Embedded generation method and device of binary function, electronic equipment and medium
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- INSTITUTE OF INFORMATION ENGINEERING CHINESE ACADEMY OF SCIENCES
- Filing Date
- 2023-11-28
- Publication Date
- 2026-07-24
Smart Images
Figure CN117762418B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, electronic device, and medium for embedding and generating binary functions. Background Technology
[0002] Binary code (or binary functions) is the basic form of programming data that computers can directly parse. It consists of a string of 0s and 1s arranged in a structured manner and can be read and executed by large computer programs. To analyze binary code, various techniques have been proposed to learn semantic information in different dimensions, such as code sequence-based learning methods and program structure graph-based learning methods.
[0003] Code sequence learning methods learn binary code sequences using natural language processing. These methods include: normalizing assembly code using a normalization strategy and then encoding the binary file using a word2vec model; simultaneously learning instruction and function embeddings using a PV-DM model; treating the programming language as text and using natural language processing techniques for similarity calculation; or converting assembly code into an intermediate representation and then using a BERT model to learn IR embeddings. However, none of the code sequence learning methods listed above can specifically learn the code semantics of binary functions.
[0004] Program structure graph-based learning methods learn the semantics of binary code by using graph neural networks and other techniques to learn program structure graphs derived from binary code, such as control flow graphs and abstract syntax trees (ASTs). These methods include using the Structure2vec structure to learn control flow graphs, using graph neural networks to learn control flow graphs, data flow graphs, and function call graphs, and using Tree-LSTM to learn abstract syntax trees of functions. However, these program structure graph-based learning methods ignore the differences in information between different structures within the program structure graph; for example, each edge in a control flow graph represents a different jump relationship. Furthermore, because these methods rely on the program structure graph, they lose the global order information of the code, preventing the model from learning the complete semantics of the code. Summary of the Invention
[0005] This invention provides a binary function embedding generation method, apparatus, electronic device, and medium to solve the problem that binary function embedding cannot fully learn the semantic information of the code in the prior art. It realizes the learning of the semantic embedding representation of the code from multiple different dimensions of the binary function, so that the binary function embedding can retain the source code information to the greatest extent and improve the quality of binary function embedding.
[0006] According to a first aspect of the present invention, a method for embedding and generating binary functions is provided, comprising:
[0007] The target binary function is input into a pre-trained control flow semantic learning model to obtain a control flow semantic embedding, wherein the control flow semantic learning model is used to convert the relational control flow graph corresponding to the binary function into a vector and output it.
[0008] The target binary function is input into a pre-trained global sequential semantic learning model to obtain a global sequential semantic embedding. The global sequential semantic learning model is used to convert the machine code corresponding to the binary function into a vector and output it.
[0009] The control flow semantic embedding and the global sequence semantic embedding are integrated, and the integration result is used as the embedding corresponding to the target binary function.
[0010] In some possible implementations, the control flow semantic learning model includes BERT networks and R-GCN networks;
[0011] The step of inputting the target binary function into a pre-trained control flow semantic learning model to obtain the control flow semantic embedding includes:
[0012] Obtain the relational control flow graph of the target binary function, wherein the relational control flow graph includes: basic block nodes and edges connecting the basic block nodes;
[0013] The relational control flow graph is input into the BERT network in a pre-trained control flow semantic learning model;
[0014] The BERT network is used to convert the basic block nodes of the relational control flow graph input from the first input terminal into vector representations and output them through the first output terminal.
[0015] The vector output from the first output terminal is input into the R-GCN network in the pre-trained control flow semantic learning model;
[0016] The edge pair vectors between the neighbor aggregation layer and the basic block nodes of the R-GCN network are updated.
[0017] The updated vectors are weighted and averaged using the graph pooling layer of the R-GCN network, and then output.
[0018] The vector output by the R-GCN network in the pre-trained control flow semantic learning model is used as the control flow semantic embedding.
[0019] In some possible implementations, the edges connecting the basic block nodes are determined according to the following rules:
[0020] In response to whether the control flow jump of any basic block node pair is a sequential jump or a control flow jump with a true condition, an edge with a value of zero is used to connect any basic block node pair.
