Cross-architecture binary code similarity detection method, system, device and medium

Abstract

The present invention provides a method, system, device and medium for similarity detection of cross-architecture binary codes, and relates to the field of information security technology. The present invention obtains two binary code files to be detected; disassembles the two binary code files to extract the corresponding binary code function information; inputs the binary code function information into a pre-trained multimodal cross-architecture binary code similarity detection model based on a twin network architecture, and outputs a similarity detection result. The present invention generates semantic embedding vectors under different architectures based on the K‑BERT deep learning model; uses the GGNN model to extract the structural embedding vector; and after fusion processing by the MLP multi-layer perceptron, performs similarity measurement in the twin network to obtain a similarity detection result. The present invention effectively solves the limitations of the prior art, realizes the unified expression of cross-architecture features through the effective fusion of multimodal information, and significantly improves the accuracy and robustness of binary code similarity detection.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method, system, device and medium for detecting similarity of cross-architecture binary codes. Background Art

[0002] Binary code similarity detection technology compares two or more binary code fragments to find their similarities. It can be evaluated based on multiple dimensions such as code structure, syntax, semantics or behavior. As an important technical means in the field of computer security and reverse engineering, binary code similarity detection involves in-depth analysis of compiled executable programs to extract high-level information such as code functions, structural features and their similarities. This technology has a wide range of applications in vulnerability detection, malware analysis, software clone detection, software protection and reverse engineering.

[0003] However, there are many challenges in determining the similarity of binary codes. First, compared with source code, binary code is more difficult to understand and analyze due to its lack of readability. Second, the compilation process causes a large amount of program semantic information (such as function names, variable names, and data structures) to be lost, which greatly weakens the semantic information of the binary code. In addition, the choice of different compilers, changes in compiler optimization options, and optimization strategies for different operating systems and CPU architectures may all lead to significant changes in the structure and behavior of the generated binary code.

[0004] Traditional binary code similarity detection methods usually rely on static or dynamic analysis techniques of specific architectures, and have significant limitations when dealing with code comparisons between multiple architectures. Existing multi-architecture binary code similarity detection methods mainly include feature extraction-based and graph matching-based methods. However, these methods have the following shortcomings when dealing with complex binary codes:

[0005] (1) Difficulty in cross-architecture feature representation. Existing methods find it difficult to uniformly represent binary code features across different architectures, which limits the accuracy of cross-architecture similarity detection.

[0006] (2) Inadequate handling of control flow structure changes. Similarity detection based on control flow graphs (CFGs) has poor recognition effect when faced with structural changes caused by code obfuscation techniques and compiler optimization.

[0007] (3) Serious information loss. A large amount of semantic information is lost during the compilation process. Especially in the absence of debugging information, existing methods are difficult to accurately analyze binary code.

[0008] (4) Cross-platform analysis is difficult. The binary codes generated by different architectures and compilers vary significantly in structure and behavior, and the performance of existing technologies in cross-platform scenarios is not satisfactory.

[0009] (5) Challenges of obfuscation technology. Code obfuscation technology significantly increases the complexity of analysis. Existing static analysis methods have difficulty identifying similar binary files that have been obfuscated.

[0010] In view of this, the applicant filed this application after studying the existing technology. Summary of the invention

[0011] The present invention aims to provide a method, system and medium for similarity detection of cross-architecture binary codes to solve at least one of the above problems.

[0012] In order to solve the above technical problems, the present invention is implemented through the following technical solutions:

[0013] A similarity detection method for cross-architecture binary codes, comprising:

[0014] S1, obtain two binary code files to be tested;

[0015] S2, disassembling the two binary code files to extract corresponding binary code function information; wherein the binary code function information includes control flow graph and instruction set information;

[0016] S3, inputting the binary code function information of the two binary code files into a pre-trained multimodal cross-architecture binary code similarity detection model based on a twin network architecture; wherein the multimodal cross-architecture binary code similarity detection model based on a twin network architecture is composed of two sub-networks with exactly the same parameters and structures;

[0017] The sub-network includes K-BERT model, GGNN gated graph neural network and Multilayer Perceptron;

[0018] The K-BERT model is based on the BERT model and integrates embedding prior knowledge to extract features from the instruction set information of the input binary code file and generate a unified and semantically rich semantic embedding vector under different architectures;

[0019] The GGNN gated graph neural network includes multiple gated graph neural network modules, which are used to extract the control flow graph of the input binary code file to obtain a structural embedding vector that can reflect the code structure and dependency relationship;

[0020] Said The multi-layer perceptron is used to fuse the semantic embedding vector and the structural embedding vector of each binary code file to obtain the corresponding semantic structural fusion embedding vector;

[0021] S4, by calculating the similarity of the semantic structure fusion embedding vectors output by the two sub-networks, the similarity detection result is obtained.

[0022] Preferably, the multimodal cross-architecture binary code similarity detection model based on the twin network architecture adopts the Siamese Network twin network, and the specific steps are:

[0023] The binary code function information of the two binary code files is respectively passed through the sub-network to obtain the corresponding semantic structure fusion embedding vector;

[0024] Calculate the cosine similarity between the two semantic structure fusion embedding vectors to obtain the similarity score;

[0025] If the similarity score exceeds a set threshold, it is determined that the two binary code files are similar.

