Training / application methods, devices and media for representation learning models

Abstract

The present application provides a training / application method, device and medium for a representation learning model. The method includes: extracting multiple source codes from an open source repository, and generating a training sample set based on the multiple source codes and a large language model, each sample in the training sample set includes assembly code and natural language text; pre-training to generate an assembly encoder based on the assembly code data set, and pre-training to generate a text encoder based on the natural language data set; aligning the assembly encoder and the text encoder according to the training sample set and the contrastive learning algorithm to obtain a semantically aligned code representation learning model and a natural language representation learning model; constructing a representation learning model based on the semantically aligned code representation learning model and the natural language representation learning model. The method of the present application significantly improves the generalization ability and accuracy of the representation learning model, and greatly reduces the model's dependence on samples and a large amount of labeled data.

Description

Technical Field

[0001] The present application relates to the field of machine learning, and in particular to a training / application method, device and medium for representing a learning model. Background Art

[0002] Binary code representation learning methods have high practical value in tasks such as function boundary detection, binary code search, binary code similarity detection, function prototype inference, malware classification, reverse engineering, etc.

[0003] Binary code representation learning is a method of representing binary code as a continuous vector in a vector space. Existing binary code representation learning methods are mainly divided into three categories: directly modeling raw bytes, using graph models to establish control flow relationships of basic blocks, and representing function instructions as instruction sequences. However, the representation learning accuracy of these three methods is poor, and they all rely on a large number of training samples and annotations. They perform poorly when there are few or no training samples, lack sufficient generalization capabilities to handle completely unknown data types or tasks, and have poor generalization. In addition, due to the complexity and diversity of binary codes, as well as the rapid changes in programming practices, it becomes very difficult and time-consuming to collect and annotate large amounts of data for new tasks, greatly increasing the cost and complexity of applying these methods to practical problems.

[0004] Therefore, there is a need for a representation learning scheme that can improve the generalization ability and accuracy of the representation learning model and reduce the dependence on samples and large amounts of labeled data. Summary of the invention

[0005] The present application provides a training / application method, device and medium for a representation learning model to solve the technical problems that existing binary code representation learning methods have poor generalization ability and accuracy and rely on samples and a large amount of labeled data.

[0006] In a first aspect, the present application provides a training method for a representation learning model, comprising:

[0007] Extracting multiple source codes from an open source repository, and generating a training sample set based on the multiple source codes and a large language model, wherein each sample in the training sample set includes assembly code and natural language text;

[0008] Based on the assembly code dataset, pre-train to generate an assembly encoder, and based on the natural language dataset, pre-train to generate a text encoder;

[0009] According to the training sample set and the contrastive learning algorithm, the assembly encoder and the text encoder are aligned and trained to obtain a semantically aligned code representation learning model and a natural language representation learning model;

[0010] A representation learning model is constructed based on the semantically aligned code representation learning model and the natural language representation learning model.

[0011] In a possible implementation, generating a training sample set according to the multiple source codes and the large language model specifically includes:

[0012] For each source code,

[0013] Generate different versions of binary assembly code according to the source code, and determine the natural language text corresponding to the source code by using a large language model;

[0014] Generate a positive sample corresponding to the source code according to any binary assembly code corresponding to the source code and a natural language text corresponding to the source code;

[0015] Generate negative samples corresponding to the source code according to any binary assembly code corresponding to the source code and any natural language text not corresponding to the source code, wherein there are multiple negative samples and the number of negative samples is greater than the number of positive samples;

[0016] Generate a positive sample set according to the positive sample corresponding to each source code, and generate a negative sample set according to the negative sample corresponding to each source code;

[0017] A training sample set is generated according to the positive sample set and the negative sample set.

[0018] In a possible implementation manner, the using of a large language model to determine the natural language text corresponding to the source code specifically includes:

[0019] Taking the pre-trained large language model as the target model, the shadow model strategy is used to train and obtain the shadow application model corresponding to the target model;

[0020] According to the shadow application model, a natural language text corresponding to the source code is determined.

[0021] In a possible implementation, pre-training and generating an assembly encoder according to an assembly code dataset specifically includes:

[0022] For each assembly code data in the assembly code data set,

[0023] Relocating the address of the assembly code data so that the assembly code data maintains a relative address relationship when processing a jump instruction;

[0024] Using a word segmentation algorithm to segment the relocated assembly code data into independent tags to obtain code samples corresponding to the assembly code data;

[0025] A code sample set is generated according to a code sample corresponding to each assembly code data, and an assembly encoder is generated by pre-training according to the code sample set.

[0026] In a possible implementation manner, generating an assembly encoder based on the code sample set through pre-training specifically includes:

[0027] Generate the initial encoder according to the Transformer model architecture;

[0028] Determining the instruction embedding corresponding to each instruction in the initial encoder;

[0029] Embedding the instructions corresponding to each instruction into the initial encoder to generate an intermediate encoder;

[0030] According to each code sample in the code sample set, the intermediate encoder is pre-trained, and the tag embedding parameters of the jump symbol and its corresponding instruction embedding are shared during the model pre-training process to obtain an assembly encoder.

