Binary homologous vulnerability detection method based on code block sequence

Abstract

The invention provides a binary homologous vulnerability detection method based on a code block sequence, which comprises the following steps of: 1, collecting samples based on the code block sequence, and constructing a new data set based on the code block sequence; 2, learning word vectors in an assembly language by using Doc2Vec, performing Block2Vec representation on assembly code blocks in the samples, and unifying vector dimensions of the samples; and step 3, a machine learning model based on Block2Vec is established. By applying the technical scheme, the security vulnerabilities in the program can be identified and positioned more accurately.

Description

Technical Field

[0001] The present invention relates to the technical field of power grid terminal programs, and in particular to a binary homology vulnerability detection method based on code block sequences. Background Art

[0002] Grid terminal programs play a vital role in modern power systems, and their security is therefore crucial to grid stability and data security. Traditional vulnerability detection methods may have certain limitations, especially when dealing with complex grid terminal programs, where traditional vulnerability detection methods are not accurate enough. Summary of the Invention

[0003] In view of this, the purpose of the present invention is to provide a binary homology vulnerability detection method based on code block sequences, which can more accurately identify and locate security vulnerabilities in programs.

[0004] To achieve the above objectives, the present invention adopts the following technical solution: a binary homology vulnerability detection method based on code block sequences, comprising the following steps: Step 1: Collect code block sequence samples and construct a new code block sequence dataset; Step 2: Use Doc2Vec to learn word vectors in assembly language, represent the assembly code blocks in the sample using Block2Vec, and unify the vector dimensions of the sample; Step 3: Machine learning model based on Block2Vec.

[0005] In a preferred embodiment, the sample collection steps are as follows: 1) First, analyze the program to obtain its function PLT table and the maximum address max_addr of the program code segment. If the PLT table cannot be obtained, use the above solution to rebuild the function PLT table; 2) Set breakpoints based on the addresses in the PLT table, trace and run the program, and send a proof of concept (PoC) at the same time. If a normal sample is to be extracted, normal data or normal parameters are sent. If a vulnerability sample is to be extracted, a PoC or specified parameters are sent. The function call sequence before the program exits or crashes, the number of times the function is called, and the EIP at the time of exit or crash are recorded. 3) Analyze the function call sequence in reverse order to find the first function that can introduce data and its call count N. Then obtain the PLT address in_addr of the function by looking up the table; 4) Attach to the program again, break at in_addr N times, and single-step through the program until it exits or crashes to obtain the address sequence. In addition, in this process, filter the instructions in the system space through max_addr because these instructions are already reflected in the called function. 5) Use IDA and python-idb to statically analyze each address to obtain the fragmented instruction sequence and function call sequence, and replace the function address in the call instruction with the corresponding function name.

[0006] In a preferred embodiment, using Doc2Vec to map assembly code blocks specifically includes training a Block2Vec network, obtaining a Block2Vec representation of an arbitrary code block, and processing the data processed by Block2vec.

[0007] In a preferred embodiment, training a Block2Vec network includes the following steps: 1) After receiving the code block input, the content of the code block is mapped into an N-dimensional vector using the paragraph matrix D, and all assembly opcodes and operands are mapped into N-dimensional vectors using the word matrix W. 2) Add the assembly code block vector and the vectors of all opcodes and operands and calculate the average or concatenate them to predict the central opcode or operand in the paragraph; 3) Update weights through backpropagation; when extracting assembly code blocks, directly replace the call calls with the corresponding functions, remove the duplicate assembly code blocks as the final training samples of Block2Vec; then use the PV-DM mode to train a Block2Vec model so that it can map any code block or any word into an N-dimensional vector.

[0008] In a preferred embodiment, the specific steps of encoding the assembly code block sequence using the trained Block2Vec model are as follows: 1) Split the assembly code block to be encoded into separate assembly opcodes or operands; 2) Obtain the Block2Vec representation of the opcode or operand split out in the first step respectively; 3) Add and average the N-dimensional vector representations of all operands and opcodes to obtain the N-dimensional vector representation of the assembly code block.

[0009] In a preferred embodiment, processing the data after Block2vec processing specifically includes: 1) selecting a fixed length FLen, where the maximum length of the training data is selected; 2) if the training data is less than FLen, padding it with 0 to make its length exactly FLen; 3) if the data length is greater than FLen during prediction, truncating the data with the length of FLen.

