A binary program vulnerability detection method

Abstract

The present invention provides a binary program vulnerability detection method, which relates to the technical field of vulnerability detection. The method comprises: training a twin neural network model through a sample set to form a binary program code similarity calculation model; extracting features of newly added vulnerability program codes and performing vectorized representation, locating similarity comparison binary program code fragments in the binary program code to be detected, using the binary program code similarity calculation model to perform similarity calculation, and judging whether there are vulnerabilities in the binary program code to be detected; the present invention can improve the accuracy of vulnerability detection in binary program codes and reduce the overall operating overhead of the method.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability detection, and in particular to a binary program vulnerability detection method. Background Art

[0002] To improve development efficiency and shorten development cycles, developers often adopt code reuse strategies, leveraging existing code bases to quickly implement module functionality. However, while this reuse approach offers convenience, it also inadvertently spreads potential security vulnerabilities across more programs, increasing security risks. This is particularly true in the connected car (IoV) sector. With the increasing adoption of connected devices, IoV programs based on MIPS or ARM architectures are proliferating. During cross-architecture code reuse, even if a vulnerability has been fixed on one architecture (such as Intel x86), the version of the same source code on another architecture (such as ARM) may not have received sufficient attention, leaving security risks. However, most commercial software code is not publicly available. Some free, closed-source software and firmware programs are often released in binary form. These binary programs can also contain vulnerabilities due to code reuse, making vulnerability detection crucial to ensure system security and stability.

[0003] Based on this, this paper proposes a method for binary program vulnerability detection. Summary of the Invention

[0004] To address the above issues, the present invention proposes a binary program vulnerability detection method, which specifically includes the following steps:

[0005] S1. Construct the first training sample set;

[0006] S2. Extract features from each sample in the first training sample set and perform vectorization on each feature to form a second training sample set;

[0007] S3. Using the second training sample set to train the twin neural network model to form a binary program code similarity calculation model;

[0008] S4. Obtain the binary program code corresponding to the newly added vulnerability program code, extract features from the binary program code, and vectorize each feature;

[0009] S5. Positioning similarity comparison binary program code fragments in the binary program code to be detected;

[0010] S6. Calculate the similarity between the binary code and the similarity comparison binary program code snippet corresponding to the newly added vulnerability program using a binary program code similarity calculation model;

[0011] S7. Determine whether the binary program code to be detected has a vulnerability based on the result of the similarity calculation.

[0012] Furthermore, the step S1 specifically includes the following steps:

[0013] S11. Obtain multiple program codes {K1, K2, ..., K i ,…,K m}, get multiple program codes {C1, C2, ..., C j ,…,C n};

[0014] Among them, K i is the i-th program code obtained from the open source program code library; m is the total number of program codes obtained from the open source program code library; C j is the jth program code obtained from the CVE vulnerability program code library; n is the total number of program codes obtained from the CVE vulnerability program code library;

[0015] S12. For {C1, C2, ..., C j ,…,C n Each program code C in j , in {K1, K2, ..., K i ,…,K m} to find the j The same program code K i , respectively, the program code C j and K i The same compilation method is used for binary encoding to form two binary program codes, which are combined as positive samples; program code C j and K i Different compilation methods are used for binary encoding to form program code C j Corresponding multiple binary program codes, and program code K i The corresponding multiple binary program codes are respectively j Corresponding multiple binary program codes and program code K i The corresponding multiple binary program codes are combined in pairs to form multiple positive samples;

[0016] S13. For {C1, C2, ..., C j ,…,C n Each program code C in j , in {K1, K2, ..., K i ,…,K m} to find the jDifferent program code K h , respectively, the program code C j and K h The same compilation method is used for binary encoding to form two binary program codes, which are combined as negative samples; the program codes C and j and K h Different compilation methods are used for binary encoding to form program code C j Corresponding multiple binary program codes, and program code K h The corresponding multiple binary program codes are respectively j Corresponding multiple binary program codes and program code K h The corresponding multiple binary program codes are combined in pairs to form multiple negative samples;

[0017] Where 1≤h≤m;

[0018] S14. The multiple positive samples formed in step S12 and the multiple negative samples formed in step S14 are combined into a first training sample set.

