Code security analysis method and device, computer equipment and storage medium

Abstract

The invention provides a code security analysis method and device, computer equipment and a storage medium, and the method comprises the steps: taking each function in a binary code of a target software system as a network node, and constructing a directed graph network according to the function attribute information of the functions; the function attribute information at least comprises a function address, calling information and data reference information; inputting the directed graph network into a pre-trained neural network to obtain an embedded feature representation of each network node; clustering each network node by using the embedded feature representation of each network node to obtain a node clustering result, and determining a code module to which each function belongs according to the node clustering result; and according to each code module, performing code security analysis on the binary code.

Description

Technical Field

[0001] The present disclosure relates to the field of software security technology, and in particular to a code security analysis method, apparatus, computer equipment and storage medium. Background Art

[0002] With the development of the digital age, software systems have become an indispensable basic system for human society, playing an increasingly important role in human life, work, entertainment, etc. However, with the continuous growth of software scale and complexity, some software security issues have also arisen accordingly. For example, security issues such as software vulnerabilities and malicious codes are becoming more and more serious, posing a huge challenge to information security. In order to improve information security, security testing of software codes has become an important technology. For example, software reverse engineering, software vulnerability analysis and malicious code detection of software codes have been widely used in the field of software security, playing a key role in ensuring information security.

[0003] However, some conventional software security analysis methods have the problem of inaccurate analysis results, and their drawbacks are quite obvious. Summary of the invention

[0004] The embodiments of the present disclosure at least provide a code security analysis method, apparatus, computer device and storage medium.

[0005] In a first aspect, an embodiment of the present disclosure provides a code security parsing method, comprising: Taking each function in the binary code of the target software system as a network node, a directed graph network is constructed according to function attribute information of the function; the function attribute information at least includes function address, call information and data reference information; Inputting the directed graph network into a pre-trained neural network to obtain an embedded feature representation of each of the network nodes; Clustering the network nodes using the embedded feature representation of each of the network nodes to obtain a node clustering result, and determining the code module to which each of the functions belongs according to the node clustering result; According to each of the code modules, code security analysis is performed on the binary code.

[0006] In a possible implementation, the method of using each function in the binary code of the target software system as a network node and constructing a directed graph network according to function attribute information of the function includes: Determine, according to the call information in the function attribute information, directed edges between the respective network nodes; A directed graph network is constructed according to the attribute matrix composed of the directed edges between the network nodes and the function attribute information of the network nodes.

[0007] In a possible implementation, inputting the directed graph network into a pre-trained neural network to obtain an embedded feature representation of each of the network nodes includes: Inputting the directed graph network into a pre-trained neural network, and obtaining the original feature representation of each network node and the attention coefficient between each network node and each adjacent node according to the attribute matrix of each network node; For any of the network nodes, an embedded feature representation of the network node is determined according to the original feature representation of the network node, the attention coefficient between the network node and each adjacent node, and the original feature representation of each adjacent node of the network node.

[0008] In a possible implementation, the method further includes: Obtaining binary code of a target software system and converting the binary code into assembly code; Each function and function attribute information of each function are extracted from the assembly code.

[0009] In a possible implementation manner, extracting each function and function attribute information of each function from the assembly code includes: Using a static analysis tool, extracting the function address and static call relationship of each function from the assembly code; Using program stub technology, extracting dynamic calling relationships of various functions, application programming interface (API) calling information and data reference information from the assembly code; The static calling relationship, the dynamic calling relationship and the API calling information of the function are used as the calling information of the function.

[0010] In a possible implementation, clustering the network nodes using the embedded feature representation of each network node to obtain a node clustering result includes: Clustering the network nodes using the embedded feature representation of each of the network nodes to obtain at least one node cluster and a target embedded feature corresponding to the cluster center of each of the node clusters; Determine the clustering loss in the current clustering process according to the embedded feature representation of each of the network nodes and the target embedded feature corresponding to the cluster center of each of the node clusters, and determine the feature reconstruction loss of the trained neural network according to the embedded feature representation and the original feature representation of each of the network nodes; With the goal of minimizing the clustering loss and the feature reconstruction loss, the embedded feature representation of each of the network nodes is optimized to obtain a new embedded feature representation of each of the network nodes; Return to the step of clustering the network nodes using the embedded feature representation of each of the network nodes to obtain at least one node cluster and the target embedded feature corresponding to the cluster center of each of the node clusters, until the clustering cutoff condition is met to obtain the node clustering result.

