Method and system for detecting recurring vulnerabilities in binary code

Abstract

The present invention relates to a recurrence vulnerability detection method and system for binary code, comprising the following steps: obtaining a function data set in a binary executable program of different versions of target software and containing debugging information; obtaining a binary vulnerability function from a vulnerability-affected version of a corresponding binary project according to vulnerability information in a vulnerability information database, and constructing an opcode co-occurrence matrix for each function after parsing; forming a function pair with the function in the target software function data set and the vulnerability function in the vulnerability information database, using their co-occurrence matrix as input and respectively obtaining corresponding feature vectors through a trained Siamese-CNN model, and judging whether they match after similarity evaluation; if they match, accurately identifying the matched function pair to judge whether there is a vulnerability. The method can overcome software version updates and compiler version changes to achieve accurate function matching.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a binary code-oriented recurrence vulnerability detection method and system. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] In the process of software development, the introduction of open source and third-party codes can effectively improve development efficiency and reduce development costs. Therefore, they are widely used in Internet applications, big data, and artificial intelligence. With the popularization of open source code, these vulnerable codes are also widely used in various projects, leading to the introduction of homologous vulnerabilities. The most noteworthy security issue of open source and third-party codes is their amplification effect. If an open source software has a vulnerability, other open source software that depends on it will be affected.

[0004] Detection of known vulnerabilities based on binary code is generally achieved through binary code similarity detection. It is worth noting that due to software updates or compiler version changes, the compiled binary files may have different grammatical structures and semantic features.

[0005] Most existing research methods for solving such problems rely on the control flow graph (CFG) of the function, property metrics, or raw byte streams. The widely used tool Bindiff calculates similarity by comparing the CFG of the function and its properties. In order to reduce the computational cost, Genius, Gemini, and Vulseeker extract property metrics from CFG for similarity comparison and perform well in vulnerability detection. α-Diff is one of the most advanced solutions for cross-version function similarity detection. It represents the raw bytes of the function as an image and uses a Siamese network to calculate the similarity of the function. From the evaluation results, it performs well when the versions are similar, but its recall@1 is only 73.8% when the version span is large.

[0006] In static vulnerability detection based on binary code, most existing methods are based on function matching only, that is, the similarity between the vulnerability function and the target function is compared with a set threshold to detect vulnerabilities. Due to software updates or compiler version changes, the similarity between the vulnerability function and the target function may be very small, resulting in the target function being unable to match and causing vulnerability misses. Secondly, most vulnerability fixes only involve a few lines of code, and the code differences between the vulnerability function and the patch function are small. Too high a similarity between the vulnerability function and the patch function may cause the patch function to be mistakenly detected as the vulnerability function, resulting in a false positive of the vulnerability. Summary of the invention

[0007] In order to solve the technical problems existing in the above-mentioned background technology, the present invention provides a method and system for reproducible vulnerability detection for binary code, which can achieve accurate function matching in response to software updates and compiler version changes, and can accurately identify vulnerabilities and patches.

[0008] In order to achieve the above object, the present invention adopts the following technical solution:

[0009] A first aspect of the present invention provides a binary code-oriented recurrence vulnerability detection method, comprising the following steps:

[0010] Obtain function data from binary executable programs of different versions of the target software;

[0011] According to the vulnerability information, binary vulnerability functions are obtained from the vulnerability-affected version of the corresponding binary project to construct a vulnerability database, and binary function data sets of different versions of the target software are obtained. After parsing, an opcode co-occurrence matrix is ​​constructed for each function;

[0012] The functions in the target software and the vulnerable functions in the vulnerability information database are combined into function pairs. The co-occurrence matrix of the function pairs is used as input to obtain the corresponding feature vectors through the trained Siamese-CNN model. After similarity evaluation, it is determined whether they match.