[0026] Preferably, the instruction set information includes assembly token, instruction type, operand type, operand read / write and flag register status.

[0027] Preferably, the K-BERT model includes an embedding module, a backbone module and a task head module; wherein,

[0028] The embedding module is used to explicitly inject token knowledge, including assembly instruction embedding vectors, explicit knowledge embedding vectors and position encoding embedding vectors;

[0029] The backbone module is a multi-layer Transformer encoder, which generates a context embedding vector through a multi-layer bidirectional Transformer encoder;

[0030] The task head module includes a masked language model task and a knowledge fusion task, which are used to fine-tune and optimize the K-BERT model; wherein, the masked language model task is used to train and optimize the masked tag prediction, and the model is optimized by randomly selecting part of the tags of the input vector for masking and maximizing the true tags and output predicted tags; at the same time, the knowledge fusion task is used to replace the traditional NSP task, and the K-BERT model is trained and optimized for the following prediction, and the model is optimized by minimizing the loss function between the true value and the predicted value, so as to improve the model's ability to understand instruction boundaries and implicit constraints between instructions.

[0031] Preferably, the specific steps of the K-BERT model for feature extraction are:

[0032] Preprocessing and word embedding conversion are performed on the input instruction set information to obtain the assembly instruction embedding vector;

[0033] Aligning the vocabulary constructed based on ISA with the text sequence after word embedding to obtain the explicit knowledge embedding vector;

[0034] The position encoding embedding vector is a position embedding vector of a BERT model;

[0035] Adding the assembly instruction embedding vector, the explicit knowledge embedding vector and the positional encoding embedding vector to obtain a final output embedding vector of the embedding module;

[0036] The final output embedding vector is taken as input and a context embedding vector is generated through a multi-layer bidirectional Transformer encoder to obtain a semantic embedding vector.

[0037] Preferably, the specific steps of extracting the control flow graph by the GGNN gated graph neural network are:

[0038] Step 1: Define N nodes in the control flow graph. The initial feature vector of each node i is ,Will Concatenate with a vector to get the initial feature representation vector ; The dimension of the concatenated vector is consistent with the number of output channels;

[0039] Step 2: For each node i in the control flow graph, aggregate and calculate the feature vectors of all its neighboring nodes j , get the message vector of node i ,Right now:

[0040] ;

[0041] Among them, N(i) represents the set of neighbor nodes j of node i, represents the vector dimension, is the feature vector of all neighbor nodes j of node i, represents the edge weight between node i and its neighbor node j, represents the product;

[0042] Step 3: Transform the message vector and the current node feature vector Input the GRU gated loop module for update to obtain the updated feature vector , the updated feature vector contains both the information of the current node and the information of the neighboring nodes, that is:

[0043] =GRU( , );

[0044] Step 4: Execute steps 2 and 3 in each layer of the gated graph neural network module of the GGNN gated graph neural network, and gradually update the feature vectors of the nodes of the control flow graph so that the nodes better reflect the graph structure and their positions in the graph;

[0045] Step 5: After linear processing and global pooling, the updated control flow graph is output as the structural embedding vector.

[0046] Preferably, the The expression of fusion processing by multi-layer perceptron is:

[0047] ;

[0048] in, represents the semantic structure fusion embedding vector after multi-layer perceptron fusion processing, represents the semantic embedding vector, Represents the structure embedding vector; Represents a multilayer perceptron.

[0049] The present invention also provides a cross-architecture binary code similarity detection system, comprising:

[0050] An acquisition unit, used for acquiring two binary code files to be detected;

[0051] A disassembly unit, used for disassembling two binary code files to extract corresponding binary code function information; wherein the binary code function information includes control flow graph and instruction set information;

[0052] A similarity detection unit, used for inputting binary code function information of two binary code files into a pre-trained multimodal cross-architecture binary code similarity detection model based on a twin network architecture; wherein the multimodal cross-architecture binary code similarity detection model based on a twin network architecture is composed of two sub-networks with exactly the same parameters and structures;

[0053] The sub-network includes K-BERT model, GGNN gated graph neural network and Multilayer Perceptron;

[0054] The K-BERT model is based on the BERT model and integrates embedding prior knowledge to extract features from the instruction set information of the input binary code file and generate a unified and semantically rich semantic embedding vector under different architectures;

[0055] The GGNN gated graph neural network includes multiple gated graph neural network modules, which are used to extract the control flow graph of the input binary code file to obtain a structural embedding vector that can reflect the code structure and dependency relationship;

[0056] Said The multi-layer perceptron is used to fuse the semantic embedding vector and the structural embedding vector of each binary code file to obtain the corresponding semantic structural fusion embedding vector;

[0057] The output unit is used to obtain the similarity detection result by calculating the similarity of the semantic structure fusion embedding vectors output by the two sub-networks.

[0058] The present invention also provides a cross-architecture binary code similarity detection device, including a processor and a memory, wherein the memory stores a computer program, and the computer program can be executed by the processor to implement a cross-architecture binary code similarity detection method as described above.

[0059] The present invention also provides a computer-readable storage medium, on which computer-readable instructions are stored. When the computer-readable instructions are executed by a processor of a device where the computer-readable storage medium is located, the cross-architecture binary code similarity detection method as described above is implemented.

