A binary component retrieval method and apparatus

Abstract

The application relates to a binary component retrieval method and device, which comprises the following steps: extracting the intermediate representation (IR) text, function method variable, binary import and export table and binary header file information of a binary file, and respectively calculating semantic features, function features and dependency features; calculating the similarity of the file and the public fingerprint database according to the three kinds of features to obtain a public component category; matching the determined public component to which the binary belongs with a private fingerprint library to obtain the accurate version similarity of the component, and then obtaining the accurate version corresponding to the component; and obtaining the architecture and operating system of the file by analyzing the binary header file information, and obtaining the component health degree and vulnerability information corresponding to the binary by combining a component knowledge graph. The application can not only effectively enhance the fingerprint difference between different components, but also accurately identify the specific version in the component, and can quickly and accurately retrieve the detailed information of the component used by the binary file.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a binary component retrieval method and apparatus. Background Technology

[0002] Public component libraries are widely used in software development due to their powerful API capabilities. Using public component libraries can significantly reduce development difficulty and improve software development efficiency. However, public component libraries contain numerous defects and even potential security vulnerabilities. For example, Windows 10 has a high-risk vulnerability, CVE-2020-1362, which allows unauthorized acquisition of administrator privileges. This vulnerability is caused by the binary dynamic link library WalletService.dll. Software Component Analysis (SCA) is an open-source component analysis method. This method is divided into SCA source code analysis and SCA binary analysis. Since public component libraries typically do not disclose their source code, only binary component component analysis can be performed.

[0003] Most existing technologies focus on identifying the categories of public component libraries, without exploring or deeply investigating the problem of accurate version identification of components. Although there are methods for extracting features from public component libraries based on cross-fingerprint analysis, these methods require building a feature library from the source code. Faced with a massive number of binary public component libraries, their practical use is limited and they lack universality. Therefore, it is necessary to accurately locate the specific version of public components in binary files. Thus, how to locate the accurate version of a public component when the source code is missing is a problem that needs to be solved.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of the prior art and provide a binary component retrieval method and apparatus, which solves the problem that the accurate version of a public component cannot be located when the source code is missing.

[0006] The objective of this invention is achieved through the following technical solution: a binary component retrieval method, the retrieval method comprising:

[0007] S1. Extract the intermediate representation (IR) text, function method variables, binary import / export table, and binary header file information from the binary file, and calculate the semantic features, function features, and dependency features respectively.

[0008] S2. Calculate the similarity between the file and the public fingerprint in the public fingerprint database based on semantic features, functional features, and dependency features to obtain the public component category;

[0009] S3. Match the public component to which the determined binary belongs with the private fingerprint database to obtain the precise version similarity of the component, and then obtain the precise version corresponding to the component;

[0010] S4. By parsing the binary header information, we can obtain the architecture and operating system of the file, and combine it with the component knowledge graph to obtain the component health and vulnerability information corresponding to the binary.

[0011] The S1 step specifically includes: using a disassembler to write a plugin to extract IR information from each binary file of the component set, and using the IR information as a linear sequence IR text to extract semantic features through the deep learning model BERT, extracting binary function method variables, import / export tables and binary header file information, and converting them into function features and dependency features through the MD5 algorithm.

[0012] In step S2, the semantic fingerprint similarity of common components is calculated using semantic features, which is the cosine distance between the semantic feature embedding and the cluster centers of the m common components. The calculation rule is as follows:

[0013] ;

[0014] in, Let represent the cluster center of the semantic fingerprint of the i-th common component. The lower the cosine distance, the closer the semantic vectors are, and the more similar they are to the fingerprint of that component.

[0015] In step S2, the similarity of the function fingerprints of common components is calculated through function features, that is, the repetition rate between the function feature func and the function fingerprints of m common components. The calculation rules are as follows:

[0016] ;

[0017] in This represents the fingerprint of the i-th common component function. This represents the number of times the function fingerprint of the i-th common component is repeated with the function feature func. This represents the number of function fingerprints for the i-th common component. The higher the repetition rate of a function fingerprint, the more similar it is to the fingerprint of that component.

[0018] The dependency fingerprint similarity of common components is calculated using dependency features, that is, the repetition rate between the dependency feature reply and the dependency fingerprints of m common components. The calculation rules are as follows:

[0019] ;

[0020] in This indicates that the i-th public component depends on the fingerprint. This represents the dependency fingerprint and dependency characteristics of the i-th common component. Number of repetitions, This represents the number of dependent fingerprints of the i-th common component. The higher the repetition of dependent fingerprints, the more similar they are to the fingerprints of that component.

