Semantics-based multi-architecture binary function name prediction method

Abstract

The present invention belongs to the field of function name prediction technology, and specifically relates to a semantic-based multi-architecture binary function name prediction method. The method first promotes LLVM IR to an intermediate language to solve the difference problem between different architectures; after promoting to the intermediate language, regular expressions are used to extract function names and function body information, and then a positive and negative sample function name binary classification model obtained by training large-scale data is used to remove meaningless function names, and then the function names are fused for morphological and semantic similarities; and then the function bodies are standardized to reduce the sparsity of function body information, improve the quality of the sequential structure information of the function body, and ensure the correctness of encoding and decoding. The function name and function body processed by the above process are input into the seq2seq model to obtain a model MFNP, which can provide a more semantically accurate function name.

Description

Technical Field

[0001] The present invention belongs to the technical field of function name prediction, and in particular relates to a semantics-based multi-architecture binary function name prediction method. Background Art

[0002] Reverse engineering is a crucial tool for analyzing malware. In security analysis, reverse engineering requires highly sophisticated techniques, requiring even experienced professionals to invest significant time to obtain valuable results. The difficulty of reverse engineering stems primarily from the frequent occurrence of poorly readable assembly code during code audits, making it difficult to quickly and accurately understand its meaning. Most commercial-off-the-shelf (COTS) software is closed-source, and to reduce the size of released software, binary files are typically released stripped of debugging information. Even some malicious binaries intentionally strip critical source-level information to prevent reverse analysis. These stripped binaries contain only low-level information, such as instructions and registers, that is difficult to read and understand, making reverse engineering more challenging.

[0003] The similarities between natural language and machine instructions inspired early security researchers. They sought to apply mature models from the natural language field to the security field. Debin is a debug information system that predicts stripped binary files, supporting both X86 and ARM architectures. It implements debug information prediction using a probabilistic model in conditional random fields. One limitation of Debin is that, since it doesn't use a neural network, it lacks the ability to predict new words. Another limitation of Debin is that its model only considers a match successful if the function name is completely matched. However, most function names are composed of multiple substrings, making this criterion unreasonable.

[0004] Code2vec is an attention-based neural network that learns to represent code snippets of any size as fixed-length continuous vectors. It uses a soft attention mechanism on the syntactic paths in the abstract syntax tree, aggregating all path vectors in the tree into a single vector to predict function names. Code2vec's relative simplicity and distributed nature ensure the generalizability of function name prediction. Thanks to the attention mechanism, the prediction results are interpretable. This vector can be used to predict semantic properties of code snippets.

[0005] Punstrip combines probabilistic fingerprints of binary code with probabilistic graphical models to predict function names across multiple compilers and optimization levels. It also leverages word2vec's CBOW and skip-gram algorithms to predict function names based on semantic similarity in code structure within stripped binaries. However, it performs poorly under dynamic cross-compilation and optimization options. This is due to differences in data samples, particularly between the clang and gcc compilers, generating different data. While this method performs well under a single condition, it has significant limitations in real-world environments.

[0006] Nero obtains call site information through static analysis of binary files and uses GNN and LSTM as encoders and decoders, respectively, to predict program function names. This method is based on call site implementation, first processing the program's control flow graph (CFG) and then reconstructing the call site information. This method uses both concrete and abstract numerical values ​​to achieve an enhanced representation of the call site. However, the method's dataset contains only 541 binary samples, a relatively small number, which limits its applicability. Furthermore, it relies too heavily on the calling relationships within functions, which limits its applicability.

[0007] NFRE proposes a lightweight framework for function name prediction on the X86 architecture. It extracts basic block features from control flow graph subgraphs as semantic features of the function body. However, due to the excessive granularity of the extracted features, this approach results in excessively large instruction-level data encoded by the encoder and a relatively short function name output by the decoder.

[0008] Function name prediction is a translation problem from code to natural language. Previous research has been conducted at the instruction sequence level. Due to the disparity in length between input and output sequences, especially when function names vary slightly in length while function bodies vary significantly, stripping function name information can hinder reverse engineering and increase the difficulty of reverse engineering. Summary of the Invention

[0009] To address the defects and problems of stripping function name information, which affects reverse analysis, the present invention provides a semantic-based multi-architecture binary function name prediction method.

