Method for detecting binary function similarity that reinforces instruction execution semantics

Abstract

The present application relates to the binary function similarity detection method of strengthening instruction execution semantics, belongs to network security technical field, first through IDA obtains the assembly code basic block of binary function, secondly, the instruction features of basic block are extracted using Word2vec, specific instructions in basic block are marked according to execution semantics table simultaneously, and instruction execution semantic representation sequence is generated according to execution order, then the instruction features and instruction execution semantic representation are fused to generate basic block embedding, and binary function embedding is generated based on basic block embedding using graph embedding network, finally, binary function similarity detection is carried out using twin network, the present application proposes a basic block instruction execution semantic representation method aiming at the problem that existing basic block embedding generation method does not make full use of instruction execution semantics, strengthens instruction execution semantic features, and improves the accuracy of binary function similarity detection.

Description

TECHNICAL FIELD

[0001] The application relates to a binary function similarity detection method for strengthening instruction execution semantics and belongs to the technical field of network security. BACKGROUND

[0002] With the development of network technology, various application software emerge in an endless stream. In order to improve the software development efficiency, developers will reuse open source codes or third-party resource libraries. However, such code reuse behavior is easy to spread a source code containing a vulnerability to different software, and due to the limitation of most software being closed source, the developers cannot directly analyze the source code. Therefore, analyzing the binary code generated after the source code is compiled and detecting the similarity between two functions from different binary codes is currently widely used in the fields of vulnerability mining and plagiarism detection. The existing binary function similarity detection methods can be classified into the following two categories:

[0003] 1. Syntax-based similarity detection method

[0004] The syntax-based similarity detection method is to perform syntax matching from the angles of function name, function variable, instruction category and instruction quantity. However, the instructions extracted from the binary functions under different architectures through disassembly have great differences. For example, the x86 architecture uses the CISC instruction set, and the ARM architecture uses the RISC instruction set. The instructions under the two different instruction sets have different syntax. The existing syntax-based similarity detection model can only perform syntax matching for a single architecture, and cannot perform similarity detection on binary functions across architectures, resulting in poor portability of the detection model.

[0005] 2. Semantic-based similarity detection method

[0006] The semantic-based similarity detection method is to extract semantic information such as function control flow, data flow and instruction and instruction relationship through a graph embedding network and the like, generate a numerical vector and perform similarity detection. However, this method lacks the representation of instruction execution semantics, and cannot comprehensively capture function semantic information. In view of this problem, the existing method starts from the global perspective of the function, dynamically executes the function flow, and captures the instruction execution semantics with basic blocks as the granularity to generate a dynamic semantic sequence, thereby representing the internal intention or usage of the function, and also improves the explainability of the model. However, the method currently only targets five kinds of instruction functions, i.e., memory reading, memory writing, function calling, comparison operation and immediate number assignment, which causes the extraction of instruction execution semantics to be not comprehensive, resulting in the reduction of the accuracy of the model detection.

[0007] In summary, the problem of the existing binary function similarity detection method is that the semantic-based similarity detection method does not fully utilize the instruction execution semantics, resulting in incomplete extraction of instruction execution semantic information, which reduces the model detection accuracy. Therefore, the present application proposes a binary function similarity detection method that strengthens instruction execution semantics. SUMMARY

[0008] The purpose of the present application is to solve the problem of incomplete extraction of instruction execution information caused by the fact that the semantic-based similarity detection method for binary functions does not fully utilize the instruction execution semantics. The present application proposes a binary function similarity detection method that strengthens instruction execution semantics. The design principle of the present application is as follows: first, obtain the assembly code basic blocks of the binary function through IDA and perform preprocessing; second, extract the instruction features of the basic blocks using Word2vec and generate basic block instruction embeddings; at the same time, extract the instruction execution semantics of the basic blocks according to the execution semantics table and generate basic block instruction execution semantics representations using a multi-head attention mechanism; then, generate function embeddings using an information fusion network and a graph embedding network; finally, construct a twin network to detect the similarity of two binary functions. The technical solution of the present application is implemented by the following steps:

[0009] Step 1, obtain the assembly code basic blocks of the binary function through IDA and perform preprocessing.

