Binary function similarity detection method, device and equipment

Abstract

The application provides a binary function similarity detection method, device and equipment, the method comprises the following steps: extracting the assembly instruction of each function in a binary file and the function category; constructing a function embedding vector of multi-granularity feature fusion according to the assembly instruction and the function category; determining the similarity of different functions according to the function embedding vector. Through the extraction of the assembly instruction of each function in the binary file and the function category, the function embedding vector based on the multi-granularity feature fusion is constructed, so that the function embedding vector contains semantic information of different granularities, the effect of function feature expression can be enhanced, and the accuracy of cross-platform binary function similarity can be improved.

Description

Technical Field

[0001] This invention relates to the field of secure multi-party computation technology, and in particular to a binary function similarity detection method, apparatus, and device. Background Technology

[0002] Binary function analysis is a crucial research area in information security, with one goal being to detect similar binary functions without accessing the source code. Due to the heterogeneous nature of IoT devices, the same program can compile into different functions on different platforms. To find relationships between vulnerabilities, it's necessary to identify connections between the code itself to determine if vulnerabilities exist or if there is malicious code plagiarism. Different compilation architectures, operating systems, compilers, and compilation options are collectively referred to as cross-platform, making cross-platform function similarity detection also of significant importance.

[0003] Currently, binary file similarity comparison schemes mainly fall into two categories based on features: traditional methods and deep learning-based methods. Traditional methods primarily calculate features from assembly code, such as the number of instructions, function calls, string constants, and numeric constants, and then use graph matching algorithms to calculate the similarity between two binary files. Deep learning-based methods mainly extract deep features from assembly instructions or control flow graphs using deep neural networks, and finally use cosine distance to calculate binary file similarity. Neither of these methods can accurately learn the semantic information of assembly instructions, resulting in low accuracy. Summary of the Invention

[0004] The purpose of this invention is to provide a binary function similarity detection method, apparatus, and device, which solves the problem of low accuracy in existing binary file similarity comparison methods.

[0005] To achieve the above objectives, embodiments of the present invention provide a binary function similarity detection method, comprising:

[0006] Extract the assembly instructions and function category for each function in the binary file;

[0007] Based on the assembly instructions and function categories, construct a function embedding vector with multi-granularity feature fusion;

[0008] The similarity of different functions is determined based on the function embedding vector.

[0009] Optionally, constructing a multi-granularity feature fusion function embedding vector based on the assembly instructions and function categories includes:

[0010] The assembly instructions are converted into words in natural language processing, and the function is converted into sentences in natural language processing to obtain word vectors;

[0011] Based on the word vectors, obtain multi-granularity feature vectors;

[0012] Multi-granularity feature vectors are fused to obtain function embedding vectors;

[0013] The multi-granularity features include: word-level semantic features, multi-word semantic features, and sentence-level semantic features.

[0014] Optionally, the multi-granularity features include: word-level semantic features, and obtaining a multi-granularity feature vector based on the word vectors, including:

[0015] The word vectors are combined to obtain the input feature map;

[0016] Embed the function category into the input feature map to obtain the category feature map;

[0017] Multiply the category feature map with the transpose of the input feature map to obtain the category-word similarity matrix;

[0018] The category-word similarity matrix is ​​pooled to obtain attention weights;

[0019] Based on the attention weights and the input feature map, a word-level semantic feature vector based on the attention mechanism is obtained.

[0020] Optionally, the multi-granularity features include: semantic features of multiple words; and obtaining a multi-granularity feature vector based on the word vectors, including:

[0021] By convolving the word vectors with K convolution kernels respectively, K feature vectors corresponding to different convolution kernels are obtained;

[0022] By concatenating the K feature vectors, we obtain the semantic feature vectors of the multi-word.

[0023] Optionally, the multi-granularity features include: sentence-level semantic features, and obtaining multi-granularity feature vectors based on the word vectors, including:

[0024] The word vectors are pooled to obtain sentence-level semantic feature vectors.

[0025] Optionally, the step of fusing multi-granularity feature vectors to obtain a function embedding vector includes:

[0026] The semantic feature vectors at the word level, the semantic feature vectors of multiple words, and the semantic feature vectors at the sentence level are fused to obtain the function embedding vector.

[0027] Optionally, the similarity of different functions is determined based on the function embedding vector, including:

[0028] The similarity of different functions is calculated based on the cosine distance between the function embedding vectors corresponding to functions on different platforms.