[0013] Specific:

[0014] Obtain a large number of different versions of binary executable programs containing debugging information through Debian packages or GitHub source code compilation to obtain function data sets for network model training and experimental verification. Furthermore, when obtaining binary executable programs with debugging symbols, for those obtained through Debian packages, use eu-unstrip to merge the executable program and debugging symbol files into binary executable programs with debugging symbols. For source code compilation, use the GNU build system for configuration and compilation. The entire process is automated through scripts, reducing time costs.

[0015] Obtain vulnerability functions and build a public vulnerability information database; build a public vulnerability information database based on the vulnerability information on NVD, including project name, vulnerability function, affected version, fixed version, vulnerability type and level, etc. Obtain binary vulnerability functions from the vulnerability affected version of the corresponding binary project based on the vulnerability information;

[0016] The collected binary functions are parsed, and an opcode co-occurrence matrix is ​​constructed for each function to train the Siamese-CNN model; binary functions are composed of instruction sequences, and each instruction can be divided into opcodes and operands. The opcode sequence represents the action of the function, which is an inherent attribute of the function and can be used to describe the function in a discriminative manner. The disassembly tool IDAPro is used to extract the assembly instruction sequence of the function;

[0017] Related models in the field of natural language processing have outstanding advantages in understanding the semantics of language data. The Bi-gram language model is used to process the opcode instruction sequence, and the two adjacent opcodes are regarded as a bigram, and the opcode co-occurrence matrix is ​​further constructed according to the bi-gram frequency sequence.

[0018] Use Siamese-CNN for feature extraction and function matching; the Siamese-CNN model connects two identical CNNs and shares the same set of parameters. Each CNN takes a function co-occurrence matrix as input. Through training, the distance between the encoding spaces of dissimilar functions is maximized and the distance between the encoding spaces of similar functions is minimized, so that the convolutional neural network (CNN) can learn the feature representation of the function; weights and biases are usually randomly initialized and then iteratively updated through back propagation during the training process;

[0019] In a convolutional neural network (CNN), there is a BN (batch normalization) layer between each convolution layer and the rectification layer. The BN layer can not only normalize the input to speed up the network convergence, but also make the output distribution more consistent with the actual distribution of the data;

[0020] After completing the training of the Siamese-CNN model, the functions in the target software and the functions in the vulnerability library are combined into function pairs. Their co-occurrence matrices are used as input to obtain the corresponding feature vectors through the trained CNN, and the similarity is evaluated through the Pearson correlation coefficient to determine whether they match.

[0021] If there is a match, vulnerability / patch identification is performed on the matched function; since the binary code difference between the vulnerability function and the patch function may be very small, the repaired function may still be misjudged as a function with a vulnerability. Therefore, it is necessary to extract the regional feature vectors that are strongly related to the vulnerability in the target function by using the difference between the co-occurrence matrix of the vulnerability and patch functions to make an accurate judgment, and then compare the distance between the regional feature vectors of the vulnerability function and the target function and the patch function and the target function to determine whether there is a vulnerability.

[0022] A second aspect of the present invention provides a system for implementing the above method, comprising:

[0023] The training data module is configured to: obtain function data in binary executable programs of different versions of target software;

[0024] The test data module is configured as follows: according to the vulnerability information, a binary vulnerability function is obtained from the vulnerability-affected version of the corresponding binary project to construct a vulnerability database, a binary function data set of different versions of the target software is obtained, and an opcode co-occurrence matrix is ​​constructed for each function after parsing;

[0025] The function matching module is configured as follows: the functions in the target software function and the vulnerability functions in the vulnerability information database are combined into function pairs, the co-occurrence matrix of the function pairs is used as input to obtain the corresponding feature vectors through the trained Siamese-CNN model, and the similarity is evaluated to determine whether they match;

[0026] The vulnerability identification module is configured as follows: if there is a match, the matched function pair is accurately identified to determine whether there is a vulnerability.

[0027] A third aspect of the present invention provides a computer-readable storage medium.

[0028] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps in the above-mentioned binary code-oriented recurrence vulnerability detection method.

[0029] A fourth aspect of the present invention provides a computer device.

[0030] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps in the above-mentioned method for recurring vulnerability detection in binary code are implemented.