[0060] In summary, compared with the prior art, the present invention has the following beneficial effects:

[0061] The present invention obtains a similarity detection result by disassembling the binary code file to be detected and inputting it into a multimodal cross-architecture binary code similarity detection model based on a twin network architecture. During the similarity detection process, the present invention integrates the ISA instruction set information of different architectures and the control flow graph CFG structure information, and based on the BERT deep learning model and combined with the prior knowledge in the assembly language, generates a unified and semantically rich semantic embedding vector under different architectures. Subsequently, a GGNN model with multiple gated graph neural network modules is used to process the CFG, and a structural embedding vector reflecting the code structure and dependency relationship is extracted; the semantic embedding vector and the structural embedding vector are fused and processed by a multi-layer perceptron MLP, and finally a similarity measurement is performed based on the twin network architecture to obtain a similarity detection result of the binary code.

[0062] The method of the present invention not only overcomes the shortcomings of the prior art in feature representation and structural information utilization, effectively solves the limitations of the prior art, but also realizes the unified expression of cross-architecture features through the effective fusion of multimodal information such as instruction set information, and significantly improves the accuracy and robustness of binary code similarity detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0064] Figure 1 A schematic diagram of a multimodal cross-architecture binary code similarity detection method based on a twin network architecture provided in Example 1 of the present invention.

[0065] Figure 2 This is a structural diagram of the multimodal cross-architecture binary code similarity detection method based on the twin network architecture provided in Example 1 of the present invention.

[0066] Figure 3 This is a structural diagram of the K-BERT model provided in Example 1 of the present invention.

[0067] Figure 4 This is a structural diagram of the masked language model MLM provided in the first embodiment of the present invention.

[0068] Figure 5 This is a structural diagram of the knowledge fusion KF task provided in Example 1 of the present invention.

[0069] Figure 6 This is a structural diagram of the gated graph neural network module provided in Example 1 of the present invention.

[0070] Figure 7 This is a structural diagram of the GGNN model provided in Example 1 of the present invention.

[0071] Figure 8 This is a structural diagram of the twin architecture provided in Example 1 of the present invention.

[0072] Fig. 9 A structural diagram of a multimodal cross-architecture binary code similarity detection system based on a twin network architecture provided in Example 2 of the present invention.

[0073] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. DETAILED DESCRIPTION

[0074] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the invention claimed for protection, but merely represents the selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0075] Embodiment 1

[0076] Embodiment 1 of the present invention provides a method for similarity detection of cross-architecture binary codes, which can be implemented by a similarity detection device for cross-architecture binary codes (hereinafter referred to as the similarity detection device), and in particular, executed by one or more processors in the similarity detection device.

[0077] In this embodiment, the similarity detection device may be an electronic device equipped with a processor, the processor having a computer program of the cross-architecture binary code similarity detection method and the computer program can be executed, such as a computer, a smart phone, a smart tablet, a workstation, etc., which is not limited here.

[0078] like Figure 1-Figure 2 As shown, a method for detecting similarity of cross-architecture binary codes includes steps S1 to S4.

[0079] S1, obtain two binary code files to be tested;

[0080] S2, disassemble the two binary code files and extract the corresponding binary code function information; wherein the binary code function information includes control flow graph and instruction set information.

[0081] Specifically, the instruction set information includes assembly token, instruction type, operand type, operand reading and writing, and flag register status.

[0082] The overall structure is as follows Figure 2 As shown, the multimodal cross-architecture binary code similarity detection model (abbreviated as K-GNET model) disassembles the input binary code file and extracts the CFG, assembly token, instruction type, operand type, operand reading and writing, and flag register status of the binary code function.

[0083] S3, inputting the binary code function information of the two binary code files into a pre-trained multimodal cross-architecture binary code similarity detection model based on a twin network architecture; wherein the multimodal cross-architecture binary code similarity detection model based on a twin network architecture is composed of two sub-networks with exactly the same parameters and structures;

[0084] The sub-network includes K-BERT model, GGNN gated graph neural network and Multilayer Perceptron;

[0085] The K-BERT model is based on the BERT model and integrates embedding prior knowledge to extract features from the instruction set information of the input binary code file and generate a unified and semantically rich semantic embedding vector under different architectures;

[0086] The GGNN gated graph neural network includes multiple gated graph neural network modules, which are used to extract the control flow graph of the input binary code file to obtain a structural embedding vector that can reflect the code structure and dependency relationship;

[0087] Said The multi-layer perceptron is used to fuse the semantic embedding vector and the structural embedding vector of each binary code file to obtain the corresponding semantic structural fusion embedding vector.

[0088] S4, by calculating the similarity of the semantic structure fusion embedding vectors output by the two sub-networks, the similarity detection result is obtained.

[0089] In this embodiment, after the two binary code files are disassembled, the corresponding binary code function information is obtained, and then the binary code function information is input into a multimodal cross-architecture binary code similarity detection model based on the twin network architecture for similarity detection.

[0090] Furthermore, in the similarity detection process, the corresponding semantic structure fusion embedding vectors are first processed through the sub-networks respectively; then the cosine similarity between the two semantic structure fusion embedding vectors is calculated to obtain a similarity score; if the similarity score exceeds a set threshold, the two binary code files are determined to be similar.

[0091] The processing steps after inputting the binary code function information into the sub-network of the twin network architecture include A1-A3.