[0021] In step S2, the similarity to the m common components is obtained as follows:

[0022] ;

[0023] in, The parameters are set, and the top-k most similar components can be returned according to actual needs.

[0024] The precise version similarity of the components includes version semantic feature similarity and version functional feature similarity; the version semantic feature similarity is calculated through semantic features, that is, the cosine distance between the semantic feature embedding and the vectors of n versions, and the calculation rule is as follows:

[0025] ;

[0026] The lower the cosine distance, the closer the semantic vectors are, and the more similar they are to the version fingerprint;

[0027] The similarity of the version function fingerprints is calculated by removing the private function features from the public fingerprints, that is, the degree of repetition between the private function feature func and the function fingerprints of n versions. The calculation rules are as follows:

[0028] ;

[0029] in This represents the fingerprint of the i-th version of the function. This indicates the number of times the fingerprint of the i-th version function overlaps with the feature of the private function func. This represents the number of fingerprints for the i-th version of the function. The higher the repetition rate of the private function fingerprint, the more similar it is to the fingerprint of that version.

[0030] The rule for calculating the precise version similarity of the components is as follows:

[0031] ;

[0032] in, The parameters are set, and the top-k most similar component versions can be returned according to actual needs.

[0033] A binary component retrieval device includes a feature extraction module, a similarity calculation module, a version matching module, and a parsing and acquisition module;

[0034] The feature extraction module is used to extract the intermediate representation (IR) text, function method variables, binary import / export tables, and binary header file information of the binary file, and to calculate semantic features, function features, and dependency features respectively.

[0035] The similarity calculation module is used to calculate the similarity between the file and the public fingerprint database based on semantic features, function features, and dependency features, and to obtain the public component category.

[0036] The version matching module is used to match the public component to which the determined binary belongs with the private fingerprint database to obtain the precise version similarity of the component, and then obtain the precise version corresponding to the component.

[0037] The parsing and acquisition module is used to obtain the architecture and operating system of the binary header file by parsing the binary header file information, and to obtain the component health and vulnerability information corresponding to the binary file by combining the component knowledge graph.

[0038] The similarity calculation module includes a common component semantic fingerprint similarity calculation unit, a common component function fingerprint similarity calculation unit, a common component dependency fingerprint similarity calculation unit, and a common component similarity calculation unit;

[0039] The public component semantic fingerprint similarity calculation unit: is used to calculate the similarity through... The semantic fingerprint similarity of common components is calculated based on semantic features, which is the cosine distance between the semantic feature embedding and the cluster centers of the m common components, where... Let represent the cluster center of the semantic fingerprint of the i-th common component. The lower the cosine distance, the closer the semantic vectors are, and the more similar they are to the fingerprint of that component.

[0040] The public component function fingerprint similarity calculation unit: is used to calculate fingerprint similarity through... The similarity of the function fingerprints of common components is calculated based on the function features, that is, the degree of repetition between the function feature `func` and the function fingerprints of m common components. This represents the fingerprint of the i-th common component function. This represents the number of times the function fingerprint of the i-th common component is repeated with the function feature func. This represents the number of function fingerprints for the i-th common component. The higher the repetition rate of a function fingerprint, the more similar it is to the fingerprint of that component.

[0041] The common dependency fingerprint similarity calculation unit is used to calculate the fingerprint similarity through... The dependency fingerprint similarity of common components is calculated based on dependency features, that is, the degree of repetition between the dependency feature reply and the dependency fingerprints of m common components, where... This indicates that the i-th public component depends on the fingerprint. This represents the dependency fingerprint and dependency characteristics of the i-th common component. Number of repetitions, This represents the number of dependent fingerprints of the i-th common component. The higher the repetition of dependent fingerprints, the more similar they are to the fingerprint of that component.

[0042] The public component similarity calculation unit is used to calculate the similarity of components through... Calculate the similarity with m common components, where, The parameters are set, and the top-k most similar components can be returned according to actual needs.