[0029] To achieve the above objectives, embodiments of the present invention provide a binary function similarity detection device, comprising:

[0030] The first extraction module is used to extract the assembly instructions and function categories of each function in the binary file;

[0031] The vector construction module is used to construct a multi-granularity feature fusion function embedding vector based on the assembly instructions and function categories;

[0032] A similarity detection module is used to determine the similarity between different functions based on the function embedding vector.

[0033] Optionally, the vector construction module includes:

[0034] The first acquisition unit is used to convert the assembly instructions into words in natural language processing and the function into sentences in natural language processing to obtain word vectors;

[0035] The second acquisition unit is used to acquire multi-granularity feature vectors based on the word vectors;

[0036] The first processing unit is used to fuse multi-granularity feature vectors to obtain function embedding vectors;

[0037] The multi-granularity features include: word-level semantic features, multi-word semantic features, and sentence-level semantic features.

[0038] Optionally, the multi-granularity features include: word-level semantic features, and the second acquisition unit includes:

[0039] The first acquisition subunit is used to combine the word vectors to obtain an input feature map;

[0040] The second acquisition subunit is used to embed the function category into the input feature map to obtain the category feature map;

[0041] The third acquisition subunit is used to multiply the category feature map with the transpose of the input feature map to obtain a category-word similarity matrix;

[0042] The fourth acquisition subunit is used to perform pooling processing on the category and word similarity matrix to obtain attention weights;

[0043] The fifth acquisition subunit is used to obtain a word-level semantic feature vector based on the attention mechanism according to the attention weight and the input feature map.

[0044] Optionally, the multi-granularity features include: semantic features of multiple words, and the second acquisition unit includes:

[0045] The sixth acquisition subunit is used to convolve the word vectors with K convolution kernels respectively to obtain K feature vectors corresponding to different convolution kernels;

[0046] The seventh sub-unit is used to concatenate K feature vectors to obtain semantic feature vectors of multi-words.

[0047] Optionally, the multi-granularity features include: sentence-level semantic features, and the second acquisition unit includes:

[0048] The eighth acquisition subunit is used to perform pooling processing on the word vectors to obtain sentence-level semantic feature vectors.

[0049] Optionally, the first processing unit is specifically used for:

[0050] The semantic feature vectors at the word level, the semantic feature vectors of multiple words, and the semantic feature vectors at the sentence level are fused to obtain the function embedding vector.

[0051] Optionally, the similarity detection module is specifically used to: calculate the similarity of different functions based on the cosine distance between the function embedding vectors corresponding to functions on different platforms.

[0052] To achieve the above objectives, embodiments of the present invention provide a binary function similarity detection device, comprising: a transceiver and a processor;

[0053] The processor is used to: extract the assembly instructions and function category of each function in the binary file; construct a function embedding vector with multi-granularity feature fusion based on the assembly instructions and function category; and determine the similarity of different functions based on the function embedding vector.

[0054] Optionally, the processor constructs a multi-granularity feature fusion function embedding vector based on the assembly instructions and function categories, including:

[0055] The assembly instructions are converted into words in natural language processing, and the function is converted into sentences in natural language processing to obtain word vectors;

[0056] Based on the word vectors, obtain multi-granularity feature vectors;

[0057] Multi-granularity feature vectors are fused to obtain function embedding vectors;

[0058] The multi-granularity features include: word-level semantic features, multi-word semantic features, and sentence-level semantic features.

[0059] Optionally, the multi-granularity features include: word-level semantic features, wherein the processor obtains a multi-granularity feature vector based on the word vectors, including:

[0060] The word vectors are combined to obtain the input feature map;

[0061] Embed the function category into the input feature map to obtain the category feature map;

[0062] Multiply the category feature map with the transpose of the input feature map to obtain the category-word similarity matrix;

[0063] The category-word similarity matrix is ​​pooled to obtain attention weights;

[0064] Based on the attention weights and the input feature map, a word-level semantic feature vector based on the attention mechanism is obtained.

[0065] Optionally, the multi-granularity features include: semantic features of multiple words, and the processor obtains a multi-granularity feature vector based on the word vectors, including:

[0066] By convolving the word vectors with K convolution kernels respectively, K feature vectors corresponding to different convolution kernels are obtained;

[0067] By concatenating the K feature vectors, we obtain the semantic feature vectors of the multi-word.