[0021] If the control flow jump mode of any basic block node pair is a control flow jump with a false condition, then an edge with a value of one is used to connect any basic block node pair.
[0022] In some possible implementations, the global sequential semantic learning model includes a DPCNN network;
[0023] The step of inputting the target binary function into a pre-trained global sequential semantic learning model to obtain a global sequential semantic embedding includes:
[0024] Obtain the machine code of the target binary function;
[0025] The binary numbers in the machine code are reassembled and converted into decimal numbers to obtain a decimal byte sequence;
[0026] Convert each decimal number in the decimal byte sequence into a vector;
[0027] The vectors corresponding to each decimal number in the decimal byte sequence are input into the DPCNN network in the pre-trained global sequential semantic learning model;
[0028] The dependency information of the decimal byte sequence is extracted using the DPCNN network and then output.
[0029] The vector output by the DPCNN network in the pre-trained global sequential semantic learning model is used as the global sequential semantic embedding.
[0030] In some possible implementations, the step of recombining and converting the binary number in the machine code into a decimal number to obtain a decimal byte sequence includes:
[0031] Starting from the first bit of the machine code, group consecutive eight-bit binary numbers together to obtain several groups of binary numbers with a sequence.
[0032] Convert each set of binary numbers into decimal numbers in the order of the sets to obtain a decimal byte sequence.
[0033] In some possible implementations, converting each decimal number in the decimal byte sequence into a vector includes:
[0034] The embedding layer in PyTorch is used to generate a token embedding for each decimal number, and the token embedding is used as the vector for transformation.
[0035] In some possible implementations, the method further includes:
[0036] The BERT network is used to compare the reference relation control flow graph, which is represented by a vector and is input from the second input terminal, with the first output terminal. The comparison operation includes: comparing whether any basic block node pairs are connected, and / or comparing whether any basic block nodes belong to the same relation control flow graph, and / or the compilation type corresponding to the relation control flow graph to which any basic block node belongs;
[0037] The comparison result is output through the second output terminal of the BERT network.
[0038] According to a second aspect of the present invention, an apparatus for embedding and generating binary functions is also provided, the apparatus comprising:
[0039] The first conversion module is used to input the target binary function into a pre-trained control flow semantic learning model to obtain a control flow semantic embedding, wherein the control flow semantic learning model is used to convert the relational control flow graph corresponding to the binary function into a vector and output it.
[0040] The second conversion module is used to input the target binary function into a pre-trained global sequential semantic learning model to obtain a global sequential semantic embedding. The global sequential semantic learning model is used to convert the machine code corresponding to the binary function into a vector and output it.
[0041] An integration module is used to integrate the control flow semantic embedding and the global sequence semantic embedding, and use the integration result as the embedding corresponding to the target binary function.
[0042] According to a third aspect of the present invention, an electronic device is also provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the method for embedding and generating binary functions as described above.
[0043] According to a fourth aspect of the present invention, a non-transitory computer-readable storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the method for embedding and generating binary functions as described above.
[0044] The binary function embedding generation method provided by this invention involves inputting the target binary function into a pre-trained control flow semantic learning model and a pre-trained global sequence semantic learning model, respectively, in the form of a relational control flow graph and machine code. This allows the pre-trained control flow semantic learning model and the pre-trained global sequence semantic learning model to learn features from the relational control flow dimension and the data dimension of the binary function, respectively, thereby obtaining control flow semantic embeddings and global sequence semantic embeddings belonging to different dimensions. Finally, the embeddings from different dimensions are integrated to obtain the semantically complete binary function embedding. This method ensures that the binary function embedding retains code information to the greatest extent, has good generalization performance, and improves the quality of binary function embedding.
[0045] Furthermore, the binary function embedding and generation apparatus, the electronic device, and the non-transitory computer-readable storage medium of the present invention can also achieve the above-mentioned technical effects, and will not be described in detail here. Attached Figure Description
[0046] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0047] Figure 1 This is a flowchart illustrating a binary function embedding generation method provided in an example of the present invention;
[0048] Figure 2 This is a schematic diagram of the model framework used in the binary function embedding and generation method provided in an example of the present invention;
[0049] Figure 3 This is a schematic diagram of the BERT network training process provided in an example of the present invention;
[0050] Figure 4 This is a schematic diagram of the structure of a binary function embedding and generation device provided in an embodiment of the present invention;
[0051] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation
[0052] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.
