Binary program similarity detection method and system based on wandering attention kernel

Abstract

The present invention provides a binary program similarity detection method and system based on an attention wandering kernel, and relates to the field of computer security technology. The method comprises: statically analyzing the binary program to be detected, and obtaining the ICFG of the binary program; using a pre-trained generative pre-trained transformation model GPT to generate a feature vector of each node in the ICFG; based on the generated node feature vector, constructing a feature matrix of the ICFG using an attention wandering graph kernel method; flattening the feature matrix; inputting the flattened feature matrix into a fully connected neural network to obtain the probability of program similarity. The present invention performs similarity detection on binary programs by combining a graph kernel and a neural network, which can not only effectively combine the structure and vertex attribute information of the graph, capture the graph structure information, but also realize efficient graph similarity measurement through matrix operations; and realizes improved detection efficiency while having a high detection accuracy rate.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a binary program similarity detection method and system for attention wandering kernels. Background Art

[0002] Binary code similarity detection refers to judging whether two binary files are similar by comparing the similarity of their features. It has a wide range of applications in the security field, such as malware detection and analysis, vulnerability detection and repair, intellectual property protection, patch matching and version tracking, etc.

[0003] There are many binary code similarity detection methods. In order to extract meaningful information from binary code, binary code is usually converted into a graph structure, such as an inter-procedural control flow graph (hereinafter referred to as "ICFG"). Then, a graph neural network algorithm is used to compare the similarities of two programs.

[0004] Chinese patent document CN113254934A discloses a binary code similarity detection method and system based on graph matching network. The method includes obtaining a pair of programs to be tested, disassembling the programs to be tested to obtain the inter-procedural control flow graph ICFG and its instructions; obtaining the initial feature embedding of the basic blocks in the inter-procedural control flow graph ICFG of the programs to be tested respectively; obtaining the final embedding h of the inter-procedural control flow graph ICFG of the program pair to be tested through a graph matching neural network. G1 and h G2 ; Calculate the final embedding h of the interprocedural control flow graph ICFG of the program pair under test in the vector space G1 and h G2 The similarity between them is taken as the similarity detection result of the program pair to be tested.

[0005] Chinese patent document CN116541273A discloses a binary code similarity detection method and system based on graph attention. The method obtains the attribute control flow graph of the binary code, inputs it into the pre-trained attention mechanism, and obtains the attention correlation coefficient between nodes; normalizes each attention correlation coefficient, and activates it using the LeakyReLU function to obtain the weight coefficient between nodes; and generates new node features based on the weight coefficient between nodes; thus judging the similarity of the binary code based on the new node features. The method adopts the idea of ​​attention to obtain the weight coefficient of each node's neighbor node to it, so as to obtain the information of the entire network from local information.

[0006] However, graph neural network algorithms usually apply some kind of permutation-invariant vertex representation of the readout graph structure to generate a representation of the entire graph, but this approach often ignores the interaction between vertices. As a result, the combination of graph structure and feature information is not transparent enough, resulting in the inability of existing similarity detection algorithms to effectively process large-scale binary programs, and they are inefficient and resource-intensive.

[0007] Chinese patent document CN116700781A proposes a binary code similarity detection method and system based on differentiable random walk kernel and neural network. The method includes obtaining a binary code pair to be detected, decompiling the binary code pair to be detected, and obtaining its control flow chart; extracting the structural features of the binary code flow chart to be detected by using a kernel function; encoding the structural features of the control flow chart of the binary code to be detected by a neural network, and obtaining the corresponding structural embedding and the structural information embedding and similarity of the control flow chart of the binary code pair as the similarity result of the binary code to be detected. Although this scheme proposes a method of extracting the structural information of the binary code control flow chart through a graph kernel and a neural network set method and then judging the similarity of the binary code to be detected, it can capture the control dependency hidden in the binary code to a certain extent. However, this scheme is based on the differentiable random walk kernel, which adopts a random walk strategy. It generates a certain number of subgraphs by random initialization and performs direct product with the original graph to capture structural features. The differentiable random walk kernel focuses on random walks on the control flow graph, encodes the extracted subgraph features through a neural network, and uses a specific metric to calculate the similarity of the graph. Moreover, this method cannot perceive and extract the semantic information of the nodes, so as to more comprehensively capture the complex semantic features in binary programs. Summary of the invention

[0008] The technical problem to be solved by the present invention is to provide a binary program similarity detection method and system based on the attention wandering kernel in view of the deficiencies in the prior art. By combining the graph kernel and the neural network to extract the structural information of the inter-procedural control flow graph (ICFG), the feature matrix of the graph is generated to realize the similarity detection of the binary program. This method can handle complex function structures, improve detection efficiency, and has a high detection accuracy.