[0031] In a possible implementation, the alignment training of the assembly encoder and the text encoder is performed according to the training sample set and the contrastive learning algorithm to obtain a semantically aligned code representation learning model and a natural language representation learning model, specifically including:

[0032] For each positive sample / negative sample in the training sample set, inputting the assembly code in the positive sample / negative sample into the assembly encoder, and inputting the natural language text in the positive sample / negative sample into the text encoder;

[0033] Iteratively training the assembly encoder and the text encoder using the InfoNCE contrastive learning loss function to obtain a semantically aligned code representation learning model and a natural language representation learning model;

[0034] Among them, the code representation learning model can represent the input binary assembly code as a continuous vector, and the natural language representation learning model can represent the input natural language text as a continuous vector.

[0035] In a second aspect, the present application provides an application method of a representation learning model, comprising:

[0036] Inputting the binary code to be identified into the code representation learning model of the representation learning model, and determining the code representation vector corresponding to the binary code to be identified;

[0037] Generate corresponding natural language text according to each set behavior information / category information, wherein the behavior information / category information is multiple;

[0038] Inputting a plurality of natural language texts into the natural language representation learning model of the representation learning model, and determining a natural language representation vector corresponding to each natural language text;

[0039] Calculating the vector similarity between the code representation vector and each natural language representation vector;

[0040] Determine a target vector among the natural language representation vectors that has the highest similarity to the code representation vector;

[0041] The behavior information / category information corresponding to the binary code to be identified is determined according to the behavior information / category information corresponding to the target vector.

[0042] In a third aspect, the present application provides an electronic device, including:

[0043] A sample generation module is used to extract multiple source codes from an open source repository, and generate a training sample set based on the multiple source codes and a large language model, wherein each sample in the training sample set includes assembly code and natural language text;

[0044] The model training module is used to pre-train and generate an assembly encoder based on an assembly code data set, and to pre-train and generate a text encoder based on a natural language data set; align the assembly encoder and the text encoder according to the training sample set and the contrastive learning algorithm to obtain a semantically aligned code representation learning model and a natural language representation learning model; and construct a representation learning model based on the semantically aligned code representation learning model and the natural language representation learning model.

[0045] In a fourth aspect, the present application provides another electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0046] The memory stores computer-executable instructions;

[0047] The processor executes the computer-executable instructions stored in the memory to implement the above method.

[0048] In a fifth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to implement the above-mentioned method when executed by a processor.

[0049] In a sixth aspect, the present application provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0050] The training / application method, device and medium of the representation learning model provided in the present application can extract multiple source codes from an open source warehouse, and generate a training sample set based on multiple source codes and a large language model, each sample in the training sample set includes assembly code and natural language text; pre-train an assembly encoder based on the assembly code data set, and pre-train a text encoder based on the natural language data set; align the assembly encoder and the text encoder according to the training sample set and the contrastive learning algorithm to obtain a semantically aligned code representation learning model and a natural language representation learning model; construct a representation learning model based on the semantically aligned code representation learning model and the natural language representation learning model. The method of the present application extracts multiple source codes from an open source warehouse, processes the source codes to obtain a training sample set, and then obtains a representation learning model based on the training sample set. Through such a setting, the generalization ability of the representation learning model is improved, so that the model can still show significant capabilities in few-sample and zero-sample learning scenarios, reduces dependence on samples, and improves the practicality of the model. Furthermore, each sample in the training sample set includes assembly code and natural language text, which can efficiently and massively generate binary code data sets and natural language data sets, avoiding the reliance on a large amount of labeled data during model training, and eliminating the need to label samples, thereby reducing the cost and complexity of representation learning applications. Furthermore, according to the training sample set and the contrastive learning algorithm, the assembly encoder and the text encoder are aligned and trained, and the paired data samples in the training sample set ensure that the representation learning model obtained by the final training can more comprehensively understand the semantic content of the binary code, thereby improving the accuracy and efficiency of representation learning; and the use of the contrastive learning method to align the assembly encoder and the text encoder enables the representation learning model to learn and represent the binary code more accurately, and also enhances the adaptability of the model when processing new tasks and data sets, further improving the accuracy and generalization of the model, ensuring that the model has sufficient generalization ability to process completely unknown data types or tasks, and further improving the practicality and adaptability of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0052] Figure 1 A flowchart of a training method for a representation learning model according to an embodiment of the present application;

[0053] Figure 2 A schematic diagram of a training sample set generation process according to an embodiment of the present application;

[0054] Figure 3 A schematic diagram of the training process of a representation learning model according to an embodiment of the present application;

[0055] Figure 4 A flowchart of an application method of a representation learning model according to an embodiment of the present application;

[0056] Figure 5 A schematic diagram of the structure of an electronic device according to an embodiment of the present application;

[0057] Figure 6 A schematic diagram of the structure of an electronic device according to another embodiment of the present application;

[0058] Figure 7 This is a schematic structural diagram of an electronic device according to another embodiment of the present application.

[0059] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0060] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0061] It should be noted that the training / application method, device and medium of the representation learning model of the present application can be used in the field of machine learning, and can also be used in any field other than the field of machine learning, such as the computer field, the data processing field, etc. The application field of the training / application method, device and medium of the representation learning model of the present application is not limited.

[0062] The training / application method, device and medium of the representation learning model of the present application can be applied to any scenario related to binary code representation learning, such as function boundary detection, binary code search, binary code similarity detection, function prototype inference, malware classification, reverse engineering, encryption identification, protocol classification and algorithm classification, etc. The application scenario of the training / application method, device and medium of the representation learning model of the present application is not limited.