[0031] Compared with the prior art, one or more of the above technical solutions have the following beneficial effects:

[0032] 1. It can overcome the software version update and compiler version change to achieve accurate function matching, which is more advantageous than existing related technologies. At the same time, it can accurately identify vulnerabilities and patches by extracting regional feature vectors that are strongly related to vulnerabilities, effectively solving the problems of high missed alarm rate and false alarm rate in existing related vulnerability detection methods.

[0033] 2. It can be applied to vulnerability detection of projects in various fields. It is universal and can be expanded to vulnerability detection of third-party components that the software depends on.

[0034] 3. The above method creates a public vulnerability information database, including CVE number, vulnerable function name, version containing vulnerability, version with vulnerability repair, vulnerability type and level, etc., to facilitate future vulnerability research work.

[0035] 4. A dataset for binary function similarity detection research was constructed. A large number of binary files were generated automatically, which greatly reduced the time cost of dataset acquisition. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0037] Figure 1 is a schematic diagram of a vulnerability detection process provided by one or more embodiments of the present invention;

[0038] Figure 2 is a schematic diagram of a Siamese-CNN architecture provided by one or more embodiments of the present invention;

[0039] Figure 3 It is a schematic diagram of a Siamese-CNN neutron network model (CNN) provided by one or more embodiments of the present invention. DETAILED DESCRIPTION

[0040] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0041] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0042] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0043] As described in the background technology, the number of vulnerabilities contained in open source and third-party codes is also showing a rapid growth trend. With the popularization of open source code, these vulnerable codes are also widely used in various projects, resulting in the introduction of homologous vulnerabilities. Synopsys pointed out in its "2021 Open Source Security and Risk Analysis" report that 98% of the 1,546 code bases audited in 2020 contained open source code, and 84% of them contained vulnerabilities. Each code base has an average of 158 vulnerabilities, of which the proportion of high-risk vulnerabilities has increased from 49% to 60%. A more worrying problem is that abandoned open source code is still widely used, and up to 91% of the code with open source dependencies has not undergone any code improvements and security fixes in the past two years. Even if the open source components have released updates and security patches, the downstream software developers who rely on these open source codes have not updated them in a timely manner. The report pointed out that 85% of the code bases contain open source dependencies that have not been updated for at least four years.

[0044] The most noteworthy security issue of open source and third-party code is its amplification effect. If an open source software has a vulnerability, other open source software that depends on it will be affected. This has also become a major target for hacker attacks, such as the "Heartbleed" vulnerability in 2014, the "EternalBlue" vulnerability in 2017, and the log4j2 vulnerability in 2021. Moreover, the layers of related dependencies lead to a very hidden and complex attack surface, which increases the difficulty of vulnerability analysis. Therefore, automated methods are needed for vulnerability detection, and research on vulnerability detection has also received more and more attention.

[0045] Vulnerability detection methods can be divided into two categories: static analysis and dynamic analysis. Dynamic analysis methods, such as fuzz testing and dynamic taint analysis, mainly monitor, detect and debug the program during operation. The disadvantage is that it is difficult to cover all code execution paths, and it takes a lot of work to create test cases, which is time-consuming. Static analysis mainly analyzes source code or compiled binary files without executing program code. It can basically cover all code paths and does not generate running overhead without executing the program. At present, most of the research is based on static analysis detection methods of source code. However, due to software property protection or other reasons, many software sources are usually not open, so the scope of applicable detection is limited, which makes binary code detection a key and feasible method at present.

[0046] Currently, detection of known vulnerabilities based on binary code is generally achieved through binary code similarity detection. However, due to software updates or changes in compiler versions, the similarity between the vulnerability function and the target function may be very small, resulting in the target function not being able to match and causing vulnerability misses. Secondly, most vulnerability fixes only involve a few lines of code, and the code difference between the vulnerability function and the patch function is very small. Too high a similarity between the vulnerability function and the patch function may cause the patch function to be mistakenly detected as a vulnerability function, resulting in a false positive of the vulnerability. At the same time, there is currently no large public binary dataset for the purpose of binary code vulnerability detection, and it is very time-consuming and expensive to manually build such a dataset.

