A binary function similarity detection method based on transformer

Abstract

The application provides a binary function similarity detection method based on a Transformer, comprising the following steps: S1, a microcode preprocessing method is used to convert a binary function into microcode; S2, a microcode language model based on a Transformer architecture is established, the global semantics of the microcode in S1 are learned using the microcode language model, the microcode language model is fine-tuned using a triple loss for a binary code similarity detection task, and a trained microcode language model is obtained; S3, a target binary function is input into the trained microcode language model in S2, a robust semantic embedding is generated, and fast offline code similarity detection is performed through the semantic embedding. The application is constructed on the basis of the Transformer to learn the global features and modes of the code. In order to capture the code semantics including context, control flow and data flow, the application uses three tasks to pretrain the model.

Description

Technical Field

[0001] This invention relates to the field of code detection technology, and more particularly to a binary function similarity detection method based on Transformer. Background Technology

[0002] Binary Code Similarity Detection (BCSD) is an important technique in software security that measures the similarity between binary codes by analyzing their characteristics. This technique is widely used in various binary security detection tasks, such as code plagiarism detection, patch analysis, malware detection, and vulnerability discovery. However, source code compiled under different compilation configurations may yield semantically identical binary code with significantly different instruction sequences and structures, posing a challenge to BCSD. In recent years, researchers have increasingly focused on BCSD across compilation configurations. By analyzing the attribute characteristics, control flow graphs, and instruction sequences of binary code, they have proposed effective BCSD methods across various scenarios, including cross-architecture and cross-optimization levels.

[0003] However, existing BCSD methods have certain shortcomings. First, the combination of different compilers, CPU architectures, optimization levels, word lengths, etc., results in a wide variety of compilation configurations. This leads to tens of thousands of binary versions of a single source code, making it difficult for current BCSD methods to assess semantic similarity. Second, current methods typically rely on one-to-one comparisons, which can generate a large number of candidate codes in large-scale detection scenarios, thus complicating the detection process. Summary of the Invention

[0004] In view of this, the purpose of this invention is to propose a Transformer-based binary function similarity detection method to solve the technical problem that existing BCSD methods are difficult to evaluate semantic similarity.

[0005] The technical means employed in this invention are as follows:

[0006] A binary function similarity detection method based on Transformer includes the following steps:

[0007] S1. Use microcode preprocessing method to convert binary functions into microcode;

[0008] S2. Establish a microcode language model based on the Transformer architecture. Use the microcode language model to learn the global semantics of the microcode in S1. Fine-tune the microcode language model using triplet loss for the binary code similarity detection task to obtain the trained microcode language model.

[0009] S3. Input the target binary function into the microcode language model trained in S2 to generate a robust semantic embedding. Perform fast offline code similarity detection through the semantic embedding.

[0010] Furthermore, S1 specifically includes the following steps:

[0011] S11, Instruction Decompression: Decompress the composite operands in the microcode instructions into nested microcode instructions composed of related instructions;

[0012] S12. Perform fine-grained word segmentation on the microcode instructions processed in S11, treating each opcode or operand as a word;

[0013] S13. Perform word substitution on the strings and constants in the microcode instructions processed by S12 to reduce the number of markers and preserve code semantics.

[0014] Furthermore, the decompression method in S11 is as follows:

[0015] S111, Obtain the opcode and compound operand of the microcode instruction;

[0016] S112. Replace the composite operand with a semantically equivalent microcode instruction, and recursively decompress the replaced microcode instruction.

[0017] S113. For instruction operands, recursively decompress the instructions in the operands;

[0018] S114. Output decompression command, wherein the decompression command is a nested command and does not contain compound operands.

[0019] Furthermore, the word substitution method in S13 is as follows:

[0020] S131, Reserve all registers;

[0021] S132, constants with a value of 0 or 1;

[0022] S133, Replace the jump operand with Block + destination basic block;

[0023] S134. Replace function parameters with argv + parameter number;

[0024] S135. Replace local variables with lvar + variable number;

[0025] S136. Replace other operands with the corresponding operand types.

[0026] Furthermore, S2 specifically includes the following steps:

[0027] S21. Train the microcode language model using the masked language model task to capture the contextual semantics of the microcode.

[0028] S22. The microcode language model trained in S21 is trained using a jump block prediction task to learn control flow features.