[0063] First, the terms involved in this application are explained:

[0064] Assembly language is any low-level language used in electronic computers, microprocessors, microcontrollers or other programmable devices, also known as symbolic language. In assembly language, mnemonics are used instead of opcodes of machine instructions, and address symbols or labels are used instead of addresses of instructions or operands. In different devices, assembly languages ​​correspond to different machine language instruction sets, which are converted into machine instructions through the assembly process. A specific assembly language corresponds to a specific machine language instruction set one-to-one, and cannot be directly ported between different platforms. Different CPU architectures correspond to different assembly versions.

[0065] Large language model (LLM) refers to a language model trained with a large amount of text data. As a proven feasible direction, its largeness is reflected in the wide training data set, large model parameters and layers, and large amount of calculation. Its value is reflected in its versatility and better generalization ability. It can handle a variety of natural language tasks, such as text classification, question answering, dialogue, etc. Compared with the language model trained in traditional specific fields, it has a wider range of application scenarios.

[0066] Binary code representation learning is a method to represent binary code as continuous vectors in vector space. Existing binary code representation learning methods are mainly divided into three types: directly modeling raw bytes, using graph models to establish control flow relationships of basic blocks, and representing function instructions as instruction sequences.

[0067] However, on the one hand, these three existing binary code representation learning methods still have deficiencies in representing the semantic information of binary codes and the control flow information of modeling programs, resulting in poor accuracy of representation learning.

[0068] (1) For direct modeling methods of raw bytes, although they have advantages in computational efficiency, they perform poorly in capturing high-level semantic information of each instruction and control flow graph (CFG) structure information because these methods treat the function as a flat, continuous sequence of raw bytes and ignore instruction semantics and control flow information. In addition, these methods may encounter difficulties when processing binary codes with complex structures and semantics.

[0069] (2) Graphical model methods embed the control flow information of basic blocks into assembly code by using graph neural networks (GNNs), thereby fusing control flow information in function representation to better understand the function. However, these methods usually rely on manually selected features to represent control flow graph (CFG) blocks, which may result in the inability to convey sufficient semantic information. In addition, since graphical model methods need to process graph structures, the computational complexity may increase significantly when processing large-scale binary codes, thus affecting the scalability of the method.

[0070] (3) Sequence modeling methods represent function instructions as instruction sequences, which has the advantage of preserving instruction order. Although such methods perform well in capturing the semantic information of instructions, most methods have limitations in capturing control flow graph information. Some studies have proposed improved methods, such as jTrans, etc., which attempt to retain control flow information through improved models. However, during the tokenization and normalization process, these methods may lose call parameter information, disassembly string information, and external function call information. This limitation is a common problem of existing sequence modeling methods.

[0071] On the other hand, current methods often require a large amount of data for retraining when applied to new datasets or tasks, and this dependence leads to poor performance when training samples are scarce. In particular, in few-shot learning scenarios, models must be able to quickly adapt to new tasks using very few examples, but existing methods often lack efficiency in this rapid adaptation ability. In addition, in zero-shot learning scenarios, that is, when the model encounters a task that has never been seen during training, the performance of current methods is often more limited. This is because these models are usually optimized specifically for their training data and lack sufficient generalization capabilities to handle completely unknown data types or tasks.

[0072] In addition, due to the complexity and diversity of binary code, as well as the rapid changes in programming practices, it becomes very difficult and time-consuming to collect and annotate large amounts of data for new tasks. This increases the cost and complexity of applying these methods to real-world problems, especially in security-critical areas such as malware detection and vulnerability analysis. In these areas, the ability to quickly adapt to emerging threat patterns is crucial.

[0073] Based on this technical problem, the inventive concept of this application is: how to provide a representation learning method that can improve the generalization ability and accuracy of the representation learning model and reduce the dependence on samples and a large amount of labeled data.

[0074] Specifically, multiple source codes can be extracted from the open source warehouse, and a training sample set can be generated according to the multiple source codes and the large language model, and each sample in the training sample set includes assembly code and natural language text; according to the assembly code data set, an assembly encoder is pre-trained and generated, and according to the natural language data set, a text encoder is pre-trained and generated; according to the training sample set and the contrastive learning algorithm, the assembly encoder and the text encoder are aligned and trained to obtain a semantically aligned code representation learning model and a natural language representation learning model; according to the semantically aligned code representation learning model and the natural language representation learning model, a representation learning model is constructed. The method of the present application extracts multiple source codes from the open source warehouse, and processes the source codes to obtain a training sample set, so as to obtain a representation learning model according to the training sample set training. Through such a setting, the generalization ability of the representation learning model is improved, so that the model can still show significant ability in few-sample and zero-sample learning scenarios, reduce the dependence on samples, and improve the practicality of the model. Further, each sample in the training sample set includes assembly code and natural language text, which can efficiently and massively generate binary code data sets and natural language data sets, avoid the dependence on a large amount of labeled data during model training, do not need to label samples, and reduce the cost and complexity of representation learning applications. Furthermore, based on the training sample set and the contrastive learning algorithm, the assembly encoder and the text encoder are aligned and trained. The paired data samples in the training sample set ensure that the representation learning model finally trained can more comprehensively understand the semantic content of the binary code, thereby improving the accuracy and efficiency of the representation learning. The contrastive learning method is used to align the assembly encoder and the text encoder, so that the representation learning model can learn and represent the binary code more accurately, and enhances the adaptability of the model in processing new tasks and data sets, further improving the accuracy and generalization of the model, and ensuring that the model has sufficient generalization ability to process completely unknown data types or tasks, thereby further improving the practicality and adaptability of the model.