[0092] A1, input the instruction set information of the binary code file into the K-BERT model for feature extraction to obtain the corresponding semantic embedding vector; wherein, the K-BERT model is based on the BERT model and integrates the embedding prior knowledge to generate a unified and semantically rich semantic embedding vector under different architectures.

[0093] Based on the current challenges of binary code similarity detection, this paper proposes a solution based on the BERT model and combined with prior knowledge to integrate knowledge into the analysis process of binary codes, named K-BERT. Figure 3 As shown in the figure, the K-BERT method is based on the Transformer encoder architecture and adopts a modular design to achieve high scalability. The method mainly consists of three modules: embedding module, backbone module and task head module. The embedding module is responsible for explicitly injecting token knowledge, the backbone module is used to generate contextual embedding information, and the task head module is used to integrate implicit knowledge and fine-tune and optimize the model.

[0094] (1) Embedded module

[0095] The embedding module generates three types of input embedding vectors for the Transformer encoder, including assembly instruction embedding vectors, explicit knowledge embedding vectors, and positional encoding embedding vectors. The final output embedding vector is obtained by adding them together.

[0096] First, the assembly instruction embedding vector refers to the text sequence of instruction set information. We use common word segmentation methods to obtain token sequences and convert them into vectors, namely token embeddings. Secondly, the explicit knowledge embedding vector refers to the explicit knowledge contained in the instruction set information, such as opcode types and operand types. A vocabulary is built based on the definition of ISA prior knowledge (i.e. instruction set architecture); this knowledge is encoded into a sequence aligned with the assembly instruction embedding vector to calculate the explicit knowledge embedding vector. Finally, the position encoding embedding vector refers to the encoding of the position, using the position encoding method widely used in BERT. Since the Transformer itself does not have the ability to process the token position information in the sequence, position embedding is required to provide this information. Each position has a unique embedding vector, which is learned during the training process.

[0097] In another preferred embodiment, referring to the standardized processing flow, the input instruction set information is first preprocessed to alleviate the out-of-vocabulary (also known as unregistered vocabulary, OOV) problem. Specifically, a dedicated vocabulary is first constructed, and the instruction set information is converted into a tag sequence based on the vocabulary. In this process, specific tags (such as [CLS], [SEP]) are added to mark the start and end of the assembly function. In order to ensure the consistency of sequence length, sequences exceeding the maximum length will be truncated, and the insufficient part will be filled with [PAD]. For tags not defined in the vocabulary, [UNK] is used instead. The final generated token sequence is passed to a learnable embedding layer to generate an assembly instruction embedding vector.

[0098] In this embodiment, in order to enhance the representation ability of Transformer, multiple knowledge sequences are constructed based on ISA (instruction set architecture), and similar embedding operations are performed on these sequences. Specifically, we consider four explicit knowledge edges including: opcode type, operand type, operand read / write status, and FLAGS register status. Each sequence passes through the embedding layer to generate a corresponding knowledge embedding. For each type of knowledge, we construct the corresponding vocabulary respectively and add special tags such as [CLS], [SEP], [PAD], and [UNK]. Finally, the assembly instruction embedding vector, the explicit knowledge embedding vector, and the position encoding embedding vector are added to generate the final output embedding vector. These embeddings are contextually integrated through the Transformer hierarchical structure, thereby enhancing the model's ability to understand assembly code.

[0099] (2) Backbone module

[0100] The backbone module uses the Transformer model to integrate various embeddings and generate contextual embedding information. The Transformer model uses a self-attention mechanism to capture contextual information in the sequence, and the generated contextual embedding vectors are used for various downstream tasks.

[0101] In this embodiment, a multi-layer Transformer encoder is used as the backbone model. As a bidirectional language model based on the attention mechanism, Transformer performs well in knowledge transfer with its extensive training data and self-supervised learning capabilities. The backbone model receives the final output embedding vector as input and generates context embedding through a multi-layer bidirectional Transformer to obtain a semantic embedding vector. .

[0102] (3) Task Header Module

[0103] The task head module is responsible for constructing pre-training tasks. During the pre-training of the K-BERT model, a masked language model (MLM) task and a knowledge fusion (KF) task are included, which are further adapted to specific tasks through task-specific fine-tuning.

[0104] In this example, we use the Masked Language Model (MLM) task for pre-training and replace the traditional NSP (next sentence prediction) task with the Knowledge Fusion (KF) task. The KF task aims to enhance the BERT model’s understanding of instruction boundaries and implicit constraints between instructions.

[0105] like Figure 4As shown, the x86 architecture is used as an example. In the task head module, the masked language model (MLM) task is used, which is similar to the implementation in BERT. Specifically, the model randomly selects 10% (the proportion can be set according to the actual situation) of the tokens for mask prediction, and requires the model to predict these masked tokens based on the context, and optimizes the model by maximizing the information between the true token and the output predicted token.

[0106] like Figure 5 As shown in the figure, the x86 architecture is taken as an example. A knowledge fusion (KF) task is also introduced in the task head module to replace the traditional next sentence prediction (NSP) task. The KF task randomly selects 15% (this ratio can be set according to actual conditions) of the tokens for masking and predicts the following text to improve the model's ability to understand instruction boundaries and implicit constraints between instructions. This task objective optimizes the model by minimizing the loss function between the true value and the predicted value.

