A method, apparatus and electronic device for function similarity detection

Abstract

This application discloses a function similarity detection method, apparatus, and electronic device, relating to the field of computer processing technology, to address the problem of poor accuracy in existing function similarity detection schemes. The method includes: acquiring at least two functions to be detected; inputting the at least two functions into a function similarity detection model for similarity detection, and obtaining the similarity detection result output by the function similarity detection model for the at least two functions; the similarity detection includes: extracting function features for each function separately, and determining the similarity detection result by comparing the function features of each function, wherein the function features of each function are obtained through fusion processing using a multilayer perceptron neural network model included in the function similarity detection model. The embodiments of this application improve the accuracy of expressing the semantic features of functions by employing a multilayer perceptron neural network model for multi-level extraction and fusion of the features of each function, thereby improving the accuracy of function similarity detection.

Description

Technical Field

[0001] This application relates to the field of computer processing technology, and in particular to a function similarity detection method, apparatus and electronic device. Background Technology

[0002] To ensure computer network security, cross-platform vulnerability and malware detection is frequently required. Currently, the common method for similarity detection between cross-platform program code (usually binary functions) is based on assembly instructions. The specific implementation involves extracting function feature matrices using a Recurrent Neural Network (RNN), then performing dimensionality reduction to obtain function embedding vectors, and finally comparing similarity based on these vectors. However, this approach only performs relatively simple feature extraction and fusion on binary functions, resulting in inaccurate representation of function semantic features and consequently, poor accuracy in function similarity detection results. Summary of the Invention

[0003] This application provides a function similarity detection method, apparatus, and electronic device to address the problem of poor accuracy in existing function similarity detection schemes.

[0004] In a first aspect, embodiments of this application provide a function similarity detection method, including:

[0005] Obtain at least two functions to be detected;

[0006] The at least two functions are input into a pre-trained function similarity detection model for similarity detection, and the similarity detection results of the at least two functions output by the function similarity detection model are obtained.

[0007] The similarity detection includes:

[0008] The function features of each function are extracted separately, and the similarity detection result is determined by comparing the function features of each function. The function features of each function are obtained by performing fusion processing on the multilayer perceptron neural network model included in the function similarity detection model.

[0009] Optionally, the step of extracting the function features of each function separately includes:

[0010] Word vectors are extracted from the input function;

[0011] The first feature matrix is ​​extracted from the word vectors;

[0012] The first feature matrix is ​​reduced in dimensionality to obtain the second feature matrix;

[0013] The word vectors, the first feature matrix, and the second feature matrix are fused using the multilayer perceptron neural network model to obtain the function features of the input function.

[0014] Optionally, the function similarity detection model further includes a word embedding model, a feature extraction network, and a feature transformation network;

[0015] The word embedding model is used to extract word vectors from the input function and output the word vectors.

[0016] The feature extraction network is used to extract features from the word vectors and output the first feature matrix;

[0017] The feature transformation network is used to reduce the dimensionality of the first feature matrix and output the second feature matrix.

[0018] Optionally, the multilayer perceptron neural network model includes a scale feature fusion network and an attention feature fusion network;

[0019] The scale feature fusion network is used to fuse the word vectors with the first feature matrix to obtain a first fused feature matrix.

[0020] The attention feature fusion network is used to fuse the first fusion feature matrix and the second feature matrix to obtain the function features of the input function.

[0021] Optionally, the scale feature fusion network includes a feature concatenation layer, a fully connected layer, and a pooling layer; both the word vector and the first feature matrix are s×d dimensional matrices, where s represents the sentence length and d represents the word vector dimension;

[0022] The feature concatenation layer is used to concatenate the word vector with the first feature matrix to obtain an s×2d dimensional third feature matrix;

[0023] The fully connected layer and the pooling layer are used to perform fully connected and pooling processing on the third feature matrix to obtain the first fused feature matrix in d×1 dimensions.

[0024] Optionally, both the first fusion feature matrix and the second feature matrix are d×1 dimensional matrices;

[0025] The attention feature fusion network is used to: perform matrix multiplication on the rank transformation of the first fusion feature matrix and the second feature matrix to obtain a d×d interaction matrix; perform normalization on the interaction matrix to obtain a d×1 weight matrix; and perform fusion and concatenation processing on the weight matrix with the first fusion feature matrix and the second feature matrix respectively to obtain a 2d×1 function feature of the input function.

[0026] Optionally, the normalization operation on the interaction matrix to obtain a d×1 dimensional weight matrix includes:

[0027] The maximum value of each element in the interaction matrix is ​​taken to obtain a d×1 dimensional weight matrix composed of the maximum values ​​of each element in the interaction matrix.

[0028] Optionally, the function similarity detection model is trained using a Siamese network, and the similarity detection result is determined by calculating the cosine distance of the function features of each function.

[0029] Secondly, embodiments of this application also provide a function similarity detection device, comprising:

[0030] The acquisition module is used to acquire at least two functions to be detected;

[0031] A similarity detection module is used to input the at least two functions into a pre-trained function similarity detection model for similarity detection, and obtain the similarity detection results of the at least two functions output by the function similarity detection model;

[0032] The similarity detection includes:

[0033] The function features of each function are extracted separately, and the similarity detection result is determined by comparing the function features of each function. The function features of each function are obtained by performing fusion processing on the multilayer perceptron neural network model included in the function similarity detection model.

