A software security defense method, apparatus and equipment

Abstract

This invention provides a software security defense method, apparatus, and device. The method includes: disassembling target software to obtain binary disassembly information; analyzing and identifying the binary disassembly information to determine corresponding semantic information and function body boundaries; determining target code in the binary disassembly information based on the semantic information and function body boundaries; performing binary rewriting on the target code; correcting the rewritten code to obtain a rewritten binary program; performing multi-dimensional evaluation on the rewritten binary program; and determining at least the feasibility and security defense performance of the rewritten binary program based on the multi-dimensional evaluation results. The method of this invention can perform vulnerability detection and analysis on binary software and automatically rewrite the vulnerable parts of the program, ensuring that the software has high security defense performance.

Description

Technical Field

[0001] This invention belongs to the field of security defense technology, specifically relating to a software security defense method, device, and equipment. Background Technology

[0002] With the rapid development and widespread application of computer technology, computer software has transcended its simple tool function, becoming the "nerve center" supporting the operation of modern society and playing a core role in driving progress across all industries. However, in this process, computer software security issues have become increasingly prominent, posing a serious challenge. Due to inherent security flaws in programming languages ​​and developer negligence during software development, security vulnerabilities may exist. Once these vulnerabilities are discovered and exploited by malicious attackers, they can lead to severe economic and property losses. Therefore, how to prevent attackers from exploiting vulnerabilities in software is a crucial research issue in the field of computer security.

[0003] For software security vulnerabilities, direct patching is undoubtedly the most straightforward and effective method. However, due to the varying characteristics of vulnerabilities across different software, and the inherent challenge of discovering vulnerabilities for defenders, it is difficult to ensure the comprehensive identification of all hidden vulnerabilities within the software. Furthermore, vulnerability patching often incurs high costs, and patching strategies for a specific vulnerability are often difficult to directly apply to other vulnerabilities, further increasing the difficulty of defense.

[0004] In many cases, the source code of software is not readily available, especially for Commercial Off-the-Shelf (COTS) and Legacy Software. Their source code may be unpublished or lost, leaving security experts with only access to the program's binary files. This lack of source code access undoubtedly presents additional challenges to defense efforts. In the absence of source code, defenders typically rewrite the binary files to modify their functionality and patch vulnerabilities. However, this binary rewriting approach can introduce additional performance overhead, leading to a decrease in the performance of the rewritten program. Finding a proper balance between security and performance is crucial.

[0005] In summary, current solutions for software-level attack defense have the following shortcomings and deficiencies:

[0006] (1) Defense strategies based on vulnerability patching have low generalization and high cost;

[0007] (2) The vulnerability patching strategy of using rewriting strategy for binary files introduces additional performance overhead.

[0008] Therefore, defenders need to explore new methods to prevent attackers from exploiting vulnerabilities when it is impossible to discover or patch all of them. At the same time, they also need to consider how to effectively improve software security without sacrificing too much performance to protect computer systems from attack threats. Summary of the Invention

[0009] The technical problem to be solved by the present invention is to provide a software security defense method, device and equipment that can accurately and effectively detect vulnerabilities in the binary disassembly information of software and automatically rewrite the vulnerable parts of the program to ensure that the software has high security defense performance.

[0010] The present invention includes providing a software security defense method, comprising:

[0011] The target software is disassembled to obtain binary disassembly information;

[0012] The binary disassembled information is analyzed and identified to determine the corresponding semantic information and function body boundaries;

[0013] Based on the semantic information and function body boundaries, the target code is determined in the binary disassembly information;

[0014] Perform binary rewriting on the target code;

[0015] The rewritten code was corrected to obtain the rewritten binary program;

[0016] The rewritten binary program is evaluated from multiple dimensions.

[0017] Based on the multi-dimensional evaluation results, at least the feasibility and security defense performance of the rewritten binary program data should be determined.

[0018] In some embodiments, the method further includes:

[0019] An analysis and identification model is constructed, which is used to analyze and identify the binary disassembled information to determine the corresponding semantic information and function body boundaries;

[0020] The analysis and identification of the binary program content to determine the corresponding semantic information and function body boundaries includes:

[0021] The binary program content is analyzed and identified based on the analysis and recognition model to determine the corresponding semantic information and function body boundaries.