[0029] S23. The microcode language model trained in S22 is trained using a defined block prediction task to learn data stream features;

[0030] S24. Using the triplet loss function, fine-tuning is performed on the microcode language model trained in S23 for the binary code similarity detection task.

[0031] Furthermore, S21 specifically includes:

[0032] The masked language model masks opcodes or compound operands in microcode and randomly masks 15% of words; of the 15% of words, 80% are replaced with the special word MASK, 10% are replaced with random words, and 10% remain unchanged;

[0033] The loss function for the masked language model is defined as follows:

[0034]

[0035] Where M represents the set of mask words, y represents the prediction of word m. m For the true value, I M This serves as the input for the masked language model.

[0036] Furthermore, S22 specifically includes:

[0037] In the jump block prediction task, 20% of the jump addresses are masked. The microcode language model predicts the first opcode in the target block for each masked jump address based on the microcode context.

[0038] The loss function for the jump block prediction task is defined as follows:

[0039]

[0040] Where J represents the set of jump prediction words, y represents the prediction of word j. j For the true value of word j, I J This serves as the input to the model for the jump block prediction task.

[0041] Furthermore, S23 specifically includes:

[0042] Define a block prediction task that randomly masks 20% of local variables during prediction;

[0043] The loss function for the block prediction task is defined as follows:

[0044]

[0045] Where D represents the set of jump prediction words, y represents the prediction of word j. d To correspond to the true value, I D This defines the input to the model for the block prediction task.

[0046] Furthermore, S24 specifically includes:

[0047] The triplet loss function minimizes the distance between positive sample pairs while maximizing the distance between negative sample pairs. The fine-tuning loss is defined as follows:

[0048]

[0049] Where f represents the anchor microcode function, g + and g - Let represent positive and negative samples respectively. Cosine similarity is used as a distance metric to evaluate functional distance, and ε is a hyperparameter between 0 and 0.5.

[0050] Compared with the prior art, the present invention has the following advantages:

[0051] The proposed BinEncoder captures high-level semantic features of binary functions, enabling efficient cross-compiler code similarity detection (BCSD). First, the method converts binary functions into microcode to mitigate differences caused by different compilation configurations. To this end, a novel microcode preprocessing method is proposed, decomposing composite microcode instructions and performing fine-grained word segmentation to improve the model's learnability of microcode programs. Second, a deep neural network model based on the Transformer architecture is used to learn the global semantics of the microcode. To capture the structural information of the microcode, a novel pre-training task is designed for control flow and data flow information. Third, the trained model can generate robust semantic embeddings for binary functions and perform fast offline code similarity detection. Experimental results show that the microcode method can achieve code similarity detection across different compilation configurations with higher accuracy than existing methods.

[0052] This invention proposes an innovative microcode preprocessing method that decomposes and replaces compound instructions while employing a fine-grained normalization strategy. This method can alleviate the out-of-vocabulary (OOV) word problem and maximize the extraction of code semantics;

[0053] This invention proposes a novel Transformer-based model for generating robust semantic embeddings of binary functions. The invention also includes three innovative pre-training tasks designed for microcode to help the model understand the context, data flow, and control flow semantics of the microcode. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 This is a schematic diagram of the overall framework of the present invention.

[0056] Figure 2 This is a schematic diagram of the jump block prediction task of the present invention.

[0057] Figure 3 This is a schematic diagram illustrating the block prediction task defined in this invention. Detailed Implementation

[0058] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0059] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0060] like Figure 1As shown, this invention provides a Transformer-based binary function similarity detection method (BinEncoder). In the first stage, binary function instructions are converted into microcode and then normalized. In this stage, the control flow and data flow of the microcode function are also analyzed. The second stage involves constructing a microcode language model (MCLM), which is pre-trained through three pre-designed pre-training tasks to enhance the learning of the semantic information of the microcode function. Then, in the third stage, the MCLM is fine-tuned for the BCSD task. Finally, in the fourth stage, semantic embeddings are derived from the target binary function and compared with all embeddings in the function embedding pool.