[0010] In a preferred embodiment, a Block2Vec-based machine learning model assumes that a certain assembly code sample has L lines, where each line represents a basic block. Each line in the assembly code block sequence is treated as a paragraph and mapped to an N-dimensional vector through Block2Vec, ultimately obtaining an L*N vector. These L rows of vectors are concatenated and then dimensionalized to obtain an F-dimensional vector. The calculation formula for F is as follows: F=M*N(3-3) Here, M represents the maximum number of rows in all training set samples, and N represents the vector dimension after Block2Vec representation of each code block.

[0011] In a preferred embodiment, an RNN-LSTM model and a Text-CNN model are used for training; in the RNN-LSTM model, each sample is preprocessed into an F-dimensional vector, where F=M*N; N data are taken out each time as the input of the LSTM, which is equivalent to processing the Block2Vec representation of a basic block through the LSTM unit each time; after processing by the LSTM unit, the state S and the N-dimensional representation of the next row of basic blocks are handed over to the LSTM unit of the next time step, and all information of the sample is used for model training through M time steps; the output of the last time step is passed through the fully connected layer using the Relu activation function to obtain the final result; the result of each step is compared with the expected result to calculate the loss value, and then the weights in the network are optimized by the gradient descent algorithm; during the training process, batch_size is used to specify the number of samples input at each step, so that batch_size samples are trained through M time steps; where batch_size represents the length of the batch processing.

[0012] In a preferred embodiment, the embedding layer in the Text-CNN network is removed, and a Text-CNN model based on Block2Vec is proposed to expand the application scope of the Text-CNN model to the field of vulnerability mining; the Text-CNN model is divided into two parts: the first part is to convert the Block into a Vector; the second part is to input the Vector into the Text-CNN network for training to obtain a Text-CNN prediction model; the first part mainly represents the assembly code block sequence in the sample as vector data that can be processed by the machine; for each group of assembly code block sequences, each assembly code block is first mapped to an N-dimensional vector through Block2Vec and then converted into an L*N two-dimensional vector; then the fixed length is determined according to the maximum number of rows M, and each sample is converted into an M*N one by filling 0 Vector matrix; The second part is the convolution and maximum pooling process of the assembly code vector; Convolution and maximum pooling are one of the magic weapons for the success of CNN, and they are very mature in the field of image processing; The M*N assembly code vector matrix must first pass through the convolution layer, and specify multiple convolution kernels of different sizes in the convolution layer; It will pass through a convolution layer with a convolution kernel of H*N, where H represents the height of the convolution kernel and N represents the width of the convolution kernel; The convolution kernel performs a sliding window operation on the spatial dimension of the input assembly code vector; Each sliding window performs a correlation operation with all the data in the (H, N) window to obtain the N-gram feature of the output vector, and then introduces nonlinear factors through nonlinear activation; After the activation function is processed, the N-gram feature will enter the maximum pooling layer for feature compression, and finally connected to the fully connected layer, and normalized using Softmax to obtain the final prediction result.

[0013] Compared with the existing technology, the present invention has the following beneficial effects: the binary homology vulnerability detection method based on code block sequence proposed by the present invention can more accurately identify and locate security vulnerabilities in the program by combining dynamic analysis and control flow graph modeling. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 A brief flowchart of vulnerability sample collection in a preferred embodiment of the present invention; Figure 2 This is a sample of a vulnerable program under Canary protection in a preferred embodiment of the present invention; Figure 3 A sample of a vulnerable program protected by Fortify according to a preferred embodiment of the present invention; Figure 4 The .plt.got table for enabling PIE and FULLRELRO protection programs in a preferred embodiment of the present invention; Figure 5 A schematic diagram of the sample collection process according to a preferred embodiment of the present invention; Figure 6 This is a schematic diagram of a PV-DM model according to a preferred embodiment of the present invention; Figure 7 Schematic diagram of Block2Vec model training and vector representation in a preferred embodiment of the present invention; Figure 8 The vocabulary of the preferred embodiment of the present invention lacks untrained words; Figure 9 A Block2Vec-based machine learning model for a preferred embodiment of the present invention; Figure 10 This is a schematic diagram of a simple RNN-LSTM model based on Block2Vec in a preferred embodiment of the present invention; Figure 11 A simple Text-CNN model based on Block2Vec in a preferred embodiment of the present invention; Figure 12 is the loss value and the number of iterations of the preferred embodiment of the present invention; Figure 13 Flowchart of vulnerability potential prediction based on code blocks according to a preferred embodiment of the present invention; Figure 14 The two features of the preferred embodiment of the present invention are demonstrated on different models. DETAILED DESCRIPTION

[0015] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0016] It should be noted that the following detailed description is illustrative and is intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used in the present invention have the same meaning as commonly understood by those skilled in the art to which the present application belongs.