[0022] In some embodiments, the construction of the analysis and identification model includes:

[0023] Build the initial model;

[0024] Construct a training dataset, which consists of open-source known program source code and compiled data compiled by a known compiler from the known program source code;

[0025] The initial model is trained based on the dataset so that it learns the compilation process of the program source code, and is used to disassemble or decompile binary disassembly information, and to analyze and identify the semantic information and function body boundaries corresponding to the binary program content based on the disassembly or decompilation results.

[0026] In some embodiments, the initial model is composed of a BERT model;

[0027] The compilation data includes binary files obtained by compiling known program source code, data during the compilation process, semantics of marked binary statements, and function boundary information;

[0028] The initial model is trained using the dataset in two phases. The first phase involves learning the embeddings of semantic and function boundary information in binary data using cloze tests and context prediction. The second phase involves predicting the semantic and function boundaries of binary data based on the embedded information.

[0029] In some embodiments, performing binary rewriting on the target code includes:

[0030] The target code is subjected to binary rewriting processing by at least one of the following methods: heuristic-based software rewriting method, randomized software rewriting method, and program semantic rewriting method.

[0031] In some embodiments, the method further includes:

[0032] The target code is analyzed based on prior knowledge to determine its data characteristics. The prior knowledge is related to the attack type and the corresponding data characteristics of the attacked data.

[0033] Based on the data characteristics, a method for performing binary rewriting processing on the target code is determined from the heuristic software rewriting method, the randomized software rewriting method, and the program semantic rewriting software rewriting method.

[0034] In some embodiments, the multi-dimensional evaluation of the rewritten binary program includes:

[0035] The correctness of the binary disassembled information and the rewritten binary program is evaluated by using fuzz testing.

[0036] The effectiveness of the binary disassembled information and the rewritten binary program was evaluated using the CVE test method.

[0037] The binary disassembled information and the rewritten binary program are converted into fields of visual representation based on the binary visualization method. The binary data in each field are marked with different colors based on the binary function recognition method. The code differences between the binary disassembled information and the rewritten binary program are evaluated based on the marking results.

[0038] The binary disassembled information and the rewritten binary program are tested based on the SPEC test set. The performance overhead and defense performance during program execution are compared based on the test results to evaluate the security defense performance of the rewritten binary program. The performance overhead and defense performance include at least the rewriting overhead during software loading, the rewriting overhead under active attack, the degree of memory saving during software execution, the performance evaluation of the software system, and the overall memory saving of the software system.

[0039] Another embodiment of the present invention also provides a software security defense device, comprising:

[0040] The first acquisition module is used to disassemble the target software and obtain binary disassembly information;

[0041] The identification module is used to analyze and identify the binary disassembled information to determine the corresponding semantic information and function body boundaries;

[0042] The first determining module is used to determine the target code in the binary disassembly information based on the semantic information and function body boundaries;

[0043] A rewrite module is used to perform binary rewrite processing on the target code;

[0044] The correction module is used to correct the rewritten code and obtain the rewritten binary program.

[0045] The evaluation module is used to perform multi-dimensional evaluation of the rewritten binary program;

[0046] The second determining module is used to determine, at least, the feasibility and security defense performance of the rewritten binary program based on the multi-dimensional evaluation results.

[0047] Another embodiment of the present invention provides an electronic device, the electronic device including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps in the software security defense method as described in any of the above embodiments.

[0048] Another embodiment of the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the software security defense method as described in any of the above embodiments.

[0049] The beneficial effects of this invention include the ability to detect the binary program content of target software, identify vulnerabilities or errors in the binary program content through semantic analysis and function boundary determination, automatically rewrite the vulnerable areas, and correct the content based on the rewritten content to form a rewritten binary program. The rewritten binary program has significantly improved security defense performance during runtime and is more secure. Attached Figure Description

[0050] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0051] Figure 1 This is a flowchart illustrating the software security defense method in an embodiment of the present invention.

