A control flow graph-oriented cross-platform binary function representation method and device

Abstract

The application discloses a kind of control flow chart-oriented cross-platform binary function representation method and device, the method includes: obtaining the instruction set of binary code and statistics feature;Obtain the feature vector of each instruction feature;Based on the feature vector of the instruction feature and LSTM model, the basic block embedding is carried out to each basic block in each CFG, and the feature vector of each basic block is obtained;Filter invalid node in CFG, and obtain the feature vector set corresponding to the filtered basic block;Function representation is carried out using graph neural network model;In the graph neural network model, each node obtains the information of its corresponding k-order neighbor;The k-order neighbor of a node is the node in the graph neural network model, which is connected with the node with less than or equal to k connection number.The method has strong data understanding ability and cognitive ability, and the data size of k-order subgraph is controlled by random sampling of neighbor nodes, to save the cost.

Description

Technical Field

[0001] This invention relates to the field of information security, and specifically to a cross-platform binary function representation method and apparatus for control flowcharts. Background Technology

[0002] Cross-platform binary function similarity detection can determine whether two binary functions from different platforms, compilers, optimization options, and software versions are similar. It is widely used in vulnerability searching, patch analysis, malware family classification, and other fields. Function representation is a crucial step in the detection process; the feature vectors used to represent the function directly affect the quality of the similarity detection.

[0003] Existing detection methods typically utilize graph embedding networks to transform control flow graphs into high-dimensional vectors, using the similarity between vectors to represent the correlation of function pairs, thus improving accuracy. Higher accuracy has been achieved by constructing semantically aware deep neural networks to capture high-level semantic information in data flow graphs and control flow graphs. Function semantic simulation has been integrated into the semantic learning backend, adding the ability to identify TOP-M functions. Analysis methods combining semantic and structural representations, using recurrent neural networks, message-passing neural networks, and convolutional neural networks to extract semantic, structural, and sequential information, have improved the F1 score. Finally, unsupervised feature learning solutions have been employed, using mnemonics or operands of each instruction as labels to train the model, further leveraging graph embedding networks for function representation.

[0004] However, existing detection methods typically represent functions as regularly structured image or sequence data, and then use convolutional neural networks for comparison and analysis. Control flow graphs, on the other hand, are irregular, unstructured data. When applied to convolutional neural networks, the convolution operation cannot be performed effectively, leading to the following problems.

[0005] The overhead is too high. Graph convolutional neural networks use a full-graph-based training approach and require eigenvalue decomposition of the graph's Laplacian matrix, which is an extremely time-consuming operation. For large control flow graphs of complex functions, the time cost of traversing subgraphs, the computational cost of model training, and the storage cost become highly unpredictable.

[0006] Loss of structural information. Structural information represents the internal structure of a function, reflecting the dependencies between basic blocks and their contextual semantics, which is crucial for distinguishing binary code from different platforms. Loss of structural information can affect detection accuracy. However, structural information is not fully utilized in some methods because many graph embedding methods rely on random walk strategies in the representation of CFGs. But random walks cannot obtain all the structural information of the central nodes. Summary of the Invention

[0007] In view of this, the present invention provides a cross-platform binary function representation method and apparatus for control flowcharts, which can solve the technical problems of high overhead and loss of some structural information in existing methods.

[0008] To solve the above-mentioned technical problems, the present invention is implemented as follows.

[0009] A cross-platform binary function representation method for control flow graphs includes:

[0010] Step S1: Obtain binary code and extract instruction set features corresponding to the binary code. The instruction set features include multiple instruction features.

[0011] Step S2: Input the instruction set features into the Word2Vec model to obtain the feature vectors of each instruction feature;

[0012] Step S3: Obtain multiple CFGs corresponding to the binary code, and based on the feature vectors of the instruction features and the LSTM model, perform basic block embedding on each basic block in each CFG to obtain the feature vectors of each basic block.

[0013] Step S4: Based on the relationship between the total number of basic blocks in each CFG and the preset basic block size, filter out invalid nodes in the CFG to obtain the feature vector set corresponding to the filtered basic blocks.