[0017] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application; as used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form, and it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or their combinations.

[0018] A binary homology vulnerability detection method based on code block sequence, reference Figure 1-14 , including the following steps: 1. Sample Collection Process Based on Code Block Sequences Currently, there is no similar dataset with code block granularity, so it is necessary to construct a new dataset based on code block sequences. A large number of vulnerable programs and normal programs are required in the process of collecting the dataset. Compared with normal programs, the collection of vulnerable programs is more difficult. There are two solutions for collecting vulnerable programs: one is to use existing vulnerability detection tools to detect programs in the Linux system and locate vulnerable programs; the other is to obtain vulnerability information from the public vulnerability library, obtain the corresponding vulnerable program version number, and thus locate the vulnerable program. The present invention chooses the second solution, obtains thousands of POCs and vulnerability exploitation scripts (Exploit, EXP) under the Linux system from 2004 to the present from the 0day.today website, builds a vulnerability environment locally based on the vulnerability information, and then uses POC to reproduce the vulnerability.

[0019] The brief process of sample collection is as follows Figure 1 As shown, samples are obtained through dynamic tracing and static analysis: first, the program is run, the corresponding POC is sent, and the program is dynamically tracked, recording the execution flow before the program crashes or exits. Then, static analysis is used to obtain the assembly code block sequence and function call sequence from the data introduction point to the vulnerability triggering or program exit. Using the vulnerable program and the corresponding POC, it is possible to quickly select the "static" information associated with the vulnerability and segment out some irrelevant information using the data introduction point. When predicting unknown programs, the assembly code block sequence and function call sequence can be obtained by constructing a control flow graph, locating the function call location, and simulating jumps.

[0020] During the sample collection process, some programs may enable certain protection mechanisms. This is because the program chooses to enable certain protection mechanisms during the compilation process, which will affect sample collection. The following discusses the impact of Linux security protection mechanisms on sample collection: (1) Enabling NX protection in a program will not negatively impact vulnerability sample collection. This is because programs with NX protection will crash when executing instructions on the stack. Some vulnerability exploitation scripts that could have successfully exploited the program will cause a SIGSEGV signal to crash if they place shellcode on the stack during exploitation, which in turn accelerates the vulnerability sample collection process.

[0021] (2) If Figure 2As shown in the figure, the assembly code snippets "xoredi,dwordptrgs:[0x14]" and "call.__stack_chk_fail" before the program crash indicate a stack overflow, overwriting the canary value stored on the stack. After detecting the change in the canary value, the program calls the .__stack_chk_fail function, which then halts execution due to a SIGABRT signal. Without canary protection, the vulnerability could be triggered at or after the function returns. Therefore, the canary mechanism narrows the timeframe from data introduction to vulnerability triggering, facilitating subsequent analysis. However, during sample collection, it is important to exclude the final canary protection code, as the presence of "call.__stack_chk_fail" in a sample indicates a vulnerability.

[0022] (3) The Fortify mechanism replaces some dangerous functions in the program, such as the strcpy function, with the corresponding XXX_chk function. It then checks for buffer overflows within this function. If an overflow is detected, it calls the chk_fail function internally to send an exception signal, print the exception information, and finally terminate the program. All of this occurs within the XXX_chk function, so it can effectively locate the buffer overflow point. The vulnerability collection script can locate the program crash after calling the .strcpy_chk function. During the sample collection process, the XXX_chk function needs to be replaced with the original protected function.

[0023] (4) If a program has both Position Independent Executables (PIE) and Relocation Read-Only (RELRO) enabled, it will be impossible to directly extract the function PLT table, and thus unable to collect valid data. PIE is used to build position-independent executable files and needs to be used together with ASLR. The base address is randomly changed each time the program is run, which is used to prevent Ret2libc attacks. RELRO can set the program's .GOT segment to read-only, thereby preventing attackers from maliciously modifying the GOT table to launch attacks.