[0052] Figure 2 This is a schematic diagram illustrating the application process of the software security defense method in this embodiment of the invention.

[0053] Figure 3 This is a schematic diagram of another application process of the software security defense method in this embodiment of the invention.

[0054] Figure 4 This is a structural block diagram of the software security defense device in an embodiment of the present invention. Detailed Implementation

[0055] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings, but these are not intended to limit the scope of the invention.

[0056] It should be understood that various modifications can be made to the embodiments disclosed herein. Therefore, the following description should not be considered as limiting, but merely as an example of embodiments. Other modifications within the scope of this disclosure will be apparent to those skilled in the art.

[0057] The accompanying drawings, which are included in and form part of this specification, illustrate embodiments of the present disclosure and, together with the general description of the disclosure given above and the detailed description of the embodiments given below, serve to explain the principles of the disclosure.

[0058] These and other features of the invention will become apparent from the following description of preferred forms of embodiments given as non-limiting examples, with reference to the accompanying drawings.

[0059] It should also be understood that although the invention has been described with reference to some specific examples, those skilled in the art can certainly implement many other equivalent forms of the invention, which have the features described in the claims and are therefore all within the scope of protection defined herein.

[0060] The above and other aspects, features and advantages of this disclosure will become more apparent when taken in conjunction with the accompanying drawings and in view of the following detailed description.

[0061] Specific embodiments of the present disclosure are described thereafter with reference to the accompanying drawings; however, it should be understood that the disclosed embodiments are merely examples of the present disclosure and can be implemented in various ways. Well-known and / or repeated functions and structures are not described in detail to avoid unnecessary or redundant details that could obscure the present disclosure. Therefore, the specific structural and functional details disclosed herein are not intended to be limiting, but merely to serve as the basis and representative basis for the claims to teach those skilled in the art to use the present disclosure in a variety of substantially any suitable detailed structures.

[0062] This specification may use the phrases “in one embodiment,” “in another embodiment,” “in yet another embodiment,” or “in still another embodiment,” all of which may refer to one or more of the same or different embodiments according to this disclosure.

[0063] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0064] like Figure 1 and Figure 2 As shown, this embodiment of the invention provides a software security defense method, including:

[0065] S1: Disassemble the target software to obtain binary disassembly information;

[0066] S2: Analyze and identify the binary disassembled information to determine the corresponding semantic information and function body boundaries;

[0067] S3: Determine the target code in the binary disassembly information based on the semantic information and function body boundaries;

[0068] S4: Perform binary rewrite processing on the target code;

[0069] S5: Correct the rewritten code to obtain the rewritten binary program;

[0070] S6: Perform a multi-dimensional evaluation of the rewritten binary program;

[0071] S7: Based on the multi-dimensional evaluation results, at least determine the feasibility and security defense performance of the rewritten binary program.

[0072] In this embodiment, the target software can be any program that requires security testing; it is not unique. After obtaining the binary disassembly information of the target software, the system analyzes and identifies this information to determine its semantic information and function body boundaries. Then, based on this semantic information and function body boundaries, the system analyzes and identifies content with security vulnerabilities or program errors, i.e., identifies the target code that needs to be rewritten. This target code is part or all of the binary disassembly information. Of course, if there is no data that needs to be rewritten, the system will output a corresponding prompt. When there is target code that needs to be rewritten, the system will automatically perform binary rewriting processing on the target code to obtain the corresponding rewritten data. Based on this rewritten data, the system then obtains the rewritten binary program. To ensure the stability of the new binary disassembled information, the overall performance of the software, and the high level of security defense, the system will conduct multi-dimensional evaluations of the rewritten binary program. For example, it will verify whether the rewritten binary disassembled information can crash immediately and block the attack chain through memory attacks such as code injection and code reuse, or verify the effectiveness of the rewritten binary program. Finally, based on the evaluation results, the feasibility and security defense performance of the rewritten binary program will be determined, and the corresponding results will be output for user reference.