[0034] Optionally, the step of extracting the function features of each function separately includes:

[0035] Word vectors are extracted from the input function;

[0036] The first feature matrix is ​​extracted from the word vectors;

[0037] The first feature matrix is ​​reduced in dimensionality to obtain the second feature matrix;

[0038] The word vectors, the first feature matrix, and the second feature matrix are fused using the multilayer perceptron neural network model to obtain the function features of the input function.

[0039] Optionally, the function similarity detection model further includes a word embedding model, a feature extraction network, and a feature transformation network;

[0040] The word embedding model is used to extract word vectors from the input function and output the word vectors.

[0041] The feature extraction network is used to extract features from the word vectors and output the first feature matrix;

[0042] The feature transformation network is used to reduce the dimensionality of the first feature matrix and output the second feature matrix.

[0043] Optionally, the multilayer perceptron neural network model includes a scale feature fusion network and an attention feature fusion network;

[0044] The scale feature fusion network is used to fuse the word vectors with the first feature matrix to obtain a first fused feature matrix.

[0045] The attention feature fusion network is used to fuse the first fusion feature matrix and the second feature matrix to obtain the function features of the input function.

[0046] Optionally, the scale feature fusion network includes a feature concatenation layer, a fully connected layer, and a pooling layer; both the word vector and the first feature matrix are s×d dimensional matrices, where s represents the sentence length and d represents the word vector dimension;

[0047] The feature concatenation layer is used to concatenate the word vector with the first feature matrix to obtain an s×2d dimensional third feature matrix;

[0048] The fully connected layer and the pooling layer are used to perform fully connected and pooling processing on the third feature matrix to obtain the first fused feature matrix in d×1 dimensions.

[0049] Optionally, both the first fusion feature matrix and the second feature matrix are d×1 dimensional matrices;

[0050] The attention feature fusion network is used to: perform matrix multiplication on the rank transformation of the first fusion feature matrix and the second feature matrix to obtain a d×d interaction matrix; perform normalization on the interaction matrix to obtain a d×1 weight matrix; and perform fusion and concatenation processing on the weight matrix with the first fusion feature matrix and the second feature matrix respectively to obtain a 2d×1 function feature of the input function.

[0051] Optionally, the normalization operation on the interaction matrix to obtain a d×1 dimensional weight matrix includes:

[0052] The maximum value of each element in the interaction matrix is ​​taken to obtain a d×1 dimensional weight matrix composed of the maximum values ​​of each element in the interaction matrix.

[0053] Optionally, the function similarity detection model is trained using a Siamese network, and the similarity detection result is determined by calculating the cosine distance of the function features of each function.

[0054] Thirdly, embodiments of this application also provide an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps in the function similarity detection method as described in the first aspect.

[0055] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in the function similarity detection method described above.

[0056] In this embodiment, at least two functions to be detected are obtained; the at least two functions are input into a pre-trained function similarity detection model for similarity detection, and the similarity detection result of the at least two functions output by the function similarity detection model is obtained; wherein, the similarity detection includes: extracting the function features of each function respectively, and determining the similarity detection result by comparing the function features of each function, wherein the function features of each function are obtained by performing fusion processing through a multilayer perceptron neural network model included in the function similarity detection model. Thus, by using a multilayer perceptron neural network model to extract and fuse the features of each function at multiple levels, the accuracy of expressing the semantic features of functions can be improved, thereby improving the accuracy of function similarity detection. Attached Figure Description

[0057] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 This is a flowchart of the function similarity detection method provided in the embodiments of this application;

[0059] Figure 2 This is a structural diagram of the function similarity detection model based on feature fusion provided in the embodiments of this application;

[0060] Figure 3 This is a structural diagram of the scale feature fusion network provided in the embodiments of this application;

[0061] Figure 4 This is a structural diagram of the attention feature fusion network provided in the embodiments of this application;

[0062] Figure 5 This is an example flowchart of the function similarity detection method provided in the embodiments of this application;

[0063] Figure 6 This is a structural diagram of the function similarity detection device provided in the embodiments of this application;

[0064] Figure 7 This is a structural diagram of the electronic device provided in the embodiments of this application. Detailed Implementation

[0065] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0066] See Figure 1 , Figure 1 This is a flowchart of the function similarity detection method provided in the embodiments of this application, such as... Figure 1 As shown, it includes the following steps:

[0067] Step 101: Obtain at least two functions to be detected.

[0068] The functions mentioned above can refer to binary functions in a computer system. For example, a function can be a piece of program code used to implement a certain function, or a compiled system firmware.

[0069] The embodiments of this application can be applied to scenarios such as vulnerability detection, malicious code plagiarism detection, and software theft detection. They can also be applied to similarity detection of two functions across platforms. Platforms with different compilation architectures, operating systems, compilers, or compilation options can be collectively referred to as cross-platform.

[0070] When it is necessary to perform similarity detection on two or more functions, these functions can be obtained, and these functions are the functions to be detected.