[0009] In order to solve the above technical problems, the present invention adopts the following technical solutions:

[0010] In a first aspect, the present invention provides a binary program similarity detection method based on an attention wandering kernel, comprising the following steps:

[0011] S1. Perform static analysis on the binary program to be detected to obtain an inter-procedural control flow graph (ICFG) of the binary program. Usually, the ICFG includes multiple nodes and edges, each node represents a basic block in the binary program, and each edge represents a jump or function call between basic blocks.

[0012] S2. Generate a feature vector for each node in the ICFG using a pre-trained generative pre-trained transformation model (abbreviated as "GPT").

[0013] S3. Based on the feature vectors of the generated nodes, the feature matrix of ICFG is constructed using the attention wandering kernel method.

[0014] S4. Flatten the constructed feature matrix.

[0015] S5. Input the flattened feature matrix into a fully connected neural network, calculate the similarity score between the target binary program and the reference binary program, and determine the similarity.

[0016] Furthermore, step S2 specifically includes:

[0017] S201. Use assembly instructions as text description for each node (ie, basic block) in the ICFG, where the assembly instructions include an operation code and an operand.

[0018] Assuming that the node Contains instruction sequence ,instruction Expressed as , then the node The text description is:

[0019] ;

[0020] In the formula, Indicates the assembly instructions corresponding to the node, represents the opcode of the assembly instruction, Represents the operand of the assembly instruction, and n represents the number of assembly instructions in the node.

[0021] S202: Normalize the assembly instructions in the node, and normalize the operand values, memory addresses, registers, and non-system function names into corresponding universal identifiers.

[0022] S203: Input the text representation of each node into the pre-trained GPT model to generate a feature vector of the node.

[0023] Furthermore, in step S203, the text representation of each node is input into the pre-trained GPT model, and the process of generating the feature vector of the node is as follows:

[0024] (1) Input the text representation of the node into the tokenizer, which is used to convert the input assembly instruction string into a token ID sequence, that is, to generate the input sequence of the GPT model;

[0025] (2) Input the input sequence into the GPT model to generate feature representation of the sequence. The specific process is as follows:

[0026] The GPT model includes an embedding layer, a position encoder, and a multi-layer Transformer encoder;

[0027] First, the input sequence produced in step (1) is input into the embedding layer of the GPT model to be converted into an embedding representation;

[0028] Then, the position information of the input sequence is input into the position encoder of the GPT model to obtain the position code, and the position code is added to the embedded representation to obtain an embedded representation containing the position code, so as to retain the information of each position in the sequence;

[0029] Next, the embedded representation containing the positional encoding is input into the multi-layer Transformer encoder of the GPT model, and the output of each layer is used as the input of the next layer; the Transformer encoder contains two sublayers, namely: a multi-head self-attention mechanism and a feedforward neural network; the multi-head self-attention mechanism is used to calculate the attention weight of each position in the input sequence and generate a weighted representation and; the feedforward neural network consists of two linear transformations and a Activation function composition;

[0030] Finally, the feature representation of the input sequence is the output of the last layer of the GPT model, which is a representation matrix consisting of the hidden layer representation of each word;

[0031] (3) The feature matrix of the sequence output in step (2) is aggregated using the average pooling method, and the feature vector of each node is represented as a vector of fixed length, thus obtaining the feature vector of each node.

[0032] Specifically, the calculation process of step (1) of S203 is expressed as follows:

[0033] The node Text representation of Input into the word segmenter to generate the input sequence of the GPT model , It is expressed as follows:

[0034] ;

[0035] In the formula, It is a tokenizer function used to convert the input assembly instruction string into a Token ID sequence.