[0010] Step 1.1, input the original binary function, and obtain the function control flow graph and assembly code information through the disassembly tool IDA.

[0011] Step 1.2, extract the assembly code basic blocks in the function control flow graph, and preprocess the instructions in the basic blocks based on the preprocessing rule table to generate preprocessed basic blocks.

[0012] Step 2, extract the instruction features of the basic blocks using Word2vec and generate basic block instruction embeddings.

[0013] Step 2.1, convert the preprocessed basic blocks into instruction flow form to obtain block-level instruction flow.

[0014] Step 2.2, input the block-level instruction flow into Word2vec to generate basic block instruction embeddings.

[0015] Step 3, extract the instruction execution semantics of the basic blocks according to the execution semantics table and generate basic block instruction execution semantics representations using a multi-head attention mechanism.

[0016] Step 3.1, construct an execution semantics table, traverse the preprocessed basic blocks, and construct an instruction set based on the special instructions and destination operands in the execution semantics table, label the instruction set, and generate special instruction execution labels.

[0017] Step 3.2, re-traverse the pre-processed basic block and label the instructions based on the general instruction execution semantics table, generate general instruction execution labels, and then integrate the special instruction execution labels and the general instruction execution labels based on the instruction execution order to generate a basic block instruction execution label sequence.

[0018] Step 3.3, input the instruction execution semantic representation sequence using the multi-head attention mechanism to generate the basic block instruction execution semantic representation.

[0019] Step 4, generate the function embedding using the information fusion network and the graph embedding network.

[0020] Step 4.1, fuse the basic block instruction embedding and the instruction execution semantic representation using the information fusion network to generate the basic block embedding.

[0021] Step 4.2, input all basic block embeddings in the control flow graph and generate the function embedding using the graph embedding network.

[0022] Step 5, construct a twin network for similarity detection of two binary functions.

[0023] Step 5.1, construct a twin network, and train the weight matrix of the multi-head attention mechanism, the information fusion network and the graph embedding network by minimizing the objective function.

[0024] Step 5.2, obtain the function embedding of the two binary functions using the twin network, calculate the distance between the function embeddings based on the cosine similarity formula, and finally perform similarity detection of the two binary functions combined with a threshold.

[0025] Advantages

[0026] Compared with existing binary function similarity detection methods, the present application proposes a basic block instruction execution semantic representation method based on the original semantic similarity detection, and considers the importance of different instruction execution semantics, strengthens the instruction execution semantic features, and improves the accuracy of binary function similarity detection. BRIEF DESCRIPTION OF DRAWINGS

[0027] Figure 1 The binary function similarity detection method of the present application strengthens the instruction execution semantics.

[0028] Figure 2 The instruction context sampling example diagram of the present application.

[0029] Figure 3 The basic block instruction execution semantic representation generation example diagram of the present application.

[0030] Figure 4 The function embedding generation example diagram of the present application. DETAILED DESCRIPTION

[0031] For better illustrating the purposes and advantages of the present application, the embodiments of the method of the present application are further explained in detail below with examples.

[0032] The present application is based on the dataset of the open source software OpenSSL construction model, which is used to train the weight matrix of the multi-head attention mechanism, information fusion network and graph embedding network, and test the performance of the present application in the binary function similarity detection task. The dataset marks two binary functions compiled from the same source code as similar functions, and the label is +1; two binary functions compiled from different source codes are marked as dissimilar functions, and the label is -1. The specific construction method is shown in Table 1:

[0033] Table 1: OpenSSL dataset construction information table:

[0034]

[0035] The dataset contains 3296 similar function pairs, i.e. positive samples, and 3296 dissimilar function pairs, i.e. negative samples, and the positive and negative sample ratio of the dataset reaches 1:1, and it is divided into training set and test set according to the ratio of 9:1.