[0061] Specifically, the steps include the following:

[0062] S1. Use microcode preprocessing method to convert binary functions into microcode;

[0063] Preprocessing: Using IDA Pro, BinEncoder first converts binary functions into microcode, a more abstract and refined language compared to assembly code. As an intermediate language, microcode helps mitigate the differences between binary code compiled from the same source code but using different compilation configurations. Furthermore, microcode simplifies the extraction of semantic features of the code at a higher level.

[0064] S11. Microcode Instruction Structure: Microcode is typically represented in the form "opcode, l, r, d", where "opcode" represents the opcode, and "l, r, d" represent the left operand, right operand, and destination operand, respectively. The opcode indicates the operation to be performed on the operand. Operands include 16 types, such as registers, immediate values, and strings. Table 1 lists all operand types. When the operand in the microcode is of type mop_z, it is usually omitted.

[0065] Table 1. Description of all microcode operand types

[0066] Mop_z No operands Mop_r register Mop_n constant immediate number Mop_str character constants Mop_d The result of another instruction Mop_S Local stack variables Mop_v global variables Mop_b Basic block jump label Mop_f Parameter list Mop_l Local variables Mop_a operand address Mop_h Helper functions Mop_c Switch branch Mop_fn Floating-point pointer constant Mop_p operand pairs Mop_sc Distributed operands

[0067] Instruction Normalization: Compared to assembly instructions, a microcode instruction can contain richer semantic information. On one hand, the operands in a microcode instruction may be an arithmetic expression. In this study, these operands are referred to as compound operands, and instructions containing compound operands are called compound instructions. The intricate syntax and dense semantic information in compound instructions pose challenges to semantic extraction. On the other hand, nested instructions may also exist in microcode, meaning that the operands of a microcode instruction may be another microcode instruction, which may lead to out-of-vocabulary (OOV) words. To address these challenges, this invention proposes an instruction decompression method to convert compound instructions into nested instructions and a fine-grained word segmentation method to reduce the number of OVO words.

[0068] Instruction Decompression: Composite operands typically implement arithmetic operations, memory operations, or other operations. Semantically, these operations can be equated to a sequence of instructions. By replacing composite operands with semantically equivalent ordinary instructions, the semantics within the composite instructions are decompressed and made easier for deep learning models to understand. This invention decompresses operands into nested microcode instructions composed of related instructions. The decompression process is recursive to ensure semantic equivalence. For example, the following microcode instruction has a composite operand [ds:(ap+#8)], representing a memory data retrieval operation.

[0069] sdiv[ds:(ap+#8)],#8,var8

[0070] The operand is replaced with a microcode instruction to fetch data from memory, namely ldxds,(ap+#8). Then, a new microcode instruction is obtained, as shown below, where {·} represents an instruction.

[0071] sdiv{ldxds,(ap+#8)},#8,var8

[0072] In this instruction, the compound operand (ap+#8) still exists, performing the addition operation. It is then replaced with the corresponding microcode instruction addap,#8. After all compound operands are replaced, the decompression instruction is as follows.

[0073] sdiv{ldxds,{addap,#8}},#8,var8

[0074] The instruction decompression process is summarized as Algorithm 1. This algorithm recursively replaces composite operands in microcode instructions with semantically equivalent instructions. First, it obtains the opcode and operands of the microcode instruction (lines 1-3). Second, it replaces the composite operand with a semantically equivalent microcode instruction and recursively decompresses that instruction (lines 6-9). Third, for the instruction operands, it recursively decompresses the instructions within the operands (lines 11-13). Finally, it outputs the decompression instruction (line 19), which is a nested instruction that does not contain composite operands.

[0075]

[0076]

[0077] S12. Fine-grained word segmentation: After the instruction decompression is completed, nested instructions still exist in the microcode program. Some of these instructions are converted from the decompression instructions, resulting in inconsistent instruction lengths. Unlike methods such as Asm2Vec and BindiffNN, which unify instructions to a fixed length and remove redundant parts, the method of this invention retains the entire microcode instruction and uses fine-grained word segmentation to preserve more semantic information in the instruction. Each opcode or operand is treated as a word. For example, the following nested instructions are processed into 12 words.

[0078] sdiv{ldxds,{addap,#8}},#8,var8→

[0079] sdiv,{,ldx,ds,{,add,ap,#8,},},#8,var8}

[0080] S13. Lexical Substitution: Strings and constants in microcode may cause OOV (Out of Variable) issues. To address this problem, this invention designs the following token substitution strategy to reduce the number of tokens while preserving code semantics.