[0107] The K-BERT model is used to extract semantic information from binary code. It aims to generate an embedding representation that reflects the semantics of the code by capturing the contextual relationship of the code, thereby achieving consistent feature representation in a cross-architecture environment. The performance of the model is enhanced by integrating instruction set information (assembly tokens, instruction types, operand types, operand reading and writing, and flag register status, etc.) and its explicit knowledge. The integration of explicit knowledge can be seen as part of multimodal learning, which can reduce the incompleteness or ambiguity problems that may be caused by single-modal data. Through the optimization of the MLM task and the KF task, the K-BERT model enables the Transformer encoder to learn data from multiple perspectives (different masking strategies). Through this joint optimization of multiple perspectives, the K-BERT model can capture more information and generate embeddings with better representation capabilities. Since binary codes have significant semantic differences in different architectures, the K-BERT model can effectively extract and unify these semantic representations, laying the foundation for cross-architecture similarity detection.

[0108] A2, input the control flow graph of the binary code file into the GGNN gated graph neural network, and extract the structural embedding vector that reflects the code structure and dependency relationship; wherein, the GGNN gated graph neural network includes multiple gated graph neural network modules, and captures the complex dependency relationships and structural patterns in the code through a multi-layer message passing mechanism.

[0109] In this embodiment, a gated graph neural network (GGNN) is used to extract structural information from binary code, in particular, to process a control flow graph (CFG) to generate an embedded representation that reflects the structure and dependencies of the code. The control flow graph is an important representation of binary code, which describes the basic blocks in the program and the control flow relationships between them. Since the control flow graph of binary code often has complex global structures (such as control flow across function calls) and fine local dependencies (such as order and conditional jumps between basic blocks), extracting this information is crucial for accurately understanding and analyzing binary code.

[0110] like Figure 6 As shown in the figure, the GGNN model is implemented using the PyTorch Geometric library, and the message passing mechanism is implemented through GatedGraphConv in PyTorchGeometric. GatedGraphConv implements the GRU (Gated Recurrent Unit) mechanism for transmitting information in the graph structure.

[0111] like Figure 7 As shown in the figure, the GGNN model includes: an input layer, an embedding layer (used to capture the features and local structural information of nodes), multiple GGNN modules, a linear layer (used to perform linear transformations on node representations or graph representations), a global pooling layer (used to merge node representations into representations of the entire graph) and an output layer. GGNN captures the complex dependencies and structural patterns in the code by passing messages between nodes (i.e., basic blocks) in the control flow graph. Specifically, GGNN first represents each basic block as a node and represents the control flow relationship between basic blocks as edges in the graph. Then, GGNN gradually updates the embedding representation of each node through a multi-layer message passing mechanism, so that these embeddings contain not only the information of the node itself, but also the information of other nodes connected to it. This message passing process allows the model to capture global information (such as high-level patterns of function calls) and local information (such as direct control relationships between basic blocks) in the control flow graph.

[0112] The specific calculation process of GatedGraphConv is:

[0113] First, define that there are N nodes in the control flow graph, and the initial feature vector of each node i is ,Will Concatenate with a zero vector (depending on the dimension of the output vector, other non-zero vectors can also be selected for concatenation) to obtain the initial feature representation vector , to ensure that the dimension is consistent with the number of output channels,

[0114] Next, in the message passing phase, each node in the control flow graph collects information from its neighbor nodes. Specifically, each node i receives messages from all of its neighbor nodes j, and each message is the product of the neighbor node feature vector and the edge weight. All these messages from neighbors are aggregated (e.g., additive aggregation) to form the message vector of node i .

[0115] Then, the feature vector of node i is updated through a gated recurrent unit (GRU), which receives the aggregated message vector And the current feature vector of node i As input. The updated feature vector It only contains node i’s own information, and also incorporates the messages obtained from neighboring nodes.

[0116] This process is repeated in each layer of the GGNN module of the graph neural network, thereby gradually updating the feature representation of the nodes so that the nodes can better reflect the graph structure and their position in the graph.

[0117] In this embodiment, the specific calculation process expression of GatedGraphConv is as follows:

[0118] ;

[0119] ;

[0120] =GRU( , );

[0121] Among them, N(i) represents the set of neighbor nodes j of node i, represents the vector dimension, is the initial feature vector of node i; for Concatenate with a zero vector to get the initial feature representation vector ; is the feature vector of all neighbor nodes j of node i; is the feature vector of the current node; is the message vector of node i; is the updated feature vector, represents the edge weight between node i and its neighbor node j, Represents the product symbol, which represents the product of the neighbor node feature vector and the edge weight.

[0122] Finally, the updated control flow graph is linearly processed and globally pooled to output the structural embedding vector.

[0123] A3, fuse the semantic embedding vector and structural embedding vector of each binary code file to obtain the corresponding semantic structure fusion embedding vector.

[0124] Furthermore, the semantic structure fusion embedding vector is obtained by fusion processing through a multi-layer perceptron, and its expression is:

[0125] ;

[0126] in, represents the semantic structure fusion embedding vector after multi-layer perceptron fusion processing, represents the semantic embedding vector, Represents the structure embedding vector; Represents a multilayer perceptron.

[0127] Finally, the embedding vectors of the two code files are fused according to their semantic structures, and the similarity is measured in combination with the twin neural network architecture. The cosine similarity between the two semantic structure fused embedding vectors is calculated to quantify the similarity between the code files and obtain a similarity score.