[0053] The following is combined Figures 1-5 This invention describes a binary function embedding generation method, a binary function embedding generation apparatus, an electronic device, and a non-transitory computer-readable storage medium.
[0054] Figure 1 This is a flowchart illustrating a binary function embedding generation method provided in an example of the present invention. Please refer to it. Figure 1 As shown, the binary function embedding generation method provided by the present invention can be implemented through steps S101 to S103:
[0055] Step S101: Input the target binary function into the pre-trained control flow semantic learning model to obtain the control flow semantic embedding. The control flow semantic learning model is used to convert the relational control flow graph corresponding to the binary function into a vector and output it.
[0056] Specifically, the target binary function refers to the selected binary function whose code semantics need to be learned. When the target binary function is input into the control flow semantics learning model, it needs to be converted into a relational control flow graph. The relational control flow graph (CFG) is an abstract representation of a process or program, an abstract data structure used in the compiler and maintained internally. It represents all paths traversed during program execution; the CFG uses a graph to represent the possible flow of execution for all basic blocks (sequences of sequentially executed statements) within a process.
[0057] In the specific implementation process, the target binary function can be transformed into a relational control flow graph using any existing transformation method, such as using pre-defined transformation rules, or using existing transformation tools (such as compilers) to implement the transformation from binary function to relational control flow graph.
[0058] Step S102: Input the target binary function into the pre-trained global sequential semantic learning model to obtain the global sequential semantic embedding. The global sequential semantic learning model is used to convert the machine code corresponding to the binary function into a vector and output it.
[0059] Specifically, machine code, also known as machine number, is a structured data sequence formed when program code is represented in binary in a computer. The program code can be written in any existing computer programming language.
[0060] Step S103: Integrate the control flow semantic embedding and the global sequence semantic embedding, and use the integration result as the embedding corresponding to the target binary function.
[0061] Specifically, integrating the control flow semantic embedding and the global sequential semantic embedding means calculating the sum of the control flow semantic embedding and the global sequential semantic embedding, and using the sum as the integration result.
[0062] The binary function embedding generation method in this embodiment inputs the target binary function into a pre-trained control flow semantic learning model and a pre-trained global sequence semantic learning model in the form of a relational control flow graph and machine code, respectively. This allows the pre-trained control flow semantic learning model and the pre-trained global sequence semantic learning model to learn features from the relational control flow dimension and the data dimension of the binary function, respectively, thereby obtaining control flow semantic embeddings and global sequence semantic embeddings belonging to different dimensions. Finally, the embeddings of different dimensions are integrated to obtain the semantically complete binary function embedding. This allows the binary function embedding to retain code information to the greatest extent, has good generalization performance, and improves the quality of binary function embedding.
[0063] For some possible implementations, please refer to Figure 2 As shown, the control flow semantic learning model includes a BERT network and an R-GCN network. In the specific implementation process, the BERT network and R-GCN network of the control flow semantic learning model are trained separately before being integrated together.
[0064] The following section will detail the implementation process of generating control flow semantic embeddings using BERT and R-GCN networks. Specifically, step S101, mentioned above, involves inputting the target binary function into a pre-trained control flow semantic learning model to obtain the control flow semantic embedding, which includes:
[0065] First, obtain the relational control flow graph of the target binary function, which includes: basic block nodes and edges connecting the basic block nodes.
[0066] Specifically, the edges connecting basic block nodes are determined according to the following rules:
[0067] In response to whether the control flow jump of any basic block node pair is a sequential jump or a control flow jump with a true condition, an edge with a value of zero is used to connect any basic block node pair.
[0068] If the control flow jump mode of any basic block node pair is a control flow jump with a false condition, then an edge with a value of one is used to connect any basic block node pair.
[0069] It should be noted that when the jump relationship between basic block node pairs does not belong to any of the types listed above, it means that there is no jump relationship between basic block nodes, that is, the basic block node pairs do not need to be connected.