[0036] Specifically, step (2) of S203 inputs the sequence The process of inputting into the GPT model to generate the feature representation of the sequence is as follows:

[0037] The GPT model includes an embedding layer, a position encoder, and a multi-layer Transformer encoder. First, the input sequence Input to the embedding layer of the GPT model is converted into an embedded representation ,Right now:

[0038] ;

[0039] In the formula, Represents the embedding layer of the GPT model;

[0040] Then input the sequence The position information is input into the position encoder of the GPT model to obtain the position encoding and added to the embedding representation The embedding representation including position encoding is obtained in , used to retain the information of each position in the sequence, namely:

[0041] ;

[0042] In the formula, Represents the position encoder of the GPT model;

[0043] Next, the embedding representation containing the positional encoding Input to the multi-layer Transformer encoder of the GPT model, the output of each layer is used as the input of the next layer, and the hidden layer of each layer is represented as:

[0044] ;

[0045] In the formula, represents the number of layers of the multi-layer Transformer encoder, and , Indicates layer Transformer encoder, is the input sequence The embedding representation of It is The hidden layer representation of the layer;

[0046] The Transformer encoder consists of two sublayers: a multi-head self-attention mechanism and a feedforward neural network;

[0047] The multi-head self-attention mechanism is used to calculate the attention weight of each position in the input sequence and generate a weighted representation sum, namely:

[0048] ;

[0049] In the formula, , , denote query, key, and value matrices respectively, is the dimension of the key, Represents the core calculation process of the attention mechanism, represents the activation function, represents the transpose of the key matrix;

[0050] The feedforward neural network consists of two linear transformations and a The activation function consists of:

[0051] ;

[0052] In the formula, and represents the weight matrix in the linear transformation, and represents the corresponding bias vector, represents a feedforward neural network, ReLU activation function.

[0053] Last input sequence The feature representation is the output of the last layer of the GPT model, that is, the representation matrix composed of the hidden layer representation of each word. The input sequence The feature representation as follows:

[0054] ;

[0055] In the formula, Representation Node The corresponding input sequence The feature representation matrix of , each row represents the hidden vector of a word, and ,in is the length of the input sequence, is the dimension of the hidden layer vector, represents a real matrix with n rows and d columns, Represents the output feature representation of the last layer of the GPT model;

[0056] Specifically, step (3) of S203 uses the average pooling method to aggregate the feature matrix of the sequence, and represents the feature vector of each node as a vector of fixed length. The calculation formula is as follows:

[0057] ;

[0058] in, Representation Node Middle The hidden vector of each word, is the number of words in the node; The feature vector representing the node after aggregation.

[0059] Furthermore, in step S3, based on the generated node feature vector, the process of constructing the feature matrix of ICFG using the attention wandering kernel method is as follows:

[0060] (1) By calculating the similarity matrix of the input graph Process the vertex attributes;

[0061] (2) Input graph after processing vertex attributes Perform an attention-based walk on the input graph The feature matrix of .

[0062] Furthermore, the above step (1) calculates the similarity matrix for the input graph The vertex attributes are processed as follows:

[0063] The ICFG of the input binary program, that is, the input graph It is expressed as: ,in is a set of vertices, is the edge set;

[0064] The input graph have vertices, each with dimension attribute, then the vertex attribute set ;set up A collection of hidden graphs , among which, Hidden images have vertices, each vertex has dimension attributes, so the attribute matrix of each hidden graph is ;

[0065] According to the input diagram The vertex attributes and the attribute matrix of the hidden graph , calculate the similarity matrix :

[0066] ;

[0067] in, , Elements Represents a hidden graph No. vertices and the input graph No. Similarity of attributes of vertices;

[0068] Similarity Matrix Vectorization yields a vectorized vector ,Right now:

[0069] ;

[0070] In the formula, represents a vectorized vector, represents a vectorized function, The dimension is A real vector of ;

[0071] Furthermore, the above step (2) is performed on the input graph after processing the vertex attributes. Perform an attention-based walk on the input graph The characteristic matrix of ; the specific process is as follows:

[0072] The input graph and hidden graph Perform a direct product to form a new graph Direct Graph , direct graph The vertices of the input graph G and the hidden graph An ordered pair of vertices, two vertices and There is an edge between and In the input graph Adjacent and and Hide Image The calculation formula is as follows:

[0073] ;

[0074] ;

[0075] ;

[0076] In the formula, and Direct graph The point set and edge set of and Represents the input graph and hidden graph The vertex set of and Represents the input graph and hidden graph The edge set of ; and represents the vertices of the input graph G, and Represents a hidden graph The vertex of

[0077] Let direct graph The adjacency matrix of , the adjacency matrix of Power express The number of paths from one vertex to another in the step walk. The attention walk kernel introduces the attention matrix of the adjacency matrix , and calculate the power of the adjacency matrix to capture the similarity of the two graphs. The calculation formula is as follows:

[0078] ;

[0079] ;

[0080] In the formula, represents the element-wise product, Represents a direct graph The number of vertices, For all pairs of vertices To sum, Represents the adjacency matrix The power of ; attention weight matrix It will be adjusted during the training process to optimize the effect of the kernel. is the weight matrix of the fully connected layer; , Represents vectorized vectors No. and values, Represents a vectorized vector The transpose of represents the activation function;

[0081] Since the kernel function For different number of steps , different kernel values ​​can be obtained, so for each input graph , construct a feature matrix F, namely:

[0082]

[0083] Represents the input graph and hidden graph between The random walk kernel of .