[0036] Since the target of the present application is similarity detection, there are only two possibilities of similarity or dissimilarity, so it is a binary classification task, and the positive and negative samples of the dataset based on the open source software OpenSSL are equal, so the AUC value and accuracy are used as the evaluation index of the present application. The AUC value represents the probability that the predicted positive sample is ranked before the negative sample. The AUC value is independent of the classification threshold, which considers the sample prediction ranking quality, and can well evaluate the performance of the classification model. The AUC value calculation method is shown in formula (1):

[0037]

[0038] Where P positive is the prediction probability of the positive sample, N positive is the number of positive samples; P negative is the prediction probability of the negative sample, N negative is the number of negative samples, and the specific calculation method of I(P positive , P negative ) is shown in formula (2):

[0039]

[0040] The accuracy calculation method is shown in formula (3):

[0041]

[0042] Wherein, TP is the number of positive samples determined by the detection model as positive samples, TN is the number of negative samples determined by the detection model as negative samples, FP is the number of negative samples determined by the detection model as positive samples, and FN is the number of positive samples determined by the detection model as negative samples.

[0043] The specific process is as follows:

[0044] Step 1, obtain the assembly code basic block of the binary function through IDA and pre-process.

[0045] Step 1.1, input the original binary function f, and obtain the function control flow graph CFG and internal assembly code information through the disassembly tool IDA. f (Control Flow Graph).

[0046] Step 1.2, generate the pre-processed basic block BB_normolized i (i=1,2,…,n).

[0047] Step 1.2.1, extract the assembly code basic block BB f (i=1,2,…,n) in the control flow graph CFG i (i=1,2,…,n), where n is the number of basic blocks in CFG f .

[0048] Step 1.2.2, in order to avoid the problem of large calculation overhead and low embedding accuracy caused by embedding of subsequent instructions out of vocabulary, according to the pre-processing rule table, the assembly instructions in the basic block BB i (i=1,2,…,n) are pre-processed to generate the pre-processed basic block BB_normolized i (i=1,2,…,n). The pre-processing rule table is shown in Table 2:

[0049] Table 2 Pre-processing rule table

[0050]

[0051] Step 2, use Word2vec to extract the instruction features of the basic block and generate the basic block instruction embedding.

[0052] Step 2.1, convert BB_normolized i into instruction stream form to obtain block-level instruction stream BIS i (Block-level Instruction Stream), which is specifically represented as BIS i =(I1,I2,…I m ), i=1,2,…,n, wherein, Is (s = 1, 2, ..., m) represents BB i The s-th instruction in the code, where m is BB. i The number of instructions.

[0053] Step 2.2, convert the block instruction stream (BIS) i Input into Word2vec generates basic block instructions embedded in BIS_embedding. i (i = 1, 2, ..., n).

[0054] Step 2.2.1: Construct the instruction corpus. The instruction corpus consists of a large number of instructions from x86-64 and AArch64 architectures. Specifically, the instructions in the corpus are generated after the preprocessing in step 1.2.2. For the convenience of subsequent steps, this invention assumes that the instruction corpus contains V instructions.

[0055] Step 2.2.2, perform BIS analysis based on the instruction corpus. i Instruction I in t Perform one-hot encoding to generate the one-hot encoded vector I_onehot of the instruction. t (t = 1, 2, ..., m), where m is BB i The number of instructions.

[0056] Step 2.2.3: Train the Word2vec instruction embedding model. This invention selects the Skip-gram model from Word2vec. For any one-hot encoded vector I_onehot... t (t=1,2,…,m), I_onehot t The probability distribution vector p is obtained by passing the instruction embedding layer and the output layer sequentially, and then normalizing it through the Softmax layer, resulting in a V-dimensional probability distribution vector. t (t=1,2,…,m). The method for calculating the probability distribution vector is given in formula (4):

[0057] p t =Softmax(I_onehot) t ×W embedding ×W output )#(4)

[0058] Where Softmax(·) is the normalization exponential function, W embedding W is the instruction embedding layer weight matrix. output This is the output layer weight matrix.