[0073] As can be seen from the above embodiments, the solution described in this embodiment can detect the binary program content of the target software, identify vulnerabilities or errors in the binary program content through semantic analysis and function boundary determination, automatically rewrite the vulnerable or erroneous areas, and correct the rewritten content to form a rewritten binary program. The rewritten binary program has significantly improved security defense performance at runtime and is more secure. In other words, the method in this embodiment can greatly improve the security and reliability of software, providing a "low-cost," "low-overhead," and "widely applicable" defense means for critical software systems.

[0074] Furthermore, based on the above, the software security defense method deployed in this embodiment can be configured as a software tool consisting of three modules. The first module is a binary software analysis module, which aims to identify semantic information and function body boundaries in the binary code, providing a target carrier for the binary content that needs to be rewritten. The second module is a software rewriting module, which uses binary rewriting technology to rewrite part or all of the content of the binary file. The third module is an evaluation and verification module, which is used to evaluate the correctness of the rewritten binary software, the overall software performance, and the effectiveness of attack defense, etc.

[0075] In some embodiments, the method further includes:

[0076] S8: Construct an analysis and identification model, which is used to analyze and identify the binary disassembled information to determine the corresponding semantic information and function body boundaries;

[0077] The analysis and identification of the binary program content to determine the corresponding semantic information and function body boundaries includes:

[0078] S9: Based on the analysis and recognition model, the binary program content is analyzed and recognized to determine the corresponding semantic information and function body boundaries.

[0079] For example, the first module is a model, which is an analysis and identification model. By building this model, the binary disassembly information of the target software can be input into the model, so as to realize the semantic analysis of the binary disassembly information and the determination of function body boundaries based on the model.

[0080] Specifically, the construction of the analysis and identification model includes:

[0081] S10: Construct the initial model;

[0082] S11: Construct a training dataset, which consists of open-source known program source code and compiled data compiled by a known compiler from the known program source code;

[0083] S12: Train the initial model based on the dataset so that the initial model learns the compilation process of the program source code, so as to disassemble or decompile the binary disassembly information, and analyze and identify the semantic information and function body boundaries corresponding to the binary program content based on the disassembly or decompiling results.

[0084] In some embodiments, the initial model is composed of a BERT model;

[0085] The compilation data includes binary files obtained by compiling known program source code, data during the compilation process, semantics of marked binary statements, and function boundary information;

[0086] The initial model is trained using the dataset in two phases. The first phase involves learning the embeddings of semantic and function boundary information in binary data using cloze tests and context prediction. The second phase involves predicting the semantic and function boundaries of binary data based on the embedded information.

[0087] For example, the initial model is first selected, which can be, but is not limited to, the BERT model. Then, the system constructs training data, for instance, by obtaining the source code of open-source software, compiling it to obtain binary program files, and recording data during the compilation process, such as symbol tables, as well as the semantic information of each binary statement or source code statement and the related function boundary information. By collecting the above data, the training dataset can be obtained. To enhance the model's generalization ability, each software's source code can be compiled using different compilers and optimization schemes during dataset construction, and intermediate compilation data can be recorded as the training dataset.

[0088] During model training, the training data obtained in the previous step, i.e., binary data, is disassembled and input into the model for learning. The training is achieved using labeled semantic and function boundary information. Specifically, to enhance the model's generalization ability and enable it to be used for different downstream tasks, this embodiment divides the training into two stages: a model pre-training stage and a specific downstream task training stage. In the pre-training stage, the BERT model is used to learn the embeddings of semantic and function boundary information in the binary data using methods such as Mask Learning (ML) and Non-Side Context Prediction (NSP). In the specific downstream task stage, the semantic and function boundary information of the corresponding binary disassembled information is predicted based on the embedded information. In other words, the first stage is responsible for converting the binary file into assembly instructions or intermediate representations using disassembly and other techniques, and using this as input to the machine learning model to learn to embed the data in the binary file. The second stage uses function body boundary recognition technology based on code semantics as input to predict the semantic and function body boundary information in the binary file. After training the model using the above methods, the model is able to infer and predict the semantic and function boundary information in the binary disassembled information. For example, in application, a binary file is used as the input to the model. After disassembly, it is input into the machine learning module of the model. The machine learning module can then perform inference and prediction on the input binary file to obtain the semantic information and function boundary information of the corresponding binary file.