[0084] Furthermore, the process of flattening the feature matrix in step S4 is as follows:

[0085] Flatten the feature matrix F into a vector, input the feature matrix into a fully connected layer, and output a vector of fixed dimension. Suppose the weight of the fully connected layer is , then the output vector The calculation formula is as follows:

[0086]

[0087] In the formula, is the weight matrix of the fully connected layer, is the bias vector, is the activation function.

[0088] Furthermore, the specific process of similarity judgment in step S5 is as follows:

[0089] S501, inputting the flattened feature matrices of the target binary program and the reference binary program into a fully connected neural network respectively;

[0090] S502, calculating feature vectors of two programs through a fully connected neural network;

[0091] S503, using a similarity measurement method to calculate a similarity score between two feature vectors;

[0092] S504: Determine the similarity between the target binary program and the reference binary program according to the similarity score.

[0093] Furthermore, the similarity measurement method in step S503 includes a cosine similarity method or a Euclidean distance method.

[0094] Furthermore, the binary program includes but is not limited to the following types: executable files, dynamic link libraries, and static link libraries.

[0095] Furthermore, the method also includes detecting the following contents according to the similarity score of S5: reuse relationship between binary programs, vulnerability analysis of binary programs, and family classification of malware.

[0096] In a second aspect, the present invention also provides a binary program similarity detection system based on an attention wandering kernel, which specifically includes: a data processing module, a semantic perception module, a structure perception module, and a similarity judgment module;

[0097] The data processing module is used to perform static analysis on the binary program to be detected and generate its corresponding ICFG;

[0098] A semantic perception module, used to generate a node feature vector of the ICFG and extract semantic information of the binary program;

[0099] The structure perception module is used to extract the structural information of ICFG by combining the attention wandering kernel and the neural network, and generate the feature matrix of the graph;

[0100] The similarity judgment module is used to calculate the similarity score between the target binary program and the reference binary program and judge the similarity between the two.

[0101] Beneficial effects of the present invention:

[0102] Compared with the prior art, the advantage of the present invention is that by combining the attention wandering kernel and the neural network to perform similarity detection on binary programs, it can not only effectively combine the structure of the graph and the vertex attribute information to capture the graph structure information, but also realize efficient graph similarity measurement through matrix operations, which is more efficient in calculation. Therefore, the method of the present invention can handle complex program structures, improve detection efficiency and have a high detection accuracy.

[0103] In the method provided by the present invention, the GPT model is used to perceive the semantic information of the node, and the feature vector of the node in the inter-procedural control flow graph (ICFG) is extracted by using the GPT model. By using GPT to perceive and extract the semantic information of the node, the complex semantic features in the binary program can be more comprehensively captured, and the accuracy of similarity detection can be enhanced.

[0104] In the method of the present invention, the attention wandering kernel method adopted introduces a weighted attention wandering strategy, so that the algorithm can focus on paths with greater influence when exploring the structure of the graph, thereby improving the accuracy and efficiency of detection.

[0105] The method of the present invention adds the attribute feature vector of the node when using the graph kernel, combines the semantic information and structural features of each node, and inputs it into the fully connected neural network after flattening through the feature matrix, thereby realizing similarity calculation. This method not only considers the topological structure of the graph, but also enriches the feature representation by adding the attribute feature vector of the node. This method can effectively combine the structure of the graph and the node attribute information, thereby improving the accuracy of the similarity measurement.

[0106] The present invention can be widely used in malware detection and analysis, vulnerability detection and repair, intellectual property protection, patch matching and version tracking of binary programs, and has broad application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0107] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0108] Figure 1 A schematic diagram of the basic flow of a binary program similarity detection method based on an attention wandering kernel provided in an embodiment of the present invention.

[0109] Figure 2 A structural block diagram of a binary program similarity detection system based on an attention wandering kernel provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0110] The invention is further described below in conjunction with the embodiments and drawings, but they are not intended to limit the scope of the invention.

[0111] Example 1

[0112] like Figure 1 As shown, this embodiment provides a binary program similarity detection method based on attention wandering kernel, comprising the following steps:

[0113] S1. Perform static analysis on the binary program to be detected to obtain the inter-procedural control flow graph ICFG of the binary program. The ICFG includes multiple nodes and edges, each node represents a basic block in the binary program, and each edge represents a jump or function call between basic blocks.