[0059] During training, a context window is introduced, with a window size w = 2. The context window is used to manage the currently embedded instruction I. tContext sampling is performed, specifically, I t Two instructions are sampled before and after, namely I t-2 ,I t-1 ,I t+1 ,I t+2 , to obtain four context instructions, and the conditional probability of the context instructions is calculated by Word2vec. The context instruction conditional probability calculation formula is shown in formula (5):

[0060]

[0061] where I t represents the instruction at position t, i.e. the instruction being embedded, p t is the probability distribution vector of instruction I t ; I t+j represents the context instruction with a distance of j from I t , p t+j is the probability distribution vector of instruction I t+j ; and w is the window size. is the transpose of p t . The goal of the model is to make the conditional probability of the context instruction of the embedded instruction 1 and the conditional probability of the non-context instruction 0. The objective function of the model selects the negative log-likelihood function, and the calculation method is shown in formula (6):

[0062]

[0063] where N is the number of instructions in an iteration process; and w is the window size. The random gradient descent method is used to minimize the objective function, and the weight matrix is updated and optimized. At the same time, the negative sampling method is used to speed up the convergence process of the model. The training set uses all binary functions of OpenSSL v1.0.1f version, and the specific compilation conditions are GCC v5.4 compiler, O0 optimization option, and x86-64 and AArch64 architecture. After the training is completed, the instruction embedding layer weight matrix W embedding is selected as the instruction embedding matrix, i.e. where V is the number of instructions in the corpus; and d is a hyperparameter representing the dimension of the instruction embedding, and d generally takes a value of 100.

[0064] Step 2.2.4, generate the basic block instruction embedding BIS_embedding i of the block-level instruction stream BIS i . The one-hot encoding vectors I_onehot i (t = 1, 2, …, m) of each instruction in BIS t are spliced to obtain the block-level instruction stream BIS_embedding ione-hot encoding matrix W_onehot i , multiplied by the instruction embedding matrix W embedding , to obtain the basic block instruction embedding BIS_embedding i =(ω1;ω2;…;ω m ), i=1, 2, …, n, where m is the number of instructions in the BB i , n is the number of basic blocks in the CFG f , ω j (j=1, 2, …, m) is the instruction embedding. The specific calculation method is shown in formula (7):

[0065] BIS_embedding i =Onehot(BIS i )×W embedding #(7)

[0066] where Onehot(·) represents one-hot encoding, which is specifically represented as Onehot(IBS i )=(I_onehot1;I_onehot2;…;I_onehot m )=(W_onehot i .

[0067] Step 3, extract the instruction execution semantics of the basic block according to the execution semantics table, and generate the basic block instruction execution semantics representation by using the multi-head attention mechanism.

[0068] Step 3.1, construct the execution semantics table, traverse the preprocessed basic block BB_normolized i , and construct the instruction set based on the special instructions and destination operands in the execution semantics table label the instruction set to generate special instruction execution labels

[0069] Step 3.1.1, construct the execution semantics table. Disassemble 5754 x86-64 architecture binary functions and 6270 AArch64 architecture binary functions, and collect the assembly instruction operation codes generated by disassembly. The top 20 operation codes in the x86-64 and AArch64 architectures are counted, and 35 assembly instruction operation codes are obtained after merging the same operation codes. According to the actual function of the operation code, the instructions are divided into two levels of special instructions and general instructions, and the execution semantics table is constructed. Specifically, the function call instruction, comparison instruction, stack instruction and transfer instruction are defined as special instructions, and the immediate assignment instruction, stack instruction, memory write instruction, address transfer instruction, arithmetic operation instruction and null operation instruction are defined as general instructions. The execution semantics table is shown in Table 3:

[0070] Table 3 Execution Semantics Table:

[0071]

[0072] Step 3.1.2: Traverse BB_normolized in the forward order according to the instruction execution sequence. i Instructions in (i = 1, 2, ..., n), if BB_normolized i Instructions in If the instruction belongs to a special instruction in the execution semantic table, then the forward traversal stops, and... Traverse BB_normolized in reverse order from the starting point. i Find out Instructions with operands of the same purpose Then and Constitute an instruction set According to the instructions In the execution semantic table, let the function name be... The function name is Then for Labeling special instructions Next, we will continue with... Starting from the beginning, perform a forward traversal. If the next special instruction is encountered... At that time, special instructions will be used. Perform reverse traversal from the starting point to generate a set of instructions. And mark special instruction execution labels. The operation continues in this manner until the forward traversal of BB_normolized is complete. i All special instructions within the [database / system]. This ultimately generates special instruction execution tags.