[0070] For example, please refer to Figure 2 The relational control flow graph shown here consists of a total of five basic block nodes. Figure 2 In the control flow graph, edges represented by solid lines are edges with a value of zero, and edges represented by dashed lines are edges with a value of zero. Figure 2 There are five pairs of basic block nodes that are connected.
[0071] The relational control flow graph is input into the BERT network in a pre-trained control flow semantic learning model.
[0072] Specifically, when inputting the relational control flow graph into the BERT network in the pre-trained control flow semantic learning model, it is necessary to map each basic block node in the relational control flow graph to an input object, and each input object corresponds to multiple input nodes at the first input end of the BERT network.
[0073] For example, Figure 2 The BERT network constructs input nodes E1 to En, which are respectively connected to the basic block nodes in the relational control flow graph (i.e., ...). Figure 2 (BB in the text) corresponds to this.
[0074] The BERT network is used to convert the basic block nodes of the relational control flow graph input from the first input terminal into vector representations and output them through the first output terminal.
[0075] Specifically, when the BERT network outputs the vectors corresponding to each basic block node, it needs to map the vectors corresponding to each basic block node to output objects. Each output object corresponds to multiple output nodes at the first input end of the BERT network.
[0076] For examples, please refer to Figure 2 As shown, after processing by the BERT network, each basic open node in the relational control flow graph will be converted into a vector representation. That is, the five basic block nodes are converted into their corresponding vectors and output through T1 to Tn.
[0077] It should be noted that the number of basic block nodes in the relational control flow graph, the number of input nodes and output nodes in the BERT network listed above are for illustrative purposes only and should not be construed as a limitation on the present invention.
[0078] The vector output from the first output terminal is input into the R-GCN network in the pre-trained control flow semantic learning model.
[0079] Specifically, when inputting the vector output from the first output end into the R-GCN network in the pre-trained control flow semantic learning model, it is necessary to map each basic block node represented by a vector to an input object, with each input object corresponding to multiple input nodes of the R-GCN network.
[0080] The update is performed using the neighbor aggregation layer and the edge pair vectors between basic block nodes in the R-GCN network.
[0081] In this embodiment, the RGCN network is able to learn the embedded representation of the relation control flow graph, and the embedding update formula used by its neighbor aggregation layer is as follows:
[0082]
[0083] Among them, F d Represents a basic block node, RGCN(F) d ) represents the basic block node F d The updated vector, where Leakyrelu represents the activation function, Indicates a pointer to the basic block node F i The connection relationship is the set of neighbor nodes of r, where R represents all possible connection relationships, and R takes the value 0 or 1. i,r It is a regularization constant, where c i,r The value is This indicates the parameter value corresponding to the edge type connecting the basic block nodes. Indicates the number of edge types. The node embedding of basic block node j is represented by l, and the number of network layers is represented by l.
[0084] The updated vector is weighted and averaged using the graph pooling layer of the R-GCN network before outputting the new vector. Specifically, the graph pooling layer adds and averages the vectors corresponding to all basic block nodes to obtain a new vector.
[0085] Finally, the vector output by the R-GCN network in the pre-trained control flow semantic learning model is used as the control flow semantic embedding.
[0086] According to this embodiment, firstly, edges between different basic block nodes are constructed through different jump relationships (direct sequential jump and conditional jump) to obtain a specific form of relational control flow graph; then, the basic block nodes of the BERT network are converted into embeddings, and the RGCN network is used to learn the embedding representation of the relational control flow graph, thereby obtaining a semantically complete control flow semantic embedding.
[0087] Please refer to the following for possible implementations. Figure 2 As shown, the global sequential semantic learning model includes the DPCNN network; the generation process of global sequential semantic embedding will be explained in detail below with reference to the DPCNN network.
[0088] Specifically, step 102 above involves inputting the target binary function into a pre-trained global sequential semantic learning model to obtain a global sequential semantic embedding, which includes:
[0089] First, obtain the machine code of the target binary function.
[0090] The binary numbers in the machine code are reassembled and converted into decimal numbers to obtain a decimal byte sequence.
[0091] Please refer to the following for possible implementations. Figure 2 As shown, the binary numbers in the machine code are reassembled and converted into decimal numbers to obtain a decimal byte sequence, including:
[0092] Starting from the first bit of the machine code, group consecutive eight-bit binary numbers together to obtain several groups of binary numbers with a sequence.