[0075] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0076] Embodiment 1

[0077] Figure 1 This is a flow chart of a training method for a representation learning model according to an embodiment of the present application. This embodiment uses an electronic device as an execution subject to illustrate the training method for the representation learning model. Figure 1 As shown, the training method of the representation learning model may include the following steps:

[0078] S101: extract multiple source codes from the open source repository, and generate a training sample set based on the multiple source codes and the large language model.

[0079] In this embodiment, each sample in the training sample set may include assembly code and natural language text.

[0080] In this embodiment, the open source repository may be a large number of open source projects including source code, and those skilled in the art may flexibly set the specific open source repository as long as a large number of different source codes can be obtained in the open source repository.

[0081] In this embodiment, the specific type of the large language model can be flexibly set by those skilled in the art. For example, the large language model can be a ChatGPT model, a Wenyan Yixin model, an iFlytek Spark model, a ChatGLM model, an LLaMA model, etc., without any limitation here.

[0082] In this embodiment, the electronic device can be a terminal device such as a computer or a mobile phone, or a server device such as a physical server or a cloud server. The specific type of the electronic device can be flexibly set by technical personnel in this field, and no restrictions are made here, as long as the electronic device can perform training and application of the representation learning model.

[0083] In a possible implementation, generating a training sample set according to multiple source codes and a large language model in step S101 may include:

[0084] S11: For each source code, generate different versions of binary assembly code according to the source code, and use a large language model to determine the natural language text corresponding to the source code.

[0085] S12: Generate a positive sample corresponding to the source code according to any binary assembly code corresponding to the source code and a natural language text corresponding to the source code.

[0086] S13: Generate negative samples corresponding to the source code according to any binary assembly code corresponding to the source code and any natural language text not corresponding to the source code, where there are multiple negative samples and the number of negative samples is greater than the number of positive samples.

[0087] S14: Generate a positive sample set according to the positive sample corresponding to each source code, and generate a negative sample set according to the negative sample corresponding to each source code.

[0088] S15: Generate a training sample set based on the positive sample set and the negative sample set.

[0089] In this embodiment, different CPU architectures correspond to different assembly versions. The specific version of the binary assembly code can be flexibly set by those skilled in the art according to actual conditions, and no limitation is made here.

[0090] In this embodiment, the binary assembly code and natural language text obtained by processing the same source code constitute positive samples (same semantics), and the binary assembly code and natural language text obtained by processing different source codes constitute negative samples (different semantics). The number of negative samples can be set to be much larger than the number of positive samples, and a large number of negative samples can be used to improve the accuracy of the semantic representation of the model.

[0091] In this embodiment, a large language model and a large amount of source code can be used to generate positive samples and a large amount of negative samples. The positive samples include assembly code and natural language text with the same semantics, while the negative samples include assembly code and natural language text with different semantics. Through such a setting, a very large negative sample pool can be set up, from which multiple negative sample pairs are randomly selected, ensuring that the model is exposed to a large number of negative samples during the learning process, so as to better learn the semantic alignment between the source code and the self-verifying prophecy description, and improve the performance of the model.

[0092] In a possible implementation, the use of a large language model in step S11 to determine the natural language text corresponding to the source code may include: using a pre-trained large language model as a target model, and using a shadow model strategy to train a shadow application model corresponding to the target model; and determining the natural language text corresponding to the source code according to the shadow application model.

[0093] In this embodiment, when training using the shadow model strategy, task-specific data can be used for training, which can be natural language description data obtained from requests from large models (such as GPT-3.5, etc.).

[0094] For example, Figure 2 FIG. 1 is a schematic diagram of a training sample set generation process according to an embodiment of the present application. Figure 2 As shown in the figure, after extracting multiple source codes from the open source repository, on the one hand, the source codes can be compiled into different versions of binary assembly codes, and on the other hand, the natural language text corresponding to the source code can be determined based on the shadow model of the large language model. According to the source and correspondence between the assembly code and the natural language text, the positive sample set and the negative sample set can be generated, thereby generating the training sample set.

[0095] In this embodiment, the cost of directly using the large language model to determine the natural language text corresponding to the source code is relatively high. Therefore, the shadow model strategy can be used to train a shadow application model corresponding to the large language model, and the low-cost shadow application model can be used to determine the natural language text corresponding to the source code. The main goal of the shadow model is to imitate the performance of a model that has a good effect on code interpretation, but it is more efficient in terms of resource consumption, saving the cost of model training while ensuring the training effect.

[0096] S102: Pre-training an assembly encoder based on an assembly code dataset, and pre-training a text encoder based on a natural language dataset.

[0097] In this embodiment, the assembly code data set may be any training set including assembly code, and those skilled in the art may flexibly set it. The assembly code data set may be a data set composed of different versions of binary assembly code generated in the above step S11, or a data set composed of assembly code obtained by other means (open source or non-open source data set), and no limitation is made here.

[0098] In this embodiment, the assembly encoder is pre-trained on a large number of assembly code datasets, so that the model can effectively learn and extract key features in various assembly language environments, which significantly improves the model's ability to understand and adapt to binary codes.

[0099] Similarly, the natural language dataset can be any training set that includes natural language text, and technical personnel in this field can flexibly set it. The natural language dataset can be a dataset composed of natural language text generated in the above step S11, or it can be a dataset composed of natural language text obtained by other means (open source or non-open source dataset), and no restrictions are made here.