[0068] Optionally, the multi-granularity features include: sentence-level semantic features, wherein the processor obtains a multi-granularity feature vector based on the word vectors, including:

[0069] The word vectors are pooled to obtain sentence-level semantic feature vectors.

[0070] Optionally, the processor performs a fusion process on the multi-granularity feature vectors to obtain a function embedding vector, including:

[0071] The semantic feature vectors at the word level, the semantic feature vectors of multiple words, and the semantic feature vectors at the sentence level are fused to obtain the function embedding vector.

[0072] Optionally, the processor determines the similarity of different functions based on the function embedding vector, including:

[0073] The similarity of different functions is calculated based on the cosine distance between the function embedding vectors corresponding to functions on different platforms.

[0074] To achieve the above objectives, embodiments of the present invention provide an electronic device, including: a transceiver, a processor, a memory, and a program or instructions stored in the memory and executable on the processor; when the processor executes the program or instructions, it implements the above-described binary function similarity detection method.

[0075] To achieve the above objectives, embodiments of the present invention provide a readable storage medium storing a program or instructions thereon, which, when executed by a processor, implement the steps of the binary function similarity detection method described above.

[0076] The beneficial effects of the above-mentioned technical solution of the present invention are as follows:

[0077] In embodiments of the present invention, by extracting the assembly instructions and function categories of each function in a binary file, a function embedding vector based on multi-granularity feature fusion is constructed. This enables the function embedding vector to contain semantic information of different granularities, thereby enhancing the effect of function feature expression and improving the accuracy of cross-platform binary function similarity. Attached Figure Description

[0078] Figure 1 This is a flowchart illustrating the binary function similarity detection method according to an embodiment of the present invention;

[0079] Figure 2 This is a schematic diagram of a convolutional neural network based on multi-granularity feature fusion according to an embodiment of the present invention;

[0080] Figure 3 This is a schematic diagram of the binary function similarity detection device according to an embodiment of the present invention;

[0081] Figure 4 This is a schematic diagram of the binary function similarity detection device according to an embodiment of the present invention;

[0082] Figure 5 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0083] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0084] It should be understood that the phrase "one embodiment" or "an embodiment" throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of the invention. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments.

[0085] In various embodiments of the present invention, it should be understood that the sequence number of each process described below does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0086] In addition, the terms "system" and "network" are often used interchangeably in this article.

[0087] In the embodiments provided in this application, it should be understood that "B corresponding to A" means that B is associated with A, and B can be determined based on A. However, it should also be understood that determining B based on A does not mean determining B solely based on A; B can also be determined based on A and / or other information.

[0088] like Figure 1 As shown, this embodiment of the invention provides a binary function similarity detection method, including:

[0089] Step 11: Extract the assembly instructions and function category of each function in the binary file.

[0090] This embodiment performs data preprocessing on the binary file. First, the binary file firmware is disassembled to obtain the firmware's assembly code set. Each code consists of different functions, and disassembly reveals each function and its assembly instructions. Finally, preprocessing is used to clean the assembly instructions. For example, preprocessing replaces all basic memory addresses with the special symbol MEM (Memory) and replaces values ​​with absolute values ​​higher than a certain threshold with the special symbol IMM (Immediate).

[0091] The function categories, such as function category labels (N classes), can convert cross-platform information into a multi-label problem. For example, they can be divided into four categories: architecture, operating system, compiler, and compilation options. Architecture includes subclasses such as arm, x86-64, x86, and mips; operating system includes subclasses such as Windows, Linux, and MAX; compiler includes subclasses such as gcc, clang, and icc; and compilation options include subclasses such as 00, 01, 02, and 03. Labels are added to the categories within each subclass. For example, in the architecture subclass, arm is labeled 0, x86-64 is labeled 1, x86 is labeled 2, and mips is labeled 3. If a binary function is compiled under arm, Windows, clang, and 00, then the category label of that binary function is (0,0,1,0).

[0092] Step 12: Construct a multi-granularity feature fusion function embedding vector based on the assembly instructions and function categories.

[0093] The multi-granularity features can include: word-level semantic features, multi-word semantic features, and sentence-level semantic features. This embodiment extracts multi-granularity semantic features of the function as a whole, constructs a function embedding vector, and fuses semantic information of different granularities to solve the problem of inaccurate semantic information learning, thereby improving the accuracy of function similarity detection.

[0094] Step 13: Determine the similarity of different functions based on the function embedding vector.