[0024] Programs that enable PIE protection and FULLRELRO protection no longer use the .plt segment to find the address of the function call, but instead jump to the corresponding function call location through the .plt.got segment, such as Figure 4As shown, EBX is the first address of the .got segment, and 0x14 indicates that the function pointer is stored at offset 0x14 of the .got segment. The key to collecting samples is to determine every function call in the entire process. If every function call is represented by data such as callsub_4348, the entire sample will lose a lot of information. At the same time, there is no way to introduce a function segmentation sequence based on the data, which will introduce a large amount of useless information when extracting samples. Therefore, the present invention proposes a method for obtaining the PLT table when the program protection is fully enabled: 1) Read the import table to get the function name and address of the .extern segment, and then get the corresponding got table through cross-reference; 2) Locate the first address of the .plt.got segment, read an assembly instruction every 8 bytes from the first address, and get the offset after EBX; 3) Get the first address of the .got segment, add the offset obtained in the previous step .plt.got segment to the first address of the .got segment to get an address, and get the function name corresponding to the address from the got table; 4) Add 0x400000 to all addresses in the .plt.got section and the corresponding function name to form a .plt.got-function-name dictionary. Set a breakpoint using the address in the .plt.got-function-name dictionary. When the breakpoint is hit, look up the dictionary to determine the corresponding function call. Note: 0x400000 is added to the final address because the program has PIE protection. Before obtaining the program sample, disable the system's ASLR, so the base address is always 0x400000.

[0025] In summary, the process of extracting samples from a multi-threaded program with any security protection enabled is as follows: Figure 5 The specific sample collection steps are as follows: 1) First, analyze the program to obtain its function PLT table and the maximum address max_addr of the program code segment. If the PLT table cannot be obtained, use the above solution to rebuild the function PLT table; 2) Set breakpoints based on the addresses in the PLT table, trace and run the program, and send a proof-of-concept (PoC) simultaneously. If extracting a normal sample, send normal data or give normal parameters. If extracting a vulnerable sample, send a PoC or give specified parameters. Record the function call sequence before the program exits or crashes, the number of function calls, and the EIP address at the time of exit or crash. 3) Analyze the function call sequence in reverse order to find the first function that can introduce data and its call count N, such as the recvfrom function, and obtain the PLT address in_addr of the function by looking up the table; 4) Attach to the program again, break at in_addr N times, and single-step through the program until it exits or crashes, obtaining the address sequence. Additionally, during this process, use max_addr to filter instructions in the system memory, as these instructions are already present in the called function. 5) Use IDA and python-idb to statically analyze each address to obtain the fragmented instruction sequence and function call sequence, and replace the function address in the call instruction with the corresponding function name.

[0026] 2. Block2Vec Representation Based on Doc2Vec Because the collected samples are granular with code blocks, before machine learning training, the assembly code block sequence must be converted into a machine-readable vector, that is, each code block must be represented using Block2Vec. This paper uses Doc2Vec to map assembly code blocks. Doc2Vec can accept lists of varying lengths as training samples, ultimately training vector representations for all lists and predicting the vector representation of an unknown list. Using Doc2Vec to represent code blocks using Block2Vec not only allows complex and variable code blocks to be represented as vectors of uniform dimensionality, but also allows the vectors of similar code blocks to be closer together.

[0027] (1) Training the Block2Vec network The PV-DM model in the Doc2Vec method is similar to the CBOW model in Word2Vec. It can predict words based on context. The difference is that paragraphs are added to the input layer to represent the central idea of ​​the paragraph when training word vectors and paragraph vectors. This paper applies it to the training of assembly code blocks, such as Figure 6 As shown. Each code block has a unique BlockID. When training a code block, the paragraph content in the input remains unchanged, that is, all the content of the code block, while the context words used each time are different. For example, for the code block "MOVEAX,EBXTESTEAX,EAXJZLABEL1", during training, the content of the code block and the four words "MOV", "EAX", "TEST", and "EAX" are used to predict the central word "EBX" for the first time; the content of the code block and the four words "EAX", "EBX", "EAX", and "EAX" are used to predict the central word "TEST" for the second time, and so on.