[0114] S2. Generate the feature vector of each node in the ICFG using the pre-trained generative pre-trained transformation model GPT. The specific process includes:

[0115] S201, use assembly instructions as text description for each node in the ICFG, the assembly instructions include an operation code and an operand, assuming that the node Contains instruction sequence ,instruction Expressed as , then the node The text description is:

[0116] ;

[0117] In the formula, Indicates the assembly instructions corresponding to the node, represents the opcode of the assembly instruction, Represents the operand of the assembly instruction, and n represents the number of assembly instructions in the node.

[0118] S202: Normalize the assembly instructions in the node, and normalize the operand values, memory addresses, registers, and non-system function names into corresponding universal identifiers.

[0119] S203: Input the text representation of each node into the pre-trained GPT model to generate a feature vector of the node. The specific process is as follows:

[0120] (1) The node Text representation of Input into the word segmenter to generate the input sequence of the GPT model , It is expressed as follows:

[0121] ;

[0122] In the formula, It is a tokenizer function used to convert the input assembly instruction string into a Token ID sequence.

[0123] (2) Input sequence Input into the GPT model to generate feature representation of the sequence. The specific process is as follows:

[0124] The GPT model includes an embedding layer, a position encoder, and a multi-layer Transformer encoder. First, the input sequence Input to the embedding layer of the GPT model is converted into an embedded representation ,Right now:

[0125] ;

[0126] In the formula, Represents the embedding layer of the GPT model.

[0127] Then, the input sequence The position information is input into the position encoder of the GPT model to obtain the position encoding and added to the embedding representation The embedding representation including position encoding is obtained in , used to retain the information of each position in the sequence, namely:

[0128] ;

[0129] In the formula, Represents the positional encoder of the GPT model.

[0130] Next, the embedding representation containing the positional encoding Input to the multi-layer Transformer encoder of the GPT model, the output of each layer is used as the input of the next layer, and the hidden layer of each layer is represented as:

[0131] ;

[0132] In the formula, represents the number of layers of the multi-layer Transformer encoder, and , Indicates layer Transformer encoder, is the input sequence The embedding representation of It is The hidden layer representation of the layer.

[0133] The Transformer encoder consists of two sublayers: a multi-head self-attention mechanism and a feedforward neural network;

[0134] The multi-head self-attention mechanism is used to calculate the attention weight of each position in the input sequence and generate a weighted representation sum, namely:

[0135] ;

[0136] In the formula, , , denote query, key, and value matrices respectively, is the dimension of the key, Represents the core calculation process of the attention mechanism, represents the activation function, Represents the transpose of the key matrix.

[0137] The feedforward neural network consists of two linear transformations and a The activation function consists of:

[0138] ;

[0139] In the formula, and represents the weight matrix in the linear transformation, and represents the corresponding bias vector, represents a feedforward neural network, Represents the ReLU activation function.

[0140] Finally, enter the sequence The feature representation is the output of the last layer of the GPT model, that is, the representation matrix composed of the hidden layer representation of each word. The input sequence The feature representation as follows:

[0141] ;

[0142] In the formula, Representation Node The corresponding input sequence The feature representation matrix of , each row represents the hidden vector of a word, and ,in is the length of the input sequence, is the dimension of the hidden layer vector, represents a real matrix with n rows and d columns, Represents the output feature representation of the last layer of the GPT model.

[0143] (3) The feature matrix of the sequence is aggregated using the average pooling method, and the feature vector of each node is represented as a vector of fixed length, that is:

[0144] ;

[0145] in, Representation Node Middle The hidden vector of each word, is the number of words in the node; The feature vector representing the node after aggregation.

[0146] S3. Based on the feature vectors of the generated nodes, the feature matrix of ICFG is constructed using the attention wandering kernel method. The specific process is as follows:

[0147] (1) By calculating the similarity matrix of the input graph The vertex attributes are processed as follows:

[0148] The ICFG of the input binary program, that is, the input graph It is expressed as: ,in is a set of vertices, is the edge set;

[0149] The input graph have vertices, each with dimension attribute, then the vertex attribute set ;set up A collection of hidden graphs , among which, Hidden images have vertices, each vertex has dimension attributes, so the attribute matrix of each hidden graph is ;

[0150] According to the input diagram The vertex attributes and the attribute matrix of the hidden graph , calculate the similarity matrix :