[0095] After obtaining the multi-semantic function embedding vectors, the similarity of different functions is determined based on the function embedding vectors corresponding to functions on different platforms.

[0096] In embodiments of the present invention, by extracting the assembly instructions and function categories of each function in a binary file, a function embedding vector based on multi-granularity feature fusion is constructed. This enables the function embedding vector to contain semantic information of different granularities, thereby enhancing the effect of function feature expression and improving the accuracy of cross-platform binary function similarity.

[0097] As an optional embodiment, step 12 includes:

[0098] Step 121: Convert the assembly instructions into words in natural language processing, and convert the function into sentences in natural language processing to obtain word vectors.

[0099] In binary function similarity detection, assembly instructions can be converted into words in natural language processing, and functions can be converted into sentences. For example, word2vec can be used to extract word vectors. After word vector extraction, the function can be converted into an s*d dimensional matrix, where s is the sentence length and d is the word vector dimension.

[0100] Step 122: Obtain multi-granularity feature vectors based on the word vectors; wherein the multi-granularity features include: word-level semantic features, multi-word semantic features, and sentence-level semantic features.

[0101] Based on the extracted word vectors, semantic feature vectors at the word level, semantic feature vectors between words, and semantic feature vectors at the sentence level can be obtained. These multi-granularity feature vectors can be obtained by different feature extraction modules. For example, the word-level semantic extraction module can embed function categories into the feature vectors for training, making the function embedding vectors rich in category information, thereby improving the accuracy of function similarity calculations across platforms; the multi-word semantic feature extraction module considers the order and position of controls using different windows; and the sentence-level semantic feature extraction module considers the overall nature of the function, enriching the expression of the feature vectors and improving the accuracy of function similarity calculations.

[0102] Step 123: Perform fusion processing on the multi-granularity feature vectors to obtain the function embedding vector; specifically, the fusion processing on the multi-granularity feature vectors to obtain the function embedding vector may include: fusing the semantic feature vectors at the word level, the semantic feature vectors of multiple words, and the semantic feature vectors at the sentence level to obtain the function embedding vector.

[0103] The following specific examples illustrate the process of obtaining each feature vector from the word vectors.

[0104] As an optional embodiment, the multi-granularity features include word-level semantic feature vectors, and step 122 includes:

[0105] The word vectors are combined to obtain the input feature map;

[0106] Embed the function category into the input feature map to obtain the category feature map;

[0107] Multiply the category feature map with the transpose of the input feature map to obtain the category-word similarity matrix;

[0108] The category-word similarity matrix is ​​pooled to obtain attention weights;

[0109] Based on the attention weights and the input feature map, a word-level semantic feature vector based on the attention mechanism is obtained.

[0110] In this embodiment, the word vectors in the function are combined into an input feature map F. i,j ∈R s×d Where s is the sentence length and d is the word vector dimension. In data preprocessing, cross-platform information is transformed into a multi-label problem, and a label vector is generated for each function. The class label vectors are then embedded (i.e., class embedding) to obtain the class feature map C. i,j ∈R i×d , where i is the number of categories and d is the embedding vector dimension.

[0111] Multiplying the category feature map by its transpose yields the category-word similarity matrix: CW i,j ∈R s×l After pooling and softmax, the attention weights β∈R are obtained. s The attention weights are multiplied and summed with the corresponding input features to obtain the attention-based feature vector: F1∈∑ l β l ×v l v lThis is the l-th word vector. Through the joint embedding of the category label and the word vector, the feature vector F1 contains both word and category information. It should be noted that the pooling process can be either average pooling or max pooling.

[0112] As an optional embodiment, the multi-granularity features include semantic features of multiple words, and step 122 includes:

[0113] By convolving the word vectors with K convolution kernels respectively, K feature vectors corresponding to different convolution kernels are obtained;

[0114] By concatenating K feature vectors, we obtain the semantic feature vector of a multi-word. K is greater than or equal to 1.

[0115] In this embodiment, the value of K can be determined according to the convolution requirements. Multiple convolution kernels (e.g., 2×d, 3×d, 4×d) can be used to convolve the feature map. Each kernel has multiple variations. Each kernel convolves with the word vectors to obtain a feature vector. All feature vectors are concatenated to obtain the semantic feature vector F2 of the multi-word. By convolving the feature map with multiple kernels, the features between multi-words can be captured.