[0019] Furthermore, the step S2 specifically includes the following steps:

[0020] S21. For each sample in the first training sample set, obtain two binary program codes in the sample, disassemble the two binary program codes to form two disassembled program codes;

[0021] S22 extracts instructions and functions from two disassembled program codes respectively;

[0022] S23. For each instruction in the disassembled program code, the instruction is input into the skip-thoughts model to obtain contextual semantic features for the instruction;

[0023] For each function in the disassembled program code, the function is input into the graph autoencoder to obtain the global semantic structure feature of the function;

[0024] Combining the contextual semantic features corresponding to all instructions and the global semantic structural features corresponding to all functions in each disassembled program code to form features corresponding to the disassembled program code;

[0025] S24. Vectorize the features corresponding to each disassembled program code to represent the features as the feature vector corresponding to the disassembled program code;

[0026] S25. For each sample in the first training sample set, execute steps S21 to S24 to obtain the feature vector corresponding to each binary program code in each sample to form a second training sample set.

[0027] Furthermore, the step S4 specifically includes the following steps:

[0028] S41 obtains new vulnerability program code, compiles the new vulnerability program code to form a binary program code; disassembles the binary program code to form a disassembled program code;

[0029] S42 extracts instructions and functions from the disassembled program code in step S41;

[0030] S43. For the instruction in the program code after disassembly in step S42, the instruction is input into the skip-thoughts model to obtain the contextual semantic features of the instruction;

[0031] For the function in the program code disassembled in step S42, the function is input into the graph autoencoder to obtain the global semantic structure feature of the function;

[0032] Combining the contextual semantic features corresponding to all instructions in the disassembled program code and the global semantic structural features corresponding to all functions to form features corresponding to the disassembled program code;

[0033] S44. Perform vectorized representation on the features corresponding to the program code disassembled in step S43 as the feature vector corresponding to the program code disassembled.

[0034] Furthermore, the step S5 specifically includes the following steps:

[0035] S501. The binary program code to be detected is disassembled to form a disassembled program code;

[0036] S502. Obtain the code length L of the binary program code formed after the newly compiled vulnerability program code;

[0037] S503. Initialize the window length equal to the code length L, starting from the position W of the binary program code to be detected p To position W q A binary program code fragment for obtaining the window length;

[0038] Among them, W p The initial value of is the starting position of the binary program code to be detected; position W p To position W qThe code length of the binary program code is L;

[0039] S504. Get the location of the binary program code to be detected W p To position W q Corresponding to the disassembled program code fragment, extracting instructions and functions in the disassembled program code fragment;

[0040] S505. Determine whether the function extracted in step S504 contains the function extracted in step S42. If so, execute step S506; if not, execute step S507;

[0041] S506. Obtain the number A of instructions identical to those extracted in step S504 and those extracted in step S42, obtain the number B of functions identical to those extracted in step S04 and those extracted in step S42, and calculate the code overlap R based on the number A and the number B.

[0042] Where, R = γ1*A+γ2*B;

[0043] Where γ1 and γ2 are the first weight value and the second weight value respectively; and γ2>γ1; R is the position W p To position W q The code overlap between the binary program code and the binary code compiled with the newly added vulnerability program code;

[0044] Execute step S508;

[0045] S507. Set position W p To position W q The code overlap R between the binary program code and the binary program code compiled with the newly added vulnerability program code is 0;

[0046] And, set Determine the position W q Is it greater than the end position of the binary program code to be detected? If not, return to step S503; if greater, execute step S508;

[0047] S508. Obtain the code overlap R′ corresponding to each binary program code segment, R′={R1,R2…R d};

[0048] Wherein, d is the number of binary program code segments into which the binary program code to be detected is divided according to the length L; R d is the code overlap degree corresponding to the d-th binary program code fragment;

[0049] The maximum value of the code overlap in R′ is obtained, and the binary program code segment corresponding to the maximum value is obtained as the similarity comparison binary program code segment located in the binary program code to be detected.

[0050] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above description and other purposes, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are specifically cited and described in detail as follows. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present invention. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0052] Figure 1 The flowchart of a binary program vulnerability detection method. DETAILED DESCRIPTION

[0053] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0054] In the description of the present invention, unless otherwise expressly specified or limited, terms such as "mounted," "connected," "connect," and "fixed" should be understood in a broad sense. For example, they may refer to connection, detachable connection, or integration; mechanical connection or electrical connection; direct connection or indirect connection through an intermediate medium; and internal communication between two components or interaction between two components. Those skilled in the art will understand the specific meanings of the above terms in the present invention based on specific circumstances.