[0047] Therefore, the following embodiments provide a method and system for reproducible vulnerability detection for binary code, which performs static analysis based on binary code and cross-version detection of vulnerabilities. It can achieve accurate function matching in response to software updates and compiler version changes, and can accurately identify vulnerabilities and patches.

[0048] Embodiment 1:

[0049] like Figure 1-3 As shown in the figure, the binary code-oriented vulnerability detection method includes the following steps:

[0050] 1. Collect a large number of different versions of binary files to obtain function data sets that can be used for training and testing. The main sources of data are:

[0051] The first source is the Debian package repository. This example crawls different versions of software packages and symbol packages of 29 projects from the Debian package repository, and uses scripts to batch build their executable files, and then uses IDA Pro 7.0 to decompile the obtained binary files to obtain function information. This part of the data is mainly used for training network models.

[0052] The second source is the GitHub repository. This example collects the source code of 9 open source projects from the GitHub repository and compiles each software using GCC according to the default optimization options. Then IDA Pro 7.0 is used to decompile the obtained binary files to obtain function information. This part of the data is mainly used for experimental effect evaluation.

[0053] 2The collected function data sets are divided into three data sets:

[0054] Dataset I is used to train the Siamese-CNN network model. Functions obtained from the Debian package repository are used as training samples. Two versions of binaries of the same project are randomly selected as a pair, and for each pair of cross-version binaries, matching function pairs are retrieved to ensure that they have the same name but are not identical.

[0055] Dataset II is used to evaluate the accuracy of the Siamese-CNN network model on the function matching task. For the cross-software version function matching task, the source code of 7 versions of the coreutils project was collected from GitHub for compilation. For the cross-compiler version function matching task, this embodiment collected 5 versions of tcpdump source code, compiled with gcc-5.5, gcc-7.5, gcc-9.4 and gcc-11.1 respectively.

[0056] Dataset III is a public vulnerability information database. We obtained six projects in different fields from GitHub and performed vulnerability detection on different versions of these projects. We obtained different versions of OpenVPN and Tesseract source code from GitHub to compile and further evaluate the effectiveness of detecting third-party component vulnerabilities.

[0057] 3 Given a binary file, perform data analysis on it. This embodiment first uses a disassembly tool to decompile it to obtain the assembly code of each function. Then, the assembly instructions of the function are processed so that it can effectively represent the function characteristics.

[0058] Construct an opcode table. This embodiment extracts an instruction opcode sequence. On the one hand, for the same function of different versions of software or the same third-party function used by two software, their instruction operands are usually different, such as registers, memory addresses, etc. However, since the instruction opcode represents the execution action of the instruction, its statistical properties are relatively stable even in different versions. Therefore, this embodiment can use the instruction opcode sequence as the key to distinguish functions. On the other hand, the number of opcodes in the instruction set is limited, which can effectively compress the dimensional space of the statistical model. Since low-frequency redundant data will reduce the matching accuracy, and this high-dimensional data will seriously affect the data processing efficiency, this embodiment only selects the top 200 most frequently used opcodes.

[0059] Construct an opcode Bi-gram sequence. The Bi-gram language model in the field of natural language processing is used to process the opcode instruction sequence in the assembly code, that is, the two adjacent opcodes are treated as a tuple. Each function will get a Bi-gram sequence of opcodes. The opcode of the function itself is retained, and the order of the opcodes is retained to a certain extent, which can ensure that the lexical and semantic features of the function are not lost.

[0060] Construct the opcode co-occurrence matrix. Since the input of the subsequent Siamese-CNN model needs to be two-dimensional data to preserve the spatial relationship characteristics of the opcode, the bi-gram sequence of the opcode is converted into a co-occurrence matrix. For 200 different opcodes, the frequency of occurrence of bigrams in the bi-gram sequence is calculated to generate a 200*200 dimensional co-occurrence matrix. The values ​​in the matrix correspond to the frequency of occurrence of the corresponding opcode bigrams.