[0089] In other embodiments, performing binary rewrite processing on the target code includes:

[0090] S13: Perform binary rewriting processing on the target code using at least one of the following methods: heuristic-based software rewriting method, randomized software rewriting method, and program semantic rewriting method.

[0091] Optionally, the method further includes:

[0092] S14: Analyze the target code based on prior knowledge to determine the data characteristics of the target code. The prior knowledge is related to the attack type and the corresponding data characteristics of the attacked data.

[0093] S15: Based on the data characteristics, determine the method for performing binary rewriting processing on the target code from the software rewriting method of the heuristic method, the randomized software rewriting method, and the software rewriting method of program semantic rewriting.

[0094] For example, a model can be constructed to analyze target code based on prior knowledge, determine the data characteristics of the target code, and match these data characteristics with a certain type of attack method. For instance, attack method A is mainly used to attack data regions with data characteristics B, such as function B. Based on this, the system can find and determine a rewriting method that can keep the source code content unchanged while avoiding attack method A, thereby rewriting the target code and improving the security defense performance of the rewritten software. The rewriting methods in this embodiment include, but are not limited to, heuristic software rewriting methods, randomized software rewriting methods, and program semantic rewriting methods. For heuristic software rewriting methods, attack modeling and feature extraction can be used to construct heuristics for rewriting. Specifically, firstly, memory attack behavior is modeled to characterize code injection and code reuse attack behaviors; based on the memory attack behavior model and actual attack code, behavior and code features are extracted, and heuristics are designed based on these features; then, through binary rewriting technology, the implementation code of the heuristic is injected into the target code corresponding to the binary disassembly information, so that when the attack code is executed, the code itself will directly enter a crash state. For example, in code injection attacks, a heuristic can be used to set the stack frames to be non-executable, causing the attacking code to directly enter a crash state upon execution. In code reuse attacks, because attackers need to continuously search memory space to construct attack chains, these chains typically end with the execution of interrupt functions, and their memory layout is disjointed, differing from normal control flow. Therefore, the system can design heuristics based on this to induce software crashes when abnormal instructions are executed. For randomized software rewriting methods, address space randomization is involved. Address space randomization makes it difficult for attacking instructions to jump to functions at specific memory locations. When an attacker jumps to an illegal address region, the software crashes, thus preventing buffer overflow attacks. Since parsing instructions from different locations may yield different results, different instruction equivalence transformation methods can be used to implement randomized software rewriting for different types of short instruction fragments, such as ret, jmp, and call instructions.

[0095] In other embodiments, after obtaining the rewritten binary program, the system evaluates it from different dimensions to determine whether the rewritten binary program can support successful software operation and its overall runtime performance, security defense capabilities, etc. Specifically, the multi-dimensional evaluation of the rewritten binary program includes:

[0096] S16: The correctness of the binary disassembled information and the rewritten binary program is evaluated by fuzz testing;

[0097] S17: Evaluate the effectiveness of the binary disassembled information and the rewritten binary program using the CVE test method;

[0098] S18: Based on the binary visualization method, the binary disassembled information and the rewritten binary program are converted into fields of visual representation, and the binary data in each field are marked with different colors in combination with the binary function recognition method, so as to evaluate the code differences between the binary disassembled information and the rewritten binary program based on the marking results.

[0099] S19: Test the binary disassembled information and the rewritten binary program based on the SPEC test set, and compare the performance overhead and defense performance during program execution based on the test results, so as to evaluate the security defense performance of the rewritten binary program. The performance overhead and defense performance include at least the rewriting overhead during software loading, the rewriting overhead under active attack, the degree of memory saving during software execution, the performance evaluation of the software system, and the overall memory saving of the software system.

