Function boundary identification method, device, cloud device and computer device

Abstract

The present invention relates to the field of function boundary recognition, and specifically to a function boundary recognition method, device, cloud device and computer device, which can better extract the information of important bytes. The function boundary recognition method of the present invention includes: semantically processing the original bytes and additional semantic information through a semantic converter to obtain a semantic conversion vector; inputting the semantic conversion vector into a Transformer module, performing function boundary recognition through the Transformer module, and inputting the recognized output result into a logistic regression module for classification. The present invention is suitable for binary function boundary recognition.

Description

Technical Field

[0001] The present invention relates to the field of function boundary recognition, and in particular to a function boundary recognition method, device, cloud device and computer device. Background Art

[0002] Function identification is a basic task in binary analysis, and is the basis for binary similarity analysis, component composition analysis, binary vulnerability detection, and malware identification. It mainly refers to the process of recovering function boundaries, bodies, and function fingerprints (such as parameters and return values) from machine code; function body recovery refers to the process of instruction identification starting from the recovered function start instruction.

[0003] The existing technical solutions directly target the original byte sequence and use a bidirectional RNN (Recurrent Neural Network) model, such as Figure 1 As shown, the hidden unit in the RNN uses LSTM (Long short-term Memory) or GRU (Gated Recurrent Units) network structure. The advantage of this solution is that the RNN model can extract sequence information, and structures such as LSTM solve the original RNN gradient disappearance problem, retain long-term memory through gating, and better extract semantics.

[0004] However, the existing technical solutions do not fully consider some additional information in modeling, such as the CPU (Central Processing Unit) architecture to which the binary file belongs, the word length related to the instruction (64 or 32 bits), and the file type. In particular, the CPU architecture determines the instruction type. For example, the x86 and arm architectures are completely different instruction set modes. The x86 uses variable-length mode instructions, and the instructions are represented by byte sequences of different lengths; while the arm instruction set belongs to fixed-length instructions, and the instructions have the same byte length. The lack of these semantics will affect the accuracy of the model.

[0005] In addition, due to compiler optimization, the binary does not have a fixed function fingerprint, i.e., function prologue and tail, etc. When determining whether a byte is the start byte of a function, the degree of attention paid to the related bytes before and after is different in different situations.

[0006] Therefore, existing solutions cannot distinguish the importance of different machine bytes in a friendly way, nor can they process machine bytes according to the binary file type. The model also does not consider the problem of cross-instruction sets. Summary of the invention

[0007] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a function boundary identification method, device, cloud device and computer device that can better extract important byte information.

[0008] The present invention adopts the following technical solutions to achieve the above-mentioned purpose. In a first aspect, the present invention provides a function boundary identification method, comprising:

[0009] The original bytes and semantic information are processed semantically by a semantic converter to obtain a semantic conversion vector;

[0010] The semantic transformation vector is input into the Transformer module, the function boundary is identified through the Transformer module, and the output result of the identification is input into the logistic regression module for classification;

[0011] The function boundary recognition through the Transformer module specifically includes: if the original byte input sequence is x1, x2, ..., x n , then let the matrix X = [x1, x2, …, x n ], Q = X * W Q ,K=X*W K ,V=X*W V ; Q represents the query vector, K represents the key vector, V represents the value vector, and W represents the matrix obtained in the Transformer module learning;

[0012] but Where Q and K are d k dimensional vector, Q is composed of q1,q2,…,q n Composed of, K consists of k1, k2, …, k n V consists of v1, v2, …, v n composition;

[0013] Let Z = Attention(Q, K, V), then the calculation logic of the addition and normalization operation is Z1 = LayerNorm(X+Z); then it is calculated through the Feed-Forward module as follows: FFN(Z1) = max(0,Z1W1+b1)W2+b2, where W1, W2, b1, and b2 represent the neuron parameters in the Feed-Forward module respectively.

[0014] Furthermore, the semantic converter performs semantic processing on the original bytes and semantic information to obtain the semantic conversion vector, which specifically includes:

[0015] The central processing unit architecture, the maximum number of bits of binary data that the central processing unit can process at one time, and the format information of the executable file under the operating system are mapped into dense low-dimensional vectors, and then concatenated, maximized or minimized, arithmetic mean, and multiplied with the byte-mapped vectors. All the obtained vectors are then concatenated together and input into a multi-layer MLP (Multilayer Perceptron) model to finally obtain a fixed-length vector as the semantic conversion vector.