[0071] Step 102: Input the at least two functions into a pre-trained function similarity detection model for similarity detection, and obtain the similarity detection results of the at least two functions output by the function similarity detection model;

[0072] The similarity detection includes:

[0073] The function features of each function are extracted separately, and the similarity detection result is determined by comparing the function features of each function. The function features of each function are obtained by performing fusion processing on the multilayer perceptron neural network model included in the function similarity detection model.

[0074] In this embodiment, a function similarity detection model can be pre-trained to perform similarity detection on the function to be detected. In order to ensure the accuracy of detection, the feature fusion layer network structure of the function similarity detection model can be improved. Specifically, a multilayer perceptron neural network model can be designed as the feature fusion layer structure of the function similarity detection model in this embodiment to perform multi-level fusion of the features of the input function, so as to deeply learn the semantic features of the function from multiple perspectives, ensuring that the extracted function features can accurately represent the semantic features of the function, thereby ensuring the accuracy of function similarity detection based on the extracted function features.

[0075] The multilayer perceptron neural network model can be a network structure that fuses function features from multiple dimensions. For example, to ensure that the overall semantic features of the function can be learned, a network layer can be designed to extract word vectors of the function and fuse the extracted word vectors with the hidden layer features of the function. Alternatively, to explore the relationship between the features of the function and to express the function features more accurately, a network layer can be designed to fuse features from different feature spaces of the function.

[0076] In this step, the at least two functions obtained can be input into a pre-trained function similarity detection model for similarity detection. The function similarity detection model can be used to extract the function features of each function. Specifically, the multilayer perceptron neural network model in the function similarity detection model can be used to fuse the features of each function to obtain the function features of each function. Then, the similarity detection result can be determined by comparing the function features of each function, and then the similarity detection result can be output.

[0077] It should be noted that the function similarity detection model can perform similarity detection on two functions at a time and output the similarity detection results for these two functions. Therefore, when it is necessary to perform similarity detection on more than two functions, two functions can be input into the function similarity detection model at a time to obtain the similarity detection results for the two input functions until the similarity between all functions has been detected. Alternatively, the function similarity detection model can also perform similarity detection on each function sequentially from multiple functions input at once, in the manner of performing similarity detection on two functions at a time, until the similarity detection results for any two functions are finally obtained.

[0078] Optionally, the step of extracting the function features of each function separately includes:

[0079] Word vectors are extracted from the input function;

[0080] The first feature matrix is ​​extracted from the word vectors;

[0081] The first feature matrix is ​​reduced in dimensionality to obtain the second feature matrix;

[0082] The word vectors, the first feature matrix, and the second feature matrix are fused using the multilayer perceptron neural network model to obtain the function features of the input function.

[0083] In one implementation, the process of extracting function features can be as follows: First, word vectors are extracted from the input function, i.e., the function input to the function similarity detection model. For example, a general word embedding model (word2vec) can be used to extract word vectors from the input function, i.e., the assembly instructions in the function are converted into word vectors. Then, a first feature matrix can be extracted from the word vectors. For example, an RNN network can be used to extract features from the word vectors to obtain hidden layer features, which can be represented as a first feature matrix H. Next, the first feature matrix can be dimensionality reduced to obtain a second feature matrix F2. Finally, the word vectors, the first feature matrix, and the second feature matrix can be fused in multiple stages using the multilayer perceptron neural network model. For example, different features in the word vectors, the first feature matrix, and the second feature matrix can be fused separately or sequentially in a reasonable manner. The fused features are the function features of the input function.

[0084] In some embodiments, when the input function is a binary firmware file, the input function can be preprocessed before extracting word vectors. For example, the binary firmware file can be disassembled to extract the assembly instructions of each function in all executable files, and then the word2vec model can be used to convert the assembly instructions into word vectors. Thus, the input function can be converted into an s×d dimensional matrix, where s is the sentence length and d is the word vector dimension.

[0085] The dimensionality reduction process described above can be achieved by performing self-attention and / or multi-layer perceptron (MLP) operations. For example, for the first feature matrix H in the dimension of s×d, after the self-attention and MLP operations, it can be reduced to the second feature matrix F2 in the dimension of d×1.

[0086] In this way, through this implementation method, diverse features can be extracted from the input function from different dimensions, thereby ensuring that the fused features can more accurately express the semantic features of the function.

[0087] Furthermore, the function similarity detection model also includes a word embedding model, a feature extraction network, and a feature transformation network;

[0088] The word embedding model is used to extract word vectors from the input function and output the word vectors.

[0089] The feature extraction network is used to extract features from the word vectors and output the first feature matrix;

[0090] The feature transformation network is used to reduce the dimensionality of the first feature matrix and output the second feature matrix.

[0091] In one implementation, the function similarity detection model can be designed to consist of a multi-layer network structure connected sequentially, so that the input function can be processed differently through different network layer structures.

[0092] Specifically, such as Figure 2 As shown, the function similarity detection model may include a word embedding model 21 for word vector extraction, a feature extraction network 22 for hidden layer feature extraction, a feature transformation network 23 for dimensionality reduction, and a multilayer perceptron neural network model 24 for multi-feature fusion.