[0100] For example, the multi-dimensional evaluation in this embodiment mainly involves four aspects: First, the correctness evaluation of the rewritten binary program can be achieved by using fuzz testing to input the original binary file and the rewritten binary file with the same input, and then comparing their outputs. If the similarity of their outputs is higher, it indicates that the rewritten software retains the semantics of the original binary file under correct execution. In this embodiment, the correctness test experiment verifies that all allocations in the system can be executed normally and that these allocated memory addresses are real and effective by checking the memory addresses allocated after rewriting. Second, the effectiveness evaluation of the rewritten binary program: the effectiveness evaluation is based on real software or test sets, and typical CVEs are selected for effectiveness testing to compare and analyze the resilience of software rewriting defense methods against existing attacker models. Third, based on visual code difference comparison, the binary visualization method can convert the software binary code into another domain that can be visually represented (usually a two-dimensional space), and then use different colors to represent the binary code at different positions within the domain. Considering the increased difficulty in binary visualization annotation of the rewritten binary disassembly information, this embodiment achieves the annotation of the rewritten binary code by combining binary function recognition, that is, to achieve binary visualization. Fourth, the performance overhead of the rewritten software is evaluated. In this embodiment, testing is conducted using the SPEC test set. By inputting the test set, the performance overhead of the binary disassembled information before and after rewriting is compared. Further comparative analysis is performed on the rewriting overhead when loading the rewritten binary program, the rewriting latency, the rewriting overhead under active attacks, the degree of runtime memory saving, the overall system performance evaluation, and the estimated system-wide memory savings to analyze the software's defensive performance.

[0101] like Figure 3 As shown, the specific steps in applying the solution in this embodiment include:

[0102] The first stage involves analyzing and training the identification model. The trained model can then identify the semantic information and function boundary information of binary files.

[0103] The first step is to compile the binary file of the training source code and record the intermediate compilation process data.

[0104] The second step involves inputting the information obtained in the previous step into the model for training, resulting in an embedded representation (feature vector). Simultaneously, the feature vector is used as input for downstream tasks to train the model's ability to analyze and recognize functional boundaries and semantic information.

[0105] The second stage involves model reasoning and binary rewriting.

[0106] The third step involves disassembling the binary files that need to be rewritten based on analysis to obtain intermediate representation data.

[0107] The fourth step is to input the intermediate representation data into the trained analysis and recognition model to obtain the function boundary information and semantic information in the binary file.

[0108] The fifth step involves selecting a matching rewriting method to rewrite part or all of the content in the binary file, using the function boundary information and semantic information in the binary file as a reference.

[0109] The sixth step is to conduct a multi-dimensional evaluation of the rewritten binary file to determine whether it can support the safe and stable operation of the software.

[0110] like Figure 4 As shown, another embodiment of the present invention also provides a software security defense device 100, comprising:

[0111] The first acquisition module is used to disassemble the target software and obtain binary disassembly information;

[0112] The identification module is used to analyze and identify the binary disassembled information to determine the corresponding semantic information and function body boundaries;

[0113] The first determining module is used to determine the target code in the binary disassembly information based on the semantic information and function body boundaries;

[0114] A rewrite module is used to perform binary rewrite processing on the target code;

[0115] The correction module is used to correct the rewritten code and obtain the rewritten binary program.

[0116] The evaluation module is used to perform multi-dimensional evaluation of the rewritten binary program;

[0117] The second determining module is used to determine, at least, the feasibility and security defense performance of the rewritten binary program based on the multi-dimensional evaluation results.

[0118] In some embodiments, the apparatus further includes:

[0119] The construction module is used to build an analysis and recognition model, which is used to analyze and recognize the binary disassembled information to determine the corresponding semantic information and function body boundaries.

[0120] The analysis and identification of the binary program content to determine the corresponding semantic information and function body boundaries includes:

[0121] The binary program content is analyzed and identified based on the analysis and recognition model to determine the corresponding semantic information and function body boundaries.

[0122] In some embodiments, the construction of the analysis and identification model includes:

[0123] Build the initial model;

[0124] Construct a training dataset, which consists of open-source known program source code and compiled data compiled by a known compiler from the known program source code;

[0125] The initial model is trained based on the dataset so that it learns the compilation process of the program source code, and is used to disassemble or decompile binary disassembly information, and to analyze and identify the semantic information and function body boundaries corresponding to the binary program content based on the disassembly or decompilation results.