[0073] Step 3.2, re-traverse BB_normolized i And based on the general instruction in the execution semantic table, which is BB_normolized i The instructions in the code are labeled to generate general instruction execution tags. Then, based on the instruction execution order, special instruction execution tags and general instruction execution tags are integrated to generate a basic block instruction execution tag sequence.

[0074] Step 3.2.1, re-normalize BB_normolized i The instructions in the list are traversed in a forward direction to find any missing instructions that were not included in any instruction set in step 3.1.2. According to the instructions Function name pairs in the execution semantic table Labeling general instruction execution

[0075] Step 3.2.2, based on BB_normolized i The instruction execution order integrates the instruction execution tags. It is assumed that the execution order of the instructions mentioned in step 3.1.2 and step 3.2.1 is: where '→' represents the next instruction to be executed, and the special instruction execution tag generated in step 3.2.1 and the general instruction execution tag generated in step 3.1.2 In particular, other instructions with the same destination operand as the special instruction are not considered in the integration process, i.e. The final basic block instruction execution tag sequence is generated

[0076] Step 3.3, using the multi-head attention mechanism, input the basic block instruction execution tag sequence InsExecetion_Seq i , generate the basic block instruction execution semantic representation BB_InsExecetion i , which is specifically represented as BB_InsExecetion i =MH-ATT(InsExecetion_Seq i )=(e1;e2;…;e s ), where MH-ATT(·) represents the multi-head attention mechanism, s is the number of instruction execution tags in InsExecetion_Seq i , and e i (i=1,2,…s) is the instruction execution semantic representation.

[0077] Step 4, generate function embedding using information fusion network and graph embedding network.

[0078] Step 4.1, using the information fusion network, fuse the basic block instruction embedding BIS_embedding i generated in step 2.2.4 with the basic block instruction execution semantic representation BB_InsExecetion i generated in step 3.3 to generate the basic block embedding BB_embedding i (i=1,2,…,n).

[0079] Step 4.1.1, if the instruction I t has a special instruction execution tag or a general instruction execution tag, fuse the instruction embedding ω t generated in step 2.2.4 with the instruction execution semantic representation e tFusion is performed, especially, an execution semantic influence factor α is added during the fusion process, if I t The special instruction execution label exists, α generally takes 1.2-1.5; if I t The general instruction execution label exists, α generally takes 1-1.2, the purpose is to consider the importance of different instruction execution semantics in the basic block embedding generation process, and generate instruction embedding with enhanced execution semantics The calculation method is shown in formula (8) and formula (9):

[0080]

[0081] Wherein, W t , b is the weight matrix; α is the execution semantic influence factor; GELU(·) is a nonlinear activation function, and the specific calculation method is shown in formula (10):

[0082]

[0083] Step 4.1.2, if the instruction I t There is no special instruction execution label or general instruction execution label, for I t , the instruction embedding with enhanced execution semantics is generated through formula (11) and formula (12)

[0084]

[0085]

[0086] Wherein, W t , b is the weight matrix; GELU(·) is a nonlinear activation function.

[0087] Step 4.1.3, the instruction embedding with enhanced execution semantics output in step 4.1.1 and step 4.1.2 Input into the long short-term memory (LSTM) network according to the instruction execution order, use the LSTM network to extract the long-term dependence relationship between instructions in the basic block, and finally generate the basic block embedding BB_embedding i , which enhances the instruction execution semantics. The specific process is shown in formula (13):

[0088]

[0089] Wherein, i=1, 2, …, n, n is the number of basic blocks in CFG f ; LSTM(·) is an LSTM network; Fusion(·) is an information fusion network; m is BBi The number of instructions in the sequence; s is InsExecetion_Seq i The number of tags for executing instructions.