[0010] The solution adopted by the present invention to solve the technical problem is: a semantic-based multi-architecture binary function name prediction method, comprising the following steps:

[0011] Step 1: Obtain an intermediate language file from the binary data samples of multiple architectures through LLVM-RetDec;

[0012] Step 2: Select a readable intermediate language file, extract the function name and function body information from the readable intermediate language file, and process the function name and function body separately; perform denoising on the function name to reduce the sparsity of the function name; perform normalization and semantic feature extraction on the function body;

[0013] Step 3: Input the processed function name and function body data into the machine translation model for training to obtain the trained prediction model MFNP;

[0014] Step 4: Input the binary file stripped of the function name into the prediction model MFNP to predict the function name.

[0015] In the above-mentioned semantic-based multi-architecture binary function name prediction method, in step 2, the function names are denoised to reduce the sparsity of the function names. Specifically, the method removes meaningless function names from the dataset and fuses similar semantic tokens based on the morphological and semantic similarity of the function name tokens to reduce the sparsity of the function name tokens.

[0016] The above semantic-based multi-architecture binary function name prediction method uses WordNe to compare the similarity of function name tokens that are morphologically dissimilar but semantically similar. Specifically, it obtains the lowest common hypernym set of two words and calculates the depth of the lowest hypernym subset respectively. i 、deep j , calculate the similarity between two words,

[0017]

[0018] Where: deep i is the depth of word i and the lowest hypernym subset; deep j is the depth between word j and the lowest hypernym subset; sim is the specific value of the similarity between the two words, which is greater than 0 and less than or equal to 1; if there is no path between the two words, sim is -1.

[0019] In the above-mentioned semantic-based multi-architecture binary function name prediction method, the function body is processed in step 2, and the instruction sequence information and control flow graph of the function body corresponding to the intermediate language are extracted with the basic block as the basic unit, forming the control flow form between the basic blocks, while retaining the operator and library function names in the basic block and the name of the function called outside the function body.

[0020] The above-mentioned semantic-based multi-architecture binary function name prediction method extracts the control flow graph based on depth-first traversal and limits the walk length to complete the extraction of all control flow graph features of most function bodies.

[0021] In the above-mentioned semantic-based multi-architecture binary function name prediction method, in step 3, the machine translation model selects a neural machine translation model that supports translation between Chinese and foreign languages.

[0022] In the above semantic-based multi-architecture binary function name prediction method, the machine translation model in step 3 can select the OpenNMT neural machine translation model.

[0023] Beneficial effects of the present invention: The present invention uses LLVM RetDec to upgrade binary files to intermediate language (IR) files, and then compares the extracted readable intermediate language .ll files in terms of morphology and semantic similarity to achieve function name similarity fusion to reduce the sparsity of function name data; at the same time, the function body corresponding to the function name is normalized, and the basic blocks carrying sequential instruction semantic information and the function body control flow graph with the basic blocks as the basic unit are extracted as the semantic features of the function body to complete the prediction of the function name. This method can support the function name prediction work of stripped binary files under the four mainstream architectures of X86, X64, MIPS, and ARM. A stripped binary file is input to MFNP, and MFNP can output a predicted function name; compared with Debin, MFNP can support the prediction work of newly stripped binary function names. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 2 is the overall architecture diagram of the prediction method of the present invention.

[0025] Figure 2 This is the LLVM framework diagram. DETAILED DESCRIPTION

[0026] To address the problem of stripping function name information, which affects reverse engineering analysis, the present invention provides a semantic-based multi-architecture binary function name prediction method. The present invention is further described below with reference to the accompanying drawings and examples.