[0028] The training of the network generally includes the following steps: 1) After receiving the code block input, the content of the code block is mapped into an N-dimensional vector using the paragraph matrix D, and all assembly opcodes and operands are mapped into N-dimensional vectors using the word matrix W. 2) Add the assembly code block vector and the vectors of all opcodes and operands and calculate the average or concatenate them to predict the central opcode or operand in the paragraph; 3) Update weights through backpropagation. This method uses all code blocks from all collected programs to train the Block2Vec model, rather than just the code blocks from previously collected samples. This increases the model's inclusiveness. During the extraction of assembly code blocks, call calls are directly replaced with corresponding functions, and duplicate assembly code blocks are removed as the final Block2Vec training samples. A Block2Vec model is then trained using the PV-DM model, enabling it to map any code block or word into an N-dimensional vector.

[0029] Get the Block2Vec representation of any code block The method of encoding the assembly code block sequence using the trained Block2Vec model is as follows Figure 7 The specific steps are as follows: 1) Split the assembly code block to be encoded into separate assembly opcodes or operands; 2) Obtain the Block2Vec representation of the opcode or operand split out in the first step respectively; 3) Add and average the N-dimensional vector representations of all operands and opcodes (without deduplication) to obtain the N-dimensional vector representation of the assembly code block; like Figure 7 As shown in the figure, suppose you want to get the vector representation of a new code block "CMPEAX,EBXJZLABEL1", you need to get the N-dimensional vector representations of "CMP", "EAX", "EBX", "JZ", and "LABEL1" from the model respectively, and then add them up and average them to get the N-dimensional vector representation of the code block. When the samples participating in Block2Vec training are large enough, the model's vocabulary will basically cover all assembly opcodes, but it is impossible to cover all operands. When representing a new program, there will always be a problem that a few data do not exist, such as Figure 8 As shown, the code block cannot be directly represented by Block2Vec using the above method. If this happens, use the Block2Vec model to predict the entire code block. By specifying a random seed, the same prediction result is obtained when predicting the same code block twice.

[0030] Although each code block becomes a vector of uniform dimension after Block2Vec representation, the number of code blocks in each sample is different. RNN and CNN require fixed-length input. The present invention performs the following processing on the data processed by Block2vec: 1) Select a fixed length FLen, where the maximum length in the training data is selected; 2) If a piece of training data is less than FLen, fill it with 0 to make its length exactly FLen; 3) If the data length is greater than FLen during prediction, truncate the data with a length of FLen.

[0031] 3. Machine Learning Model Based on Block2Vec Machine learning models based on Block2Vec such as Figure 9 As shown in the figure, assume that a sample of assembly code has L lines, where each line represents a basic block. Each line in the assembly code block sequence is treated as a paragraph and mapped to an N-dimensional vector using Block2Vec, ultimately obtaining an L*N vector. These L rows of vectors are concatenated and then dimensionally normalized to obtain an F-dimensional vector. The calculation formula for F is as follows: F=M*N(3-3) Here, M represents the maximum number of rows in all training set samples, and N represents the vector dimension after Block2Vec representation of each code block.

[0032] LSTM network design based on Block2Vec: LSTM is an RNN network that avoids gradient explosion. Its input at the previous moment will affect the output at the next moment. This logic is very similar to program processing. The logic at the previous moment will affect the direction of the subsequent code. The present invention designs an RNN-LSTM model. For each sample, it is an F-dimensional vector after preprocessing, where F=M*N. Each time, N data is taken out as the input of LSTM, which is equivalent to processing the Block2Vec representation of a basic block through the LSTM unit each time. After being processed by the LSTM unit, the state S and the N-dimensional representation of the next row of basic blocks are handed over to the LSTM unit of the next time step, and all information of the sample is used for model training through M time steps. The output of the last time step is passed through the fully connected layer using the Relu activation function to obtain the final result. The result of each step is compared with the expected result to calculate the loss value, and then the weights in the network are optimized by the gradient descent algorithm.