[0151] ;

[0152] in, , Elements Represents a hidden graph No. vertices and the input graph No. Similarity of attributes of vertices;

[0153] Similarity Matrix Vectorization yields a vectorized vector ,Right now:

[0154] ;

[0155] In the formula, represents a vectorized vector, represents a vectorized function, The dimension is A real vector of ;

[0156] (2) Input graph after processing vertex attributes Perform an attention-based walk on the input graph The characteristic matrix of is as follows:

[0157] The input graph and hidden graph Perform direct product to form a new graph Direct Graph , direct graph The vertices of the input graph G and the hidden graph An ordered pair of vertices, two vertices and There is an edge between and In the input graph Adjacent and and Hide Image The calculation formula is as follows:

[0158] ;

[0159] ;

[0160] ;

[0161] In the formula, and Direct graph The point set and edge set of and Represents the input graph and hidden graph The vertex set of and Represents the input graph and hidden graph The edge set of ; and represents the vertices of the input graph G, and Represents a hidden graph The vertex of

[0162] Let direct graph The adjacency matrix of , the adjacency matrix of Power express The number of paths from one vertex to another in the step walk. The attention walk kernel introduces the attention matrix of the adjacency matrix , and calculate the power of the adjacency matrix to capture the similarity of the two graphs. The calculation formula is as follows:

[0163] ;

[0164] ;

[0165] In the formula, represents the element-wise product, Represents a direct graph The number of vertices, For all pairs of vertices To sum, Represents the adjacency matrix The power of ; attention weight matrix It will be adjusted during the training process to optimize the effect of the kernel. is the weight matrix of the fully connected layer; , Represents vectorized vectors No. and values, Represents a vectorized vector The transpose of represents the activation function;

[0166] Since the kernel function For different number of steps , different kernel values ​​can be obtained, so for each input graph , construct a feature matrix F, namely:

[0167]

[0168] Represents the input graph and hidden graph between The random walk kernel of .

[0169] S4, flatten the constructed feature matrix. The specific process is as follows:

[0170] Flatten the feature matrix F into a vector, input the feature matrix into a fully connected layer, and output a vector of fixed dimension. Suppose the weight of the fully connected layer is , then the output vector The calculation formula is as follows:

[0171]

[0172] In the formula, is the weight matrix of the fully connected layer, is the bias vector, is the activation function.

[0173] S5. Input the flattened feature matrix into the fully connected neural network, calculate the similarity score between the target binary program and the reference binary program, and judge the similarity. The specific process is as follows:

[0174] S501, inputting the flattened feature matrices of the target binary program and the reference binary program into a fully connected neural network respectively.

[0175] S502. Calculate feature vectors of two programs through a fully connected neural network.

[0176] S503: Calculate the similarity score between the two feature vectors using a similarity measurement method; the similarity measurement method includes a cosine similarity method or a Euclidean distance method.

[0177] S504: Determine the similarity between the target binary program and the reference binary program according to the similarity score.

[0178] Example 2

[0179] like Figure 2As shown, this embodiment provides a binary program similarity detection system 100 based on attention wandering kernel, which specifically includes: a data processing module 101, a semantic perception module 102, a structure perception module 103, and a similarity judgment module 104.

[0180] The data processing module 101 is used to perform static analysis on the binary program to be detected and generate its corresponding ICFG.

[0181] The semantic perception module 102 is used to generate a node feature vector of the ICFG and extract the semantic information of the binary program.

[0182] The structure perception module 103 is used to extract the structural information of the ICFG by combining the attention wandering kernel and the neural network, and generate a feature matrix of the graph.

[0183] The similarity judgment module 104 is used to calculate the similarity score between the target binary program and the reference binary program, and judge the similarity between the two.

[0184] Based on the same inventive concept, this embodiment is a system embodiment corresponding to the above method embodiment, and can be implemented in conjunction with the above implementation. The relevant technical details mentioned in the above implementation are still valid in this implementation, and the repeated parts will not be repeated.

[0185] It can be understood by those skilled in the art that the embodiments of the present invention can be provided as methods, systems, computer program products or electronic devices. For example, an electronic device includes a microprocessor and a memory connected to each other, and the microprocessor is programmed or configured to perform the steps of the binary program similarity detection method based on the attention wandering kernel described in Example 1.