[0128] In this embodiment, the Siamese Network twin neural network architecture is selected and optimized and trained through the loss function. Siamese Network is a twin neural network specially used to compare the similarity between two inputs. Figure 8 As shown, the Siamese Network consists of two sub-networks (also called twin networks, i.e., K-GNET models) that share weights. This means that the parameters of the two sub-networks are the same. Therefore, when two different inputs (in this embodiment, the semantic structure fusion embedding vectors of two binary code files) pass through the network, they are processed by the same network structure and parameters. The embedding vectors generated by K-BERT and GGNN are input into a multi-layer perceptron (MLP) for fusion processing to integrate semantic and structural information to obtain a semantic structure fusion embedding vector. This step ensures that the semantic structure fusion embedding vector contains both the semantic context of the code snippet and captures its structural features. Subsequently, the function information of the binary code file is input into the two sub-networks of the Siamese Network that share weights to obtain the similarity detection result.

[0129] In this embodiment, when similarity training is performed on Siamese Network, each pair of training samples has a label y, where Indicates that the functions of the two code files are similar. Indicates that the functions of the two code files are not similar. The goal of training is to enable the model to effectively identify similar and dissimilar samples based on these labels by optimizing the loss function.

[0130] In this embodiment, a contrast loss function is used for training optimization, and the model is trained by minimizing the distance between similar sample pairs and maximizing the distance between dissimilar sample pairs. During the training process, the model receives sample pairs and calculates the similarity, and adjusts the model parameters through the loss function, so that the Siamese Network can effectively distinguish similar and dissimilar code files in the embedding space.

[0131] Since the Siamese Network is specifically designed to deal with similarity measurement problems, it can effectively capture and measure the differences between feature representations, thereby providing a quantitative similarity score.

[0132] The shared weight design of Siamese Network has the following key advantages: (1) Consistency. Since the weights of the two sub-networks are shared, Siamese Network ensures that the processing of the two inputs is completely consistent. This feature ensures that when comparing two binary code files, the feature extraction process is fair and unbiased, and does not cause unnecessary deviations due to differences in network structure. (2) Reducing the number of parameters. The shared weight design significantly reduces the number of parameters in the network, which not only reduces the complexity of the model but also improves training efficiency. This is particularly important for application scenarios that need to process a large number of binary code fragments, because it can effectively reduce the consumption of computing resources.

[0133] The method of the present invention shows excellent accuracy and robustness in similarity detection of binary codes across architectures, ensuring efficient and accurate code snippet comparison in a multi-architecture environment. Through this innovative combination, SiameseNetwork provides an efficient and consistent method for binary code similarity detection, which is particularly suitable for accurate comparison of multi-architecture code snippets.

[0134] In summary, compared with the prior art, the present invention has the following beneficial effects:

[0135] (1) The present invention improves the accuracy of cross-architecture binary code similarity detection. The semantic information of binary code is extracted through the K-BERT model to achieve a unified semantic embedding representation between different architectures. This step effectively solves the problem of inconsistent code semantic representation under different architectures and significantly improves the accuracy of cross-architecture binary code similarity detection.

[0136] (2) The present invention enhances the ability to process complex code structures. By using the gated graph neural network (GGNN) to perform deep structural feature extraction on the control flow graph (CFG), the global and local structural information of the binary code is effectively captured. Through this step, the present invention shows stronger robustness in dealing with structural changes caused by code obfuscation and compilation optimization, while greatly improving the ability to process complex code structures.

[0137] (3) Accurately measure the similarity of binary code snippets. The present invention achieves accurate measurement of the similarity of binary code snippets by fusing the feature representations generated by K-BERT and GGNN through a multi-layer perceptron (MLP) and then passing it through a Siamese Network. The Siamese Network has the ability to accurately quantify code similarity by calculating the distance between fused features, thereby further improving the accuracy of similarity detection.

[0138] Embodiment 2

[0139] like Fig. 9 As shown, the second embodiment of the present invention further provides a cross-architecture binary code similarity detection system, including:

[0140] An acquisition unit, used for acquiring two binary code files to be detected;

[0141] A disassembly unit, used for disassembling two binary code files to extract corresponding binary code function information; wherein the binary code function information includes control flow graph and instruction set information;

[0142] A similarity detection unit, used for inputting binary code function information of two binary code files into a pre-trained multimodal cross-architecture binary code similarity detection model based on a twin network architecture, and outputting a similarity detection result; wherein the multimodal cross-architecture binary code similarity detection model based on a twin network architecture is composed of two sub-networks with completely identical parameters and structures;

[0143] The sub-network includes K-BERT model, GGNN gated graph neural network and Multilayer Perceptron;

[0144] The K-BERT model is based on the BERT model and integrates embedding prior knowledge to extract features from the instruction set information of the input binary code file and generate a unified and semantically rich semantic embedding vector under different architectures;

[0145] The GGNN gated graph neural network includes multiple gated graph neural network modules, which are used to extract the control flow graph of the input binary code file to obtain a structural embedding vector that can reflect the code structure and dependency relationship;

[0146] Said The multi-layer perceptron is used to fuse the semantic embedding vector and the structural embedding vector of each binary code file to obtain the corresponding semantic structural fusion embedding vector.