[0061] 4 Use Siamese-CNN model for feature extraction and function matching.

[0062] The convolutional neural network (CNN) is used to extract features from the two-dimensional co-occurrence matrix, and the obtained feature vector is used for function matching. For model training, this embodiment designs a Siamese-CNN architecture, which takes similar function pairs and dissimilar function pairs as inputs, maximizes the distance in the encoding space between dissimilar functions through training, and minimizes the distance in the encoding space between similar functions, so that the convolutional neural network (CNN) can learn the feature representation of the function and perform function matching through similarity comparison.

[0063] The Siamese-CNN architecture proposed in this embodiment is as follows Figure 2 This architecture connects two identical CNNs and shares the same set of parameters. Each CNN takes a co-occurrence matrix of a function as input, optimizes the network through ContrastiveLoss function feedback, extracts features, and outputs the corresponding feature vector.

[0064] The advantage of using a convolutional neural network (CNN) in the sub-network is that it can retain the spatial characteristics of the co-occurrence matrix for two-dimensional data and can effectively reduce the loss of feature information. Figure 3 As shown. The entire model consists of a convolutional layer, a batch normalization layer, a Relu layer, and a linear layer. It is worth noting that the CNN model used in this embodiment removes the pooling layer. Because for functions containing a small amount of opcode information, their co-occurrence matrix may be very sparse, and the pooling operation will lose more information. At the same time, a batch normalization (BN) layer is used in the model, which makes the output data more realistically distributed and can speed up the convergence of the network.

[0065] The similarity is calculated using the feature vector output by the fully connected layer. This embodiment uses the Euclidean distance to measure the similarity, and the formula is as follows:

[0066]

[0067] X and Y are the feature vectors output by CNN. This embodiment assumes that the function vector set of the target software is A = {a 1 , a 2, a 3 ,......,a n}, the vector set of vulnerability functions in the vulnerability function library is B = {b 1 , b 2 , b 3 ,......,b n}. This embodiment performs function matching between A and B. This embodiment sets the matching threshold t according to the actual situation of the experiment. i , b j )<t, it is added into the candidate items, and the function with the highest similarity coefficient is finally selected as a successful match, otherwise, the match fails.

[0068] When training the Siamese-CNN architecture, this embodiment receives a function pair (x1, x2) as input and outputs a feature vector (f(x1, θ), f(x2, θ)) through a convolutional neural network. The Siamese-CNN model uses ContrastiveLoss as a loss function to represent the matching degree of the input sample, and can optimize the weights for feature extraction during training. The formula of ContrastiveLoss is as follows:

[0069]

[0070] Where N is the number of samples, Y is the sample label, Y=1 means that the two sample functions match, Y=0 means that the two sample functions do not match, m is the defined distance threshold, and Dw is the Euclidean distance. The gradient of the loss will be fed back to the two convolutional neural network structures that share parameters, so that the vector distance between two similar functions is as small as possible, and the vector distance between two dissimilar functions is as large as possible.

[0071] Training the Siamese-CNN architecture requires a large number of positive samples (similar function pairs) and negative samples (different function pairs). In the acquired dataset, positive samples are generated by function name labels, and then negative samples are generated online in each mini-batch based on the positive samples during the training process. Specifically, for each pair of positive samples (X a , X p ) will generate two pairs of semi-hard negative samples, namely (Xa, X n1 ) and (X p , X n2 ). With function X a For example, the selected dissimilar functions need to satisfy the formula relationship:

[0072] 0<D w (X a , X n )<m

[0073] This embodiment randomly selects a function from Xn that satisfies the constraint as a negative function. However, it is worth noting that the hardest negative sample (i.e., minD w (X a , X n )) are excluded because such samples easily cause the model to fall into a bad local minimum during training. At the same time, during the training process, this embodiment shuffles the order of positive samples in each epoch, which ensures that new negative samples can be generated from the randomly sorted batch each time, making the model generalizable.