[0011] In a possible implementation, determining the clustering loss in the current clustering process according to the embedded feature representation of each of the network nodes and the target embedded feature corresponding to the cluster center of each of the node clusters includes: For any of the network nodes, determining an initial probability that the network node belongs to the cluster center of each of the node clusters according to the embedded feature representation of the network node and the target embedded feature of each of the node clusters; Determining a target probability that each of the network nodes belongs to the cluster center of each of the node clusters according to an initial probability that each of the network nodes belongs to the cluster center of each of the node clusters; The clustering loss in the current clustering process is determined according to the minimized divergence between the initial probability and the target probability that each of the network nodes belongs to the cluster center of each of the node clusters.

[0012] In a possible implementation manner, the neural network is trained according to the following steps: Acquire a plurality of sample directed graph networks; the sample directed graph networks include a plurality of sample network nodes; Inputting the sample directed graph network into the neural network to be trained, and obtaining the sample original feature representation and the predicted embedded feature representation of each sample network node in the sample directed graph network; Determining the prediction loss of the neural network to be trained according to the original feature representation of the sample and the predicted embedded feature representation; The neural network to be trained is iteratively trained using the prediction loss until a training cutoff condition is met, thereby obtaining a trained neural network.

[0013] In a second aspect, the present disclosure also provides a code security analysis device, including: A construction module, used to construct a directed graph network using each function in the binary code of the target software system as a network node according to function attribute information of the function; the function attribute information at least includes function address, call information and data reference information; An extraction module, used for inputting the directed graph network into a pre-trained neural network to obtain an embedded feature representation of each of the network nodes; A clustering module, used to cluster each network node using the embedded feature representation of each network node, obtain a node clustering result, and determine the code module to which each function belongs according to the node clustering result; The parsing module is used to perform code security analysis on the binary code according to each of the code modules.

[0014] In a third aspect, an optional implementation of the present disclosure further provides a computer device, a processor, and a memory, wherein the memory stores machine-readable instructions executable by the processor, and the processor is used to execute the machine-readable instructions stored in the memory, and when the machine-readable instructions are executed by the processor, the steps of the above-mentioned first aspect, or any possible implementation of the first aspect are performed.

[0015] In a fourth aspect, an optional implementation of the present disclosure further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed, the steps of the above-mentioned first aspect, or any possible implementation of the first aspect are executed.

[0016] For a description of the effects of the above-mentioned code security analysis device, computer equipment, and computer-readable storage medium, please refer to the description of the above-mentioned code security analysis method, which will not be repeated here.

[0017] The above embodiment provides a solution for automatically performing code security analysis, wherein, before the code is security analyzed, a directed graph corresponding to the binary code is constructed by extracting each function and its function attribute information from the binary code, so that the constructed directed graph can reflect the direction between the network nodes corresponding to each function and the important attributes carried by the nodes, and such a directed graph network can be effectively used for subsequent feature extraction. The trained neural network has reliable prediction accuracy. By using the trained neural network to identify and analyze the directed network graph, the accurate embedded feature representation of each network node can be extracted to achieve accurate characterization of the network nodes. Then, the node embedding features are used to cluster the various network nodes, which can fully consider the node attributes and the direction between the nodes while ensuring the accuracy and robustness of the module division, so as to achieve accurate clustering of the various network nodes corresponding to the same function into the same module. Then, by using the accurately divided code modules to perform security analysis on the binary code, not only the accuracy of the code analysis results can be improved, but also the efficiency of the code analysis can be improved.

[0018] In order to make the above-mentioned objectives, features and advantages of the present disclosure more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following is a brief introduction to the drawings required for use in the embodiments. The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and are used together with the specification to illustrate the technical solutions of the present disclosure. It should be understood that the following drawings only illustrate certain embodiments of the present disclosure and should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can also be obtained based on these drawings without creative work.