[0093] Convert each set of binary numbers into decimal numbers in the order of the sets to obtain a decimal byte sequence.
[0094] For example, let's assume the machine code is: 0100100010110111..., the first group of eight-bit binary code is "01001000", the second group of eight-bit binary code is "10110111", after decimal conversion, the decimal number corresponding to the first group of eight-bit binary code is "72", and after decimal conversion, the decimal number of the second group of eight-bit binary code is "183". Arrange the obtained decimal numbers according to the order of the eight-bit binary numbers of each group to obtain the decimal byte sequence.
[0095] Then, each decimal number in the decimal byte sequence is converted into a vector.
[0096] Specifically, converting each decimal number in a decimal byte sequence into a vector can include:
[0097] The embedding layer in PyTorch is used to generate a token embedding for each decimal number, and the token embedding is used as the vector for transformation.
[0098] Next, the vectors corresponding to each decimal number in the decimal byte sequence are input into the DPCNN network in the pre-trained global sequential semantic learning model.
[0099] The DPCNN network is used to extract the dependency information of the decimal byte sequence and then output it.
[0100] In this embodiment, the DPCNN network can learn long-range dependency information of decimal byte sequences and output the learned dependency information in vector form.
[0101] The vector output by the DPCNN network in the pre-trained global sequential semantic learning model is used as the global sequential semantic embedding.
[0102] According to this embodiment, a byte sequence in decimal representation is constructed by machine code based on binary functions, and the embedding representation of the decimal byte sequence is learned by a DPCNN model that can learn long-distance dependencies, thereby obtaining a complete semantic embedding in the dimension of data flow.
[0103] In some possible implementations, unlike the aforementioned embodiments, this embodiment further optimizes the BERT network to improve the performance of binary function embedding in downstream tasks (such as compilation environment recovery, binary code similarity identification, and vulnerability function recall). Besides converting basic block nodes into vectors, the optimized BERT network adds a reference input and another output for label output. The following will describe the functionality of the optimized BERT network in detail:
[0104] The BERT network is used to compare the reference relation control flow graph, which is represented by a vector and input from the second input, with the first output. The comparison operation includes: comparing whether any basic block node pairs are connected, and / or comparing whether any basic block nodes belong to the same relation control flow graph, and / or the compilation type corresponding to the relation control flow graph to which any basic block node belongs;
[0105] The comparison results are output through the second output terminal of the BERT network.
[0106] For example, please refer to Figure 3As shown, the improved BERT network has two inputs. When training this improved BERT network, four training tasks can be constructed: Training Task 1 can predict the vector corresponding to any basic block node; Training Task 2 can classify the adjacency information of vectors corresponding to any two basic blocks. For example, if vector 3 and its corresponding basic block node are connected, the output is 1 indicating a connection; if vector 4 and its corresponding basic block node are not connected, the output is 0 indicating a disconnection; Training Task 3 can learn whether vectors corresponding to any two basic blocks belong to the same relational control flow graph. For example, the basic block nodes corresponding to vectors 1-4 belong to CFG1, and the basic block nodes corresponding to vectors 5-7 belong to CFG2. When any two vectors to be compared belong to different CFGs, the task can output 0; when any two vectors to be compared belong to the same CFG, the task can output 1; Task 4 can identify the compilation type of the CFG to which the basic block node corresponding to the vector belongs.
[0107] According to this embodiment, the BERT network has been further optimized for the application of binary function embedding to downstream tasks. The overall model framework does not need to be changed. Only a task-specific output layer needs to be added after the BERT network for training, which has better flexibility.
[0108] The binary function embedding and generation apparatus provided by the present invention will be described below. The binary function embedding and generation apparatus described below and the binary function embedding and generation method described above can be referred to in correspondence.
[0109] Figure 4 This is a schematic diagram of the structure of a binary function embedding and generation device provided in an embodiment of the present invention. Please refer to... Figure 4 As shown, the binary function embedding and generation device provided in this embodiment of the invention includes: a first conversion module 410, a second conversion module 420, and an integration module 430. Each module will be described in detail below:
[0110] The first conversion module 410 is used to input the target binary function into a pre-trained control flow semantic learning model to obtain a control flow semantic embedding, wherein the control flow semantic learning model is used to convert the relational control flow graph corresponding to the binary function into a vector and output it.
