating the weight factor of the assembly function according to the weight analysis function, and deriving the correspondence between the assembly function feature value and the weight factor in the form of a dictionary table file;

[0038] In this step, the weight analysis function is expressed as follows:

[0039] w=idf*T

[0040] Where W represents the weight factor of the function, idf represents the inverse document frequency of the function, and T represents the comprehensive value of the frequency of the function in different versions and different software;

[0041] Based on this, it can be seen that the weight analysis function fully considers the inverse document frequency of the assembly function and its distribution in different versions and different software, combines the inverse document frequency of the assembly function and the two-layer distribution structure of software-version-binary executable file, calculates and analyzes the weight factor of the assembly function, and exports the correspondence between the assembly function feature value and the weight factor in the form of a dictionary table file, realizing a dictionary query function that can index the corresponding weight factor according to the assembly function. Moreover, by loading the dictionary table file configuration into the system that needs to be trimmed and screened, the system memory overhead can be effectively reduced.

[0042] S4. Based on the assembly functions and their corresponding weight factors, tailoring and filtering are performed according to preset tailoring requirements of the binary executable file functions.

[0043] This step is specifically as follows:

[0044] S41, read the dictionary table file and load it into memory;

[0045] S42, querying weight factors corresponding to all assembly functions based on the dictionary table file;

[0046] S43 , sorting in descending order based on the weight factors corresponding to all assembly functions, and performing trimming and filtering of the assembly functions according to preset trimming requirements of the binary executable file functions.

[0047] In this step, the dictionary table file configuration of all assembly functions and their weight factor correspondence is first loaded into the system memory. After querying the weight factors and sorting them, different coarse and fine granularity pruning and filtering are performed according to the preset pruning requirements of the binary executable file functions. If the preset pruning requirement is to prune and filter out half of the assembly functions, then the half of the assembly functions corresponding to the smaller weight factors are filtered out according to the dictionary table file. For example, two assembly functions decompiled from a binary file: function A and function B. Assuming that function A appears in many component samples and version samples, or there are approximate functions with extremely high similarity, then we believe that function A is not representative and its importance is very low. The weight factor calculated by our weight analysis function will also be low. When the business system prunes and filters the assembly functions, it will query the dictionary table file for the weight factors of all current assembly functions and sort them in descending order. Then, different coarse and fine granularity pruning and filtering will be performed according to the screening strength of the preset pruning requirements. Because the weight factor of function A is smaller than that of function B, the possibility of function A being filtered is greater than that of function B. Since the calculated training results can be configured and loaded into the system that needs to be trimmed and filtered in the form of a dictionary table file, it has the characteristics of low memory overhead and low coupling.

[0048] The present invention also provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the program, the steps of the above-mentioned binary executable file function feature screening method are implemented.

[0049] In this embodiment, since the processor in the electronic device implements the steps of the above-mentioned binary executable file function screening method when executing the computer program, based on the description of the above-mentioned binary executable file function screening method, the electronic device has the same beneficial technical effects.

[0050] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned binary executable file function feature screening method are implemented.

[0051] In this embodiment, since the computer-readable storage medium stores a computer program, and the computer program implements the steps of the above-mentioned binary executable file function feature screening method when executed by the processor, based on the above description, the computer-readable storage medium has the same beneficial technical effects and will not be repeated here.

[0052] The above is a detailed introduction to the binary executable file function feature screening method, device and storage medium provided by the present invention. This article uses specific examples to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the core idea of ​​the present invention. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the scope of protection of the claims of the present invention.

Claims

1. A method for screening binary executable file function features, characterized in that: The method comprises the following steps: S1. Use a disassembly tool to convert the binary file into corresponding assembly code, and map the assembly function corresponding to the assembly code to a vector in a high-dimensional space based on a preset trained neural network model; S2. Convert the vector in the high-dimensional space into a hash feature value based on the locality-sensitive hashing algorithm and perform data persistence operations; S3. Constructing a weight analysis function based on the inverse document frequency of the assembly function and its distribution in different versions and different software, calculating the weight factor of the assembly function according to the weight analysis function, and deriving the correspondence between the assembly function feature value and the weight factor in the form of a dictionary table file; S4. Based on the assembly functions and their corresponding weight factors, perform trimming and filtering according to preset trimming requirements of the binary executable file functions; The specific implementation of step S1 is: S11. Use the IDA disassembly tool to convert the input binary file code fragment into the corresponding assembly code; S12. Use a preset trained neural network model to map the assembly function corresponding to the assembly code into a 128-dimensional vector.

2. The method for screening binary executable file function features according to claim 1, wherein: The weight analysis function in step S3 is expressed as follows: ； Where, represents the weight factor of the function, represents the inverse document frequency of the function, A comprehensive value that represents the frequency of a function appearing in different versions and different software.

3. The method for screening binary executable file function features according to claim 2, wherein: The specific implementation of step S4 is as follows: S41, read the dictionary table file and load it into memory; S42, querying weight factors corresponding to all assembly functions based on the dictionary table file; S43 , sorting in descending order based on the weight factors corresponding to all assembly functions, and performing trimming and filtering of the assembly functions according to preset trimming requirements of the binary executable file functions.

4. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the binary executable file function feature screening method according to any one of claims 1 to 3 are implemented.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the binary executable file function feature screening method described in any one of claims 1 to 3 are implemented.

Images