[0100] In this embodiment, the specific type of the text encoder can be flexibly set by those skilled in the art. Preferably, in order to improve the model performance, the text encoder can be an existing text encoder with better text similarity detection and more accurate semantic judgment, and no limitation is made here.

[0101] In a possible implementation, pre-training and generating an assembly encoder according to the assembly code dataset in step S102 may include:

[0102] S21: for each assembly code data in the assembly code data set, relocate the address of the assembly code data so that the assembly code data maintains a relative address relationship when processing a jump instruction.

[0103] S22: Using a word segmentation algorithm to segment the relocated assembly code data into independent tags to obtain code samples corresponding to the assembly code data.

[0104] S23: Generate a code sample set according to the code sample corresponding to each assembly code data, and generate an assembly encoder by pre-training according to the code sample set.

[0105] In this implementation, the word segmentation algorithm may be the WordPiece word segmentation algorithm or other word segmentation algorithms, and no limitation is made here.

[0106] In this embodiment, when pre-training to generate an assembly encoder, the address of the assembly code in the assembly code data set can be relocated first, and the relative address relationship can be maintained when processing jump instructions. Through such a setting, the control flow information in the assembly code is retained, and the relative distance between the jump instruction and its target is maintained during the relocation process, so that the model can understand the control flow changes caused by the jump instruction, thereby improving the accuracy of the assembly encoder code representation learning. Further, after address relocation, the assembly code can be segmented into independent tags, that is, the WordPiece algorithm is used to train the word segmenter on the entire assembly code data set, which can losslessly encode the assembly code without the need for standardization processing, thereby retaining key information, such as call parameters and external function names, etc., further improving the accuracy of the assembly encoder code representation learning.

[0107] In a possible implementation, generating an assembly encoder according to the code sample set pre-training in step S23 may include:

[0108] S31: Generate the initial encoder based on the Transformer model architecture.

[0109] S32: Determine the instruction embedding corresponding to each instruction in the initial encoder.

[0110] S33: embed the instructions corresponding to each instruction and integrate them into the initial encoder to generate an intermediate encoder.

[0111] S34: Pre-training the intermediate encoder according to each code sample in the code sample set, and sharing the tag embedding parameters of the jump symbol and its corresponding instruction embedding during the model pre-training process to obtain an assembly encoder.

[0112] In this embodiment, the specific structure of the assembly encoder can refer to the Transformer model that has performed well in binary code analysis in the past, such as the RoBERTa model, which contains about 110 million parameters. Of course, it can also be other models based on the Transformer model architecture, and those skilled in the art can flexibly set it without any limitation here.

[0113] In this embodiment, by embedding the instruction corresponding to each instruction and integrating it into the initial encoder, the boundaries of the assembly instructions can be clearly divided, so that the model can effectively identify and process single instructions. By assigning a unique embedding to each instruction, the model learns to distinguish different instructions, providing a basis for subsequent model training. Furthermore, by sharing the tag embedding parameters of the jump symbol and its corresponding instruction embedding, the model's understanding of the jump relationship within the assembly code is enhanced. For example, specific tag embeddings share parameters with instruction embeddings, allowing the model to capture the complex connections between the various components of the assembly code. Through shared parameters, the model learns to associate symbol tags with their target tags, thereby better understanding the control flow within the code, further improving the accuracy of the assembly encoder code representation learning, and improving model performance.

[0114] S103: Perform alignment training on the assembly encoder and the text encoder according to the training sample set and the contrastive learning algorithm to obtain a semantically aligned code representation learning model and a natural language representation learning model.

[0115] In a possible implementation, the above step S103 performs alignment training on the assembly encoder and the text encoder according to the training sample set and the contrastive learning algorithm to obtain a semantically aligned code representation learning model and a natural language representation learning model, which may include:

[0116] S41: For each positive sample / negative sample in the training sample set, the assembly code in the positive sample / negative sample is input into the assembly encoder, and the natural language text in the positive sample / negative sample is input into the text encoder.

[0117] S42: Using the InfoNCE contrastive learning loss function, the assembly encoder and text encoder are iteratively trained to obtain the semantically aligned code representation learning model and natural language representation learning model.

[0118] Among them, the code representation learning model can represent the input binary assembly code as a continuous vector, and the natural language representation learning model can represent the input natural language text as a continuous vector.

[0119] In this embodiment, the InfoNCE contrastive learning loss function is used to iteratively train the assembly encoder and the text encoder, which can enhance the model's ability to distinguish between positive and negative samples and maximize the mutual information between positive sample pairs and negative samples, so that the model can more accurately learn and represent binary codes, which not only improves the accuracy of the model, but also enhances its adaptability in processing new tasks and data sets, further improves the accuracy and generalization of the model, and ensures that the model has sufficient generalization ability to handle completely unknown data types or tasks, further improving the practicality and adaptability of the model.

[0120] S104: Construct a representation learning model based on the semantically aligned code representation learning model and the natural language representation learning model.

[0121] For example, Figure 3 FIG. 1 is a schematic diagram of a training process of a representation learning model according to an embodiment of the present application. Figure 3 As shown, the assembly code in the training sample set (positive samples / negative samples) can be input into the assembly encoder, and the natural language text can be input into the text encoder, and iterative training can be performed using the InfoNCE contrastive learning loss function to obtain a semantically aligned representation learning model.