[0111] The second conversion module 420 is used to input the target binary function into a pre-trained global sequential semantic learning model to obtain a global sequential semantic embedding. The global sequential semantic learning model is used to convert the machine code corresponding to the binary function into a vector and output it.
[0112] Integration module 430 is used to integrate the control flow semantic embedding and the global sequence semantic embedding, and use the integration result as the embedding corresponding to the target binary function.
[0113] It should be noted that the specific limitations regarding the binary function embedding generation device can be found in the limitations of the binary function embedding generation method described above, and will not be repeated here. Each module in the aforementioned binary function embedding generation device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in hardware or independently of the processor in the electronic device, or stored in software in the memory of the electronic device, so that the processor can call and execute the operations corresponding to each module.
[0114] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5 As shown, the electronic device may include a processor 510, a communication interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communication interface 520, and the memory 530 communicate with each other through the communication bus 540. The processor 510 can call logical instructions in the memory 530 to execute a binary function embedding generation method. This method includes: inputting a target binary function into a pre-trained control flow semantic learning model to obtain a control flow semantic embedding, wherein the control flow semantic learning model is used to convert the relational control flow graph corresponding to the binary function into a vector and output it; inputting the target binary function into a pre-trained global order semantic learning model to obtain a global order semantic embedding, wherein the global order semantic learning model is used to convert the machine code corresponding to the binary function into a vector and output it; integrating the control flow semantic embedding and the global order semantic embedding, and using the integrated result as the embedding corresponding to the target binary function.
[0115] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0116] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements an embedding generation method for binary functions provided by the above methods. This method includes: inputting a target binary function into a pre-trained control flow semantic learning model to obtain a control flow semantic embedding, wherein the control flow semantic learning model is used to convert the relational control flow graph corresponding to the binary function into a vector and output it; inputting the target binary function into a pre-trained global order semantic learning model to obtain a global order semantic embedding, wherein the global order semantic learning model is used to convert the machine code corresponding to the binary function into a vector and output it; and integrating the control flow semantic embedding and the global order semantic embedding, using the integrated result as the embedding corresponding to the target binary function.
[0117] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.
[0118] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0119] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for embedding and generating binary functions, characterized in that, The method includes: The target binary function is input into a pre-trained control flow semantic learning model to obtain a control flow semantic embedding, wherein the control flow semantic learning model is used to convert the relational control flow graph corresponding to the binary function into a vector and output it. The target binary function is input into a pre-trained global sequential semantic learning model to obtain a global sequential semantic embedding. The global sequential semantic learning model is used to convert the machine code corresponding to the binary function into a vector and output it. The control flow semantic embedding and the global sequence semantic embedding are integrated, and the integration result is used as the embedding corresponding to the target binary function. The control flow semantic learning model includes the BERT network and the R-GCN network; The step of inputting the target binary function into a pre-trained control flow semantic learning model to obtain the control flow semantic embedding includes: Obtain the relational control flow graph of the target binary function, wherein the relational control flow graph includes: basic block nodes and edges connecting the basic block nodes; The relational control flow graph is input into the BERT network in a pre-trained control flow semantic learning model; The BERT network is used to convert the basic block nodes of the relational control flow graph input from the first input terminal into vector representations and output them through the first output terminal. The vector output from the first output terminal is input into the R-GCN network in the pre-trained control flow semantic learning model; The edge pair vectors between the neighbor aggregation layer and the basic block nodes of the R-GCN network are updated. The updated vectors are weighted and averaged using the graph pooling layer of the R-GCN network, and then output. The vector output by the R-GCN network in the pre-trained control flow semantic learning model is used as the control flow semantic embedding; The global sequential semantic learning model includes a DPCNN network; The step of inputting the target binary function into a pre-trained global sequential semantic learning model to obtain a global sequential semantic embedding includes: Obtain the machine code of the target binary function; The binary numbers in the machine code are reassembled and converted into decimal numbers to obtain a decimal byte sequence; Convert each decimal number in the decimal byte sequence into a vector; The vectors corresponding to each decimal number in the decimal byte sequence are input into the DPCNN network in the pre-trained global sequential semantic learning model; The dependency information of the decimal byte sequence is extracted using the DPCNN network and then output. The vector output by the DPCNN network in the pre-trained global sequential semantic learning model is used as the global sequential semantic embedding.