[0186] In summary, in the method provided by the present invention, by using the GPT model to extract feature vectors of nodes in the inter-procedural control flow graph (ICFG), and by using GPT to perceive and extract the semantic information of the nodes, it is possible to more comprehensively capture the complex semantic features in the binary program and enhance the accuracy of similarity detection. The adopted attention wandering kernel method introduces a weight-based attention wandering strategy, so that the algorithm can focus on paths with greater influence when exploring the structure of the graph, thereby improving the accuracy and efficiency of detection. When using the graph kernel, the attribute feature vector of the node is added, and the semantic information and structural features of each node are combined together, and the feature matrix is ​​flattened and input into the fully connected neural network to realize similarity calculation. This method not only takes into account the topological structure of the graph, but also enriches the feature representation by adding the attribute feature vector of the node. This method can effectively combine the structure of the graph and the node attribute information, thereby improving the accuracy of the similarity measurement.

[0187] The present invention extracts the structural information of the inter-procedural control flow graph (ICFG) by combining the graph kernel and the neural network, generates the feature matrix of the graph, and realizes the similarity detection of binary programs. This method can not only handle complex program structures, but also improve the detection efficiency and have a high detection accuracy.

[0188] The present invention can be widely used in similarity detection between binary programs (e.g., executable files, dynamic link libraries, static link libraries, etc.). The similarity score obtained by the method of the present invention detects the following contents: reuse relationship between binary programs, vulnerability analysis of binary programs, and family classification of malware. Therefore, it can be used for malware detection and analysis, vulnerability detection and repair, intellectual property protection, patch matching and version tracking, etc., and has broad application prospects.

[0189] Obviously, the above embodiments are only preferred examples of the present invention and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived therefrom are still within the protection scope of the present invention.

Claims

1. A binary program similarity detection method based on attention wandering kernel, characterized in that: The steps include: S1. Perform static analysis on the binary program to be detected to obtain the inter-procedural control flow graph ICFG of the binary program; S2, using a pre-trained generative pre-trained transformation model GPT to generate a feature vector for each node in the ICFG; S3. Based on the feature vectors of the generated nodes, the feature matrix of ICFG is constructed using the attention wandering kernel method; the details are as follows: (1) By calculating the similarity matrix of the input graph Process the vertex attributes; (2) Input graph after processing vertex attributes Perform an attention-based walk on the input graph The feature matrix of Specifically: The input graph and hidden graph Perform direct product to form a new graph Direct Graph , direct graph The vertices of the input graph G and the hidden graph An ordered pair of vertices, two vertices and There is an edge between and In the input graph Adjacent and and Hide Image Middle adjacent; Let direct graph The adjacency matrix of , the adjacency matrix of Power express The number of paths from one vertex to another in the step walk. The attention walk kernel introduces the attention matrix of the adjacency matrix , and calculate the power of the adjacency matrix to capture the similarity of the two graphs; Since the kernel function For different number of steps , different kernel values ​​can be obtained, so for each input graph , construct a feature matrix F; S4, flattening the constructed feature matrix; S5. Input the flattened feature matrix into a fully connected neural network, calculate the similarity score between the target binary program and the reference binary program, and determine the similarity.

2. The binary program similarity detection method based on attention wandering kernel according to claim 1 is characterized in that: Step S2 specifically includes: S201, using an assembly instruction as a text description for each node in the ICFG, wherein the assembly instruction includes an operation code and an operand; S202, normalizing the assembly instructions in the node, normalizing the operand values, memory addresses, registers, and non-system function names into corresponding universal identifiers; S203: Input the text representation of each node into the pre-trained GPT model to generate a feature vector of the node.

3. The binary program similarity detection method based on attention wandering kernel according to claim 2 is characterized in that: Step S203: The text representation of each node is input into the pre-trained GPT model, and the process of generating the feature vector of the node is as follows: (1) Input the text representation of the node into the tokenizer, which is used to convert the input assembly instruction string into a TokenID sequence, that is, to generate the input sequence of the GPT model; (2) Input the input sequence into the GPT model to generate feature representation of the sequence. The specific process is as follows: The GPT model includes an embedding layer, a position encoder, and a multi-layer Transformer encoder; First, the input sequence produced in step (1) is input into the embedding layer of the GPT model to be converted into an embedding representation; Then, the position information of the input sequence is input into the position encoder of the GPT model to obtain the position code, and the position code is added to the embedded representation to obtain an embedded representation containing the position code, so as to retain the information of each position in the sequence; Next, the embedded representation containing the positional encoding is input into the multi-layer Transformer encoder of the GPT model, and the output of each layer is used as the input of the next layer; the Transformer encoder contains two sublayers, namely: a multi-head self-attention mechanism and a feedforward neural network; the multi-head self-attention mechanism is used to calculate the attention weight of each position in the input sequence and generate a weighted representation and; the feedforward neural network consists of two linear transformations and a Activation function composition; Finally, the feature representation of the input sequence is the output of the last layer of the GPT model, which is a representation matrix consisting of the hidden layer representation of each word; (3) The feature matrix of the sequence output in step (2) is aggregated using the average pooling method, and the feature vector of each node is represented as a vector of fixed length, thus obtaining the feature vector of each node.