[0016] In a second aspect, the present invention provides a function boundary identification device, which is used to implement the function boundary identification method described above, and the device comprises:

[0017] The semantic transformer is used to perform semantic processing on the original bytes and semantic information to obtain a semantic transformation vector, and input the semantic transformation vector into the Transformer module;

[0018] Transformer module, wherein the Transformer module is composed of an encoder, and each layer of the encoder is composed of an Attention module and a Feed-Forward module. The Transformer module identifies function boundaries according to semantic transformation vectors, and inputs the identified output results into a logistic regression module;

[0019] Function boundary recognition specifically includes: if the original byte input sequence is x1, x2, …, x n , then let the matrix X = [x1, x2, …, x n ], Q = X * W Q ,K=X*W K ,V=X*W V ; Q represents the query vector, K represents the key vector, V represents the value vector, and W represents the matrix obtained in the Transformer module learning;

[0020] but where q and k are d k dimensional vector, Q is composed of q1,q2,…,q n Composed of, K consists of k1, k2, …, k n V consists of v1, v2, …, v n composition;

[0021] Let Z = Attention(Q, K, V), then the calculation logic of the addition and normalization operation is Z1 = LayerNorm(X+Z); then it is calculated by the Feed-Forward module, and the calculation method is as follows: FFN(Z1) = max(0, Z1W1+b1)W2+b2; W1, W2, b1, b2 represent the neuron parameters in the Feed-Forward module respectively;

[0022] Logistic regression module, used to classify the recognized output results.

[0023] Furthermore, the semantic converter is specifically used to map the central processing unit architecture, the maximum number of bits of binary data that the central processing unit can process at one time, and the format information of the executable file under the operating system into dense low-dimensional vectors, and then perform concatenation, maximum or minimum, arithmetic mean and multiplication operations with the byte-mapped vectors, and then concatenate all the obtained vectors together and input them into the multi-layer MLP model, and finally obtain a fixed-length vector as a semantic conversion vector.

[0024] In a third aspect, the present invention provides a cloud device, which includes a server, and the function boundary identification device as described above is installed on the server.

[0025] In a fourth aspect, the present invention provides a computer device, comprising a memory, wherein the memory stores program instructions, and when the program instructions are executed, the function boundary identification method as described above is executed.

[0026] The beneficial effects of the present invention are:

[0027] The present invention replaces the RNN model in the existing solution with the Transformer module. The Transformer model contains a self-attention module, which gives different machine bytes different importance and can better extract the information of important bytes. In addition, this solution adds a semantic converter, which uses additional information such as the CPU architecture to input the original bytes into the semantic converter and adds semantic information related to the instruction. Bytes at different sequence positions share the same semantic converter parameters, so the number of parameters will not increase too much. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 is a schematic diagram of a bidirectional RNN model provided by an embodiment of the present invention;

[0029] Figure 2 is a schematic diagram of a Transformer-based model provided by an embodiment of the present invention;

[0030] Figure 3 is a schematic diagram of a semantic converter provided by an embodiment of the present invention;

[0031] Figure 4 It is an application structure block diagram provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0032] To make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0033] The present invention provides a method for identifying function boundaries. Figure 2 As shown in the figure, the raw byte and the extra semantic information Extra Info are input into the semantic converter Semantic Converter for semantic alignment processing to obtain the corresponding byte1, byte2, ..., byten, which is similar to the IR language in program compilation and decompilation, and shields the CPU architecture information. Then a 3-layer Transformer module is connected. Since it is a classification task, the decoder module of the Transformer is not required, and only the encoder module is retained. Each layer of the encoder consists of an Attention module and a Feed-Forward module. In order to speed up the model convergence, the residual network idea is borrowed, and the residual connection and LayerNorm standardization model are connected.

[0034] Specifically, assume that the byte input sequence is x1,x2,…,x n , we can view the sequence as a matrix X, and then let Q = X*W Q ,K=X*W K ,V=X*W V ; Q, K, and V are three vectors needed in the transformer model, which are calculated by inputting vectors and three W matrices. The W matrix is ​​obtained in model learning. For example, in one embodiment of the present invention, in the transformer module, Q, K, and V represent Query, Key, and Value, respectively.

[0035] Then calculate the attention: Where Q and K are d k dimensional vector, Q is composed of q1,q2,…,q n Composed of, K consists of k1, k2, …, k n V consists of v1, v2, …, v nComposition. Let Z = Attention(Q,K,V). The calculation logic of Add&Normalize is Z1 = LayerNorm(X+Z), and then the Feed-Forward module is a model with two layers of linear transformation and one ReLU activator, that is, FFN(Z1) = max(0,Z1W1+b1)W2+b2. The final output is classified by the logistics regression module. Among them, W1, W2, b1, and b2 represent the neuron parameters in the Feed-Forward module respectively. The Feed-Forward module here is a 2-layer DNN (Deep Neural Network), W1 and W2 are the weights of the linear parts of the first and second layers of the DNN network, respectively, and b1 and b2 are the corresponding bias vectors. Each layer of the DNN network first performs a linear transformation on the input part, and then passes it through the activation function.