[0122] In this embodiment, after following the above steps S101-S105, a representation learning model can be constructed, and the representation of binary code can be learned by aligning the binary code with the natural language text. The method includes an efficient data engine and a powerful assembly encoder, which successfully bridges the gap between assembly code and natural language representation. The resulting model has significant zero-sample and few-sample learning capabilities on various tasks, including binary code similarity detection, encryption recognition, protocol classification, and algorithm classification.

[0123] It is easy for those skilled in the art to understand that what is shown above is only a preferred embodiment of the present application, and some improvements and modifications can be made without departing from the principles of the present application. For example, although we use specific compilers and optimization options in this embodiment, other compilers and optimization options can be used. Similarly, although we use specific pre-training tasks and training tasks here, other types of pre-training tasks and training tasks can be used. In addition, although we use specific network structures here, other types of network structures can be used.

[0124] In this embodiment, multiple source codes can be extracted from the open source warehouse, and the source codes can be processed to obtain a training sample set, so as to obtain a representation learning model based on the training sample set. Through such a setting, the generalization ability of the representation learning model is improved, so that the model can still show significant capabilities in few-sample and zero-sample learning scenarios, reducing the dependence on samples and improving the practicality of the model. Furthermore, each sample in the training sample set includes assembly code and natural language text, which can efficiently and massively generate binary code data sets and natural language data sets, avoiding the dependence on a large amount of labeled data during model training, and eliminating the need to label samples, reducing the cost and complexity of representation learning applications. Furthermore, based on the training sample set and the contrastive learning algorithm, the assembly encoder and the text encoder are aligned and trained. The paired data samples in the training sample set ensure that the representation learning model finally trained can more comprehensively understand the semantic content of the binary code, thereby improving the accuracy and efficiency of the representation learning. The contrastive learning method is used to align the assembly encoder and the text encoder, so that the representation learning model can learn and represent the binary code more accurately, and enhances the adaptability of the model in processing new tasks and data sets, further improving the accuracy and generalization of the model, and ensuring that the model has sufficient generalization ability to process completely unknown data types or tasks, thereby further improving the practicality and adaptability of the model.

[0125] Embodiment 2

[0126] Figure 4 This is a flow chart of an application method of a representation learning model according to an embodiment of the present application. This embodiment uses an electronic device as an execution subject to illustrate the application method of the representation learning model. Figure 4 As shown, the application method of the representation learning model may include the following steps:

[0127] S201: Inputting the binary code to be recognized into the code representation learning model of the representation learning model, and determining the code representation vector corresponding to the binary code to be recognized.

[0128] In this embodiment, the binary code to be identified may be a code of unknown behavior / category. By using the representation learning model, the behavior / category corresponding to the binary code to be identified may be determined for subsequent operations.

[0129] S202: Generate corresponding natural language text according to each set behavior information / category information, where the behavior information / category information may be multiple.

[0130] In this embodiment, the set behavior information / category information can be several types of behavior information / category information that are close to the binary code to be identified or to be detected by the staff, such as screenshots, file uploads, keyboard logging and other common malicious behaviors. The specific behavior information / category information can be flexibly set by those skilled in the art, and no limitation is made here.

[0131] S203: Input a plurality of natural language texts into a natural language representation learning model of a representation learning model, and determine a natural language representation vector corresponding to each natural language text.

[0132] S204: Calculate the vector similarity between the code representation vector and each natural language representation vector.

[0133] S205: Determine a target vector in the natural language representation vector that has the highest similarity to the code representation vector.

[0134] In this embodiment, the higher the vector similarity between the code representation vector and the natural language representation vector, the closer their semantics are.

[0135] S206: Determine the behavior information / category information corresponding to the binary code to be identified according to the behavior information / category information corresponding to the target vector.

[0136] It should be noted that since the representation learning model trained in Example 1 performs well in a variety of downstream tasks, it is not only limited to the application scenarios of this embodiment, but can also be widely used in multiple fields of binary code analysis and processing. This embodiment is only an example of an application of the representation learning model.

[0137] In this embodiment, when determining the behavior / category corresponding to the binary code to be identified, the binary code to be identified can be first input into the code representation learning model to obtain a code representation vector, and then the natural language text corresponding to the set behavior information / category information can be input into the natural language representation learning model to obtain a natural language representation vector. Since the code representation learning model and the natural language representation learning model are models that are semantically aligned using a contrastive learning method, they can not only learn and represent binary codes more accurately, but also enhance the adaptability of the model when processing new tasks and data sets. Therefore, after obtaining the representation vector, the behavior information / category information corresponding to the binary code to be identified can be simply and accurately determined based on the behavior information / category information corresponding to the natural language representation vector with the highest similarity to the code representation vector.

[0138] The following is an explanation of the training and application methods of the representation learning model of the present application with a specific embodiment.

[0139] Embodiment 3

[0140] In a specific embodiment, a software company wants to determine the behavior corresponding to a malicious assembly code. First, it needs to vectorize the malicious assembly code. The specific process is as follows:

[0141] In the first step, the staff input a large number of open source projects including source code into the computer and input model building instructions. The computer extracts multiple source codes from the open source warehouse and generates a training sample set based on multiple source codes and a large language model. Each sample in the training sample set includes assembly code and natural language text.

[0142] In the second step, the computer pre-trains and generates an assembly encoder based on a set assembly code data set, and pre-trains and generates a text encoder based on a set natural language data set.