[0033] During the training process, batch_size is used to specify the number of samples input at each step, so that batch_size samples are trained through M time steps. Among them, batch_size represents the length of the batch. • Text-CNN network design based on Block2Vec In the traditional Text-CNN network, text data is mapped to a low-dimensional vector in the embedding layer. However, the embedding layer of Text-CNN only maps and converts words, which is not suitable for mapping assembly code. To this end, this paper removes the embedding layer in the Text-CNN network and proposes a Text-CNN model based on Block2Vec, expanding the application scope of the Text-CNN model to the field of vulnerability mining. The Block2Vec-based Text-CNN model is shown in the figure Figure 11 As shown in Figure 1, the model consists of two main parts: the first part converts blocks into vectors. The second part inputs the vectors into the Text-CNN network for training, resulting in a Text-CNN prediction model. The first part primarily represents the assembly code block sequences in the sample as machine-processable vector data. For each assembly code block sequence, Block2Vec is first used to map each block into an N-dimensional vector and then convert it into an L*N two-dimensional vector. A fixed length is then determined based on the maximum number of rows, M, and each sample is converted into an M*N vector matrix by padding with zeros. The second part primarily involves convolution and max pooling of the assembly code vector. Convolution and max pooling are key to the success of CNNs and are well-established in the field of image processing. The M*N assembly code vector matrix first passes through a convolutional layer, in which multiple convolution kernels of varying sizes can be specified. It then passes through a convolutional layer with an H*N kernel, where H represents the kernel height and N represents the kernel width. The convolution kernel operates as a sliding window across the spatial dimensions of the input assembly code vector. Each sliding window performs correlation operations on all data within the (H, N) window to obtain the N-gram features of the output vector. Nonlinear factors are then introduced through nonlinear activation. After the activation function, the N-gram features enter the max pooling layer for feature compression, and finally the fully connected layer and softmax normalization to obtain the final prediction result.

[0034] Loss functions are often used to evaluate the accuracy of a classifier's predictions. Lower loss values ​​indicate better model performance. The corresponding loss function for classification problems is the 0-1 loss, where the correct estimate is 0 and the incorrect estimate is 1: The formula for the binary cross entropy function is shown in Formula 5-2. Since y ranges from 0 to 1, both log(y) and log(1-y) are non-positive numbers, and therefore L(ŷ, y) is always non-negative. When the expected value is 0, −(1-ŷ)log(1-y) is 0. The closer ŷ is to 0, the closer −ŷlog(y) is to 0, and the loss value also approaches 0. When the expected value is 1, −ŷlog(y) is 0. Only when ŷ approaches 1 can the loss value approach 0. Since the loss value is always not less than 0, the closer the loss value is to 0, the better the model performs on the training set.

[0035] L(ŷ,y)=−ŷlog(y)−(1−ŷ)log(1−y) Compared to the mean square error function, the binary cross entropy function is more suitable as a loss function for classification problems, because the mean square error function will learn slowly when the actual output deviates greatly from the expected output. In the comparison of the binary cross entropy function and the mean square error function during model training, the left side shows the loss value decrease process using the binary cross entropy function. It can be seen that after 5 iterations, the loss value of the model using the cross entropy function is close to 0. After 60 iterations, the loss value of the model using the mean square error function is stable and close to 0. Therefore, the present invention adopts the binary cross entropy function as the loss function of the RNN-LSTM model and the Text-CNN model.

[0036] Deep neural networks have a large number of nonlinear hidden layers and are capable of learning very complex relationships between inputs and outputs. However, overfitting is a common problem in deep neural networks. The dropout method aims to prevent overfitting in deep learning networks and provide a method for effectively combining different neurons. During the training process, some hidden layer neurons are randomly dropped so that the output of the hidden layer does not overly depend on any one neuron in the hidden layer, effectively preventing overfitting. The dropout method randomly drops some hidden layer nodes with probability p during the learning phase, multiplies the dropped nodes by 0, and stretches the neurons that are not dropped by dividing them by 1-p. Dropout does not change the expected value of the output. Assuming that the variable ε follows a 0-1 distribution, that is, the probability of ε being 0 is p and the probability of ε being 1 is 1-p, then its expected value E(ε) is 1-p. The formula for recalculating the hidden layer node ℎi using the dropout method is as follows: (3-5) ℎi=ℎi(3-6) The present invention "discards" some nodes with a probability of 0.5 when training the two models to prevent overfitting, and does not use Dropout during testing and prediction.