[0116] As an optional embodiment, the multi-granularity features include sentence-level semantic features, and step 122 includes: performing Avg-pooling on the word vectors to obtain sentence-level semantic feature vectors.

[0117] Sentence-level semantic feature vectors F3 can be obtained using pooling layers. It should be noted that the pooling process can be either average pooling or max pooling. Average pooling sums and averages the word vectors to obtain a one-dimensional vector, thus capturing sentence-level semantic information in the features; max pooling takes the maximum value of the word vectors.

[0118] After obtaining the word-level semantic feature vector F1, the multi-word semantic feature vector F2, and the sentence-level semantic feature vector F3, F1, F2, and F3 are fused to obtain the entire sentence embedding vector, which contains category information, word vector information, and sentence-level semantic information.

[0119] After obtaining the function embedding vector, the similarity of functions across platforms can be determined based on the function embedding vector. A Siamese network can be used to train and determine whether two input functions are similar, transforming cross-platform identification into a classification problem. In the feature vector extraction of the above embodiment, category embedding is added so that the features contain category information. Similar and dissimilar functions from different platforms can be trained in the Siamese network, allowing the network to learn the platform classification information of the functions.

[0120] Specifically, the similarity of different functions can be calculated based on the cosine distance between the function embedding vectors corresponding to functions on different platforms. When using cosine distance to calculate function similarity, the input is the word vector matrix of the two functions, and the output is the similarity score, for example, 1 for similarity and 0 for dissimilarity.

[0121] In embodiments of the present invention, a convolutional neural network based on multi-granularity feature fusion is used, such as... Figure 2 As shown, the process includes obtaining word-level semantic feature vectors F1, multi-word semantic feature vectors F2, and sentence-level semantic feature vectors F3, achieving feature extraction at different granularities. Specifically, pooling strategies are applied to word embedding vectors to achieve sentence-level semantic features, enabling the function feature vectors to fully learn the high-level semantic features of the function. Different convolutional kernels are used to learn the inter-word and spatial relationships, and an attention mechanism is introduced to learn word-level semantic information. By extracting semantic features at different granularities, the feature vectors contain richer semantic information, thereby improving the accuracy of function similarity calculation. The fusion of word-level features, inter-word relationship features, and sentence-level features enriches the feature vector expression and improves the accuracy of similarity detection. Transforming cross-platform information into a classification problem and incorporating it into the learning of embedding vectors through an attention mechanism allows the learning of common characteristics between cross-platform functions, enhancing the semantic feature expression of cross-platform functions and thus improving the accuracy of cross-platform function similarity detection.

[0122] It should be noted that the embodiments of the present invention can be expanded to include more cross-platform categories by adding categories.

[0123] In embodiments of the present invention, high-level semantic features of functions are extracted through pooling, enabling the overall semantic information of the function to be learned from the function feature vector. This embodiment learns the relationships and spatial relationships between words by setting different convolutional kernels. By introducing an attention mechanism to learn word-level semantic information, and finally fusing semantic information of different granularities, the accurate expression of function semantic features is improved, thereby enhancing the accuracy of function similarity calculation.

[0124] This embodiment transforms the cross-platform problem into a classification problem by introducing an attention mechanism module that jointly embeds cross-platform categories and word vectors into the input features. This allows the feature extraction stage to learn cross-platform category information, improves the ability to express cross-platform classification features, and enhances the accuracy of function similarity calculation under cross-platform conditions.

[0125] like Figure 3 As shown, this embodiment of the invention also provides a binary function similarity detection device 300, comprising:

[0126] The first extraction module 310 is used to extract the assembly instructions and function categories of each function in the binary file;

[0127] The vector construction module 320 is used to construct a multi-granularity feature fusion function embedding vector based on the assembly instructions and function categories;

[0128] The similarity detection module 330 is used to determine the similarity of different functions based on the function embedding vector.

[0129] Optionally, the vector construction module includes:

[0130] The first acquisition unit is used to convert the assembly instructions into words in natural language processing and the function into sentences in natural language processing to obtain word vectors;

[0131] The second acquisition unit is used to acquire multi-granularity feature vectors based on the word vectors;

[0132] The first processing unit is used to fuse multi-granularity feature vectors to obtain function embedding vectors;

[0133] The multi-granularity features include: word-level semantic features, multi-word semantic features, and sentence-level semantic features.