[0081] All registers are retained;

[0082] Retain constants with values ​​of 0 or 1;

[0083] Replace the jump operand with "Block + destination basic block" (e.g., "Block3"). To distinguish different basic blocks, BinEncoder assigns identifiers to basic blocks within functions.

[0084] Replace function arguments with "argv + parameter number" (for example, "argv2" represents the second parameter in the function).

[0085] Replace local variables with "lvar + variable number" (for example, "lvar6" represents the 6th local variable in the function).

[0086] Replace other operands with the corresponding operand types from Table 1.

[0087] S2. Establish a microcode language model based on the Transformer architecture. Use the microcode language model to learn the global semantics of the microcode in S1. Fine-tune the microcode language model using triplet loss for the binary code similarity detection task to obtain the trained microcode language model.

[0088] The Transformer is a widely used model in natural language processing, possessing powerful semantic encoding capabilities and effectively capturing high-level semantic information. This invention develops an MCLM model based on the Transformer encoder to extract semantic information from microcode functions. To facilitate the model's understanding of the semantic and syntactic structure of the microcode, this invention designs three pre-training tasks for the microcode program. Finally, the model is fine-tuned using triplet loss for the BCSD task.

[0089] Considering the special semantics and syntactic structure of microcode, this invention designs a Masked Language Model (MLM) task to capture the contextual semantics of microcode, a Jump Block Prediction (JBP) task to learn control flow features, and a Definition Block Prediction (DBP) task to learn data flow features.

[0090] S21. Masked Language Model: Originally proposed by BERT, the Masked Language Model (MLM) masks certain words in an input sentence and then trains the model to predict the masked words based on the context. In BinEncoder, the masked words are opcodes or operands. MCLM learns the contextual semantics of the microcodes through MLM. This invention's MLM task randomly masks 15% of the words; of these, 80% are replaced with the special word "MASK," 10% are replaced with random words, and 10% remain unchanged.

[0091]

[0092] Where M represents the set of mask words, y represents the prediction of word m. m For the true value, I M This is the input for MLM.

[0093] S22. Jump Block Prediction: Unlike natural language, jumps are a common syntax in code and are central to the program's control flow graph. Jumps can combine two distant code segments in the address space, making them semantically aligned. Given this characteristic, this invention designs a JBP task that enables MCLM to learn control flow information in microcode functions. Specifically, in the JBP task, 20% of jump addresses are masked, and MCLM predicts the first opcode in the target block for each masked jump address based on the microcode context.

[0094] Figure 2 This demonstrates BinEncoder's method for modeling the jump block prediction task. "Block3" represents a jump to the third basic block, which is replaced with the special symbol "[JUMP]", and the correct prediction result is "Start@4". The loss function for the jump block prediction (JBP) task is defined as follows:

[0095]

[0096] Where J represents the set of jump prediction words, y represents the prediction of word j. j For the true value of word j, I J This serves as the input to the model under the JBP task.

[0097] S23. Data flow analysis is an important aspect of binary software reverse engineering. Data flow dependencies typically remain relatively stable during different compiler optimization processes. Therefore, it is necessary to incorporate data flow analysis into the model. Since variables are semantically closely related to the native instructions they define, this invention assumes a semantic association between variables and the basic blocks they define, and performs data flow analysis based on this assumption. To this end, this invention introduces a Definition Block Prediction (DBP) task to help the model understand the "definition-use" relationships in the code and learn the relevant semantics.

[0098] The DBP task randomly masks 20% of local variables during prediction. Figure 3 An example of the DBP task is shown. “lvar1” represents a local variable defined in the first basic block and used in the second basic block. It is replaced with the special marker “[DATA]”, indicating that the model needs to predict the basic block in which this variable is defined. The correct prediction is “Block1”, representing the first basic block. The loss function for the Define Block Prediction (DBP) task is defined as follows:

[0099]

[0100] Where D represents the set of jump prediction words, y represents the prediction of word j. d To correspond to the true value, I D This is the input to the model under the DBP task.