[0043] The version matching module includes a version semantic feature similarity calculation unit, a version function feature similarity calculation unit, and a component accurate version calculation unit;

[0044] The version semantic feature similarity calculation unit: is used to calculate the similarity through... The semantic feature similarity between the versions is calculated based on the semantic features, that is, the cosine distance between the semantic feature embedding and the vectors of the n versions;

[0045] The version function feature similarity calculation unit is used to calculate the similarity of features through... The similarity of the private function features after removing public fingerprints is calculated, i.e., the repetition rate between the private function feature func and the function fingerprints of n versions. This represents the fingerprint of the i-th version of the function. This indicates the number of times the fingerprint of the i-th version function overlaps with the feature of the private function func. This represents the number of fingerprints for the i-th version of the function. The higher the repetition rate of the private function fingerprint, the more similar it is to the fingerprint of this version.

[0046] The component precise version similarity calculation unit: is used to calculate the similarity between the components through... Calculate the exact version similarity of components, where, The parameters are set, and the top-k most similar component versions can be returned according to actual needs.

[0047] The present invention has the following advantages: a binary component retrieval method and apparatus, by extracting a common fingerprint set of components from binary sets of components of different versions and architectures, and using the private fingerprint of binary files to locate the precise version, can not only effectively enhance the fingerprint differences between different components, but also accurately identify the specific version within a component, and can quickly and accurately retrieve the detailed information of the components used in the binary file. Attached Figure Description

[0048] Figure 1 This is a schematic flowchart of the method of the present invention;

[0049] Figure 2 A schematic diagram for fingerprint extraction of public components;

[0050] Figure 3 This is a schematic diagram illustrating the extraction of fingerprints for a specific version of the component.

[0051] Figure 4 This is a schematic diagram of the device of the present invention. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the detailed description of the embodiments of this application provided below with reference to the accompanying drawings is not intended to limit the scope of protection of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application. The present invention will be further described below with reference to the accompanying drawings.

[0053] One embodiment of this invention relates to a binary component retrieval method based on semantics, functions, and dependency fingerprints. This method extracts a common fingerprint set of components from binary sets of different versions and architectures, and uses the version-specific fingerprints of the binary files to pinpoint the precise version. This method not only effectively enhances the fingerprint differences between different components but also accurately identifies the specific version of a common component. After obtaining the precise version library of public components, historical vulnerability information is retrieved based on vulnerability knowledge graphs or software gene libraries, thereby discovering potential security vulnerabilities and risks in the binary files and taking timely corresponding measures to improve software security.

[0054] like Figure 1 As shown, it specifically includes the following:

[0055] S0. Construct a public component fingerprint database and a private version fingerprint database, which respectively serve the public component fingerprint matching in step S2 and the private version fingerprint matching retrieval in step S3.

[0056] S1. Extract the intermediate representation (IR) text, function and method variable strings, and binary import / export table from the binary file, and calculate semantic features, function features, and dependency features respectively. In addition, binary header file information also needs to be extracted.

[0057] S2. Using the above three features, calculate the similarity between the file and the public fingerprint in the public fingerprint database to obtain the public component category.

[0058] S3. After determining the public component to which the binary belongs, match it with the private fingerprint database to obtain the private version corresponding to the component.

[0059] S4. By parsing the binary header file, the architecture and operating system of the file are obtained. Combined with the component knowledge graph, detailed information such as the component's health and vulnerabilities corresponding to the binary is obtained.

[0060] Furthermore, in step S1, the extended functionality of the disassembler IDA Pro is utilized to write a plugin to extract LLVM IR information from each binary file in the component set. IR information, simply put, is the equivalent internal representation code between high-level languages ​​(e.g., C+, Java) and machine languages ​​(e.g., binary executables), acting as a bridge during the compilation process. In this invention, IR is treated as a linear sequence of IR text, and semantic features (Embedding) are extracted using a re-pre-trained deep learning model BERT. In addition, strings such as function method variables and import / export tables of the binary file need to be extracted and converted into function features (function) and dependency features (reply) using the MD5 algorithm.