[0134] Optionally, the multi-granularity features include: word-level semantic features, and the second acquisition unit includes:

[0135] The first acquisition subunit is used to combine the word vectors to obtain an input feature map;

[0136] The second acquisition subunit is used to embed the function category into the input feature map to obtain the category feature map;

[0137] The third acquisition subunit is used to multiply the category feature map with the transpose of the input feature map to obtain a category-word similarity matrix;

[0138] The fourth acquisition subunit is used to perform pooling processing on the category and word similarity matrix to obtain attention weights;

[0139] The fifth acquisition subunit is used to obtain a word-level semantic feature vector based on the attention mechanism according to the attention weight and the input feature map.

[0140] Optionally, the multi-granularity features include: semantic features of multiple words, and the second acquisition unit includes:

[0141] The sixth acquisition subunit is used to convolve the word vectors with K convolution kernels respectively to obtain K feature vectors corresponding to different convolution kernels;

[0142] The seventh sub-unit is used to concatenate K feature vectors to obtain semantic feature vectors of multi-words.

[0143] Optionally, the multi-granularity features include: sentence-level semantic features, and the second acquisition unit includes:

[0144] The eighth acquisition subunit is used to perform pooling processing on the word vectors to obtain sentence-level semantic feature vectors.

[0145] Optionally, the first processing unit is specifically used for:

[0146] The semantic feature vectors at the word level, the semantic feature vectors of multiple words, and the semantic feature vectors at the sentence level are fused to obtain the function embedding vector.

[0147] Optionally, the similarity detection module is specifically used to: calculate the similarity of different functions based on the cosine distance between the function embedding vectors corresponding to functions on different platforms.

[0148] It should be noted that the binary function similarity detection device provided in this embodiment of the invention can implement all the method steps implemented in the above binary function similarity detection method embodiment, and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiment and the beneficial effects will not be described in detail.

[0149] To achieve the above objectives, such as Figure 4 As shown, a binary function similarity detection device 400 according to an embodiment of the present invention includes a processor 410 and a transceiver 420, wherein,

[0150] The processor 410 is used to: extract the assembly instructions and function category of each function in the binary file; construct a function embedding vector with multi-granularity feature fusion based on the assembly instructions and function category; and determine the similarity of different functions based on the function embedding vector.

[0151] Optionally, the processor constructs a multi-granularity feature fusion function embedding vector based on the assembly instructions and function categories, including:

[0152] The assembly instructions are converted into words in natural language processing, and the function is converted into sentences in natural language processing to obtain word vectors;

[0153] Based on the word vectors, obtain multi-granularity feature vectors;

[0154] Multi-granularity feature vectors are fused to obtain function embedding vectors;

[0155] The multi-granularity features include: word-level semantic features, multi-word semantic features, and sentence-level semantic features.

[0156] Optionally, the multi-granularity features include: word-level semantic features, wherein the processor obtains a multi-granularity feature vector based on the word vectors, including:

[0157] The word vectors are combined to obtain the input feature map;

[0158] Embed the function category into the input feature map to obtain the category feature map;

[0159] Multiply the category feature map with the transpose of the input feature map to obtain the category-word similarity matrix;

[0160] The category-word similarity matrix is ​​pooled to obtain attention weights;

[0161] Based on the attention weights and the input feature map, a word-level semantic feature vector based on the attention mechanism is obtained.

[0162] Optionally, the multi-granularity features include: semantic features of multiple words, and the processor obtains a multi-granularity feature vector based on the word vectors, including:

[0163] By convolving the word vectors with K convolution kernels respectively, K feature vectors corresponding to different convolution kernels are obtained;

[0164] By concatenating the K feature vectors, we obtain the semantic feature vectors of the multi-word.

[0165] Optionally, the multi-granularity features include: sentence-level semantic features, wherein the processor obtains a multi-granularity feature vector based on the word vectors, including:

[0166] The word vectors are pooled to obtain sentence-level semantic feature vectors.

[0167] Optionally, the processor performs a fusion process on the multi-granularity feature vectors to obtain a function embedding vector, including:

[0168] The semantic feature vectors at the word level, the semantic feature vectors of multiple words, and the semantic feature vectors at the sentence level are fused to obtain the function embedding vector.

[0169] Optionally, the processor determines the similarity of different functions based on the function embedding vector, including:

[0170] The similarity of different functions is calculated based on the cosine distance between the function embedding vectors corresponding to functions on different platforms.