[0093] In this system, the input of word embedding model 21 is used to input the function, and word embedding model 21 is used to extract word vectors from the input function. The output of word embedding model 21 is connected to the input of feature extraction network 22, that is, the word vectors output by word embedding model 21 are used as input data to feature extraction network 22. Word embedding model 21 can be a word2vec model.

[0094] Feature extraction network 22 is used to extract features from the word vectors and output a first feature matrix H. The output of feature extraction network 22 is connected to the input of feature transformation network 23, that is, the first feature matrix H output by feature extraction network 22 is used as input data to feature transformation network 23. Figure 2 As shown, the feature extraction network 22 can be a bidirectional RNN network.

[0095] Feature transformation network 23 is used to reduce the dimensionality of the first feature matrix H and output the second feature matrix F2. For example... Figure 2 As shown, the feature transformation network 23 can be a SelfAttention and MLP structure.

[0096] The outputs of word embedding model 21, feature extraction network 22, and feature transformation network 23 are all connected to the input of multilayer perceptron neural network model 24. That is, the word vectors output by word embedding model 21, the first feature matrix H output by feature extraction network 22, and the second feature matrix F2 output by feature transformation network 23 are all input into multilayer perceptron neural network model 24 as input data. Multilayer perceptron neural network model 24 performs fusion processing on these features, and the output of multilayer perceptron neural network model 24 outputs the final fused features, which are the function features of the input function.

[0097] In this way, by constructing different network layers to handle different processing of the input function, it is possible to ensure fast and accurate feature extraction and feature fusion of the input function.

[0098] Optionally, the multilayer perceptron neural network model includes a scale feature fusion network and an attention feature fusion network;

[0099] The scale feature fusion network is used to fuse the word vectors with the first feature matrix to obtain a first fused feature matrix.

[0100] The attention feature fusion network is used to fuse the first fusion feature matrix and the second feature matrix to obtain the function features of the input function.

[0101] In one embodiment, the multilayer perceptron neural network model can be designed as a network model including a scale feature fusion network and an attention feature fusion network to perform two-step fusion of the word vectors, the first feature matrix, and the second feature matrix based on scale and attention, respectively.

[0102] Specifically, such as Figure 2 As shown, the multilayer perceptron neural network model 24 includes a scale feature fusion network (Concat&FC) 241 for scale-based feature fusion of input features and an attention feature fusion network (Feature Fusion) 242 for attention-based feature fusion of input features.

[0103] The input data for the scale feature fusion network 241 are word vectors and the first feature matrix H, for example... Figure 2 As shown, the outputs of both the word embedding model 21 and the feature extraction network 22 can be connected to the input of the scale feature fusion network 241. The scale feature fusion network 241 is used to perform scale feature fusion on the word vectors output by the word embedding model 21 and the first feature matrix H output by the feature extraction network 22, outputting the first fused feature matrix F1. Thus, since the word vectors of a function can reflect the features of the entire function instruction, while RNNs consider local semantic information, i.e., the influence of each instruction before and after, by fusing the word vectors with the RNN hidden layer feature vectors, i.e., the first feature matrix H, the network can learn both the local semantic information between words and the overall semantic information of the function. In other words, by adding a word embedding vector matrix to the bidirectional RNN hidden layer, the scale feature fusion network 241 can solve the problem that existing schemes cannot learn the overall semantic information of the function, and can enrich the expression of the semantic information of the function features.

[0104] The input data of the attention feature fusion network 242 is the first fusion feature matrix F1 and the second feature matrix F2, for example Figure 2As shown, the outputs of both the scale feature fusion network 241 and the feature transformation network 23 are connected to the input of the attention feature fusion network 242. The attention feature fusion network 242 performs attention feature fusion on the first fusion feature matrix F1 output by the scale feature fusion network 241 and the second feature matrix F2 output by the feature transformation network 23, outputting the second fusion feature matrix, which is the function feature of the input function. Thus, by designing this attention-based feature fusion network structure, the relationships between features can be deeply explored, thereby improving the accuracy of function similarity calculation. Specifically, the attention feature fusion network 242 can enhance the features of the function itself in a targeted manner and weaken noisy features, making the feature vector expression more accurate, thereby improving the accuracy of function similarity calculation.

[0105] Optionally, the scale feature fusion network includes a feature concatenation layer, a fully connected layer, and a pooling layer; both the word vector and the first feature matrix are s×d dimensional matrices, where s represents the sentence length and d represents the word vector dimension;

[0106] The feature concatenation layer is used to concatenate the word vector with the first feature matrix to obtain an s×2d dimensional third feature matrix;

[0107] The fully connected layer and the pooling layer are used to perform fully connected and pooling processing on the third feature matrix to obtain the first fused feature matrix in d×1 dimensions.

[0108] In this embodiment, the scale feature fusion network includes a feature splicing layer, a fully connected layer, and a pooling layer. To ensure the fusion effect, the pooling layer can be a max pooling layer.