[0143] In the third step, the computer aligns the assembly encoder and the text encoder based on the training sample set and the contrastive learning algorithm to obtain a semantically aligned code representation learning model and a natural language representation learning model.

[0144] In the fourth step, the computer constructs a representation learning model based on the semantically aligned code representation learning model and the natural language representation learning model.

[0145] In the fifth step, the staff inputs the malicious assembly code and the behavior information to be detected into the computer's representation learning model and starts the recognition task. The computer inputs the malicious assembly code into the code representation learning model to determine the corresponding code representation vector.

[0146] In the sixth step, the computer generates corresponding natural language texts according to each behavior information to be detected, inputs multiple natural language texts into the natural language representation learning model, and determines the natural language representation vector corresponding to each natural language text.

[0147] In the seventh step, the computer calculates the vector similarity between the code representation vector and each natural language representation vector, and determines the target vector in the natural language representation vector that has the highest similarity with the code representation vector.

[0148] In the eighth step, the computer determines that the behavior information corresponding to the malicious assembly code is a backdoor based on the behavior information corresponding to the target vector.

[0149] Figure 5 Schematic diagram of the structure of an electronic device according to an embodiment of the present application. Figure 5As shown, the electronic device includes: a sample generation module 51, which is used to extract multiple source codes from an open source repository, and generate a training sample set based on the multiple source codes and a large language model, each sample in the training sample set includes assembly code and natural language text; a model training module 52, which is used to pre-train and generate an assembly encoder based on an assembly code data set, and pre-train and generate a text encoder based on a natural language data set; according to the training sample set and a contrastive learning algorithm, the assembly encoder and the text encoder are aligned and trained to obtain a semantically aligned code representation learning model and a natural language representation learning model; according to the semantically aligned code representation learning model and the natural language representation learning model, a representation learning model is constructed. In one embodiment, the description of the specific implementation function of the electronic device can refer to steps S101-S104 in Example 1, which will not be repeated here.

[0150] Figure 6 This is a schematic diagram of the structure of an electronic device according to another embodiment of the present application. Figure 6 As shown, the electronic device includes: a vector generation module 61, which is used to input the binary code to be identified into the code representation learning model of the representation learning model, and determine the code representation vector corresponding to the binary code to be identified; generate corresponding natural language text according to each set behavior information / category information, and the behavior information / category information is multiple; input multiple natural language texts into the natural language representation learning model of the representation learning model, and determine the natural language representation vector corresponding to each natural language text; a matching detection module 62, which is used to calculate the vector similarity between the code representation vector and each natural language representation vector; determine the target vector in the natural language representation vector that has the highest similarity with the code representation vector; determine the behavior information / category information corresponding to the binary code to be identified according to the behavior information / category information corresponding to the target vector. In one embodiment, the description of the specific implementation function of the electronic device can refer to steps S201-S206 in Example 2, which will not be repeated here.

[0151] Figure 7 This is a schematic diagram of the structure of an electronic device according to another embodiment of the present application. Figure 7 As shown, the electronic device includes: a processor 101, and a memory 102 communicatively connected to the processor 101; the memory 102 stores computer execution instructions; the processor 101 executes the computer execution instructions stored in the memory 102 to implement the steps of the training / application method representing the learning model in the above-mentioned method embodiments.

[0152] In the above electronic device, the memory 102 and the processor 101 are electrically connected directly or indirectly to realize data transmission or interaction. For example, these elements can be electrically connected to each other through one or more communication buses or signal lines, such as through a bus connection. The memory 102 stores computer-executable instructions for implementing the data access control method, including at least one software function module that can be stored in the memory 102 in the form of software or firmware. The processor 101 executes various functional applications and data processing by running the software programs and modules stored in the memory 102.

[0153] The memory 102 may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electric erasable programmable read-only memory (EEPROM), etc. The memory 102 is used to store programs, and the processor 101 executes the programs after receiving the execution instruction. Furthermore, the software programs and modules in the above-mentioned memory 102 may also include an operating system, which may include various software components and / or drivers for managing system tasks (such as memory management, storage device control, power management, etc.), and may communicate with various hardware or software components to provide an operating environment for other software components.

[0154] The processor 101 may be an integrated circuit chip having the ability to process signals. The processor 101 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc. The methods, steps, and logic diagrams disclosed in the embodiments of the present application may be implemented or executed. The general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0155] An embodiment of the present application further provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the steps of each method embodiment of the present application.

[0156] An embodiment of the present application further provides a computer program product, including a computer program, which implements the steps of each method embodiment of the present application when executed by a processor.

[0157] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present application.

[0158] It should be further noted that, although the various steps in the flowchart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0159] It should be understood that the above-mentioned device embodiments are only illustrative, and the device of the present application can also be implemented in other ways. For example, the division of units / modules in the above-mentioned embodiments is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0160] In addition, unless otherwise specified, each functional unit / module in each embodiment of the present application may be integrated into one unit / module, each unit / module may exist physically separately, or two or more units / modules may be integrated together. The above-mentioned integrated unit / module may be implemented in the form of hardware or in the form of a software program module.

[0161] In the above embodiments, the description of each embodiment has its own emphasis. For the part not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0162] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the appended claims.