[0061] The public component fingerprint database needs to store the public component fingerprints of a massive number of components. To illustrate the construction process of the component database in detail, this invention uses a set S of m different versions and architectures of binary components as an example (where set S contains n binary files). The fingerprint extraction of massive components can be performed concurrently using big data platforms such as Spark. The database construction is as follows: Figure 2 As shown, a public fingerprint consists of three parts: a public component semantic fingerprint, a public component function fingerprint, and a public component dependency fingerprint, forming a structure called "Component S, Semantic Fingerprint, Function Fingerprint, Dependency Fingerprint". The specific process for constructing these three fingerprint parts is as follows:

[0062] Common Component Semantic Fingerprint: Since the disassembly instructions of binary files are affected by CPU and architecture, they are prone to OOV (Out of Context) issues, making it difficult for deep learning models to converge. Therefore, this invention extracts semantic information from the intermediate representation (IR). For each file in the binary set S, the intermediate representation (IR) text is converted into a semantic vector set (Embeddings) using the BERT model. BERT is a bidirectional transformer encoding that can retain more semantic information. This invention uses the cluster center of the vector set (Embeddings) as the common component semantic fingerprint of the component, thus generating m semantic vector cluster centers.

[0063] Component Common Function Fingerprint: This invention extracts the common function fingerprint of components by analyzing strings such as function methods and variables. This requires prior construction of a union of component strings. .

[0064] Furthermore, the fingerprint within the component is first extracted, that is, the number of times each string within the component appears in the binary file is calculated as d_cnt. (where n is the number of binary files in set s). When d_cnt exceeds a certain threshold p1*n, the MD5 hash of the string is extracted as the fingerprint. Next, for the tf_idf values ​​between the fingerprint calculation components extracted in the previous step, fingerprints with a threshold less than p2 are deleted. Further, the above thresholds p1 and p2 can be selected as 30%, 40%, 50%, 60%, 70%, 80%, and 90% respectively, depending on the actual situation.

[0065] Component common dependency fingerprint: Calculate the intersection of the import and export tables of n binary files, and then concatenate the functions from the import and export tables to calculate the MD5 value as the fingerprint. For example, in a binary set S, the import table has a function `func1`, and the export table has a function `func2`. Then the dependency fingerprints of this set are the MD5 values ​​corresponding to `import_func1` and `export_func2`, respectively.

[0066] Furthermore, the private version fingerprint database requires the private characteristics of each file. To illustrate the construction process of the component database in detail, this invention also uses a set S of m different versions and architectures of binary components as an example (wherein, set S contains n binary files). Fingerprint extraction from massive numbers of components can be performed concurrently using big data platforms such as Spark. The construction of the private version fingerprint database described in this invention is as follows: Figure 3 As shown. Private fingerprints mainly include private semantic fingerprints and private function fingerprints.

[0067] Furthermore, intermediate representation (IR) text and strings such as function and method variables are extracted from the n files in set S. The intermediate representation (IR) text is transformed into a semantic vector using the BERT model to obtain a private semantic fingerprint, and the strings such as function and method variables are processed by removing the fingerprints of common components to obtain private function fingerprints.

[0068] In step S2 of this invention, the features from S1 are used to calculate the common fingerprint similarity and obtain the common component category. The following example uses a set S of m different versions and architectures of binary components (wherein set S contains n binary files).

[0069] The fingerprint similarity of the public components consists of three parts: semantic feature similarity, function feature similarity, and dependency similarity.

[0070] Furthermore, the semantic fingerprint similarity of common components is calculated through semantic features, which is the cosine distance between the semantic feature embedding and the m cluster centers (m components have m cluster centers). The matching rules are as follows:

[0071] ;

[0072] in This represents the cluster center of the semantic fingerprint of the i-th common component. The lower the cosine distance, the closer the semantic vectors are, and the more similar they are to the fingerprint of that component.

[0073] Furthermore, the similarity of the function fingerprints of common components is calculated through function features, that is, the degree of repetition between the function feature `func` and the function fingerprints of m common components. The matching rules are as follows:

[0074] ;

[0075] in This represents the fingerprint of the i-th common component function. This represents the number of times the function fingerprint of the i-th common component is repeated with the function feature func. This represents the number of function fingerprints for the i-th common component. The higher the repetition rate of a function fingerprint, the more similar it is to the fingerprint of that component.

[0076] Furthermore, the dependency fingerprint similarity of common components is calculated through dependency features, that is, the repetition degree between the dependency feature reply and the dependency fingerprints of m common components. The matching rules are as follows:

[0077] ;

[0078] in This represents the dependency fingerprint of the i-th public component. This represents the dependency fingerprint and dependency characteristics of the i-th common component. The number of repetitions. This represents the number of dependency fingerprints for the i-th common component. The higher the repetition rate of dependency fingerprints, the more similar they are to the fingerprint of that component.