[0109] Both the word vectors and the first feature matrix can be s×d dimensional matrices. That is, the word embedding model 21 can transform the input function into an s×d dimensional word vector matrix, where s represents the sentence length and d represents the word vector dimension. The feature extraction network 22 can extract features from the s×d dimensional word vector matrix and output an s×d dimensional hidden layer feature matrix H.

[0110] Specifically, the structure of the scale feature fusion network can be as follows: Figure 3 As shown, the input features of the scale feature fusion network (Concat&FC) are word embedding vectors and the first feature matrix H obtained through the RNN feature extraction network 22. The scale feature fusion network can fuse these two features through a feature concatenation layer (Concat). Specifically, the word embedding vector matrix can be concatted into the RNN output features and then fused through feature fusion x. i =[c l (wi );c r (w i );e(w i ]], thus obtaining the fusion feature x i,j ∈R s×2d That is, we obtain the third eigenma matrix of dimension s×2d, where c l (w i ) and c r (w i ) represents the output of a bidirectional RNN, e(w) i ) represents the word embedding vector (WordEmbedding). The s×2d third feature matrix can be further processed through fully connected layers and max pooling layers (FC & Maxpooling) to finally output the d×1 first fused feature matrix F1. The scale feature fusion network can introduce overall function features without affecting the features of the RNN hidden layers.

[0111] Furthermore, to verify the effectiveness of the scale feature fusion network, the Receiver Operating Characteristic Curve (ROC curve) can be used to evaluate the model's performance, and the Area Under Curve (AUC) value can be used as an evaluation metric. Specifically, two datasets from the SAFE method (an optimal function similarity detection method based on assembly instructions proposed by a laboratory) can be used as method validation datasets to verify the accuracy of the existing SAFE method and the scheme using the scale feature fusion network (referred to as Module 1) in this application embodiment for function similarity detection. The experimental results are shown in the table below:

[0112] Model Dataset 1 (AUC) Dataset 2 (AUC) SAFE 0.971 0.988 SAFE+Module1 0.980 0.995

[0113] As can be seen, the scale-based feature fusion network structure designed in this application embodiment can introduce low-level semantic features through the Concat layer while ensuring the continuity of data in the bidirectional RNN hidden layer. It can also extract the overall semantic features of the function through the design of a fully connected layer and finally reduce the loss of feature information through the Maxpooling layer. Adding this scale-based feature fusion network structure can improve the AUC value of function similarity calculation by an average of about 0.8%.

[0114] Optionally, both the first fusion feature matrix and the second feature matrix are d×1 dimensional matrices;

[0115] The attention feature fusion network is used to: perform matrix multiplication on the rank transformation of the first fusion feature matrix and the second feature matrix to obtain a d×d interaction matrix; perform normalization on the interaction matrix to obtain a d×1 weight matrix; and perform fusion and concatenation processing on the weight matrix with the first fusion feature matrix and the second feature matrix respectively to obtain a 2d×1 function feature of the input function.

[0116] In this embodiment, the first fusion feature matrix F1 and the second feature matrix F2 can both be d×1 dimensional feature matrices. That is, the feature transformation network 23 can reduce the s×d dimensional first feature matrix H to a d×1 dimensional feature matrix F2, and the scale feature fusion network can output a d×1 dimensional fusion feature matrix F1.

[0117] In this embodiment of the application, in order to solve the problem of mutual influence between features, an attention feature fusion network structure (Module 2) is innovatively proposed, which learns the mutual influence between features through attention.

[0118] Specifically, the structure of the attention feature fusion network can be as follows: Figure 4 As shown, the attention feature fusion network processes the input features F1 and F2 through F1×F2. T The interaction matrix A is obtained through calculation. i,j ∈R d×d This is a d×d cross matrix A, where each feature point records the mutual influence factor between features. After normalization operations such as softmax, the cross matrix yields a d×1 weight matrix, or weight vector, representing the amount by which features are weakened or strengthened. Finally, the input features F1 and F2 are added to the weight vector to obtain a weighted function feature vector, which is then concatenated to obtain a 2d×1 function feature. This allows for targeted enhancement or reduction of features, resulting in a more precise feature vector representation and improved accuracy in function similarity calculations.

[0119] In addition, to verify the effectiveness of the attention feature fusion network, ROC curves can also be used to evaluate the model's performance, and AUC values ​​can be used as an evaluation metric to verify the accuracy of the existing SAFE method and the scheme using scale feature fusion network (Module 1) and attention feature fusion network (Module 2) in this embodiment for function similarity detection. The experimental results are shown in the table below:

[0120] Model Dataset 1 (AUC) Dataset 2 (AUC) SAFE 0.971 0.988 SAFE+Module1 0.980 0.995 SAFE+Module1+Module2 0.982 0.996

[0121] As can be seen, the attention-based feature fusion network structure designed in this application proposes an interaction matrix, and then learns a feature weight vector to weight each feature. Through mutual learning of features, the features are enhanced in a targeted manner, and noisy features are weakened, making the feature vector expression more accurate. Adding this attention-based feature fusion network structure can improve the AUC value of function similarity calculation by an average of about 0.15%.

[0122] The function similarity detection model based on the fusion of scale and attention features designed in this application embodiment can more accurately represent the semantics of text, improve the accurate expression of function semantic features, and improve the accuracy of function similarity calculation. This model can improve the accuracy of function similarity calculation by about 0.95%.