[0055] The present invention proposes a binary program vulnerability detection method. Figure 1 The method is shown to include the following steps:

[0056] S1. Construct the first training sample set;

[0057] S2. Extract features from each sample in the first training sample set and perform vectorization on each feature to form a second training sample set;

[0058] S3. Using the second training sample set to train the twin neural network model to form a binary program code similarity calculation model;

[0059] S4. Obtain the binary program code corresponding to the newly added vulnerability program code, extract features from the binary program code, and vectorize each feature;

[0060] S5. Positioning similarity comparison binary program code fragments in the binary program code to be detected;

[0061] S6. Calculate the similarity between the binary code and the similarity comparison binary program code snippet corresponding to the newly added vulnerability program using a binary program code similarity calculation model;

[0062] S7. Determine whether the binary program code to be detected has a vulnerability based on the result of the similarity calculation.

[0063] Furthermore, the step S1 specifically includes the following steps:

[0064] S11. Obtain multiple program codes {K1, K2, ..., K i ,…,K m}, get multiple program codes {C1, C2, ..., C j ,…,C n};

[0065] Among them, K i is the i-th program code obtained from the open source program code library; m is the total number of program codes obtained from the open source program code library; C j is the jth program code obtained from the CVE vulnerability program code library; n is the total number of program codes obtained from the CVE vulnerability program code library;

[0066] Where 1≤i≤m; 1≤j≤n;

[0067] S12. For {C1, C2, ..., C j ,…,C n Each program code C in j , in {K1, K2, ..., K i ,…,K m} to find the j The same program code K i , respectively, the program code C j and K i The same compilation method is used for binary encoding to form two binary program codes, which are combined as positive samples; program code Cj and K i Different compilation methods are used for binary encoding to form program code C j Corresponding multiple binary program codes, and program code K i The corresponding multiple binary program codes are respectively j Corresponding multiple binary program codes and program code K i The corresponding multiple binary program codes are combined in pairs to form multiple positive samples;

[0068] S13. For {C1, C2, ..., C j ,…,C n Each program code C in j , in {K1, K2, ..., K i ,…,K m} to find the j Different program code K h , respectively, the program code C j and K h The same compilation method is used for binary encoding to form two binary program codes, which are combined as negative samples; the program codes C and j and K h Different compilation methods are used for binary encoding to form program code C j Corresponding multiple binary program codes, and program code K h The corresponding multiple binary program codes are respectively j Corresponding multiple binary program codes and program code K h The corresponding multiple binary program codes are combined in pairs to form multiple negative samples;

[0069] Where 1≤h≤m;

[0070] S14. The multiple positive samples formed in step S12 and the multiple negative samples formed in step S14 are combined into a first training sample set.

[0071] Furthermore, the step S2 specifically includes the following steps:

[0072] S21. For each sample in the first training sample set, obtain two binary program codes in the sample, disassemble the two binary program codes to form two disassembled program codes;

[0073] S22 extracts instructions and functions from two disassembled program codes respectively;

[0074] S23. For each instruction in the disassembled program code, the instruction is input into the skip-thoughts model to obtain contextual semantic features for the instruction;

[0075] For each function in the disassembled program code, the function is input into the graph autoencoder to obtain the global semantic structure feature of the function;

[0076] Combining the contextual semantic features corresponding to all instructions and the global semantic structural features corresponding to all functions in each disassembled program code to form features corresponding to the disassembled program code;

[0077] S24. Vectorize the features corresponding to each disassembled program code to represent the features as the feature vector corresponding to the disassembled program code;

[0078] S25. For each sample in the first training sample set, execute steps S21 to S24 to obtain the feature vector corresponding to each binary program code in each sample to form a second training sample set.

[0079] Furthermore, the step S4 specifically includes the following steps:

[0080] S41 obtains new vulnerability program code, compiles the new vulnerability program code to form a binary program code; disassembles the binary program code to form a disassembled program code;

[0081] The compilation method for compiling the newly added vulnerability program code may be a randomly selected compilation method.