[0090] Step 4.2, using a graph embedding network, input CFG f All basic block embeddings in BB_embedding1, BB_embedding2, ..., BB_embedding n Meanwhile, according to CFG f Extraction of basic blocks and their neighbor relationships (CFG) f The structural features of the function are used to generate the Funv_embedding function. Specifically, the control flow graph (CFG) is first... f Iterative embedding vector of basic blocks Initialize to 0, and then in each iteration, embed BB_embedding in conjunction with the current basic block. i and the current basic block BB i Iterative embedding vectors of adjacent basic blocks Perform a nonlinear mapping and finally update the iterative embedding vector of the current basic block. generate The detailed calculation process is shown in formula (14):

[0091]

[0092] Where tanh is the hyperbolic tangent function, used as the activation function for nonlinear mapping; E1 is the weight matrix; For basic blocks BB i The set of adjacent basic blocks; σ(·) is a two-layer fully connected neural network, and the specific calculation method is shown in formula (15):

[0093] σ(l)=P2×ReLU(P1l)#(15)

[0094] Where P1 and P2 are weight matrices; ReLU is the corrected linear unit, and the specific calculation method of ReLU is given in formula (16):

[0095] ReLU(x) = max{0,x} #(16)

[0096] After T iterations, it is generated After linear addition, and multiplication of the added output with matrix W2, the final function embedding Func_embedding is generated. The specific process can be represented as follows: W2 is the weight matrix.

[0097] Step 5: Construct a Siamese network to perform similarity detection on the two binary functions.

[0098] Step 5.1, construct a twin network, detect whether two binary functions are similar, train the weight matrix in the multi-head attention mechanism, information fusion network and graph embedding network by minimizing the objective function, and the calculation method of the objective function is shown in formula (17):

[0099]

[0100] Wherein, sim(·) is the function similarity; W MH-ATT is all the weight matrices in the multi-head attention mechanism; b,W LSTM is the weight matrix in the information fusion network, in particular, W LSTM is all the weight matrices in the LSTM network; W1, P1, P2, W2 are the weight matrices in the graph embedding network; y i is the true label value of the sample function pair F1 and F1, if the function pair (F1, F2) is similar, y i is 1, if the function pair (F1, F2) is not similar, y i is-1, and K is the total number of sample function pairs.

[0101] Step 5.2, output the function embeddings of two binary functions F1 and F2 through the twin network, namely, Func_embedding1=μ f1 and Func_embedding2=μ f2 Then calculate the cosine distance between the function embeddings μ f1 and μ f2 Finally, combined with the classification threshold, the similarity is detected, specifically, if the cosine distance is greater than 0, it is considered that the two binary functions are similar, if the cosine distance is less than 0, it is considered that the two binary functions are not similar. The specific calculation method of the function similarity is shown in formula (18):

[0102]

[0103] Wherein, sim(·) is the function similarity; Cosine(·) is the cosine distance calculation.

[0104] The application is specifically a binary function similarity detection method for strengthening instruction execution semantics, based on OpenSSL dataset for similarity detection, the test data includes function pairs composed of binary functions under two different architectures of x86-64 and AArch64, cross-architecture binary function similarity detection is realized, and the AUC value and accuracy of the binary function similarity detection model on the test set are better than those of the prior art, so that the binary function similarity detection performance can be effectively improved.

[0105] The above detailed description of the specific description, the purpose, technical scheme and beneficial effects of the application are further described in detail, it should be understood that the above description is only a specific embodiment of the application, and is not used to limit the protection scope of the application, any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the application should be included in the protection scope of the application.