[0027] Example 1: This example provides a semantic-based multi-architecture binary function name prediction method. The overall structure diagram of the method is as follows: Figure 1The main idea is as follows: First, binary data samples from multiple architectures are elevated to the intermediate language level through LLVM-RetDec to eliminate the influence of the architecture. After obtaining the intermediate language file, MFNP selects a readable intermediate language .ll file and extracts function names and function bodies from it. The function names are processed to remove noise and reduce sparsity, and key semantic features are extracted from the function bodies. The processed function name and function body data are input into a machine translation model for training, resulting in a model that is saved. Finally, the binary file stripped of function names is input into MFNP to predict the function names. The details are as follows.

[0028] 1. Promote binary data samples of multiple architectures (such as X86, ARM, and MIPS) to the intermediate language level through LLVM-RetDec to solve the differences between different architectures. The LLVM framework is shown in the figure below. Figure 2 As shown, it supports multiple programming languages ​​and can work on multiple architectures. LLVM IR supports a three-address code format similar to assembly language. LLVM has the jump instruction br and the call instruction call. A basic block consists of a section of instruction stream. IR under the static single assignment (SSA) mechanism performs only one assignment operation on each variable. Under the SSA mechanism, each used variable can only be reached by one definition, which also makes the UD chain (Use-Define Chain) very clear. At the same time, the SSA mechanism also causes the number of lines of generated LLVM IR to often be 10 times the number of lines of the corresponding C source code. SSA can simplify data flow analysis. Data flow value propagation is not limited to the control flow path. The introduction of the SSA mechanism simplifies the compilation optimization process, thereby achieving better optimization results.

[0029] 2. After obtaining the intermediate language, select a readable intermediate language .ll file, extract the function name and function body information from the readable intermediate language .ll file, and then process the function name and function body separately. The function name needs to remove noise data and reduce sparsity processing; the function body needs to be normalized and key semantic features extracted.

[0030] (1) Since some function names in the data set are meaningless, such as function_6310, jfioew, and helojsh, these meaningless function name data are noise data in the model. The presence of such noise data will affect the performance of the model. Therefore, denoising is required. The removal of meaningless function names is essentially a data binary classification task. This embodiment uses mature technologies in spam SMS classification to process function name noise data. Among them, a Python script is used to randomly generate strings as positive function name samples. Function name negative samples are extracted from mainstream open source toolkits such as binutils, findutils, diffutils, coreutils, vim, and openssl by sharing a large number of available open source C language libraries through B2SMatcher. Since the classification of positive and negative sample function names is not complicated, MFNP selects the Bernoulli binary classification model of naive Bayes to implement the binary classification work, and the classification accuracy is 91.87%. After the removal of meaningless function names is completed through the Bernoulli binary classification model of naive Bayes, in order to ensure the quality of the function name data, manual secondary screening is also required.

[0031] For the naming of function names, snake case or camel case is used. <unk>(Unknown Words) This output is OOV (Out of Vocabulary), also known as unknown words. Unknown words refer to words that appear during testing but were not encountered during training. This embodiment reduces the sparsity of function name tokens by merging semantically similar function name tokens. Specifically.

[0032] The tokens divided by the function name are regarded as English strings, and semantically similar tokens are merged from the perspectives of morphological similarity and semantic similarity.

[0033] The first case: similar in form, for example: version and versions, type and types.

[0034] The second case is the case with similar semantics: aim and object, target, shut and close.

[0035] Such strings are semantically similar, but their similarity cannot be judged from the morphological point of view. This paper uses WordNet

[12] to solve the similarity comparison of two function name tokens that are morphologically dissimilar but semantically similar. The steps to implement the semantic similarity comparison of two words using WordNet are as follows:

[0036] a. Get the lowest common hypernym of the two words. A hypernym is a word that is more general than the current word. For example, "color" is a hypernym of "red." This is a logical relationship in language.

[0037] b. After obtaining the lowest common superordinate subset, calculate the depth deepi and deep of the lowest superordinate subset respectively. j , the similarity calculation formula of two words is:

[0038]

[0039] Where: deep i is the depth of word i and the lowest hypernym subset; deep j is the depth between word j and the lowest hypernym subset; sim is the specific value of the similarity between the two words, which is greater than 0 and less than or equal to 1. If there is no path between the two words, sim is -1. Due to the limitations of WordNet's existing capabilities, the number of function name similarity comparisons that can be implemented using WordNet is limited.