[0123] Further, the normalization operation on the interaction matrix to obtain a d×1 dimensional weight matrix includes:

[0124] The maximum value of each element in the interaction matrix is ​​taken to obtain a d×1 dimensional weight matrix composed of the maximum values ​​of each element in the interaction matrix.

[0125] In one implementation, the interaction matrix can be obtained by taking the maximum value of each row in the interaction matrix to obtain the d×1 dimension weight matrix. This ensures that the weights with the greatest influence between features are taken, which can fully explore the mutual influence between features and make the final output function feature vector more accurate, thereby improving the accuracy of function similarity calculation.

[0126] Optionally, the function similarity detection model is trained using a Siamese network, and the similarity detection result is determined by calculating the cosine distance of the function features of each function.

[0127] In one implementation, to ensure rapid similarity feature detection for two or more functions, a Siamese network can be used to train the function feature extraction network when training the function similarity detection model used in this application embodiment. This allows the use of two identical function feature extraction networks to simultaneously extract function features from two or more functions.

[0128] Furthermore, when calculating the similarity between functions, the cosine distance between the function features of each function extracted by the function similarity detection model can be calculated to determine the corresponding similarity detection result. The smaller the cosine distance, the more similar the two functions are.

[0129] The implementation flowchart of the function similarity detection method in this application embodiment can be seen as follows: Figure 5 As shown. Specifically includes:

[0130] First, data preprocessing: disassemble the binary firmware file (i.e., the input function) and extract the assembly instructions of each function in all executable files. Second, word embedding: convert the assembly instructions into natural language processing tasks, with each instruction as a word and the function as a sentence, and train a word embedding network (word2vec). Then, use the word2vec model to convert the assembly instructions into word vectors. After word vector extraction, the input function is converted into an s×d dimensional matrix. Third, design a cross-platform binary function similarity detection model based on feature fusion and train the model using a Siamese network. Fourth, use cosine distance to calculate function similarity.

[0131] The function similarity detection method of this application embodiment obtains at least two functions to be detected; inputs the at least two functions into a pre-trained function similarity detection model for similarity detection, and obtains the similarity detection result of the at least two functions output by the function similarity detection model; wherein, the similarity detection includes: extracting function features of each function respectively, and determining the similarity detection result by comparing the function features of each function, wherein the function features of each function are obtained by performing fusion processing through a multilayer perceptron neural network model included in the function similarity detection model. Thus, by using a multilayer perceptron neural network model to extract and fuse the features of each function at multiple levels, the accuracy of expressing the semantic features of functions can be improved, thereby improving the accuracy of function similarity detection.

[0132] This application also provides a function similarity detection device. See [link to relevant documentation]. Figure 6 , Figure 6 This is a structural diagram of the function similarity detection device provided in the embodiments of this application. Since the principle of the function similarity detection device in solving the problem is similar to that of the function similarity detection method in the embodiments of this application, the implementation of the function similarity detection device can refer to the implementation of the method, and the repeated parts will not be described again.

[0133] like Figure 6 As shown, the function similarity detection device 600 includes:

[0134] The acquisition module 601 is used to acquire at least two functions to be detected;

[0135] The similarity detection module 602 is used to input the at least two functions into a pre-trained function similarity detection model for similarity detection, and obtain the similarity detection results of the at least two functions output by the function similarity detection model;

[0136] The similarity detection includes:

[0137] The function features of each function are extracted separately, and the similarity detection result is determined by comparing the function features of each function. The function features of each function are obtained by performing fusion processing on the multilayer perceptron neural network model included in the function similarity detection model.

[0138] Optionally, the step of extracting the function features of each function separately includes:

[0139] Word vectors are extracted from the input function;

[0140] The first feature matrix is ​​extracted from the word vectors;

[0141] The first feature matrix is ​​reduced in dimensionality to obtain the second feature matrix;

[0142] The word vectors, the first feature matrix, and the second feature matrix are fused using the multilayer perceptron neural network model to obtain the function features of the input function.

[0143] Optionally, the function similarity detection model further includes a word embedding model, a feature extraction network, and a feature transformation network;

[0144] The word embedding model is used to extract word vectors from the input function and output the word vectors.

[0145] The feature extraction network is used to extract features from the word vectors and output the first feature matrix;

[0146] The feature transformation network is used to reduce the dimensionality of the first feature matrix and output the second feature matrix.

[0147] Optionally, the multilayer perceptron neural network model includes a scale feature fusion network and an attention feature fusion network;

[0148] The scale feature fusion network is used to fuse the word vectors with the first feature matrix to obtain a first fused feature matrix.

[0149] The attention feature fusion network is used to fuse the first fusion feature matrix and the second feature matrix to obtain the function features of the input function.

[0150] Optionally, the scale feature fusion network includes a feature concatenation layer, a fully connected layer, and a pooling layer; both the word vector and the first feature matrix are s×d dimensional matrices, where s represents the sentence length and d represents the word vector dimension;

[0151] The feature concatenation layer is used to concatenate the word vector with the first feature matrix to obtain an s×2d dimensional third feature matrix;

[0152] The fully connected layer and the pooling layer are used to perform fully connected and pooling processing on the third feature matrix to obtain the first fused feature matrix in d×1 dimensions.