[0171] It should be noted that the binary function similarity detection device provided in the embodiments of the present invention can implement all the method steps implemented in the embodiments of the binary function similarity detection method and can achieve the same technical effect. Here, the parts that are the same as those in the method embodiments and the beneficial effects will not be described in detail.

[0172] Another embodiment of the electronic device of the present invention, such as Figure 5 As shown, it includes a transceiver 510, a processor 500, a memory 520, and a program or instructions stored in the memory 520 and executable on the processor 500; when the processor 500 executes the program or instructions, it implements the steps of the binary function similarity detection method described above.

[0173] The transceiver 510 is used to receive and send data under the control of the processor 500.

[0174] Among them, Figure 5 In this context, the bus architecture may include any number of interconnected buses and bridges, specifically linking various circuits together, represented by one or more processors (processor 500) and memory (memory 520). The bus architecture may also link together various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface. The transceiver 510 may be multiple elements, including transmitters and receivers, providing a unit for communicating with various other devices over a transmission medium. The processor 500 is responsible for managing the bus architecture and general processing, and the memory 520 may store data used by the processor 500 during operation.

[0175] An embodiment of the present invention provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the steps in the binary function similarity detection method described above and achieve the same technical effect. To avoid repetition, further details are omitted here.

[0176] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0177] It should be further noted that the electronic devices described in this specification include, but are not limited to, smartphones, tablets, etc., and many of the described functional components are referred to as modules in order to more specifically emphasize the independence of their implementation.

[0178] In this embodiment of the invention, the module can be implemented in software so that it can be executed by various types of processors. For example, an identified executable code module may include one or more physical or logical blocks of computer instructions, which may be constructed as objects, procedures, or functions. Nevertheless, the executable code of the identified module does not need to be physically located together, but may include different instructions stored in different bits, which, when logically combined, constitute the module and achieve the module's intended purpose.

[0179] In practice, an executable code module can be a single instruction or many instructions, and can even be distributed across multiple different code segments, different programs, and across multiple memory devices. Similarly, operational data can be identified within the module and can be implemented in any suitable form and organized within any suitable type of data structure. This operational data can be collected as a single dataset or distributed across different locations (including different storage devices), and can exist, at least in part, solely as electronic signals within the system or network.

[0180] When a module can be implemented using software, considering the current level of hardware technology, modules that can be implemented in software can be implemented using hardware circuits by those skilled in the art to achieve the corresponding functions, without considering cost. These hardware circuits include conventional very-large-scale integrated circuits (VLSI) or gate arrays, as well as existing semiconductors such as logic chips and transistors, or other discrete components. Modules can also be implemented using programmable hardware devices, such as field-programmable gate arrays, programmable array logic, and programmable logic devices.

[0181] The exemplary embodiments described above are with reference to the accompanying drawings. Many different forms and embodiments are feasible without departing from the spirit and teachings of the invention. Therefore, the invention should not be construed as limiting the exemplary embodiments set forth herein. Rather, these exemplary embodiments are provided to make the invention complete and convey the scope of the invention to those skilled in the art. In these drawings, component dimensions and relative dimensions may be exaggerated for clarity. The terminology used herein is for the purpose of describing particular exemplary embodiments only and is not intended to be limiting. As used herein, unless clearly indicated otherwise, the singular forms “a,” “an,” and “the” are intended to include all such forms. It will be further understood that the terms “comprising” and / or “including”, when used in this specification, indicate the presence of the stated features, integers, steps, operations, constructions, and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, constructions, components, and / or groups thereof. Unless otherwise indicated, when stated, a range of values ​​includes the upper and lower limits of the range and any subranges in between.

[0182] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A binary function similarity detection method characterized by, The method comprises the following steps: extracting assembly instructions of each function in a binary file and function categories; constructing function embedding vectors of multi-granularity feature fusion according to the assembly instructions and the function categories; determining the similarity of different functions according to the function embedding vectors. The method of constructing function embedding vectors of multi-granularity feature fusion according to the assembly instructions and the function categories comprises the following steps: convert the assembly instructions into words in natural language processing, and convert the functions into sentences in natural language processing to obtain word vectors; obtaining multi-granularity feature vectors according to the word vectors; fusing the multi-granularity feature vectors to obtain function embedding vectors. The multi-granularity features comprise word-level semantic features, multi-element word semantic features and sentence-level semantic features. When the multi-granularity features comprise word-level semantic features, obtaining multi-granularity feature vectors according to the word vectors comprises the following steps: combining the word vectors to obtain an input feature map; embedding the function categories into the input feature map to obtain a category feature map; multiplying the category feature map by the transpose of the input feature map to obtain a category and word similarity matrix; performing pooling processing on the category and word similarity matrix to obtain attention weights; obtaining word-level semantic feature vectors based on an attention mechanism according to the attention weights and the input feature map.