4. The binary program similarity detection method based on attention wandering kernel according to any one of claims 1 to 3, characterized in that: In step S3 (1), the similarity matrix is ​​calculated for the input graph The process of processing vertex attributes is as follows: The ICFG of the input binary program, that is, the input graph It is expressed as: ,in is a set of vertices, is the edge set; The input graph have vertices, each with dimension attribute, then the vertex attribute set ;set up A collection of hidden graphs , among which, Hidden images have vertices, each vertex has dimension attributes, so the attribute matrix of each hidden graph is ; According to the input graph The vertex attributes and the attribute matrix of the hidden graph , calculate the similarity matrix : ； in, , Elements Represents a hidden graph No. vertices and the input graph No. Similarity of attributes of vertices; Similarity Matrix Vectorization yields a vectorized vector ,Right now: ； In the formula, represents a vectorized vector, represents a vectorized function, The dimension is A real vector of ; In step S3 (2), a new direct graph is formed The calculation formula is as follows: ； ； ； In the formula, and Direct graph The point set and edge set of and Represents the input graph and hidden graph The vertex set of and Represents the input graph and hidden graph The edge set of ; and represents the vertices of the input graph G, and Represents a hidden graph The vertex of In step S3 (2), the attention kernel is introduced into the attention matrix of the adjacency matrix , and calculate the power of the adjacency matrix to capture the similarity of the two graphs. The calculation formula is as follows: ； ； In the formula, represents the element-wise product, Represents a direct graph The number of vertices, For all pairs of vertices To sum, Represents the adjacency matrix The power of ; attention weight matrix It will be adjusted during the training process to optimize the effect of the kernel. is the weight matrix of the fully connected layer; , Represents vectorized vectors No. and values, Represents a vectorized vector The transpose of represents the activation function; In step S3 (2), for each input graph , the calculation formula for constructing a feature matrix F is as follows: ； Represents the input graph and hidden graph between The random walk kernel of .

5. The binary program similarity detection method based on attention wandering kernel according to claim 1 is characterized in that: The process of flattening the feature matrix in step S4 is as follows: Flatten the feature matrix F into a vector, input the feature matrix into a fully connected layer, and output a vector of fixed dimension. Suppose the weight of the fully connected layer is , then the output vector The calculation formula is as follows: ； In the formula, is the weight matrix of the fully connected layer, is the bias vector, is the activation function.

6. The binary program similarity detection method based on attention wandering kernel according to claim 1 is characterized in that: The specific process of similarity judgment in step S5 is as follows: S501, inputting the flattened feature matrices of the target binary program and the reference binary program into a fully connected neural network respectively; S502, calculating feature vectors of two programs through a fully connected neural network; S503, using a similarity measurement method to calculate a similarity score between two feature vectors; S504: Determine the similarity between the target binary program and the reference binary program according to the similarity score.

7. The method for detecting binary program similarity based on wandering attention kernel according to claim 6, characterized in that: The similarity measurement method in step S503 includes a cosine similarity method or a Euclidean distance method.

8. The binary program similarity detection method based on the attention wandering kernel according to any one of claims 1-3 or 5-7, characterized in that: The method further includes detecting the following contents according to the similarity score of S5: reuse relationship between binary programs, vulnerability analysis of binary programs, and family classification of malware.

9. A binary program similarity detection system based on attention wandering kernel, characterized in that: The binary program similarity detection method based on the attention wandering kernel described in any one of claims 1 to 8 is implemented, specifically comprising: a data processing module, a semantic perception module, a structure perception module, and a similarity judgment module, wherein: The data processing module is used to perform static analysis on the binary program to be detected and generate its corresponding ICFG; A semantic perception module, used to generate a node feature vector of the ICFG and extract semantic information of the binary program; The structure perception module is used to extract the structural information of ICFG by combining the attention wandering kernel and the neural network, and generate the feature matrix of the graph; The similarity judgment module is used to calculate the similarity score between the target binary program and the reference binary program and judge the similarity between the two.

Images