[0079] Furthermore, the similarity with m common components is obtained as follows:

[0080] ;

[0081] in, These are all configurable parameters. Depending on the actual needs, the top-k most similar components can be returned.

[0082] After identifying the common components, the precise version of the common components needs to be determined in step S3.

[0083] The precise version similarity of the components consists of two parts: version semantic feature similarity and version function feature similarity.

[0084] Furthermore, the semantic feature similarity of the versions is calculated through semantic features, that is, the cosine distance between the semantic feature embedding and the n version vectors (the component contains n vectors). The matching rules are as follows:

[0085] ;

[0086] The lower the cosine distance, the closer the semantic vectors are, and the more similar they are to the fingerprint of that version.

[0087] Furthermore, the similarity of the version function fingerprints is calculated by removing the private function features from the public fingerprints, i.e., the repetition rate between the private function feature func_c and the n version function fingerprints. The matching rules are as follows:

[0088] ;

[0089] in This represents the fingerprint of the i-th version of the function. This indicates the number of times the function fingerprint of the i-th version is repeated with the private function feature func_c. This represents the number of fingerprints for the i-th version of the function. The higher the repetition rate of a private function fingerprint, the more similar it is to the fingerprint of that version.

[0090] Furthermore, the exact version similarity of the components is as follows:

[0091] ;

[0092] in, These are all configurable parameters. Depending on the actual needs, the top-k most similar component versions can be returned.

[0093] Furthermore, in step S4, information such as the binary file architecture and operating system can be obtained based on the binary header file information. Combined with the precise version of the publicly available components analyzed in step S3, detailed information such as the precise version, architecture, and compilation parameters of the publicly available components used by the binary file can be obtained. Furthermore, by combining this with a component knowledge graph, detailed information such as the health and vulnerabilities of the binary components can be obtained.

[0094] like Figure 4 As shown, another embodiment of the present invention relates to a binary component retrieval device based on semantics, function, and fingerprint dependence, which includes a feature extraction module, a similarity calculation module, a version matching module, and a parsing and acquisition module;

[0095] The feature extraction module is used to extract the intermediate representation (IR) text, function method variables, binary import / export tables, and binary header file information of the binary file, and to calculate semantic features, function features, and dependency features respectively.

[0096] The similarity calculation module is used to calculate the similarity between the file and the public fingerprint database based on semantic features, function features, and dependency features, and to obtain the public component category.

[0097] The version matching module is used to match the public component to which the determined binary belongs with the private fingerprint database to obtain the precise version similarity of the component, and then obtain the precise version corresponding to the component.

[0098] The parsing and acquisition module is used to obtain the architecture and operating system of the binary header file by parsing the binary header file information, and to obtain the component health and vulnerability information corresponding to the binary file by combining the component knowledge graph.

[0099] The similarity calculation module includes a common component semantic fingerprint similarity calculation unit, a common component function fingerprint similarity calculation unit, a common component dependency fingerprint similarity calculation unit, and a common component similarity calculation unit;

[0100] The public component semantic fingerprint similarity calculation unit: is used to calculate the similarity through... The semantic fingerprint similarity of common components is calculated based on semantic features, which is the cosine distance between the semantic feature embedding and the cluster centers of the m common components, where... Let represent the cluster center of the semantic fingerprint of the i-th common component. The lower the cosine distance, the closer the semantic vectors are, and the more similar they are to the fingerprint of that component.

[0101] The public component function fingerprint similarity calculation unit: is used to calculate fingerprint similarity through... The similarity of the function fingerprints of common components is calculated based on the function features, that is, the degree of repetition between the function feature `func` and the function fingerprints of m common components. This represents the fingerprint of the i-th common component function. This represents the number of times the function fingerprint of the i-th common component is repeated with the function feature func. This represents the number of function fingerprints for the i-th common component. The higher the repetition rate of a function fingerprint, the more similar it is to the fingerprint of that component.

[0102] The common dependency fingerprint similarity calculation unit is used to calculate the fingerprint similarity through... The dependency fingerprint similarity of common components is calculated based on dependency features, that is, the degree of repetition between the dependency feature reply and the dependency fingerprints of m common components, where... This indicates that the i-th public component depends on the fingerprint. This represents the dependency fingerprint and dependency characteristics of the i-th common component. Number of repetitions, This represents the number of dependent fingerprints of the i-th common component. The higher the repetition of dependent fingerprints, the more similar they are to the fingerprint of that component.