Claims

1. A method of binary function similarity detection that strengthens instruction execution semantics, characterized by The method comprises the following steps: Step 1, obtaining binary function assembly code basic blocks by IDA and preprocessing instructions in the basic blocks to generate preprocessed basic blocks; Step 2, extracting instruction features of the basic blocks by Word2vec to generate basic block instruction embeddings, first, converting the preprocessed basic blocks into instruction stream form to obtain block-level instruction streams, then inputting the block-level instruction streams into Word2vec to generate basic block instruction embeddings; Step 3, extracting instruction execution semantics of the basic blocks according to the execution semantic table and generating basic block instruction execution semantic representations by using a multi-head attention mechanism; Step 3.1, first, constructing an execution semantic table, then traversing the preprocessed basic blocks and constructing an instruction set based on special instructions and destination operands in the execution semantic table, and finally annotating the instruction set according to the execution semantic table to generate special instruction execution labels; Step 3.2, re-traversing the preprocessed basic blocks and annotating instructions based on general instructions in the execution semantic table to generate general instruction execution labels, integrating the special instruction execution labels and the general instruction execution labels based on instruction execution order to generate a basic block instruction execution label sequence, and finally generating a basic block instruction execution semantic representation by using a multi-head attention mechanism; Step 4, generating function embeddings by using an information fusion network and a graph embedding network; Step 4.1, fusing the basic block instruction embeddings and the instruction execution semantic representations by using the information fusion network to generate basic block embeddings; Step 4.2, inputting all basic block embeddings in the control flow graph and generating function embeddings by using the graph embedding network; Step 5, constructing a twin network to detect the similarity of two binary functions.

2. The method of claim 1, wherein the binary function similarity detection method is enhanced instruction execution semantics. In step 3, the execution semantic table is constructed by the following method, 5754 binary functions of x86-64 architecture and 6270 binary functions of AArch64 architecture are disassembled, and the assembly instruction operation codes generated by disassembly are collected, the top 20 operation codes in the use frequency of x86-64 and AArch64 architectures are counted respectively, 35 assembly instruction operation codes are obtained after merging the same operation codes, and the assembly instructions are divided into two instruction levels of special instructions and general instructions, and the execution semantic table is constructed, specifically, the function call instruction, comparison instruction, stack push instruction and transfer instruction are defined as special instructions, and the immediate assignment instruction, stack pop instruction, memory write instruction, address transfer instruction, arithmetic operation instruction and null operation instruction are defined as general instructions.

3. The binary function similarity detection method for enhancing instruction execution semantics according to claim 1, characterized in that: Step 3 uses the following method to generate the basic block instruction execution tag sequence: First, the preprocessed basic block BB_normolized is traversed in forward order according to the instruction execution order. i Instructions in (i = 1, 2, ..., n), if BB_normolized i Instructions in If the instruction belongs to a special instruction in the execution semantic table, then the forward traversal stops at this point. Traverse BB_normolized in reverse order from the starting point. i Find out Other instructions with operands of the same purpose Will and Constitute an instruction set Then, according to the instructions In the execution semantic table, let the function name be set. The function name is Then for Labeling special instructions Finally, continue with Starting from the point of view, perform a forward traversal of BB_normolized i If the next special instruction is encountered At that time, special instructions will be used. Perform reverse traversal from the starting point to generate a set of instructions. And mark special instruction execution labels. The operation continues in this manner until the forward traversal of BB_normolized is complete. i All special instructions in the final special instruction execution tag are generated. Next, re-normalize BB_normolized i Perform a forward traversal of the instructions in the dataset to find any missing instructions that were not included in any instruction set. According to the execution semantic table Labeling general instruction execution Then, based on BB_normolized i The order of instruction execution, integrating special instruction execution tags. and general instruction execution labels Assuming BB_normolized i The execution order of the instructions is as follows Here, '→' represents the next instruction to be executed. In particular, other instructions with operands having the same purpose as the special instruction are not considered during the integration process, ultimately generating a basic block instruction execution tag sequence.

4. The method of claim 1, wherein the binary function similarity detection method is enhanced instruction execution semantics. The basic block embedding is generated using the following method in step 4 if the instruction I t There is a special instruction execution label or a general instruction execution label, and the generated instruction embedding ω t and the instruction execution semantic representation e t Information fusion is performed, and in particular, an execution semantic influence factor α is added in the information fusion process if I t The value of α is generally 1.2-1.5 if I t The value of α is generally 1-1.2 if I The purpose is to consider the importance of different instruction execution semantics in the basic block embedding generation process, and to generate instruction embedding with strengthened execution semantics In this case The calculation method is as follows: If the instruction I t There is no special instruction execution label or general instruction execution label, and in this case The calculation method is as follows: Wherein, W t , b is the weight matrix; α is the execution semantic influence factor; GELU(·) is a nonlinear activation function.

Images