[0126] In some embodiments, the initial model is composed of a BERT model;

[0127] The compilation data includes binary files obtained by compiling known program source code, data during the compilation process, semantics of marked binary statements, and function boundary information;

[0128] The initial model is trained using the dataset in two phases. The first phase involves learning the embeddings of semantic and function boundary information in binary data using cloze tests and context prediction. The second phase involves predicting the semantic and function boundaries of binary data based on the embedded information.

[0129] In some embodiments, performing binary rewriting on the target code includes:

[0130] The target code is subjected to binary rewriting processing by at least one of the following methods: heuristic-based software rewriting method, randomized software rewriting method, and program semantic rewriting method.

[0131] In some embodiments, the apparatus further includes:

[0132] The analysis module is used to analyze the target code based on prior knowledge to determine the data characteristics of the target code. The prior knowledge is related to the attack type and the corresponding data characteristics of the attacked data.

[0133] The selection module is used to determine, based on the data characteristics, a method for performing binary rewriting on the target code from the heuristic software rewriting method, the randomized software rewriting method, and the program semantic rewriting software rewriting method.

[0134] In some embodiments, the multi-dimensional evaluation of the rewritten binary program includes:

[0135] The correctness of the binary disassembled information and the rewritten binary program is evaluated by using fuzz testing.

[0136] The effectiveness of the binary disassembled information and the rewritten binary program was evaluated using the CVE test method.

[0137] The binary disassembled information and the rewritten binary program are converted into fields of visual representation based on the binary visualization method. The binary data in each field are marked with different colors based on the binary function recognition method. The code differences between the binary disassembled information and the rewritten binary program are evaluated based on the marking results.

[0138] The binary disassembled information and the rewritten binary program are tested based on the SPEC test set. The performance overhead and defense performance during program execution are compared based on the test results to evaluate the security defense performance of the rewritten binary program. The performance overhead and defense performance include at least the rewriting overhead during software loading, the rewriting overhead under active attack, the degree of memory saving during software execution, the performance evaluation of the software system, and the overall memory saving of the software system.

[0139] Another embodiment of the present invention provides an electronic device, the electronic device including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps in the software security defense method as described in any of the above embodiments.

[0140] Another embodiment of the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the software security defense method as described in any of the above embodiments.

[0141] It should be noted that the computer storage medium of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. Computer-readable media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections with one or more wires, portable computer disks, hard disks, random access storage media (RAM), read-only storage media (ROM), erasable programmable read-only storage media (EPROM or flash memory), optical fibers, portable compact disk read-only storage media (CD-ROM), optical storage media, magnetic storage media, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program configured for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, antenna, optical fiber, RF, etc., or any suitable combination thereof.

[0142] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of protection of this application is limited to these examples; within the framework of this application, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of one or more embodiments of this application as described above, which are not provided in detail for the sake of brevity.

[0143] One or more embodiments in this application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of this application. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of one or more embodiments in this application should be included within the protection scope of this application.

Claims

1. A software security defense method based on binary rewriting, characterized by, The method comprises the following steps: disassembling target software to obtain binary disassembly information; analyzing and identifying the binary disassembly information to determine corresponding semantic information and function body boundaries; determining target code in the binary disassembly information based on the semantic information and the function body boundaries; performing binary rewriting processing on the target code; correcting the rewritten code to obtain a rewritten binary program; performing multi-dimensional evaluation on the rewritten binary program; based on the multi-dimensional evaluation results, determining at least the implementability and security defense performance of the rewritten binary program; The method further comprises the following steps: constructing an analysis and identification model, which is used to analyze and identify the binary disassembly information to determine the corresponding semantic information and function body boundaries; The construction of the analysis and identification model comprises the following steps: constructing an initial model; constructing a training data set composed of open source known program source code and known compiler compilation data of the known program source code; training the initial model based on the data set to enable the initial model to learn the compilation process of the program source code for disassembling or decompiling the binary program, and to analyze and identify the semantic information and function body boundaries corresponding to the content of the binary program according to the disassembly or decompilation results; The initial model is composed of a BERT model; The compilation data includes binary files obtained by compiling known program source code, data in the compilation process, semantic information of labeled binary statements, and function boundary information; The training of the initial model based on the data set comprises two training stages, the first training stage is to learn the embedding of semantic information and function boundary information in the binary in the form of fill-in-the-blank and next-sentence prediction, and the second training stage is to predict the semantic information and function boundaries of the binary data based on the embedded information.