2. The binary function embedding generation method according to claim 1, characterized in that, The edges connecting the basic block nodes are determined according to the following rules: In response to whether the control flow jump of any basic block node pair is a sequential jump or a control flow jump with a true condition, an edge with a value of zero is used to connect any basic block node pair. If the control flow jump mode of any basic block node pair is a control flow jump with a false condition, then an edge with a value of one is used to connect any basic block node pair.
3. The binary function embedding generation method according to claim 1, characterized in that, The step of reassembling and converting the binary numbers in the machine code into decimal numbers to obtain a decimal byte sequence includes: Starting from the first bit of the machine code, group consecutive eight-bit binary numbers together to obtain several groups of binary numbers with a sequence. Convert each set of binary numbers into decimal numbers in the order of the sets to obtain a decimal byte sequence.
4. The binary function embedding generation method according to claim 1, characterized in that, The step of converting each decimal number in the decimal byte sequence into a vector includes: The embedding layer in PyTorch is used to generate a token embedding for each decimal number, and the token embedding is used as the vector for transformation.
5. The binary function embedding generation method according to claim 1, characterized in that, The method further includes: The BERT network is used to compare the reference relation control flow graph, which is represented by a vector and is input from the second input terminal, with the first output terminal. The comparison operation includes: comparing whether any basic block node pairs are connected, and / or comparing whether any basic block nodes belong to the same relation control flow graph, and / or the compilation type corresponding to the relation control flow graph to which any basic block node belongs; The comparison result is output through the second output terminal of the BERT network.
6. A binary function embedding generation device, characterized in that, The device includes: The first conversion module is used to input the target binary function into a pre-trained control flow semantic learning model to obtain a control flow semantic embedding, wherein the control flow semantic learning model is used to convert the relational control flow graph corresponding to the binary function into a vector and output it. The second conversion module is used to input the target binary function into a pre-trained global sequential semantic learning model to obtain a global sequential semantic embedding. The global sequential semantic learning model is used to convert the machine code corresponding to the binary function into a vector and output it. An integration module is used to integrate the control flow semantic embedding and the global sequence semantic embedding, and use the integration result as the embedding corresponding to the target binary function; The control flow semantic learning model includes the BERT network and the R-GCN network; The first conversion module is specifically used for: Obtain the relational control flow graph of the target binary function, wherein the relational control flow graph includes: basic block nodes and edges connecting the basic block nodes; The relational control flow graph is input into the BERT network in a pre-trained control flow semantic learning model; The BERT network is used to convert the basic block nodes of the relational control flow graph input from the first input terminal into vector representations and output them through the first output terminal. The vector output from the first output terminal is input into the R-GCN network in the pre-trained control flow semantic learning model; The edge pair vectors between the neighbor aggregation layer and the basic block nodes of the R-GCN network are updated. The updated vectors are weighted and averaged using the graph pooling layer of the R-GCN network, and then output. The vector output by the R-GCN network in the pre-trained control flow semantic learning model is used as the control flow semantic embedding; The global sequential semantic learning model includes a DPCNN network; The second conversion module is specifically used for: Obtain the machine code of the target binary function; The binary numbers in the machine code are reassembled and converted into decimal numbers to obtain a decimal byte sequence; Convert each decimal number in the decimal byte sequence into a vector; The vectors corresponding to each decimal number in the decimal byte sequence are input into the DPCNN network in the pre-trained global sequential semantic learning model; The dependency information of the decimal byte sequence is extracted using the DPCNN network and then output. The vector output by the DPCNN network in the pre-trained global sequential semantic learning model is used as the global sequential semantic embedding.
7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the binary function embedding generation method as described in any one of claims 1 to 5.
8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method for embedding and generating binary functions as described in any one of claims 1 to 5.