[0014] Step S5: Obtain the structural information of each CFG, and use the filtered feature vector set and structural information of each basic block corresponding to each CFG as the input of the graph neural network model, and use the graph neural network model to perform function representation; in the graph neural network model, each node obtains the information of its corresponding k-order neighbors; the k-order neighbors of a node are the nodes in the graph neural network model whose connection level with the node is less than or equal to k.

[0015] Preferably, one or more binary functions corresponding to the binary code are obtained, and the arithmetic instructions, constants, strings, and jump information in the binary functions are counted. An instruction set is generated for each binary function, the operands of each instruction are filtered, and all basic memory addresses are replaced with the special symbol MEM. All immediate values ​​with absolute values ​​higher than a preset threshold are replaced with the special symbol IMM to obtain the processed instruction set features. The basic memory refers to the memory area occupying the address space of 0 to 640KB.

[0016] Preferably, in step S3, the CFG is constructed as follows:

[0017] The size of the CFG is preset, that is, the number of vertices p of the CFG is preset, and the number of instructions m contained in the instruction set corresponding to each vertex is preset.

[0018] For each binary function fc, if the total number of basic blocks corresponding to fc is less than p, then a vertex filling operation is performed. The filled vertices are composed of 0, i.e., invalid vertices; invalid vertices do not have edges. If the total number of basic blocks corresponding to fc is greater than p, then a vertex truncation operation is performed, i.e., p basic blocks are sequentially or randomly truncated as vertices, and other basic blocks are discarded.

[0019] For each binary function fc, based on the control flow relationship between p vertices, edges are established between p vertices; the two-dimensional array storing the relationship between each vertex in the CFG corresponding to the binary function fc is called the adjacency matrix.

[0020] Preferably, filtering invalid vertices in the feature vectors of basic blocks includes:

[0021] Step S41: Obtain the feature vector of the basic block, and based on the binary function corresponding to the basic block, obtain the adjacency matrix A corresponding to the binary function;

[0022] Step S42: Add the adjacency matrix A to the temp set as key-value pairs;

[0023] Step S43: Obtain the row vectors in the feature vectors of the basic block, and perform the following operations on each row vector: if each element in the row vector is zero, add the index of the row to the invalid set; otherwise, add the row element to the valid set; set the current row in the temp set as the first row;

[0024] Step S44: Get the current row element H in the temp set. If any element in H is equal to any element in the invalid set, delete the row element H from the temp set; otherwise, proceed to step S45.

[0025] Step S45: Update the current row to the next row of the temp set; if the temp set has been traversed to the end, i.e. the current row is empty, then output the processed temp set as the result; otherwise, proceed to step S44.

[0026] Preferably, in the graph neural network model, an aggregator is constructed for each node. The aggregator is implemented through an aggregation function. The aggregator is used to acquire and aggregate the state information of the node's k-th order neighbors. Based on the aggregated state information of the k-th order neighbors and the node's state information, an embedding vector for the node is generated. That is, for each node: when the iteration number num = 0, the input to the graph neural network is defined; when the current iteration number num ≥ 1, the node's state information is updated to node based on the current state information of the node's k-th order neighbors and the node's current state information. num; Obtain the embedding vector vec of the node at iteration num-1. num-1 The aggregator of this node is based on the state information node num and embedding vector vec num-1 The aggregate representation of the node is group. num The aggregation representation of this node is group. num The aggregation representation of this node is group. num-1 Concatenation, generating an embedding vector vec through nonlinear transformation. num .

[0027] Preferably, after step S5, step S6 is further included: applying the function representation result to the similarity judgment.

[0028] The present invention provides a cross-platform binary function representation device for control flowcharts, the device comprising:

[0029] Instruction feature acquisition module: configured to acquire binary code and extract instruction set features corresponding to the binary code, wherein the instruction set features include multiple instruction features;

[0030] Feature vector module: configured to input the instruction set features into the Word2Vec model to obtain the feature vectors of each instruction feature;

[0031] Basic block embedding module: configured to obtain multiple CFGs corresponding to the binary code, and based on the feature vectors of the instruction features and the LSTM model, to perform basic block embedding on each basic block in each CFG to obtain the feature vectors of each basic block.