2. The binary-rewriting-based software security defense method of claim 1, wherein, The binary rewriting processing on the target code comprises the following steps: performing binary rewriting processing on the target code based on any one of the heuristic software rewriting method, the randomized software rewriting method, and the program semantic rewriting software rewriting method.

3. The binary-rewriting-based software security defense method of claim 2, wherein, The method further comprises the following steps: analyzing the target code based on prior knowledge to determine the data characteristics of the target code, wherein the prior knowledge is related to the attack type and the data characteristics of the corresponding attacked data; determining the method for performing binary rewriting processing on the target code from the heuristic software rewriting method, the randomized software rewriting method, and the program semantic rewriting software rewriting method based on the data characteristics.

4. The binary-rewriting-based software security defense method of claim 1, wherein, The multi-dimensional evaluation of the rewritten binary program comprises the following steps: performing correctness evaluation on the binary disassembly information and the rewritten binary program by a fuzz testing method; performing effectiveness evaluation on the binary disassembly information and the rewritten binary program by a CVE testing method; The binary visualization method is used to convert the binary disassembly information and the rewritten binary program into visualized domains, and a binary function recognition method is used to mark the binary data in each domain with different colors, so as to evaluate the code difference between the binary disassembly information and the rewritten binary program based on the marking result; The binary disassembly information and the rewritten binary program are tested based on a SPEC test set, and the performance overhead and defense performance of the programs during the test are compared, so as to evaluate the security defense performance of the rewritten binary program, wherein the performance overhead and defense performance at least include the rewriting overhead during software loading, the re-rewriting overhead under active attack, the memory saving degree during software running, the performance evaluation of the software system, and the overall memory saving degree of the software system.

5. A software security defense apparatus based on binary rewriting, characterized by, The method comprises the following steps: A first obtaining module is configured to disassemble a target software to obtain binary disassembly information; An identification module is configured to analyze and identify the binary disassembly information to determine corresponding semantic information and function body boundaries; A first determining module is configured to determine target code in the binary disassembly information based on the semantic information and the function body boundaries; A rewriting module is configured to perform binary rewriting processing on the target code; A correction module is configured to correct the rewritten code to obtain a rewritten binary program; An evaluation module is configured to perform multi-dimensional evaluation on the rewritten binary program; A second determining module is configured to determine at least the implementability and security defense performance of the rewritten binary program based on the multi-dimensional evaluation result. The device further comprises: An analysis and identification model is configured to analyze and identify the binary disassembly information to determine the corresponding semantic information and function body boundaries; The construction process of the analysis and identification model comprises: Constructing an initial model; Constructing a training data set composed of open source known program source code and compilation data of the known program source code compiled by a known compiler; Training the initial model based on the data set, so that the initial model learns the compilation process of the program source code to disassemble or decompile the binary program, and analyzes and identifies the semantic information and function body boundaries corresponding to the content of the binary program based on the disassembly or decompilation result; The initial model is composed of a BERT model; The compilation data includes binary files obtained by compiling the known program source code, data in the compilation process, semantic information of labeled binary statements, and function boundary information; The training of the initial model based on the data set comprises two training stages, the first training stage is to learn the embedding of the semantic information and function boundary information in the binary in the way of fill-in-the-blank and next-sentence prediction, and the second training stage is to predict the semantic information and function boundary of the binary data based on the embedded information.

6. An electronic device, comprising: The electronic device comprises a memory and a processor, the memory stores a computer program, and the processor implements the steps in the software security defense method based on binary rewriting in any one of claims 1-4 when executing the computer program.

7. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the processor implements the steps in the software security defense method based on binary rewriting in any one of claims 1-4 when executing the computer program.

Images