[0103] The public component similarity calculation unit is used to calculate the similarity of components through... Calculate the similarity with m common components, where, The parameters are set, and the top-k most similar components can be returned according to actual needs.

[0104] The version matching module includes a version semantic feature similarity calculation unit, a version function feature similarity calculation unit, and a component accurate version calculation unit;

[0105] The version semantic feature similarity calculation unit: is used to calculate the similarity through... The semantic feature similarity between the versions is calculated based on the semantic features, that is, the cosine distance between the semantic feature embedding and the vectors of the n versions;

[0106] The version function feature similarity calculation unit is used to calculate the similarity of features through... The similarity of the private function features after removing public fingerprints is calculated, i.e., the repetition rate between the private function feature func and the function fingerprints of n versions. This represents the fingerprint of the i-th version of the function. This indicates the number of times the fingerprint of the i-th version function overlaps with the feature of the private function func. This represents the number of fingerprints for the i-th version of the function. The higher the repetition rate of the private function fingerprint, the more similar it is to the fingerprint of this version.

[0107] The component precise version similarity calculation unit: is used to calculate the similarity between the components through... Calculate the exact version similarity of components, where, The parameters are set, and the top-k most similar component versions can be returned according to actual needs.

[0108] The above description is merely a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the forms disclosed herein and should not be construed as excluding other embodiments. It can be used in various other combinations, modifications, and environments, and can be altered within the scope of the concept described herein through the above teachings or related technologies or knowledge. Modifications and variations made by those skilled in the art that do not depart from the spirit and scope of the present invention should be within the protection scope of the appended claims.

Claims

1. A binary component retrieval method, characterized by: The retrieval method comprises: S1, extracting the intermediate representation IR text, function method variable, binary import export table and binary header file information of the binary file, and calculating semantic features, function features and dependency features respectively; S2, calculating the public component fingerprint similarity of the file and the public component fingerprint database according to the semantic features, function features and dependency features, to obtain the public component category; S3, matching the determined public component to which the binary belongs with the private fingerprint library to obtain the component accurate version similarity, and further obtaining the accurate version corresponding to the component; S4, obtaining the architecture and operating system of the file by analyzing the binary header file information, and obtaining the component health degree and vulnerability information corresponding to the binary in combination with the component knowledge graph; In the S2 step, the public component semantic fingerprint similarity is calculated by the semantic features, that is, the cosine distance between the semantic features Embedding and the clustering centers of m public components, and the calculation rule is as follows: ； wherein, represents the i-th public component semantic fingerprint cluster center, the lower the cosine distance, the closer the semantic vector, and the more similar the component fingerprint. In the S2 step, the public component function fingerprint similarity is calculated by the function features, that is, the function feature func and the repetition degree of the function fingerprint of m public components, and the calculation rule is as follows: ； wherein represents the i-th common component function fingerprint, represents the number of times the i-th common component function fingerprint repeats the function feature func, represents the number of i-th common component function fingerprints, the higher the function fingerprint repetition degree, the more similar to the component fingerprint; The public component dependency fingerprint similarity is calculated by the dependency features, that is, the dependency feature reply and the repetition degree of the dependency fingerprint of m public components, and the calculation rule is as follows: ； wherein represents the ith common component dependency fingerprint, represents the ith common component dependency fingerprint and dependency feature the number of repetitions, represents the ith common component dependency fingerprint number, the higher the dependency fingerprint repetition, the more similar to the component fingerprint; In the S2 step, the similarity with m public component fingerprints is obtained as follows: ； wherein, is a set parameter, according to actual demand, the top-k highest similarity components can be returned.

2. The method of claim 1, wherein: The S1 step specifically comprises: extracting IR information of each binary file of the component set by writing a plug-in of a disassembler tool, taking the IR information as a linear sequence IR text, and extracting semantic features by a deep learning model BERT, extracting function method variables, import export tables and binary header file information of the binary, and converting them into function features and dependency features by an MD5 algorithm.