[0082] S42 extracts instructions and functions from the disassembled program code in step S41;

[0083] S43. For the instruction in the program code after disassembly in step S42, the instruction is input into the skip-thoughts model to obtain the contextual semantic features of the instruction;

[0084] For the function in the program code disassembled in step S42, the function is input into the graph autoencoder to obtain the global semantic structure feature of the function;

[0085] Among them, the graph autoencoder is Graph Autoencoder.

[0086] Combining the contextual semantic features corresponding to all instructions in the disassembled program code and the global semantic structural features corresponding to all functions to form features corresponding to the disassembled program code;

[0087] S44. Perform vectorized representation on the features corresponding to the program code disassembled in step S43 as the feature vector corresponding to the program code disassembled.

[0088] Furthermore, the step S5 specifically includes the following steps:

[0089] S501. The binary program code to be detected is disassembled to form a disassembled program code;

[0090] S502. Obtain the code length L of the binary program code formed after the newly compiled vulnerability program code;

[0091] S503. Initialize the window length equal to the code length L, starting from the position W of the binary program code to be detected p To position W q A binary program code fragment for obtaining the window length;

[0092] Among them, W p The initial value of is the starting position of the binary program code to be detected; position W p To position W q The code length of the binary program code is L;

[0093] S504. Get the location of the binary program code to be detected W p To position W q Corresponding to the disassembled program code fragment, extracting instructions and functions in the disassembled program code fragment;

[0094] S505. Determine whether the function extracted in step S504 contains the function extracted in step S42. If so, execute step S506; if not, execute step S507;

[0095] S506. Obtain the number A of instructions identical to those extracted in step S504 and those extracted in step S42, obtain the number B of functions identical to those extracted in step S04 and those extracted in step S42, and calculate the code overlap R based on the number A and the number B.

[0096] Where, R = γ1*A+γ2*B;

[0097] Where γ1 and γ2 are the first weight value and the second weight value respectively; and γ2>γ1; R is the position W p To position W q The code overlap between the binary program code and the binary code compiled with the newly added vulnerability program code;

[0098] Execute step S508;

[0099] S507. Set position W p To position W q The code overlap R between the binary program code of the newly compiled vulnerability program code and the binary program code of the newly compiled vulnerability program code is 0; and, set Determine the position W q Is it greater than the end position of the binary program code to be detected? If not, return to step S503; if greater, execute step S508;

[0100] S508. Obtain the code overlap R′ corresponding to each binary program code segment, R′={R1,R2…R d}; where d is the number of binary program code segments into which the binary program code to be detected is divided according to the length L; R d is the code overlap degree corresponding to the d-th binary program code fragment;

[0101] The maximum value of the code overlap in R′ is obtained, and the binary program code segment corresponding to the maximum value is obtained as the similarity comparison binary program code segment located in the binary program code to be detected.

[0102] Furthermore, the step S6 specifically includes the following steps:

[0103] S61. Disassemble the similarity comparison binary program code fragment located in the binary program code to be detected to form a disassembled program code;

[0104] S62 extracts instructions and functions from the disassembled program code in step S61;

[0105] S63. For the instruction in the program code disassembled in step S62, the instruction is input into the skip-thoughts model to obtain the contextual semantic features of the instruction;

[0106] For the function in the program code disassembled in step S62, the function is input into the graph autoencoder to obtain the global semantic structure feature of the function;

[0107] Combining the contextual semantic features corresponding to all instructions and the global semantic structural features corresponding to all functions in the program code disassembled in step S63 to form features corresponding to the disassembled program code;

[0108] S64. Vectorize the features corresponding to the disassembled program code in step S63 as the feature vector corresponding to the disassembled program code;

[0109] S65. Input the feature vector corresponding to the disassembled program code of the newly added vulnerability program code obtained in step S44 and the feature vector corresponding to the disassembled program code obtained in step S64 into the binary program code similarity calculation model to obtain a similarity value.

[0110] Furthermore, the step S7 specifically includes the following steps:

[0111] When the similarity value calculated in step S65 is greater than the preset value and greater than the preset threshold F, it is determined that the binary program code to be detected has a vulnerability; otherwise, the binary program code does not have a vulnerability;

[0112] The preset threshold F is 60%, 80% or 90%.