[0163] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A training method for a representation learning model, characterized in that: include: Extracting multiple source codes from an open source repository, and generating a training sample set based on the multiple source codes and a large language model, wherein each sample in the training sample set includes assembly code and natural language text; Based on the assembly code dataset, pre-train to generate an assembly encoder, and based on the natural language dataset, pre-train to generate a text encoder; According to the training sample set and the contrastive learning algorithm, the assembly encoder and the text encoder are aligned and trained to obtain a semantically aligned code representation learning model and a natural language representation learning model; Constructing a representation learning model according to the semantically aligned code representation learning model and the natural language representation learning model; The pre-training and generating of the assembly encoder according to the assembly code dataset specifically includes: For each assembly code data in the assembly code data set, Relocating the address of the assembly code data so that the assembly code data maintains a relative address relationship when processing a jump instruction; Using a word segmentation algorithm to segment the relocated assembly code data into independent tags to obtain code samples corresponding to the assembly code data; Generate a code sample set according to the code sample corresponding to each assembly code data, and generate an assembly encoder by pre-training according to the code sample set; The generating of the assembly encoder according to the pre-training of the code sample set specifically includes: Generate the initial encoder according to the Transformer model architecture; Determining the instruction embedding corresponding to each instruction in the initial encoder; Embedding the instructions corresponding to each instruction into the initial encoder to generate an intermediate encoder; According to each code sample in the code sample set, the intermediate encoder is pre-trained, and the tag embedding parameters of the jump symbol and its corresponding instruction embedding are shared during the model pre-training process to obtain an assembly encoder.

2. The method according to claim 1, characterized in that The generating of a training sample set according to the plurality of source codes and the large language model specifically includes: For each source code, Generate different versions of binary assembly code according to the source code, and determine the natural language text corresponding to the source code by using a large language model; Generate a positive sample corresponding to the source code according to any binary assembly code corresponding to the source code and a natural language text corresponding to the source code; Generate negative samples corresponding to the source code according to any binary assembly code corresponding to the source code and any natural language text not corresponding to the source code, wherein there are multiple negative samples and the number of negative samples is greater than the number of positive samples; Generate a positive sample set according to the positive sample corresponding to each source code, and generate a negative sample set according to the negative sample corresponding to each source code; A training sample set is generated according to the positive sample set and the negative sample set.

3. The method according to claim 2, characterized in that The determining of the natural language text corresponding to the source code by using the large language model specifically includes: Taking the pre-trained large language model as the target model, the shadow model strategy is used to train and obtain the shadow application model corresponding to the target model; According to the shadow application model, a natural language text corresponding to the source code is determined.

4. The method according to claim 1, characterized in that: The alignment training of the assembly encoder and the text encoder is performed according to the training sample set and the contrastive learning algorithm to obtain a semantically aligned code representation learning model and a natural language representation learning model, specifically including: For each positive sample / negative sample in the training sample set, inputting the assembly code in the positive sample / negative sample into the assembly encoder, and inputting the natural language text in the positive sample / negative sample into the text encoder; Iteratively training the assembly encoder and the text encoder using the InfoNCE contrastive learning loss function to obtain a semantically aligned code representation learning model and a natural language representation learning model; Among them, the code representation learning model can represent the input binary assembly code as a continuous vector, and the natural language representation learning model can represent the input natural language text as a continuous vector.

5. An application method of a representation learning model, wherein the representation learning model is trained using the training method of the representation learning model according to any one of claims 1 to 4, characterized in that: include: Inputting the binary code to be identified into the code representation learning model of the representation learning model, and determining the code representation vector corresponding to the binary code to be identified; Generate corresponding natural language text according to each set behavior information / category information, wherein the behavior information / category information is multiple; Inputting a plurality of natural language texts into the natural language representation learning model of the representation learning model, and determining a natural language representation vector corresponding to each natural language text; Calculating the vector similarity between the code representation vector and each natural language representation vector; Determine a target vector among the natural language representation vectors that has the highest similarity to the code representation vector; The behavior information / category information corresponding to the binary code to be identified is determined according to the behavior information / category information corresponding to the target vector.

6. An electronic device comprising: A sample generation module is used to extract multiple source codes from an open source repository, and generate a training sample set based on the multiple source codes and a large language model, wherein each sample in the training sample set includes assembly code and natural language text; A model training module is used to pre-train and generate an assembly encoder based on an assembly code data set, and to pre-train and generate a text encoder based on a natural language data set; perform alignment training on the assembly encoder and the text encoder based on the training sample set and the contrastive learning algorithm to obtain a semantically aligned code representation learning model and a natural language representation learning model; and construct a representation learning model based on the semantically aligned code representation learning model and the natural language representation learning model; The model training module is specifically used to relocate the address of each assembly code data in the assembly code data set so that the assembly code data maintains a relative address relationship when processing a jump instruction; Using a word segmentation algorithm to segment the relocated assembly code data into independent tags to obtain code samples corresponding to the assembly code data; Generate a code sample set according to the code sample corresponding to each assembly code data, and generate an assembly encoder by pre-training according to the code sample set; The generating of the assembly encoder according to the pre-training of the code sample set specifically includes: Generate the initial encoder according to the Transformer model architecture; Determining the instruction embedding corresponding to each instruction in the initial encoder; Embedding the instructions corresponding to each instruction into the initial encoder to generate an intermediate encoder; According to each code sample in the code sample set, the intermediate encoder is pre-trained, and the tag embedding parameters of the jump symbol and its corresponding instruction embedding are shared during the model pre-training process to obtain an assembly encoder.

7. An electronic device, characterized in that: comprising a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 5 when executed by a processor.

Images