[0032] Filtering module: Configured to filter invalid nodes in CFG based on the relationship between the total number of basic blocks in each CFG and the preset basic block size, and obtain the feature vector set corresponding to the filtered basic blocks;

[0033] Graph Neural Network Representation Module: Configured to acquire the structural information of each CFG, and use the filtered feature vector set and structural information of each basic block corresponding to each CFG as input to the graph neural network model, and use the graph neural network model to perform function representation; in the graph neural network model, each node acquires the information of its corresponding k-order neighbors; the k-order neighbors of a node are the nodes in the graph neural network model whose connection level with the node is less than or equal to k.

[0034] Beneficial effects:

[0035] This invention is primarily used for binary code similarity detection and analysis. Centered on the control flow graph of binary functions, it combines natural language processing with inductive graph neural networks. The main steps include acquiring binary code, instruction embedding, basic block embedding, function representation, and similarity analysis calculation. This invention optimizes the detection process, reduces resource consumption, significantly improves detection speed, and enhances accuracy to some extent by utilizing multiple semantic information. It overcomes the shortcomings of traditional detection methods, such as the loss of structural information like control flow and high overhead.

[0036] It has the following technical effects:

[0037] (1) This invention uses the control flow chart of binary functions as its core, and combines natural language processing with inductive graph neural networks to represent it, proposing an efficient binary function representation and similarity detection method. Compared with graph convolutional neural networks, graph neural networks integrate the structural features of graph data into the algorithm, have powerful data understanding and cognitive abilities, and randomly sample neighboring nodes to control the data scale of the k-order subgraph.

[0038] (2) The present invention uses nodes as the center for small batch training, which fundamentally saves costs.

[0039] (3) The present invention filters out invalid vertices in the feature vector of basic blocks, which greatly reduces unnecessary operations and further improves system performance.

[0040] (4) The present invention completely preserves and utilizes the structural information of the control flow graph. The structural information is used as part of the input of the function representation module in the form of node pairs and participates in the calculation.

[0041] (5) This invention is a cross-platform binary function representation method and apparatus for control flow diagrams. It fully utilizes the advantages of natural language processing and inductive graph neural networks to disassemble executable files, sequentially obtain feature vectors of instructions and basic blocks, and finally use a graph neural network model for function representation and similarity calculation. This method supports executable files under Windows and Linux as input. Attached Figure Description

[0042] Figure 1 A schematic diagram of the cross-platform binary function representation method for control flowcharts provided by the present invention;

[0043] Figure 2 A schematic diagram of the cross-platform binary function representation method for control flowcharts provided by the present invention;

[0044] Figure 3 This is a schematic diagram of the cross-platform binary function representation device for control flowcharts provided by the present invention. Detailed Implementation

[0045] Terminology Explanation:

[0046] Cross-platform binary code similarity detection: Cross-platform binary code similarity detection aims to detect whether two binary functions from different platforms are similar.

[0047] Representation: Representation learning is a process of transforming raw data into data that is easier to apply to machine learning.

[0048] Embedding: refers to representing an entity using a vector of fixed dimensions.

[0049] Control Flow Graph (CFG): A control flow graph is a representation of code during compilation, showing the control flow information of the code in a graph form. A control flow graph is represented as G = (V, E), where V and E represent the sets of vertices and edges, respectively.

[0050] Feature vector: A collection of attributes, usually represented by a vector, attached to an instance.

[0051] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0052] like Figures 1-2 As shown, this invention proposes a cross-platform binary function representation method for control flow graphs, comprising the following steps:

[0053] Step S1: Obtain binary code and extract instruction set features corresponding to the binary code. The instruction set features include multiple instruction features.

[0054] Step S2: Input the instruction set features into the Word2Vec model to obtain the feature vectors of each instruction feature;

[0055] Step S3: Obtain multiple CFGs corresponding to the binary code, and based on the feature vectors of the instruction features and the LSTM model, perform basic block embedding on each basic block in each CFG to obtain the feature vectors of each basic block.