[0113] The beneficial effects of the invention are as follows:

[0114] 1. The present invention uses instruction granularity and function structure to express the characteristics of binary program code, thereby improving the accuracy of binary program code similarity calculation;

[0115] 2. In the present invention, when selecting the first training sample, binary programs generated by different compilation methods are used to form positive and negative samples, thereby improving the accuracy of the training of the binary program code similarity calculation model;

[0116] 3. This invention locates the code fragment most relevant to the newly-added vulnerability code within the binary program code to be tested, thus avoiding the inaccurate similarity value caused by calculating the similarity of the entire binary program code to be tested, and reducing the computational overhead caused by calculating the similarity of each fragment after segmenting the binary program code to be tested.

[0117] 4. The present invention adopts a window-based progressive comparison method and an instruction and function overlap calculation method to locate the code fragment most relevant to the newly added vulnerability program code in the binary program code to be detected, thereby improving the accuracy of positioning and reducing the overall computational overhead of the method.

[0118] The foregoing description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications or substitutions that can be readily conceived by a person skilled in the art within the technical scope disclosed herein are intended to be encompassed within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A binary program vulnerability detection method, characterized in that: The method specifically comprises the following steps: S1. Constructing the first training sample set; S2. Extract features from each sample in the first training sample set, and vectorize each feature to form a second training sample set; S3. Using the second training sample set to train the twin neural network model to form a binary program code similarity calculation model; S4. Obtain the binary program code corresponding to the newly added vulnerability program code, extract features from the binary program code, and vectorize each feature; S5. Locate similarity comparison binary program code fragments in the binary program code to be detected; S6. Calculate the similarity between the binary code corresponding to the newly added vulnerability program and the similarity comparison binary program code fragment using a binary program code similarity calculation model; S7. Determine whether the binary program code to be detected has a vulnerability based on the result of the similarity calculation; Wherein, step S4 specifically includes the following steps: S41 obtains the newly added vulnerability program code, compiles the newly added vulnerability program code to form a binary program code; disassembles the binary program code to form a disassembled program code; S42 extracts instructions and functions from the program code disassembled in step S41; S43. For the instruction in the program code after decompilation in step S42, the instruction is input into the skip-thoughts model to obtain the contextual semantic features for the instruction; For the function in the program code disassembled in step S42, the function is input into the graph autoencoder to obtain the global semantic structure feature for the function; Combining contextual semantic features corresponding to all instructions in the disassembled program code and global semantic structural features corresponding to all functions to form features corresponding to the disassembled program code; S44. Vectorizing the features corresponding to the program code after disassembly in step S43 as the feature vector corresponding to the program code after disassembly; Step S5 specifically includes the following steps: S501. Disassemble the binary program code to be detected to form a disassembled program code; S502. Obtain the code length of the binary program code formed after compiling the newly added vulnerability program code ; S503. Initialize the window length to be equal to the code length , from the location of the binary program code to be detected To location A binary program code snippet for obtaining the window length; in, The initial value of is the starting position of the binary program code to be detected; To location The code length of the binary program code is L; S504. Obtain the location of the binary program code to be detected To location Corresponding to the disassembled program code fragment, extracting instructions and functions in the disassembled program code fragment; S505. Determine whether the function extracted in step S504 contains the function extracted in step S42. If so, execute step S506; if not, execute step S507; S506. Obtain the number A of the same instructions between the instructions extracted in step S504 and the instructions extracted in step S42, obtain the number B of the same functions between the functions extracted in step S504 and the functions extracted in step S42, and calculate the code overlap R based on the number A and the number B; in, ; in, , are the first weight value and the second weight value respectively; and, ; R is the position To location The code overlap between the binary program code of the newly created vulnerability program code and the binary program code compiled after the newly created vulnerability program code is compiled; Execute step S508; S507. Set location To location The code overlap R between the binary program code and the binary program code compiled with the newly added vulnerability program code is 0; And, set , ; Determine the location Is it greater than the end position of the binary program code to be detected? If not, return to step S503; if greater, execute step S508; S508. Obtaining the code overlap corresponding to each binary program code fragment , { }; Wherein, d is the number of binary program code fragments into which the binary program code to be detected is divided according to the length L; is the code overlap degree corresponding to the d-th binary program code fragment; Get The maximum value of the code overlap degree in the binary program code is obtained, and the binary program code fragment corresponding to the maximum value is obtained as the similarity comparison binary program code fragment located in the binary program code to be detected.