[0036] Semantic converters such as Figure 3 As shown in the figure, the CPU arch, i.e. the architecture of the central processing unit, such as x86, arm, mips, etc., the word size, i.e. the maximum number of bits of binary data that the central processing unit can process at one time, mainly 32 bits and 64 bits, and PE / ELF, i.e. the format of executable files under Windows and UNIX operating systems, Portable Executable and Executable and Linkable Format and other information are mapped into dense low-dimensional vectors, and then concatenated with the byte-mapped vectors by Concat, Max or Min, arithmetic mean Mean and Multiply operations, and then all the obtained vectors are concatenated together and input into the 3-layer MLP model, and finally a fixed-length vector is obtained as the semantic transformation vector, which is then input into the Transformer model for function boundary recognition and classification.

[0037] Specifically, the original byte added is x, and the additional information is c, w, and f. After the concat operation, we have a = [x, c, w, f]. After the dot multiplication, we have x c =x·c,x w =x·w,x f = x·f, and the aggregation operation is l1=max([x T ,c T ,w T ,f T ]),l2=min([x T ,c T ,w T ,f T ]),l3=mean([x T ,cT ,w T ,f T ]), then concatenate the vectors to have input = [a, x c ,x w ,x f ,l1,l2,l3]. Then connect to the 3-layer MLP network model, in which the activator uses ReLU, that is, MLP(input)=FFN2(FFN1(input)).

[0038] like Figure 4 As shown, the present invention is mainly applied to the function recognition module in binary analysis, accurately identifying functions and improving the accuracy of downstream tasks, such as component detection and vulnerability detection.

[0039] The above is only a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the form disclosed herein, and should not be regarded as excluding other embodiments, but can be used in various other combinations, modifications and environments, and can be modified within the scope of the concept described herein through the above teachings or the technology or knowledge of the relevant field. The changes and modifications made by those skilled in the art shall not deviate from the spirit and scope of the present invention, and shall be within the scope of protection of the claims attached to the present invention.

Claims

1. A method for identifying function boundaries, characterized in that: include: The original bytes and semantic information are processed semantically by a semantic converter to obtain a semantic conversion vector; The semantic transformation vector is input into the Transformer module, the function boundary is identified through the Transformer module, and the output result of the identification is input into the logistic regression module for classification; The function boundary recognition through the Transformer module specifically includes: if the original byte input sequence is , then let the input matrix X = [ ], ; Q Represents the query vector 、K Represents the key vector 、V represents a value vector, W Represents the matrix obtained in the Transformer module learning; but , where Q and K are dimensional vector, Q is given by Composition, K is composed of Composed of, V is composed of composition; make , then the calculation logic of the addition and normalization operations is ; Then it is calculated by the Feed-Forward module as follows: , , , , They represent the neuron parameters in the Feed-Forward module respectively; The semantic converter performs semantic processing on the original bytes and semantic information to obtain the semantic conversion vector, which specifically includes: The central processing unit architecture, the maximum number of bits of binary data that the central processing unit can process at one time, and the format information of the executable file under the operating system are mapped into dense low-dimensional vectors, and then concatenated, maximized or minimized, arithmetic mean, and multiplied with the byte-mapped vectors. All the obtained vectors are then concatenated together and input into the multi-layer MLP model, and finally a fixed-length vector is obtained as the semantic conversion vector.

2. A function boundary identification device, used to implement the function boundary identification method according to claim 1, characterized in that: include: The semantic transformer is used to perform semantic processing on the original bytes and semantic information to obtain a semantic transformation vector, and input the semantic transformation vector into the Transformer module; Transformer module, wherein the Transformer module is composed of an encoder, and each layer of the encoder is composed of an Attention module and a Feed-Forward module. The Transformer module identifies function boundaries according to semantic transformation vectors, and inputs the identified output results into a logistic regression module; Function boundary recognition specifically includes: if the original byte input sequence is , then let the input matrix X = [ ], ; Q Represents the query vector 、K Represents the key vector 、V represents a value vector, W Represents the matrix obtained in the Transformer module learning; but , where Q and K are dimensional vector, Q is given by Composition, K is composed of Composed of, V is composed of composition; make , then the calculation logic of the addition and normalization operations is ; Then it is calculated by the Feed-Forward module as follows: ; , , , They represent the neuron parameters in the Feed-Forward module respectively; Logistic regression module, used to classify the output results of recognition; The semantic converter is specifically used to map the central processing unit architecture, the maximum number of bits of binary data that can be processed by the central processing unit at one time, and the format information of the executable file under the operating system into a dense low-dimensional vector, and then perform concatenation, maximum or minimum, arithmetic mean and multiplication operations with the byte-mapped vector, and then concatenate all the obtained vectors together and input them into a multi-layer MLP model, and finally obtain a fixed-length vector as a semantic conversion vector.

3. A cloud device, comprising a server, characterized in that: The function boundary identification device as described in claim 2 is installed on the server.

4. A computer device comprising a memory storing program instructions, characterized in that: When the program instructions are executed, the function boundary identification method as claimed in claim 1 is executed.

Images