[0056] Step S4: Based on the relationship between the total number of basic blocks in each CFG and the preset basic block size, filter out invalid nodes in the CFG to obtain the feature vector set corresponding to the filtered basic blocks.

[0057] Step S5: Obtain the structural information of each CFG, and use the filtered feature vector set and structural information of each basic block corresponding to each CFG as the input of the graph neural network model, and use the graph neural network model to perform function representation; in the graph neural network model, each node obtains the information of its corresponding k-order neighbors; the k-order neighbors of a node are the nodes in the graph neural network model whose connection level with the node is less than or equal to k.

[0058] Furthermore, following step S5, step S6 is also included:

[0059] The function representation results are applied to similarity judgment.

[0060] Step S1 includes: obtaining binary code, disassembling the binary code into a file composed of binary functions, and extracting the instruction set features corresponding to the file composed of binary functions, wherein the instruction set features include multiple instruction features.

[0061] Further, step S1 includes:

[0062] Obtain binary code, which is obtained by assembling an executable file. Analyze the binary code using Radare2 to obtain one or more corresponding binary functions. Analyze the arithmetic instructions, constants, strings, and jump information in the binary functions to generate an instruction set for each binary function, and then construct a total instruction set U'. w ,U' w This includes various instruction sets. Due to the complexity of the assembled instruction set structure, to facilitate subsequent processing, this invention filters the operands of each instruction, replaces all basic memory addresses with the special symbol MEM, and replaces all immediate values ​​with the special symbol IMM for all absolute values ​​exceeding a preset threshold, thus obtaining U'. w The characteristics of the processed instruction set. The basic memory refers to the memory area occupying the address space from 0 to 640KB.

[0063] Step S2: Input the instruction set features into the Word2Vec model to obtain the feature vectors of each instruction feature, including:

[0064] The processed instruction set features include standardized instruction features. These features are then input into a Word2Vec model for instruction feature embedding. Each instruction feature serves as input to the Word2Vec model, and the output is a feature vector for each instruction feature. The feature vector set corresponding to each instruction set feature is labeled U. w .

[0065] Step S3: Obtain multiple CFGs corresponding to the binary code; based on the feature vectors of the instruction features and the LSTM model, perform basic block embedding on each basic block in each CFG to obtain the feature vectors of each basic block, wherein:

[0066] The binary code is parsed to generate a CFG for each binary function. Each binary function has one or more basic blocks, which are instruction sequences in the binary code that do not have branch operations.

[0067] The executable file is assembled into binary code, and the binary code is disassembled to form one or more binary functions. Based on the disassembly results, the basic block corresponding to each binary function and the instruction set corresponding to each basic block can be obtained. Based on the disassembly results, the CFG and adjacency matrix corresponding to each binary function can be constructed.

[0068] The conventional way to construct a CFG in this field is to establish a one-to-one correspondence between vertices and basic blocks. This invention makes an improvement.

[0069] The CFG construction method of the present invention is as follows: The CFG size is preset, i.e., the number of vertices p is preset, and the number of instructions m is contained in the instruction set corresponding to each vertex. For a binary function fc, if the total number of basic blocks corresponding to fc is less than p, a vertex filling operation is performed, and the filled vertices consist of 0, i.e., invalid vertices; invalid vertices do not have edges. If the total number of basic blocks corresponding to fc is greater than p, a vertex truncation operation is performed, i.e., p basic blocks are sequentially or randomly truncated as vertices, and other basic blocks are discarded; based on the control flow relationship between the selected p vertices, edges are established between the p vertices.

[0070] In this embodiment, to avoid missing semantic information, the values ​​of p and m are set to be slightly larger, for example, p = 150, m = 50.

[0071] Furthermore, the capacity of instructions contained in each vertex of the CFG was determined. Extensive experiments revealed that a large number of retained instructions resulted in high time and space consumption; conversely, a small number of instructions led to the loss of significant semantic information, causing a decrease in model accuracy. After weighing efficiency and effectiveness, the capacity of instructions contained in each vertex was set at 50.