[0147] Embodiment 3

[0148] The third embodiment of the present invention also provides a cross-architecture binary code similarity detection device, which includes a memory and a processor, wherein the memory stores a computer program, and the computer program can be executed by the processor to implement the cross-architecture binary code similarity detection method as described above.

[0149] Embodiment 4

[0150] The fourth embodiment of the present invention further provides a computer-readable storage medium, on which computer-readable instructions are stored. When the computer-readable instructions are executed by a processor of a device where the computer-readable storage medium is located, the cross-architecture binary code similarity detection method as described above is implemented.

[0151] In several embodiments provided in the embodiments of the present invention, it should be understood that the disclosed apparatus and method can also be implemented in other ways. The apparatus and method embodiments described above are merely schematic. For example, the flowcharts in the accompanying drawings show the possible architecture, functions and operations of the apparatus, method and computer program product according to multiple embodiments of the present invention. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, program segment or a part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0152] In addition, the functional modules in the various embodiments of the present invention may be integrated together to form an independent part, or each module may exist independently, or two or more modules may be integrated to form an independent part.

[0153] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions to enable a computer device (which can be a personal computer, an electronic device, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code. It should be noted that in this article, the term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such process, method, article or device. Without more constraints, an element defined by the phrase "comprising a..." does not exclude the existence of other identical elements in the process, method, article or apparatus comprising the element.

[0154] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0155] It should be understood that the term "and / or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0156] The word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0157] The "first\second" mentioned in the embodiments is only to distinguish similar objects, and does not represent a specific order for the objects. It is understandable that the "first\second" can be interchanged with the specific order or sequence where permitted. It should be understood that the objects distinguished by "first\second" can be interchanged where appropriate, so that the embodiments described herein can be implemented in an order other than those illustrated or described herein.

[0158] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A similarity detection method for cross-architecture binary codes, characterized in that: include: S1, obtain two binary code files to be tested; S2, disassembling the two binary code files to extract corresponding binary code function information; wherein the binary code function information includes control flow graph and instruction set information; S3, inputting the binary code function information of the two binary code files into a pre-trained multimodal cross-architecture binary code similarity detection model based on a twin network architecture; wherein the multimodal cross-architecture binary code similarity detection model based on a twin network architecture is composed of two sub-networks with exactly the same parameters and structures; The sub-network includes K-BERT model, GGNN gated graph neural network and Multilayer Perceptron; The K-BERT model is based on the BERT model and integrates embedding prior knowledge to extract features from the instruction set information of the input binary code file and generate a unified and semantically rich semantic embedding vector under different architectures; The K-BERT model includes an embedding module, a backbone module and a task header module; wherein the embedding module is used to explicitly inject token knowledge, including assembly instruction embedding vectors, explicit knowledge embedding vectors and positional encoding embedding vectors; the backbone module is a multi-layer Transformer encoder, which generates a context embedding vector through a multi-layer bidirectional Transformer encoder; the task header module is used to fine-tune and optimize the K-BERT model; The specific steps of feature extraction by the K-BERT model are: Preprocessing and word embedding conversion are performed on the input instruction set information to obtain the assembly instruction embedding vector; Aligning the vocabulary constructed based on ISA with the text sequence after word embedding to obtain the explicit knowledge embedding vector; The position encoding embedding vector is a position embedding vector of a BERT model; Adding the assembly instruction embedding vector, the explicit knowledge embedding vector and the positional encoding embedding vector to obtain a final output embedding vector of the embedding module; The final output embedding vector is used as input to generate a context embedding vector through a multi-layer bidirectional Transformer encoder to obtain a semantic embedding vector. The GGNN gated graph neural network includes multiple gated graph neural network modules, which are used to extract the control flow graph of the input binary code file to obtain a structure embedding vector that can reflect the code structure and dependency relationship; wherein the specific steps of the GGNN gated graph neural network to extract the control flow graph are: Step 1: Define N nodes in the control flow graph. The initial feature vector of each node i is ,Will Concatenate with a zero vector to get the initial feature representation vector ; The dimension of the concatenated vector is consistent with the number of output channels; Step 2: For each node i in the control flow graph, aggregate and calculate the feature vectors of all its neighboring nodes j , get the message vector of node i ,Right now: ； Among them, N(i) represents the set of neighbor nodes j of node i, represents the vector dimension, is the feature vector of all neighbor nodes j of node i, represents the edge weight between node i and its neighbor node j, represents the product; Step 3: Transform the message vector and the current node characteristics Input the GRU gated loop module for update to obtain the updated feature vector , the updated feature vector contains both the information of the current node and the information of the neighboring nodes, that is: =GRU( , ); Step 4: Execute steps 2 and 3 in each layer of the gated graph neural network module of the GGNN gated graph neural network, and gradually update the feature vectors of the nodes of the control flow graph so that the nodes better reflect the graph structure and their positions in the graph; Step 5: After linear processing and global pooling, the updated control flow graph is output to obtain a structural embedding vector; Said The multi-layer perceptron is used to fuse the semantic embedding vector and the structural embedding vector of each binary code file to obtain the corresponding semantic structural fusion embedding vector; S4, by calculating the similarity of the semantic structure fusion embedding vectors output by the two sub-networks, the similarity detection result is obtained.