[0101] The total loss of BinEncoder during the pre-training phase is the sum of the losses from the three pre-training tasks, expressed as follows:

[0102]

[0103] S24. Fine-tuning: To fine-tune the BCSD, this invention employs a triplet loss function to optimize the model. This loss function minimizes the distance between positive sample pairs while maximizing the distance between negative sample pairs. The fine-tuning loss is defined as follows:

[0104]

[0105] Where f represents the anchor microcode function, g + and g - Let represent positive and negative samples respectively. Cosine similarity is used as a distance metric to evaluate functional distance, and ε is a hyperparameter between 0 and 0.5.

[0106] S3. Input the target binary function into the microcode language model trained in S2 to generate a robust semantic embedding. Perform fast offline code similarity detection through the semantic embedding.

[0107] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A binary function similarity detection method based on Transformer, characterized in that, Includes the following steps: S1. Use microcode preprocessing method to convert binary functions into microcode; S11, Instruction Decompression: First, the binary code is converted into microcode; then, the composite operands in the microcode instructions are decompressed into nested microcode instructions composed of related instructions. S12. Perform fine-grained word segmentation on the microcode instructions processed in S11, treating each opcode or operand as a word; S13. Perform word substitution on the strings and constants in the microcode instructions processed by S12 to reduce the number of tags and preserve the semantics of the code; S2. Establish a microcode language model based on the Transformer architecture. Use the microcode language model to learn the global semantics of the microcode in S1. Fine-tune the microcode language model using triplet loss for the binary code similarity detection task to obtain the trained microcode language model. S21. Train the microcode language model using the masked language model task to capture the contextual semantics of the microcode. S22. The microcode language model trained in S21 is trained using a jump block prediction task to learn control flow features. In the jump block prediction task, 20% of the jump addresses are masked. The microcode language model predicts the first opcode in the target block for each masked jump address based on the microcode context. The loss function for the jump block prediction task is defined as follows: in, This represents the set of predicted keywords for navigation. Indicates the meaning of words The prediction For vocabulary The true value, This serves as the input to the model for the jump block prediction task; S23. The microcode language model trained in S22 is trained using a defined block prediction task to learn data stream features; S24. Using the triplet loss function, fine-tuning is performed on the microcode language model trained in S23 for the binary code similarity detection task. S3. Input the target binary function into the microcode language model trained in S2 to generate a robust semantic embedding. Perform fast offline code similarity detection through the semantic embedding.

2. The binary function similarity detection method based on Transformer according to claim 1, characterized in that, The decompression method in S11 is as follows: S111, Obtain the opcode and compound operand of the microcode instruction; S112. Replace the composite operand with a semantically equivalent microcode instruction, and recursively decompress the replaced microcode instruction. S113. For instruction operands, recursively decompress the instructions in the operands; S114. Output decompression command, wherein the decompression command is a nested command and does not contain compound operands.

3. The binary function similarity detection method based on Transformer according to claim 1, characterized in that, The word substitution method in S13 is as follows: S131, Reserve all registers; S132, constants with a value of 0 or 1; S133, Replace the jump operand with Block + destination basic block; S134. Replace function parameters with argv + parameter number; S135. Replace local variables with lvar + variable number; S136. Replace other operands with the corresponding operand types.

4. The binary function similarity detection method based on Transformer according to claim 1, characterized in that, S21 specifically includes: The masked language model masks opcodes or compound operands in microcode and randomly masks 15% of words; of the 15% of words, 80% are replaced with the special word MASK, 10% are replaced with random words, and 10% remain unchanged; The loss function for the masked language model is defined as follows: in, A set representing the mask words. Indicates the meaning of words The prediction For the true value, This serves as the input for the masked language model.

5. The binary function similarity detection method based on Transformer according to claim 1, characterized in that, S23 specifically includes: Define a block prediction task that randomly masks 20% of local variables during prediction; The loss function for the block prediction task is defined as follows: in, This represents the set of predicted keywords for navigation. Indicates the meaning of words The prediction To correspond to the actual value, This defines the input to the model for the block prediction task.

6. The binary function similarity detection method based on Transformer according to claim 1, characterized in that, S24 specifically includes: The triplet loss function minimizes the distance between positive sample pairs while maximizing the distance between negative sample pairs. The fine-tuning loss is defined as follows: in, This represents the anchor microcode function. and Let represent positive and negative samples respectively. Cosine similarity is used as a distance metric to evaluate the functional distance. The hyperparameter is between 0 and 0.5.

Images