[0040] Reducing the sparsity of function names is an effective way to avoid the occurrence of OOV. First, remove meaningless function names in the data set. This embodiment reduces the sparsity of function name tokens by fusing similar semantic tokens with relatively similar tokens in the function name token data set. The similarity fusion of function name tokens can be completed through the morphological similarity and semantic similarity of function name tokens respectively. An executable program often contains a large number of function names. Function names with the same meaning can be expressed through function naming forms of different forms and contents. Function names named in different forms may have the same meaning, such as seed_to_aim and seed_to_object. Longer function name tokens often carry more semantic information. Therefore, if after comparing two function names, they meet the morphological or semantic similarity, the function name token with the longest length is taken as the function name token of the two.

[0041] (2) As for the function body, a large function body will contain many useless parameters, which will affect the quality of the final semantic acquisition. Therefore, when processing the function body, the processing principle is to reduce the size of the function body as much as possible without affecting the basic semantics of the function body. First, the control flow graph of the function body corresponding to the intermediate language is extracted with the basic block as the basic unit, forming the control flow form between the basic blocks, while retaining the operators and library function names in the basic block and the names of the functions called outside the function body. This is because in the early investigation of experimental sample data, it was found that most operators are followed by numbers. And due to the SSA characteristics of LLVM, such numbers after the operator have great randomness. If such numerical features are retained, the length of the function body will be increased, which will reduce the experimental effect. It is worthwhile to sacrifice such a small part of the numerical semantic features that are not located after the operator in the preliminary experiment in exchange for better experimental results.

[0042] Preserving the library function names and the names of the calling functions can effectively prevent OOV. At the same time, the called functions are processed according to the function names, and the function names are cut into camel case and snake case to obtain more function name tokens.

[0043] A Bag of Words is a collection of tokens of the same type, where the tokens are independent of each other. See Table 1 for details.

[0044] Table 1 Tokens of bag-of-words in different function bodies

[0045]

[0046] Because different function bodies differ significantly, complex functions have more complex control flow graphs than simpler ones. This paper extracts control flow graphs based on a depth-first traversal approach, limiting the walk length to 12 (a depth-first walk length of 12 is sufficient to extract all control flow graph features for most function bodies).

[0047] 3. Input the processed function name and function body data into a machine translation model for training to generate a prediction model. This example uses the relatively mature OpenNMT neural machine translation model. In other words, any neural machine translation model that supports tasks such as English-German translation and Chinese-English translation can be used for this function name prediction task.

[0048] The encoder and decoder paradigm is essentially a collaboration between two RNN models. The encoder compresses the sequence information into a vector of a specified length. The obtained vector can be regarded as the feature vector extracted from the sequence in the input encoder. During the encoding process of the encoder, the semantic vector C obtained from the last hidden state transition is input into the RNN of the decoder as the initial state. The decoder processes the semantic vector to obtain a semantic sequence. The ultimate ideal result of the decoder decoding is to obtain a semantic sequence that is similar or even identical to the sequence input to the encoder. In short, MFNP compresses the instruction semantic sequence in the function body into a semantic vector with the help of the encoder, and the decoder obtains the corresponding function name token based on the semantic vector provided by the encoder. Finally, the correspondence between the function body instruction sequence and the function name token is established by the encoder and decoder paradigm. OpenNMT is an open source neural machine translation system that is implemented through the encoder and decoder paradigm.

[0049] 4. Input the binary file with the function names stripped off into MFNP to predict the function names.

[0050] Experimental Example: This experimental example uses a specific dataset as an example. The computer configuration is an Intel(R) Xeon(R) W-3175X CPU @ 3.10GHz and 384GB RAM. The software used is Python 3.7.6, scikit-learn 1.0.2, OpenNMT-py 2.2.0, gensim 3.8.3, and Levenshtein 0.18.1. The method of the present invention was verified. The details are as follows.