[0072] In this embodiment, the adjacency matrix corresponding to the binary function is constructed as follows: a two-dimensional array is used to store the relationship between each vertex in the CFG corresponding to the binary function. This two-dimensional array is called the adjacency matrix.

[0073] During the experiment, various methods such as LSTM and BERT were used to embed basic blocks. The experiment showed that the LSTM model performed better.

[0074] In this embodiment, the input to the LSTM is the basic block V in the CFG. i V i The instruction set included is represented as 1≤j≤n, n=50, the output is the d-dimensional eigenvector of Vi. 1≤j≤m, m=50, d=100, d represents the dimension of the output vector.

[0075] For each basic block V in CFG i Obtain its associated high-dimensional feature vector. It can make full use of the timing information between instructions.

[0076] Step S4: Based on the relationship between the total number of basic blocks in each CFG and the preset basic block size, invalid nodes in the CFG are filtered to obtain the feature vector set corresponding to the filtered basic blocks, including:

[0077] Step S41: Obtain the feature vector of the basic block, and based on the binary function corresponding to the basic block, obtain the adjacency matrix A corresponding to the binary function;

[0078] Step S42: Add the adjacency matrix A to the temp set as key-value pairs;

[0079] Step S43: Obtain the row vectors in the feature vectors of the basic block, and perform the following operations on each row vector: if each element in the row vector is zero, add the index of the row to the invalid set; otherwise, add the row element to the valid set; set the current row in the temp set as the first row;

[0080] Step S44: Get the current row element H in the temp set. If any element in H is equal to any element in the invalid set, delete the row element H from the temp set; otherwise, proceed to step S45.

[0081] Step S45: Update the current row to the next row of the temp set; if the temp set has been traversed to the end, i.e. the current row is empty, then output the processed temp set as the result; otherwise, proceed to step S44.

[0082] The above processing removes invalid vertices from the eigenvectors of basic blocks, significantly reducing unnecessary overhead. The control flow graph CFG and adjacency matrix A are taken as input, and the processed graph G' = (V, E)' is output. The eigenvectors of the filtered basic blocks are then further standardized by replacing positive and negative correlation values ​​with 1 and 0, respectively.

[0083] Step S5: Obtain the structural information of each CFG, and use the filtered feature vector set and structural information of each basic block corresponding to each CFG as the input of the graph neural network model, and use the graph neural network model to perform function representation; in the graph neural network model, each node obtains the information of its corresponding k-order neighbors; the k-order neighbors of a node are the nodes in the graph neural network model whose connection level with the node is less than or equal to k.

[0084] For example, when k=1, it represents a node directly connected to the current node; when k=2, it represents a node directly connected to k=1 and indirectly connected to the current node. The value of k can be determined according to the specific situation.

[0085] Graph convolutional neural networks (CNNs) employ transductive learning, requiring all nodes to participate in training to obtain node embedding vectors. This invention utilizes an inductive representation learning method, employing a strategy of collecting information from neighbors to transform the training method from a full-graph approach to a node-centric mini-batch training approach.

[0086] In this embodiment, the number of nodes in the graph convolutional neural network is not related to the number of vertices in the CFG; the nodes in the graph convolutional neural network are nodes used for training.

[0087] In the graph neural network model, an aggregator is constructed for each node. This aggregator is implemented using an aggregation function. The aggregator acquires and aggregates the state information of the node's k-th order neighbors, and generates the node's embedding vector based on the aggregated state information of the k-th order neighbors and the node's own state information. Specifically, for each node: when the iteration count num = 0, it is defined as the input to the graph neural network; when the current iteration count num ≥ 1, the node's state information is updated to node based on the current state information of its k-th order neighbors and the node's current state information. num ; Obtain the embedding vector vec of the node at iteration num-1. num-1 The aggregator of this node is based on the state information node num and embedding vector vec num-1 The aggregate representation of the node is group. num The aggregation representation of this node is group. num The aggregation representation of this node is group. num-1 Concatenation, generating an embedding vector vec through nonlinear transformation. num .