[0074] 5. Identify vulnerabilities / patches for the matched functions

[0075] Since the binary code difference between the vulnerability function and the patch function may be very small, the repaired function may still be misjudged as a function with a vulnerability. The original co-occurrence matrix contains more accurate function feature information, so it has a higher degree of distinction between the vulnerability function and the patch function. Therefore, this embodiment uses the difference between the co-occurrence matrices of the vulnerability function (V) and the patch function (P) to extract the regional feature vectors in the target function (T) that are strongly related to the vulnerability, and judges whether there is a vulnerability by comparing the distance between the regional feature vectors of (V, T) and (P, T).

[0076] In this embodiment, the co-occurrence matrix of the vulnerability function and the patch function is subtracted to obtain a difference matrix. The non-zero value position of the difference matrix is ​​the area with strong vulnerability correlation. Then, the co-occurrence matrix values ​​of the vulnerability function, patch function, and target function at these positions are extracted respectively, and the output is the regional feature vector of their strong vulnerability correlation, denoted as S V , S P and S T . Finally, Euclidean distance is used to identify vulnerabilities / patches.

[0077] If D W (S V , S T ) <D W (S P , S T ), then it is judged that there is a vulnerability in the target function, otherwise it is judged that the target function has been repaired.

[0078] The above method can overcome the software version update and compiler version change to achieve accurate function matching, which is more advantageous than the existing related technologies. At the same time, by extracting the regional feature vectors that are strongly related to the vulnerability, it can accurately identify the vulnerability and patch, effectively solving the problem of high false positive rate and false negative rate in the existing related vulnerability detection methods.

[0079] It can be applied to vulnerability detection of projects in various fields. It is universal and can be extended to vulnerability detection of third-party components that the software depends on.

[0080] The above method creates a public vulnerability information database, including CVE number, vulnerable function name, version containing the vulnerability, version with vulnerability fix, vulnerability type and level, etc., to facilitate future vulnerability research work.

[0081] A dataset for binary function similarity detection research was constructed. A large number of binary files were generated automatically, which greatly reduced the time cost of dataset acquisition.

[0082] Embodiment 2:

[0083] This embodiment provides a system for implementing the above method, including:

[0084] The training data module is configured to: obtain function data in binary executable programs of different versions of target software;

[0085] The test data module is configured as follows: according to the vulnerability information, a binary vulnerability function is obtained from the vulnerability-affected version of the corresponding binary project to construct a vulnerability database, a binary function data set of different versions of the target software is obtained, and an opcode co-occurrence matrix is ​​constructed for each function after parsing;

[0086] The function matching module is configured as follows: the functions in the target software function and the vulnerability functions in the vulnerability information database are combined into function pairs, and their co-occurrence matrices are used as input to obtain corresponding feature vectors through the trained Siamese-CNN model, and whether they match is determined after similarity evaluation;

[0087] The vulnerability identification module is configured as follows: if there is a match, the matched function pair is accurately identified to determine whether there is a vulnerability.

[0088] The system in this embodiment implements a binary code-oriented recurrence vulnerability detection method that can achieve accurate function matching in response to software updates and compiler version changes, and can accurately identify vulnerabilities and patches.

[0089] Embodiment 3

[0090] This embodiment provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps in the binary code recurrence vulnerability detection method proposed in the above-mentioned embodiment 1 are implemented.

[0091] The binary code-oriented reproducible vulnerability detection method executed by the computer program in this embodiment can achieve accurate function matching in response to software updates and compiler version changes, and can accurately identify vulnerabilities and patches.

[0092] Embodiment 4

[0093] This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps in the binary code recurrence vulnerability detection method proposed in the first embodiment are implemented.

[0094] The binary code-oriented recurrence vulnerability detection method executed by the processor of this embodiment can achieve accurate function matching in response to software updates and compiler version changes, and can accurately identify vulnerabilities and patches.

[0095] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program code.