3. The method of claim 1, wherein: The component accurate version similarity comprises version semantic feature similarity and version function feature similarity; the version semantic feature similarity is calculated by the semantic features, that is, the vector cosine distance between the semantic features Embedding and n versions, and the calculation rule is as follows: ； The lower the cosine distance is, the closer the semantic vector is, and the more similar the version fingerprint is; The version function feature similarity is calculated by removing the private function features of the public fingerprint, that is, the private function feature func_c and the function fingerprint repetition degree of n versions, and the calculation rule is as follows: ； wherein represents the i-th version function fingerprint, represents the number of times the i-th version function fingerprint repeats the private function characteristic func_c, represents the i-th version function fingerprint, the higher the private function fingerprint repetition degree, the more similar to the version fingerprint.

4. The method of claim 3, wherein: The component accurate version similarity calculation rule is as follows: ； wherein, is a set parameter, according to actual demand, the top-k highest similarity component version can be returned.

5. A binary component retrieval apparatus characterized by: It comprises a feature extraction module, a similarity calculation module, a version matching module and an analysis and acquisition module; The feature extraction module is used for extracting the intermediate representation IR text, function method variable, binary import export table and binary header file information of the binary file, and calculating semantic features, function features and dependency features respectively; The similarity calculation module is used for calculating the public fingerprint similarity of the file and the public fingerprint database according to the semantic features, function features and dependency features, to obtain the public component category; The version matching module is used for matching the determined public component to which the binary belongs with the private fingerprint library to obtain the component accurate version similarity, and further obtaining the accurate version corresponding to the component; The parsing acquisition module is used for obtaining the architecture and operating system of the file by parsing binary header file information, and obtaining the component health degree and vulnerability information corresponding to the binary in combination with the component knowledge graph; The similarity calculation module comprises a public component semantic fingerprint similarity calculation unit, a public component function fingerprint similarity calculation unit, a public component dependency fingerprint similarity calculation unit and a public component similarity calculation unit; The public component semantic fingerprint similarity calculation unit is configured to calculate the public component semantic fingerprint similarity by The public component semantic fingerprint similarity is calculated according to semantic features, that is, the cosine distance between semantic feature Embedding and the cluster center of m public components, wherein, The cosine distance between the i th public component semantic fingerprint cluster center and the semantic vector is represented by, and the lower the cosine distance is, the closer the semantic vector is, and the more similar the component fingerprint is. The public component function fingerprint similarity calculation unit is used for calculating the public component function fingerprint similarity through According to the function feature, the public component function fingerprint similarity is calculated, that is, the function feature func and the m public component function fingerprint repetition degree, wherein represents the i th public component function fingerprint, represents the number of repetitions of the i th public component function fingerprint and the function feature func, represents the i th public component function fingerprint number, and the higher the function fingerprint repetition degree, the more similar to the component fingerprint. The public component dependency fingerprint similarity calculation unit is configured to calculate the similarity between the dependency feature reply and the m public component dependency fingerprints by The public component dependency fingerprint similarity is calculated according to the dependency feature, that is, the dependency feature reply and the m public component dependency fingerprint repetition. The i-th public component dependency fingerprint is represented as The i-th public component dependency fingerprint and the dependency feature are represented as The number of repetitions is represented as The i-th public component dependency fingerprint is represented as the number of repetitions. The higher the dependency fingerprint repetition, the more similar the component fingerprint. The public component similarity calculation unit is configured to calculate the similarity with m public components, wherein, The public component similarity calculation unit is configured to calculate the similarity with m public components, wherein, The public component similarity calculation unit is configured to calculate the similarity with m public components, wherein, 6. A binary component retrieval apparatus according to claim 5, wherein: The version matching module comprises a version semantic feature similarity calculation unit, a version function feature similarity calculation unit and a component accurate version calculation unit; The version semantic feature similarity calculation unit is configured to calculate the version semantic feature similarity according to semantic features, that is, the cosine distance between semantic feature Embedding and the vectors of n versions. The version semantic feature similarity calculation unit is configured to calculate the version semantic feature similarity according to semantic features, that is, the cosine distance between semantic feature Embedding and the vectors of n versions. The version function feature similarity calculation unit is configured to calculate the similarity of the version function fingerprints by The private function feature of the common fingerprint is removed, and the similarity of the private function feature func_c and the function fingerprint of the n versions is calculated, where represents the i-th version function fingerprint, represents the number of times that the i-th version function fingerprint is repeated with the private function feature func_c, represents the number of i-th version function fingerprints, and the higher the function fingerprint repetition degree is, the more similar the version fingerprint is. The component precise version calculation unit is used for calculating the component precise version similarity by The top-k component versions with the highest similarity can be returned according to actual requirements.​

Images