[0153] Optionally, both the first fusion feature matrix and the second feature matrix are d×1 dimensional matrices;

[0154] The attention feature fusion network is used to: perform matrix multiplication on the rank transformation of the first fusion feature matrix and the second feature matrix to obtain a d×d interaction matrix; perform normalization on the interaction matrix to obtain a d×1 weight matrix; and perform fusion and concatenation processing on the weight matrix with the first fusion feature matrix and the second feature matrix respectively to obtain a 2d×1 function feature of the input function.

[0155] Optionally, the normalization operation on the interaction matrix to obtain a d×1 dimensional weight matrix includes:

[0156] The maximum value of each element in the interaction matrix is ​​taken to obtain a d×1 dimensional weight matrix composed of the maximum values ​​of each element in the interaction matrix.

[0157] Optionally, the function similarity detection model is trained using a Siamese network, and the similarity detection result is determined by calculating the cosine distance of the function features of each function.

[0158] The function similarity detection device provided in this application embodiment can execute the above method embodiment, and its implementation principle and technical effect are similar, so it will not be described again here.

[0159] The function similarity detection 600 of this application embodiment obtains at least two functions to be detected; inputs the at least two functions into a pre-trained function similarity detection model for similarity detection, and obtains the similarity detection result of the at least two functions output by the function similarity detection model; wherein, the similarity detection includes: extracting function features of each function respectively, and determining the similarity detection result by comparing the function features of each function, wherein the function features of each function are obtained by performing fusion processing through a multilayer perceptron neural network model included in the function similarity detection model. In this way, by using a multilayer perceptron neural network model to extract and fuse the features of each function at multiple levels, the accuracy of expressing the semantic features of functions can be improved, thereby improving the accuracy of function similarity detection.

[0160] This application also provides an electronic device. Since the principle by which the electronic device solves the problem is similar to the function similarity detection method in this application, the implementation of this electronic device can refer to the implementation of the method, and repeated details will not be elaborated further. Figure 7 As shown, the electronic device according to an embodiment of this application includes: a processor 700, configured to read a program from a memory 720 and execute the following processes:

[0161] Obtain at least two functions to be detected;

[0162] The at least two functions are input into a pre-trained function similarity detection model for similarity detection, and the similarity detection results of the at least two functions output by the function similarity detection model are obtained.

[0163] The similarity detection includes:

[0164] The function features of each function are extracted separately, and the similarity detection result is determined by comparing the function features of each function. The function features of each function are obtained by performing fusion processing on the multilayer perceptron neural network model included in the function similarity detection model.

[0165] Among them, Figure 7 In this context, the bus architecture can include any number of interconnected buses and bridges, specifically linking various circuits together, represented by one or more processors (processor 700) and memory (memory 720). The bus architecture can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides the interface. Processor 700 is responsible for managing the bus architecture and general processing, and memory 720 can store data used by processor 700 during operation.

[0166] Optionally, the step of extracting the function features of each function separately includes:

[0167] Word vectors are extracted from the input function;

[0168] The first feature matrix is ​​extracted from the word vectors;

[0169] The first feature matrix is ​​reduced in dimensionality to obtain the second feature matrix;

[0170] The word vectors, the first feature matrix, and the second feature matrix are fused using the multilayer perceptron neural network model to obtain the function features of the input function.

[0171] Optionally, the function similarity detection model further includes a word embedding model, a feature extraction network, and a feature transformation network;

[0172] The word embedding model is used to extract word vectors from the input function and output the word vectors.

[0173] The feature extraction network is used to extract features from the word vectors and output the first feature matrix;

[0174] The feature transformation network is used to reduce the dimensionality of the first feature matrix and output the second feature matrix.

[0175] Optionally, the multilayer perceptron neural network model includes a scale feature fusion network and an attention feature fusion network;

[0176] The scale feature fusion network is used to fuse the word vectors with the first feature matrix to obtain a first fused feature matrix.

[0177] The attention feature fusion network is used to fuse the first fusion feature matrix and the second feature matrix to obtain the function features of the input function.

[0178] Optionally, the scale feature fusion network includes a feature concatenation layer, a fully connected layer, and a pooling layer; both the word vector and the first feature matrix are s×d dimensional matrices, where s represents the sentence length and d represents the word vector dimension;

[0179] The feature concatenation layer is used to concatenate the word vector with the first feature matrix to obtain an s×2d dimensional third feature matrix;

[0180] The fully connected layer and the pooling layer are used to perform fully connected and pooling processing on the third feature matrix to obtain the first fused feature matrix in d×1 dimensions.

[0181] Optionally, both the first fusion feature matrix and the second feature matrix are d×1 dimensional matrices;

[0182] The attention feature fusion network is used to: perform matrix multiplication on the rank transformation of the first fusion feature matrix and the second feature matrix to obtain a d×d interaction matrix; perform normalization on the interaction matrix to obtain a d×1 weight matrix; and perform fusion and concatenation processing on the weight matrix with the first fusion feature matrix and the second feature matrix respectively to obtain a 2d×1 function feature of the input function.