[0051] 1. Experimental Dataset

[0052] The dataset used in the experiment should be highly representative of real-world environments. The dataset includes binutils, busybox, coreutils, curl, diffutils, findutils, gmp, ImageMagick, openssl, putty, sqlite, and zlib. These datasets were compiled using GCC 7.5.0 with different optimization options to generate binary files, as shown in Table 2. The readable intermediate language files obtained through decompilation are more realistic. Therefore, this paper selected the readable intermediate language files obtained through decompilation using LLVM-RetDec as experimental data.

[0053] Table 2 MFNP data compilation environment

[0054] Compiler Version Target platform / architecture Compiler optimization options GCC 7.5.0 MIPS O0 / O1 / O2 / O3 GCC 7.5.0 ARM O0 / O1 / O2 / O3 GCC 7.5.0 X86 O0 / O1 / O2 / O3

[0055] X86 uses a CISC (Complex Instruction Set), while MIPS and ARM use a RISI (Reduced Instruction Set). The decompiler retdec used in this article does not currently support the 64-bit MIPS architecture. To demonstrate the actual performance of MFNP across various architectures, this test example references MIPS 32-bit data and extracts 131,730 data points from the 32-bit and 64-bit datasets corresponding to X86 and ARM, respectively. This constructed dataset meets the requirements for multi-architecture support and optimization resistance. Table 3 shows the original data and the data before and after removing function name noise.

[0056] Table 3 Comparison of data before and after removing function name noise data

[0057]

[0058] 2. Evaluation indicators

[0059] This test uses Precision, Recall, and F1-score to evaluate the performance of MFNP against existing technologies. For ease of evaluation, function names are converted to lowercase English. MFNP predicts a function name S, which is divided into several tokens: {s1, s2...sm}. The truth function name is also divided into several tokens: {w1, w2,...wn}. The formulas for calculating TP, FP, and FN are shown below.

[0060]

[0061]

[0062]

[0063]

[0064]

[0065]

[0066] The D function in the formula is similar to the Dirichlet function, and its final result is either 0 or 1. The calculation of TP, FP, and FN here differs from the binary classification task. If the token in the predicted function name appears in the true function name, then the D function is equal to 1; otherwise, it is 0. Similarly, for FP, if the token in the function name does not appear in the function name, it is scored as 1; if it does, it is scored as 0. Each TP, FP, and FN calculation is for a single function name sample. Ultimately, to maximize the authenticity of the experimental results, the evaluation process does not calculate Precision, Recall, and F1-score separately and then average them. Instead, the numerators and denominators of Precision, Recall, and F1-score for all samples are summed sequentially. The ratio of the final numerator and denominator sum is used as the Precision, Recall, and F1-score. The final experimental results are calculated. For example, if the Precision of function name s1 is 3 / 5, the Precision of function name s1 is 2 / 3. The precision of the two is not (3 / 5+2 / 3) / 2=8 / 15, but equal to (3+2) / (3+5)=5 / 8.

[0067] 3. Contrast

[0068] Table 4 Some examples of MFNP generated function names

[0069]

[0070] MFNP, NERO, and Debin are all capable of predicting function names. However, because Debin does not use neural networks, it lacks the ability to predict unknown function names. Debin supports the X86 and ARM architectures, but not the MIPS architecture. NERO uses a dataset under the X86 architecture for training and verification to ultimately achieve function name prediction. Therefore, NERO does not have the ability to predict function names for multiple architectures. The datasets used by Debin and NERO come from a wide range of sources and include binaries with various compilation optimization options. The data samples used by MFNP are binary data files with multiple compilation optimization options obtained through the O0, O1, O2, and O3 compilation optimization options. Therefore, Debin, NERO, and MFNP all have the ability to identify binaries with multiple compilation optimization options. The basic tool used in Debin's work is BAP-IR, the basic tool used in NERO's work is IDA, and the basic tool used in MFNP proposed in this article is LLVM-RetDec.

[0071] The comparison between MFNP, NERO and Debin is shown in Table 5.

[0072] Table 5 Comparison of MFNP, NERO, and Debin

[0073]

[0074] (Note: Y represents realized, N represents not realized)

[0075] (1) This experimental example first tests the effect of MFNP under the X86, ARM, and MIPS architectures. The results are shown in Table 6.