[0096] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0097] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0098] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0099] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0100] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A binary code-oriented recurrence vulnerability detection method, characterized by: The following steps are involved: Obtain function data from binary executable programs of different versions of the target software; According to the vulnerability information, binary vulnerability functions are obtained from the vulnerability-affected version of the corresponding binary project to construct a vulnerability database, and binary function data sets of different versions of the target software are obtained. After parsing, an opcode co-occurrence matrix is ​​constructed for each function. In the process of obtaining function data sets in binary executable programs of different versions of the target software and containing debugging information, the executable program and the debugging symbol file are merged into a binary executable program with debugging symbols. The binary function consists of an instruction sequence, and each instruction is divided into an opcode and an operand. The opcode sequence represents the operation performed by the function; The functions in the target software and the vulnerable functions in the vulnerability information database are combined into function pairs. Their co-occurrence matrices are used as input to obtain the corresponding feature vectors through the trained Siamese-CNN model. After similarity evaluation, it is determined whether they match. During the training process, the order of the positive samples in each epoch is shuffled, and new negative samples can be generated from the randomly sorted batch each time to make the model generalizable. If there is a match, the matched function pair is accurately identified to determine whether there is a vulnerability.

2. The method for detecting recurring vulnerabilities in binary code according to claim 1, characterized in that: The Bi-gram language model is used to process the opcode instruction sequence, the two adjacent opcodes are regarded as a bigram, and the opcode co-occurrence matrix is ​​constructed according to the bi-gram frequency sequence.

3. The binary code-oriented recurrence vulnerability detection method according to claim 1, characterized in that: The Siamese-CNN model connects two identical convolutional neural network models CNN and shares the same set of parameters. Each convolutional neural network model CNN takes a function co-occurrence matrix as input. Through training, the distance in the encoding space between dissimilar functions is maximized and the distance in the encoding space between similar functions is minimized, so that the convolutional neural network model CNN learns the feature representation of the function.

4. The binary code-oriented recurrence vulnerability detection method according to claim 3, characterized in that: In the convolutional neural network model CNN, a batch normalization layer is provided between each convolution layer and the rectification layer to accelerate the network convergence speed.

5. The binary code-oriented recurrence vulnerability detection method according to claim 1, characterized in that: The matched function pairs are accurately identified to determine whether there are vulnerabilities. Specifically, the difference between the co-occurrence matrix of the vulnerability and patch functions is used to extract the regional feature vectors that are strongly correlated with the vulnerability in the target function. The distance between the regional feature vectors of the vulnerability function and the target function, and between the patch function and the target function are compared to determine whether there are vulnerabilities.

6. A binary code-oriented recurrence vulnerability detection system, characterized by: include: The training data module is configured to: obtain function data in binary executable programs of different versions of target software; The test data module is configured as follows: according to the vulnerability information, a binary vulnerability function is obtained from the vulnerability-affected version of the corresponding binary project to construct a vulnerability database, and a binary function data set of different versions of the target software is obtained. After parsing, an opcode co-occurrence matrix is ​​constructed for each function, wherein in the process of obtaining the function data set in the binary executable program of different versions of the target software and containing debugging information, the executable program and the debugging symbol file are merged into a binary executable program with debugging symbols, and the binary function is composed of an instruction sequence, each instruction is divided into an opcode and an operand, and the opcode sequence represents the operation performed by the function; The function matching module is configured as follows: the functions in the target software function and the vulnerability functions in the vulnerability information database are combined into function pairs, and their co-occurrence matrices are used as input to obtain the corresponding feature vectors through the trained Siamese-CNN model. After similarity evaluation, it is determined whether they match. During the training process, the order of the positive samples of each epoch is shuffled, and new negative samples can be generated from the randomly sorted batch each time, so that the model has generalization ability; The vulnerability identification module is configured as follows: if there is a match, the matched function pair is accurately identified to determine whether there is a vulnerability.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps in the binary code recurrence vulnerability detection method as described in any one of claims 1 to 5 are implemented.

8. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps in the binary code-oriented recurrence vulnerability detection method as described in any one of claims 1-5 are implemented.

Images