[0020] Figure 1 A flowchart of a code security analysis method provided by an embodiment of the present disclosure is shown; Figure 2 A schematic diagram of a directed graph network provided by an embodiment of the present disclosure is shown; Figure 3 A schematic diagram showing a network structure of a graph attention network provided by an embodiment of the present disclosure; Figure 4 A schematic diagram of a code module division process provided by an embodiment of the present disclosure is shown; Figure 5 A schematic diagram of a code security analysis device provided by an embodiment of the present disclosure is shown; Figure 6 A schematic diagram of the structure of a computer device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical scheme and advantages of the embodiments of the present disclosure clearer, the technical scheme in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The components of the embodiments of the present disclosure generally described and shown here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure is not intended to limit the scope of the present disclosure claimed for protection, but merely represents the selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present disclosure.

[0022] In addition, the terms "first", "second", etc. in the description and claims of the embodiments of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein.

[0023] The "multiple or several" mentioned in this article refers to two or more. "And / or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0024] Research has found that in software reverse engineering, module division of binary code is a key issue. By properly dividing complex or large-scale software into several modules, analysts can quickly and accurately understand the structure and function of the software, thereby improving the analysis efficiency and accuracy of the analysis results. It is not difficult to see that the quality of the module division results will directly affect the quality and efficiency of the code security analysis results. However, conventional code module division methods only divide code modules based on the static call relationship of functions in the code, or only divide code modules based on the functional and structural similarities between codes. Although these methods can also divide effective code modules, most of these methods only consider the static connection relationship between functions and ignore the dynamic information between functions during the code running process, such as dynamic call relationship, data reference information, etc., resulting in the neglect of important dynamic properties between functions in the code module division process, resulting in low accuracy of module division results, affecting the accuracy and efficiency of subsequent code security analysis results.

[0025] Based on the above research, the present disclosure provides a code security analysis method, device, computer equipment and storage medium. Before the code is security analyzed, the directed graph corresponding to the binary code is constructed by extracting each function and its function attribute information from the binary code, so that the constructed directed graph can reflect the direction between the network nodes corresponding to each function and the important attributes carried by the nodes. Such a directed graph network can be effectively used for subsequent feature extraction. The trained neural network has reliable prediction accuracy. By using the trained neural network to identify and analyze the directed network graph, the accurate embedded feature representation of each network node can be extracted to achieve accurate characterization of the network nodes. Then, the node embedding features are used to cluster the various network nodes, which can fully consider the node attributes and the direction between the nodes while ensuring the accuracy and robustness of the module division, so as to achieve accurate clustering of the various network nodes corresponding to the same function into the same module. Then, the binary code is analyzed for security using the accurately divided code modules, which can not only improve the accuracy of the code analysis results, but also improve the efficiency of code analysis.

[0026] The defects existing in the above solutions are the results obtained by the inventor after practice and careful research. Therefore, the discovery process of the above problems and the solutions proposed by the present disclosure for the above problems below should be the contributions made by the inventor to the present disclosure during the disclosure process.

[0027] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0028] It should be noted that the specific terms mentioned in the embodiments of the present disclosure include: k-means algorithm: a classic clustering analysis algorithm, which aims to divide a data set into K clusters so that the data points within each cluster are as similar as possible, while the data points between different clusters are as different as possible. The algorithm continuously optimizes the cluster division in an iterative manner until a certain termination condition is met; ‌DBSCAN: (Density-Based Spatial Clustering of Applications with Noise) is a density-based clustering algorithm that is mainly used to identify clusters of arbitrary shapes in spatial data and can effectively process noisy data.

[0029] To facilitate understanding of this embodiment, a code security parsing method disclosed in an embodiment of the present disclosure is first introduced in detail. The executor of the code security parsing method provided in the embodiment of the present disclosure is generally a terminal device or other processing device with certain computing capabilities, wherein the terminal device may be a user equipment (UE), a mobile device, a user terminal, a terminal, a personal digital assistant (PDA), a handheld device, a computer device, etc.; in some possible implementations, the code security parsing method may be implemented by a processor calling computer-readable instructions stored in a memory.

[0030] The code security parsing method provided by the embodiment of the present disclosure is described below by taking a computer device as an example of an execution subject.

[0031] like Figure 1 As shown, it is a flowchart of a code security parsing method provided by an embodiment of the present disclosure, which may include the following S101-S104: S101: Using each function in the binary code of the target software system as a network node, and constructing a directed graph network according to function attribute information of the function; the function attribute information at least includes function address, call information and data reference information.