[0037] like Figure 13 As shown, the entire process involves dataset acquisition, preprocessing, and training. The core concept is to convert the program into a sequence of code blocks and then into recognizable word vectors. This allows vulnerability discovery through machine learning. The specific plan is as follows: (1) Collect normal programs and vulnerable programs, obtain the program execution flow by tracing the program, and obtain the assembly code block sequence of the loop reduction as the feature of the corresponding sample through static analysis; (2) Divide the training set and test set, and use the improved random oversampling method to expand the vulnerability samples in the training set; (3) Use Doc2Vec to learn word vectors in assembly language, represent the assembly code blocks in the sample using Block2Vec, and unify the vector dimensions of the sample; (4) The RNN-LSTM model and the Text-CNN model are trained respectively, and the two models are tested using the test set, and evaluation indicators are given.

[0038] 4. Performance Comparison of Vulnerability Prediction Models Based on Code Blocks Figure 14 This section compares the accuracy of two features across different models. The performance of the same feature across different models shows that the LSTM model and Text-CNN have similar prediction performance. Among the four models, the Text-CNN model based on code block sequences achieves the highest accuracy. Comparing the performance of the two features across the same model shows that both models based on assembly code blocks outperform function call sequences.

[0039] Table 1 shows the performance indicators of the LSTM model and Text-CNN model based on assembly code block sequences, and the LSTM model and Text-CNN model based on function call sequences. After comparison, it was found that the Text-CNN model based on assembly code block sequences had the highest accuracy, reaching 96.3%. This model also performed well in terms of precision, recall, and F1 indicators. This may be because the Text-CNN model extracts N-gram features of assembly code block sequences during training or prediction, which can better learn local code logic. Table 1 In terms of time consumption, the model based on function call sequence has an advantage, as shown in Table 2. Since the length of the function call sequence is shorter than the assembly code sequence, the processing time of the model will be shorter during prediction.

[0040] Experiments demonstrate that the assembly code block sequences proposed in this paper outperform function call sequences when training machine learning classification models. However, due to the increased amount of extracted data, an increase in training and prediction time is unavoidable. While the vulnerability prediction model based on assembly code blocks takes longer, the average time per sample is not significantly different. Overall, assembly code block sequences perform better in vulnerability prediction.

[0041] Table 2

Claims

1. A binary homology vulnerability detection method based on code block sequence, characterized in that: The following steps are involved: Step 1: Collect samples based on code block sequences and construct a new dataset based on code block sequences; Step 2: Use Doc2Vec to learn word vectors in assembly language, represent the assembly code blocks in the sample using Block2Vec, and unify the vector dimensions of the sample; Step 3: Machine learning model based on Block2Vec.

2. According to the method for detecting binary homology vulnerabilities based on code block sequences in claim 1, it is characterized in that: The steps for sample collection are as follows: 1) First, analyze the program to obtain its function PLT table and the maximum address max_addr of the program code segment. If the PLT table cannot be obtained, use the above solution to rebuild the function PLT table; 2) Set breakpoints according to the addresses in the PLT table, trace and run the program, and send POC at the same time; if a normal sample is extracted, send normal data or give normal parameters; if a vulnerability sample is to be extracted, send POC or give specified parameters; record the function call sequence before the program exits or crashes, the number of times the function is called, and the EIP when the program exits or crashes; 3) Analyze the function call sequence in reverse order, find the first function that can introduce data and its call count N, and obtain the PLT address in_addr of the function by looking up the table; 4) Attach to the program again, break at in_addr N times, and then single-step trace the program until it exits or crashes to get the address sequence. In addition, in this process, the instructions in the system space must be filtered through max_addr, because these instructions are already reflected in the called function. 5) Use IDA and python-idb to statically analyze each address to obtain the fragmented instruction sequence and function call sequence, and replace the function address in the call instruction with the corresponding function name.

3. According to the method for detecting binary homology vulnerabilities based on code block sequences in claim 1, it is characterized in that: Using Doc2Vec to map assembly code blocks specifically includes training the Block2Vec network, obtaining the Block2Vec representation of any code block, and processing the data processed by Block2vec.

4. A binary homology vulnerability detection method based on code block sequence according to claim 3, characterized in that: Training a Block2Vec network consists of the following steps: 1) After receiving the code block input, the content of the code block is mapped into an N-dimensional vector through the paragraph matrix D, and all assembly opcodes and operands are mapped into N-dimensional vectors through the word matrix W respectively; 2) The assembly code block vector and the vectors of all opcodes and operands are summed and averaged or concatenated to predict the central opcode or operand in the paragraph; 3) Update weights through back propagation; in the process of extracting assembly code blocks, directly replace the call calls with corresponding functions, remove the repeated assembly code blocks as the final training samples of Block2Vec; then use the PV-DM mode to train a Block2Vec model so that it can map any code block or any word into an N-dimensional vector.