[0183] Optionally, the normalization operation on the interaction matrix to obtain a d×1 dimensional weight matrix includes:

[0184] The maximum value of each element in the interaction matrix is ​​taken to obtain a d×1 dimensional weight matrix composed of the maximum values ​​of each element in the interaction matrix.

[0185] Optionally, the function similarity detection model is trained using a Siamese network, and the similarity detection result is determined by calculating the cosine distance of the function features of each function.

[0186] The electronic device provided in this application embodiment can execute the above method embodiment, and its implementation principle and technical effect are similar, so it will not be described again here.

[0187] Furthermore, the computer-readable storage medium of this application embodiment is used to store a computer program, which can be executed by a processor. Figure 1 The steps in the method embodiment shown.

[0188] In the several embodiments provided in this application, it should be understood that the disclosed methods and apparatus can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0189] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can be physically comprised separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0190] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute some steps of the transmission and reception methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0191] The above description is the preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principles described in this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for detecting function similarity, characterized in that, include: Obtain at least two functions to be detected; The at least two functions are input into a pre-trained function similarity detection model for similarity detection, and the similarity detection results of the at least two functions output by the function similarity detection model are obtained. The similarity detection includes: The function features of each function are extracted separately, and the similarity detection result is determined by comparing the function features of each function. The function features of each function are obtained by performing fusion processing on the multilayer perceptron neural network model included in the function similarity detection model. The extraction of function features for each function includes: Word vectors are extracted from the input function; The first feature matrix is ​​extracted from the word vectors; The first feature matrix is ​​reduced in dimensionality to obtain the second feature matrix; The word vectors, the first feature matrix, and the second feature matrix are fused using the multilayer perceptron neural network model to obtain the function features of the input function.

2. The method according to claim 1, characterized in that, The function similarity detection model also includes a word embedding model, a feature extraction network, and a feature transformation network; The word embedding model is used to extract word vectors from the input function and output the word vectors. The feature extraction network is used to extract features from the word vectors and output the first feature matrix; The feature transformation network is used to reduce the dimensionality of the first feature matrix and output the second feature matrix.

3. The method according to claim 1, characterized in that, The multilayer perceptron neural network model includes a scale feature fusion network and an attention feature fusion network; The scale feature fusion network is used to fuse the word vectors with the first feature matrix to obtain a first fused feature matrix. The attention feature fusion network is used to fuse the first fusion feature matrix and the second feature matrix to obtain the function features of the input function.

4. The method according to claim 3, characterized in that, The scale feature fusion network includes a feature splicing layer, a fully connected layer, and a pooling layer; both the word vector and the first feature matrix are s×d dimensional matrices, where s represents the sentence length and d represents the word vector dimension. The feature concatenation layer is used to concatenate the word vector with the first feature matrix to obtain an s×2d dimensional third feature matrix; The fully connected layer and the pooling layer are used to perform fully connected and pooling processing on the third feature matrix to obtain the first fused feature matrix in d×1 dimensions.

5. The method according to claim 3, characterized in that, Both the first fusion feature matrix and the second feature matrix are d×1 dimensional matrices; The attention feature fusion network is used to: perform matrix multiplication on the rank transformation of the first fusion feature matrix and the second feature matrix to obtain a d×d dimensional interaction matrix; perform normalization on the interaction matrix to obtain a d×1 dimensional weight matrix; and perform fusion and concatenation processing on the weight matrix with the first fusion feature matrix and the second feature matrix respectively to obtain a 2d×1 dimensional function feature of the input function.

6. The method according to claim 5, characterized in that, The normalization operation on the interaction matrix to obtain a d×1 dimensional weight matrix includes: The maximum value of each element in the interaction matrix is ​​taken to obtain a d×1 dimensional weight matrix composed of the maximum values ​​of each element in the interaction matrix.

7. The method according to any one of claims 1 to 6, characterized in that, The function similarity detection model is trained using a Siamese network, and the similarity detection result is determined by calculating the cosine distance of the function features of each function.

8. A function similarity detection device, characterized in that, include: The acquisition module is used to acquire at least two functions to be detected; A similarity detection module is used to input the at least two functions into a pre-trained function similarity detection model for similarity detection, and obtain the similarity detection results of the at least two functions output by the function similarity detection model; The similarity detection includes: The function features of each function are extracted separately, and the similarity detection result is determined by comparing the function features of each function. The function features of each function are obtained by performing fusion processing on the multilayer perceptron neural network model included in the function similarity detection model. The extraction of function features for each function includes: Word vectors are extracted from the input function; The first feature matrix is ​​extracted from the word vectors; The first feature matrix is ​​reduced in dimensionality to obtain the second feature matrix; The word vectors, the first feature matrix, and the second feature matrix are fused using the multilayer perceptron neural network model to obtain the function features of the input function.

9. An electronic device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor; characterized in that the processor is configured to read the program from the memory to implement the steps of the function similarity detection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium for storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps in the function similarity detection method as described in any one of claims 1 to 7.

Images