2. A binary program vulnerability detection method according to claim 1, characterized in that: Step S1 specifically includes the following steps: S11. Obtain multiple program codes from the open source program code library ,… , …, }, Get multiple program codes from the CVE vulnerability program code library { … , …, }; in, is the i-th program code obtained from the open source program code library; m is the total number of program codes obtained from the open source program code library; is the jth program code obtained from the CVE vulnerability program code library; n is the total number of program codes obtained from the CVE vulnerability program code library; S12. For { … , …, Each program code in} ,exist{ ,… , …, } to find the Same program code , respectively, the program code and The same compilation method is used for binary encoding to form two binary program codes, and the two binary program codes are combined as positive samples; the program codes are respectively and Use different compilation methods to perform binary encoding to form program code Corresponding multiple binary program codes, and program codes Corresponding to multiple binary program codes, the program codes are Corresponding multiple binary program codes and program codes The corresponding multiple binary program codes are combined in pairs to form multiple positive samples; S13. For { … , …, Each program code in} ,exist{ ,… , …, } to find the Different program code , respectively, the program code and The same compilation method is used for binary encoding to form two binary program codes, which are combined as negative samples; the program codes are respectively and Use different compilation methods to perform binary encoding to form program code Corresponding multiple binary program codes, and program codes Corresponding to multiple binary program codes, the program codes are Corresponding multiple binary program codes and program codes The corresponding multiple binary program codes are combined in pairs to form multiple negative samples; in ; S14. The multiple positive samples formed in step S12 and the multiple negative samples formed in step S13 are combined into a first training sample set.

3. A binary program vulnerability detection method according to claim 2, characterized in that: Step S2 specifically includes the following steps: S21. For each sample in the first training sample set, obtain two binary program codes in the sample, disassemble the two binary program codes to form two disassembled program codes; S22. Extract instructions and functions from two disassembled program codes respectively; S23. For each instruction in the disassembled program code, input the instruction into the skip-thoughts model to obtain contextual semantic features for the instruction; For each function in the disassembled program code, the function is input into the graph autoencoder to obtain the global semantic structure feature of the function; Combining the contextual semantic features corresponding to all instructions and the global semantic structural features corresponding to all functions in each disassembled program code to form features corresponding to the disassembled program code; S24. Vectorizing the features corresponding to each disassembled program code as the feature vector corresponding to the disassembled program code; S25. For each sample in the first training sample set, execute steps S21 to S24 to obtain the feature vector corresponding to each binary program code in each sample to form a second training sample set.

4. A binary program vulnerability detection method according to claim 3, characterized in that: Step S6 specifically includes the following steps: S61. Disassemble the similarity comparison binary program code fragment located in the binary program code to be detected to form a disassembled program code; S62. Extracting instructions and functions from the program code disassembled in step S61; S63. For the instruction in the program code after decompilation in step S62, the instruction is input into the skip-thoughts model to obtain the contextual semantic features for the instruction; For the function in the program code disassembled in step S62, the function is input into the graph autoencoder to obtain the global semantic structure feature for the function; Combining the contextual semantic features corresponding to all instructions and the global semantic structural features corresponding to all functions in the program code disassembled in step S63 to form features corresponding to the program code disassembled; S64. Vectorizing the features corresponding to the program code after disassembly in step S63 as the feature vector corresponding to the program code after disassembly; S65. Input the feature vector corresponding to the disassembled program code of the newly added vulnerability program code obtained in step S44 and the feature vector corresponding to the disassembled program code obtained in step S64 into the binary program code similarity calculation model to obtain a similarity value.

5. A binary program vulnerability detection method according to claim 4, characterized in that: Step S7 specifically includes the following steps: When the similarity value calculated in step S65 is greater than the preset value and greater than the preset threshold F, it is determined that the binary program code to be detected has a vulnerability; otherwise, the binary program code does not have a vulnerability; The preset threshold F is 60%, 80% or 90%.

Images