5. According to the method of claim 3, the binary homology vulnerability detection method based on code block sequence is characterized in that: The specific steps to encode a sequence of assembly code blocks using the trained Block2Vec model are as follows: 1) Split the assembly code block to be encoded into separate assembly opcodes or operands; 2) Obtain the Block2Vec representation of the opcode or operand split out in the first step respectively; 3) Add and average the N-dimensional vector representations of all operands and opcodes to obtain the N-dimensional vector representation of the assembly code block.

6. A binary homology vulnerability detection method based on code block sequence according to claim 3, characterized in that: The processing of data processed by Block2vec specifically includes: 1) selecting a fixed length FLen, where the maximum length in the training data is selected; 2) if a certain training data is less than FLen, fill it with 0 to make its length exactly FLen; 3) if the data length is greater than FLen during prediction, truncate the data with a length of FLen.

7. The binary homology vulnerability detection method based on code block sequence according to claim 1 is characterized in that: In the Block2Vec-based machine learning model, it is assumed that a certain assembly code sample has L lines, where each line represents a basic block; each line in the assembly code block sequence is taken as a paragraph, mapped to an N-dimensional vector through Block2Vec, and finally an L*N vector is obtained; these L lines of vectors are concatenated and then processed by unifying the dimensions to obtain an F-dimensional vector. The calculation formula of F is as follows: F=M*N(3-3) Among them, M represents the maximum number of rows in all training set samples, and N represents the vector dimension after Block2Vec representation of each code block.

8. The binary homology vulnerability detection method based on code block sequence according to claim 7 is characterized in that: RNN-LSTM model and Text-CNN model are used for training; for each sample in the RNN-LSTM model, after preprocessing, it becomes an F-dimensional vector, where F=M*N; N data are taken out each time as the input of LSTM, which is equivalent to processing the Block2Vec representation of a basic block through the LSTM unit each time; after being processed by the LSTM unit, the state S and the N-dimensional representation of the next row of basic blocks are handed over to the LSTM unit of the next time step, and all the information of the sample is used for model training through M time steps; the output of the last time step is passed through the fully connected layer using the Relu activation function to obtain the final result; the result of each step is compared with the expected result to calculate the loss value, and then the weights in the network are optimized through the gradient descent algorithm; during the training process, batch_size is used to specify the number of samples input at each step, so that batch_size samples are trained through M time steps; where batch_size represents the length of the batch processing.

9. A binary homology vulnerability detection method based on code block sequence according to claim 8, characterized in that: The embedding layer in the Text-CNN network is removed, and a Block2Vec-based Text-CNN model is proposed to expand the application scope of the Text-CNN model to the field of vulnerability mining. The Text-CNN model is divided into two parts: the first part is to convert Block into Vector; the second part is to input the Vector into the Text-CNN network for training to obtain the Text-CNN prediction model; the first part mainly represents the assembly code block sequence in the sample as vector data that can be processed by the machine; for each group of assembly code block sequences, each assembly code block is first mapped to an N-dimensional vector through Block2Vec and then converted into a L*N two-dimensional vector; then the fixed length is determined according to the maximum number of rows M, and each sample is converted into an M*N vector matrix by padding with 0; The second part is the convolution and maximum pooling process of the assembly code vector; convolution and maximum pooling are one of the magic weapons for the success of CNN, and they are very mature in the field of image processing; the M*N assembly code vector matrix must first pass through the convolution layer, and specify multiple convolution kernels of different sizes in the convolution layer; it will pass through a convolution layer with a convolution kernel of H*N, where H represents the height of the convolution kernel and N represents the width of the convolution kernel; the convolution kernel performs a sliding window operation on the spatial dimension of the input assembly code vector; each sliding window performs correlation operations with all the data in the (H, N) window to obtain the N-gram features of the output vector, and then introduces nonlinear factors through nonlinear activation; after being processed by the activation function, the N-gram features will enter the maximum pooling layer for feature compression, and finally connected to the fully connected layer, and normalized using Softmax to obtain the final prediction result.

Images