[0088] This invention, on the one hand, changes the training method from the entire graph to a node-centric mini-batch training method by sampling k-order neighbors. On the other hand, it provides more aggregation functions to aggregate information from neighboring nodes, enhancing scalability. The graph neural network model learns the parameters of the aggregation function corresponding to the aggregator, rather than learning a representation for each node. Therefore, when a new node is added to the CFG, it is not necessary to retrain the entire graph neural network model; the latest embedding representation can be obtained through the aggregation function. That is, the features of the newly added node are aggregated according to the parameters of the already learned aggregation function. Therefore, the graph neural network model in this embodiment can always obtain the latest embedding vector regardless of how the CFG graph structure changes.

[0089] In this embodiment, the feature vectors and structural information of the basic blocks are used as input to the function representation module, and the graph neural network model GraphSAGE is used to complete the function representation task. The Laplacian matrix is ​​not involved in the representation process at all; the feature learning process of each node in the graph neural network model is only related to its k-th order neighbors, without considering the information of the entire graph, fundamentally saving runtime overhead and time. For GraphSAGE, calculating nodes that never appeared in the training phase only requires traversing the k-th order subgraph, which can then be substituted into the model for calculation, without the need for retraining.

[0090] This invention also provides a cross-platform binary function representation device for control flowcharts, such as... Figure 3 As shown, the device includes:

[0091] Instruction feature acquisition module: configured to acquire binary code and extract instruction set features corresponding to the binary code, wherein the instruction set features include multiple instruction features;

[0092] Feature vector module: configured to input the instruction set features into the Word2Vec model to obtain the feature vectors of each instruction feature;

[0093] Basic block embedding module: configured to obtain multiple CFGs corresponding to the binary code, and based on the feature vectors of the instruction features and the LSTM model, to perform basic block embedding on each basic block in each CFG to obtain the feature vectors of each basic block.

[0094] Filtering module: Configured to filter invalid nodes in CFG based on the relationship between the total number of basic blocks in each CFG and the preset basic block size, and obtain the feature vector set corresponding to the filtered basic blocks;

[0095] Graph Neural Network Representation Module: Configured to acquire the structural information of each CFG, and use the filtered feature vector set and structural information of each basic block corresponding to each CFG as input to the graph neural network model, and use the graph neural network model to perform function representation; in the graph neural network model, each node acquires the information of its corresponding k-order neighbors; the k-order neighbors of a node are the nodes in the graph neural network model whose connection level with the node is less than or equal to k.

[0096] The specific embodiments described above only illustrate the design principles of the present invention. The shapes and names of the components in this description may differ and are not limited. Therefore, those skilled in the art can modify or make equivalent substitutions to the technical solutions described in the foregoing embodiments; and such modifications and substitutions do not depart from the inventive spirit and technical solutions of the present invention, and should all fall within the protection scope of the present invention.