2. The method of claim 1, wherein, When the multi-granularity features comprise multi-element word semantic features, obtaining multi-granularity feature vectors according to the word vectors further comprises the following steps: convolving the word vectors with K convolution kernels respectively to obtain K feature vectors respectively corresponding to different convolution kernels; concatenating the K feature vectors to obtain multi-element word semantic feature vectors.

3. The method of claim 1, wherein, When the multi-granularity features comprise sentence-level semantic features, obtaining multi-granularity feature vectors according to the word vectors further comprises the following step: performing pooling processing on the word vectors to obtain sentence-level semantic feature vectors.

4. The method of claim 1, wherein, The method of fusing the multi-granularity feature vectors to obtain function embedding vectors comprises the following step: fusing word-level semantic feature vectors, multi-element word semantic feature vectors and sentence-level semantic feature vectors to obtain the function embedding vectors.

5. The method of claim 1, wherein, The method of determining the similarity of different functions according to the function embedding vectors comprises the following step: calculating the similarity of different functions according to the cosine distance between function embedding vectors corresponding to functions of different platforms.

6. A binary function similarity detection apparatus characterized by comprising: The method comprises the following steps: a first extraction module configured to extract assembly instructions of each function in a binary file and function categories; a vector construction module configured to construct function embedding vectors of multi-granularity feature fusion according to the assembly instructions and the function categories; a similarity detection module configured to determine the similarity of different functions according to the function embedding vectors. The vector construction module comprises the following steps: a first obtaining unit configured to convert the assembly instructions into words in natural language processing, and convert the functions into sentences in natural language processing to obtain word vectors; a second obtaining unit configured to obtain multi-granularity feature vectors according to the word vectors; a first processing unit configured to fuse the multi-granularity feature vectors to obtain function embedding vectors. The multi-granularity features include word-level semantic features, multi-element word semantic features, and sentence-level semantic features. When the multi-granularity features include word-level semantic features, the second obtaining unit includes: A first obtaining subunit, configured to combine the word vectors to obtain an input feature map; A second obtaining subunit, configured to embed a function category into the input feature map to obtain a category feature map; A third obtaining subunit, configured to multiply the category feature map by a transpose of the input feature map to obtain a category-word similarity matrix; A fourth obtaining subunit, configured to perform pooling processing on the category-word similarity matrix to obtain attention weights; A fifth obtaining subunit, configured to obtain a word-level semantic feature vector based on an attention mechanism according to the attention weights and the input feature map.

7. A binary function similarity detection device, characterized by, comprise: a transceiver and a processor; the processor is configured to extract assembly instructions of each function in a binary file and a function category; construct a multi-granularity feature fusion function embedding vector according to the assembly instructions and the function category; determine the similarity of different functions according to the function embedding vector; the processor constructs a multi-granularity feature fusion function embedding vector according to the assembly instructions and the function category, which includes: convert the assembly instructions into words in natural language processing, and convert the function into a sentence in natural language processing to obtain a word vector; obtain a multi-granularity feature vector according to the word vector; perform fusion processing on the multi-granularity feature vector to obtain a function embedding vector; The multi-granularity features include word-level semantic features, multi-element word semantic features, and sentence-level semantic features. When the multi-granularity features include word-level semantic features, the processor obtains a multi-granularity feature vector according to the word vector, which includes: combine the word vectors to obtain an input feature map; embed a function category into the input feature map to obtain a category feature map; multiply the category feature map by a transpose of the input feature map to obtain a category-word similarity matrix; perform pooling processing on the category-word similarity matrix to obtain attention weights; obtain a word-level semantic feature vector based on an attention mechanism according to the attention weights and the input feature map.

8. An electronic device comprising: a transceiver, a processor, a memory, and a program or instructions stored on the memory and executable on the processor; characterized in that the processor implements the binary function similarity detection method of any one of claims 1-5 when executing the program or instructions.

9. A readable storage medium, on which a program or instructions are stored, characterized in that, The program or instructions are executed by the processor to implement the steps of the binary function similarity detection method of any one of claims 1-5.

Images