2. A cross-architecture binary code similarity detection method according to claim 1, characterized in that ,The multimodal cross-architecture binary code similarity detection model based on the twin network architecture adopts Siamese Network twin network, and the specific steps are: The binary code function information of the two binary code files is respectively passed through the sub-network to obtain the corresponding semantic structure fusion embedding vector; Calculate the cosine similarity between the two semantic structure fusion embedding vectors to obtain the similarity score; If the similarity score exceeds a set threshold, it is determined that the two binary code files are similar.

3. A cross-architecture binary code similarity detection method according to claim 1, characterized in that ,The instruction set information includes assembly token, instruction type, operand type, operand reading and writing and flag register status.

4. A method for detecting similarity of cross-architecture binary codes according to claim 3, characterized in that The task head module includes a masked language model task and a knowledge fusion task; wherein, the masked language model task is used to train and optimize the masked tag prediction, and the model is optimized by randomly selecting part of the tags of the input vector for masking and maximizing the true tag and the output predicted tag; at the same time, the knowledge fusion task is used to replace the traditional NSP task, and the K-BERT model is trained and optimized for the following prediction, and the model is optimized by minimizing the loss function between the true value and the predicted value, so as to improve the model's ability to understand the instruction boundaries and implicit constraints between instructions.

5. A cross-architecture binary code similarity detection method according to claim 1, characterized in that , said The expression of fusion processing by multi-layer perceptron is: ； in, represents the semantic structure fusion embedding vector after multi-layer perceptron fusion processing, represents the semantic embedding vector, Represents the structure embedding vector; Represents a multi-layer perceptron.

6. A similarity detection system for cross-architecture binary codes, characterized in that: include: An acquisition unit, used for acquiring two binary code files to be detected; A disassembly unit, used for disassembling two binary code files to extract corresponding binary code function information; wherein the binary code function information includes control flow graph and instruction set information; A similarity detection unit, used for inputting binary code function information of two binary code files into a pre-trained multimodal cross-architecture binary code similarity detection model based on a twin network architecture; wherein the multimodal cross-architecture binary code similarity detection model based on a twin network architecture is composed of two sub-networks with exactly the same parameters and structures; The sub-network includes K-BERT model, GGNN gated graph neural network and Multilayer Perceptron; The K-BERT model is based on the BERT model and integrates embedding prior knowledge, and is used to extract features from the instruction set information of the input binary code file to generate a unified and semantically rich semantic embedding vector under different architectures; the K-BERT model includes an embedding module, a backbone module and a task header module; wherein the embedding module is used to explicitly inject token knowledge, including an assembly instruction embedding vector, an explicit knowledge embedding vector and a positional encoding embedding vector; the backbone module is a multi-layer Transformer encoder, and a context embedding vector is generated through a multi-layer bidirectional Transformer encoder; the task header module is used to fine-tune and optimize the K-BERT model; The specific steps of feature extraction by the K-BERT model are: Preprocessing and word embedding conversion are performed on the input instruction set information to obtain the assembly instruction embedding vector; Aligning the vocabulary constructed based on ISA with the text sequence after word embedding to obtain the explicit knowledge embedding vector; The position encoding embedding vector is a position embedding vector of a BERT model; Adding the assembly instruction embedding vector, the explicit knowledge embedding vector and the positional encoding embedding vector to obtain a final output embedding vector of the embedding module; The final output embedding vector is used as input to generate a context embedding vector through a multi-layer bidirectional Transformer encoder to obtain a semantic embedding vector. The GGNN gated graph neural network includes multiple gated graph neural network modules, which are used to extract the control flow graph of the input binary code file to obtain a structure embedding vector that can reflect the code structure and dependency relationship; the specific steps of the GGNN gated graph neural network to extract the control flow graph are: Step 1: Define N nodes in the control flow graph. The initial feature vector of each node i is ,Will Concatenate with a zero vector to get the initial feature representation vector ; The dimension of the concatenated vector is consistent with the number of output channels; Step 2: For each node i in the control flow graph, aggregate and calculate the feature vectors of all its neighboring nodes j , get the message vector of node i ,Right now: ； Among them, N(i) represents the set of neighbor nodes j of node i, represents the vector dimension, is the feature vector of all neighbor nodes j of node i, represents the edge weight between node i and its neighbor node j, represents the product; Step 3: Transform the message vector and the current node characteristics Input the GRU gated loop module for update to obtain the updated feature vector , the updated feature vector contains both the information of the current node and the information of the neighboring nodes, that is: =GRU( , ); Step 4: Execute steps 2 and 3 in each layer of the gated graph neural network module of the GGNN gated graph neural network, and gradually update the feature vectors of the nodes of the control flow graph so that the nodes better reflect the graph structure and their positions in the graph; Step 5: After linear processing and global pooling, the updated control flow graph is output to obtain a structural embedding vector; Said The multi-layer perceptron is used to fuse the semantic embedding vector and the structural embedding vector of each binary code file to obtain the corresponding semantic structural fusion embedding vector; The output unit is used to obtain the similarity detection result by calculating the similarity of the semantic structure fusion embedding vectors output by the two sub-networks.

7. A cross-architecture binary code similarity detection device, characterized in that: It includes a processor and a memory, wherein the memory stores a computer program, and the computer program can be executed by the processor to implement a cross-architecture binary code similarity detection method as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor of a device where the computer-readable storage medium is located, a cross-architecture binary code similarity detection method as described in any one of claims 1 to 5 is implemented.

Images