Claims

1. A cross-platform binary function representation method for control flow diagrams, characterized in that, include: Step S1: Obtain binary code and extract instruction set features corresponding to the binary code. The instruction set features include multiple instruction features. Step S2: Input the instruction set features into the Word2Vec model to obtain the feature vectors of each instruction feature; Step S3: Obtain multiple CFGs corresponding to the binary code, and based on the feature vectors of the instruction features and the LSTM model, perform basic block embedding on each basic block in each CFG to obtain the feature vectors of each basic block. The CFG is constructed by: pre-setting the size of the CFG, that is, pre-setting the number of vertices p of the CFG, and the number of instructions m contained in the instruction set corresponding to each vertex; For each binary function fc, if the total number of basic blocks corresponding to fc is less than p, then a vertex filling operation is performed, and the filled vertices are composed of 0, i.e. invalid vertices; invalid vertices do not have edges; if the total number of basic blocks corresponding to fc is greater than p, then a vertex truncation operation is performed, i.e., p basic blocks are sequentially or randomly truncated as vertices, and other basic blocks are discarded. For each binary function fc, based on the control flow relationship between p vertices, establish the edges between p vertices; The two-dimensional array that stores the relationships between vertices in the CFG corresponding to the binary function fc is called the adjacency matrix; Filter out invalid vertices in the feature vectors of basic blocks, including: Step S41: Obtain the feature vector of the basic block, and obtain the adjacency matrix A corresponding to the binary function based on the binary function corresponding to the basic block; Step S42: Add the adjacency matrix A to the temp set in the form of key-value pairs; Step S43: Obtain the row vectors in the feature vectors of the basic block, and perform the following operations on each row vector: if each element in the row vector is zero, add the index of the row to the invalid set; otherwise, add the row element to the valid set; set the current row in the temp set as the first row; Step S44: Get the current row element H from the temp set. If any element in H is equal to any element in the invalid set, delete the row element H from the temp set; otherwise, proceed to step S45. Step S45: Update the current row to the next row of the temp set; if the temp set has been traversed to its end, i.e. the current row is empty, then output the processed temp set as the result; otherwise, proceed to step S44. Step S4: Based on the relationship between the total number of basic blocks in each CFG and the preset basic block size, filter out invalid nodes in the CFG to obtain the feature vector set corresponding to the filtered basic blocks. Step S5: Obtain the structural information of each CFG, and use the filtered feature vector set and structural information of each basic block corresponding to each CFG as the input of the graph neural network model, and use the graph neural network model for function representation; in the graph neural network model, each node obtains the information of its corresponding k-order neighbors; the k-order neighbors of a node are the nodes in the graph neural network model whose connection level with the node is less than or equal to k.

2. The method as described in claim 1, characterized in that, Step S1 includes: Obtain one or more binary functions corresponding to the binary code, count the arithmetic instructions, constants, strings, and jump information in the binary functions, generate an instruction set for each binary function, filter the operands of each instruction, replace all basic memory addresses with the special symbol MEM, and replace all immediate values ​​with the special symbol IMM with the special symbol IMM, to obtain the processed instruction set features; the basic memory refers to the memory area occupying the address space of 0 to 640KB.

3. The method as described in claim 1, characterized in that, In the graph neural network model, an aggregator is constructed for each node. The aggregator is implemented through an aggregation function. The aggregator is used to acquire and aggregate the state information of the node's k-th order neighbors. Based on the aggregated state information of the k-th order neighbors and the state information of the node, the embedding vector of the node is generated. That is, for each node: the iteration number num = 0 is defined as the input of the graph neural network; when the current iteration number num ≥ 1, the state information of the node is updated to nodenum based on the current state information of the node's k-th order neighbors and the current state information of the node itself; the embedding vector vecnum-1 of the node is acquired at the num-1th iteration; the aggregator of the node generates the aggregated representation groupnum of the node based on the state information nodenum and the embedding vector vecnum-1; the aggregated representation groupnum of the node is concatenated with the aggregated representation groupnum-1 of the node, and the embedding vector vecnum is generated through a nonlinear transformation.

4. The method according to any one of claims 1-3, characterized in that, Following step S5, step S6 is further included: applying the function representation result to the similarity judgment.

5. A cross-platform binary function representation device for control flowcharts, used to implement the method of any one of claims 1-4, characterized in that, include: Instruction feature acquisition module: configured to acquire binary code and extract instruction set features corresponding to the binary code, wherein the instruction set features include multiple instruction features; Feature vector module: configured to input the instruction set features into the Word2Vec model to obtain the feature vectors of each instruction feature; Basic block embedding module: Configured to obtain multiple CFGs corresponding to the binary code, and based on the feature vector of the instruction features and the LSTM model, to perform basic block embedding on each basic block in each CFG to obtain the feature vector of each basic block; Filtering module: Configured to filter invalid nodes in CFG based on the relationship between the total number of basic blocks in each CFG and the preset basic block size, and obtain the feature vector set corresponding to the filtered basic blocks; Graph Neural Network Representation Module: Configured to acquire the structural information of each CFG, and use the filtered feature vector set and structural information of each basic block corresponding to each CFG as input to the graph neural network model, and use the graph neural network model to perform function representation; in the graph neural network model, each node acquires the information of its corresponding k-order neighbors; The k-th order neighbors of a node are the nodes in the graph neural network model whose connection level with the node is less than or equal to k.

Images