[0076] Table 6 Test results of MFNP under different architectures

[0077]

[0078] As shown in Table 6, the proposed MFNP supports function name prediction for a variety of architectures and achieves excellent results. Compared to existing work, MFNP achieves comparable function name prediction results. In particular, it achieves significantly better results for function name prediction in stripped binary files on the X86 and ARM architectures compared to existing work.

[0079] (2) This experiment compares MFNP with Debin on the X86 and ARM architectures, which both methods support. Three evaluation metrics, precision, recall, and F1, are used to assess the performance of each method on the X86 dataset. The results are shown in Table 7.

[0080] Table 7 Comparison results between MFNP and Debin

[0081]

[0082] Table 7 compares MFNP and Debin. Debin performs well on samples that have appeared in the training set, as supported by both methods, on the X86 and ARM architectures. However, it performs poorly on newly stripped binaries. The proposed method significantly outperforms Debin, demonstrating superior performance.

[0083] (3) This experiment also compares MFNP and NERO on the X86 architecture. We use three evaluation metrics, Precision, Recall, and F1, to evaluate the performance of each method on the X86 dataset. The results are shown in Table 8.

[0084] Table 8 Comparison results between MFNP and NERO

[0085]

[0086] Table 8 shows the comparative experimental results between MFNP and NERO, demonstrating that MFNP performs relatively well. Model training using larger data samples performed just as well as in experiments; in machine learning tasks, larger data samples often lead to better generalization. Furthermore, the semantic features extracted by MFNP include control flow graphs, as well as operators, library functions, and call functions within basic blocks. For library functions within basic blocks, the processing of call functions yields more function name tokens; these tokens are highly helpful in the function name prediction task, leading to better results.< / unk>

Claims

1. A semantics-based multi-architecture binary function name prediction method, characterized by: The following steps are involved: Step 1: Obtain an intermediate language file from the binary data samples of multiple architectures through LLVM-RetDec; Step 2: Select a readable intermediate language file, extract function name and function body information from the readable intermediate language file, and process the function name and function body respectively; denoise the function name to reduce the sparsity of the function name; Normalize the function body and extract semantic features; Step 3: Input the processed function name and function body data into the machine translation model for training to obtain the trained prediction model MFNP; Step 4: Input the binary file stripped of the function name into the prediction model MFNP to predict the function name.

2. The semantic-based multi-architecture binary function name prediction method according to claim 1, characterized in that: In step 2, the function names are denoised to reduce their sparsity. Specifically, meaningless function names in the dataset are removed and similar semantic tokens are fused based on their morphological and semantic similarities to reduce their sparsity.

3. The semantic-based multi-architecture binary function name prediction method according to claim 2, characterized in that: Use WordNe to compare the similarity of function name tokens that are morphologically dissimilar but semantically similar. Specifically, obtain the lowest common hypernym set of the two words and calculate the depth of the lowest hypernym subset respectively. i 、deep j , calculate the similarity between two words, Where: deep i is the depth of word i and the lowest hypernym subset; deep j is the depth of word j to the lowest hypernymous subset; sim is the specific value of the similarity between the two words. sim is greater than 0 and less than or equal to 1. If there is no path between the two words, sim is -1.

4. The semantic-based multi-architecture binary function name prediction method according to claim 1, characterized in that: In step 2, the function body is processed by extracting the instruction sequence information and control flow graph of the function body corresponding to the intermediate language with the basic block as the basic unit, forming the control flow form between the basic blocks, while retaining the operator and library function names in the basic block and the name of the called function outside the function body.

5. The semantic-based multi-architecture binary function name prediction method according to claim 4, characterized in that: Control flow graph extraction is performed based on depth-first traversal, limiting the walk length to 12.

6. The semantic-based multi-architecture binary function name prediction method according to claim 1, characterized in that: In step 3, the machine translation model selects a neural machine translation model that supports translation between Chinese and foreign languages.

7. The semantic-based multi-architecture binary function name prediction method according to claim 6, characterized in that: In step 3, select the OpenNMT neural machine translation model as the machine translation model.

Images