[0032] Here, the target software system can be any code editing system, which can be used for editing, modifying, compiling, etc. of program codes. The above-mentioned binary code is the edited program code, which has program functions that match the development requirements. The above-mentioned functions are the various function codes included in the binary code, and the number of functions included in different binary codes is different. Function attribute information is used to characterize the code attributes of the function itself, which may at least include the function address, the function call information, and the function data reference information. Among them, the function call information may specifically include static direct call relationships and dynamic indirect call relationships; the call relationship is used to indicate the call relationship between different functions. Data reference information is used to indicate the various data that the function needs to reference during operation.

[0033] A directed graph network may include multiple network nodes, one network node corresponds to one function, and each network node carries the function attribute information of the function corresponding to the network node. The connection edge between network nodes may be a directed edge, and its direction is related to the calling relationship between the functions corresponding to the network nodes. For example, if function A calls function B, the directed edge between network node A corresponding to function A and network node B corresponding to function B may be a connection edge from network node A to network node B.

[0034] In specific implementation, for any binary code written, each function and the function attribute information of each function can be extracted from the code. Then, based on the function attribute information of each function, the calling relationship between functions is determined. Each function is used as a network node, and based on the calling relationship between functions and the function attribute information of functions, the binary code is abstracted into a directed graph network. Figure 2 As shown, it is a schematic diagram of a directed graph network provided by an embodiment of the present disclosure, in Figure 2 In the figure, a circle represents a network node corresponding to a function, and a total of 10 network nodes corresponding to functions are shown. The directed edges between different network nodes are Figure 2 The arrowed lines between the network nodes in the figure show that each network node carries the function attribute information of the corresponding function. Figure 2 Function attribute information is not shown.

[0035] S102: Input the directed graph network into a pre-trained neural network to obtain an embedded feature representation of each network node.

[0036] Here, the pre-trained neural network is used to identify and extract features of each network node in the input directed graph network, and then output the embedded feature representation of each network node. The embedded feature representation can be a feature vector, which is used to characterize the node features of the network node. One network node corresponds to one embedded feature representation, and the embedded feature representation of any network node is related to the function attribute information carried by the network node and the function attribute information carried by each adjacent node.

[0037] In specific implementation, the constructed directed graph network can be input into a pre-trained neural network, and the graph autoencoder in the neural network can extract, encode and fuse the features of each network node and the directed edges of the network nodes in the directed graph network to obtain the embedded feature representation corresponding to each network node.

[0038] S103: clustering each network node using the embedded feature representation of each network node to obtain a node clustering result, and determining the code module to which each function belongs according to the node clustering result.

[0039] Here, the node clustering result is used to characterize the node cluster to which each network node belongs, and one node cluster corresponds to one code module.

[0040] In specific implementation, a clustering algorithm can be used to cluster each network node according to the embedded feature representation of each network node to obtain at least one node cluster, each of which includes a network node as a cluster center and at least one other network node related to the cluster center. The obtained node clusters are used as node clustering results, and according to the node clustering results, the functions corresponding to each network node belonging to the same node cluster are divided into the same code module, thereby obtaining each code module corresponding to the binary code.

[0041] S104: Perform code security analysis on the binary code according to each code module.

[0042] Here, code security line parsing is specifically used to analyze security vulnerabilities and malicious code in binary code.

[0043] In specific implementation, after obtaining each code module, a security analysis strategy related to the function of the code module can be used to perform security analysis on the functions in each code module to obtain a security analysis result corresponding to the binary code. The security analysis result may include whether the binary code is safe, as well as possible security vulnerabilities and malicious code. Optionally, after obtaining each code module, any security analysis method in the prior art can be used to perform security analysis on the binary code according to the code module to obtain a security analysis result.

[0044] Alternatively, after obtaining each code module, when a problem occurs during the running of the binary code, the problem module can be determined from multiple code modules based on the problem and the corresponding functions of each code module, and then a security analysis can be performed on each function in the problem module to locate the function that causes the problem, thereby achieving rapid location and analysis of the problem.

[0045] In general, the code security parsing method provided by the embodiment of the present disclosure fully considers the function attribute information of network nodes and the similarity between network nodes, improves the accuracy and robustness of module division, and can help analysts quickly and accurately understand software structure and functions, thereby improving analysis efficiency.

[0046] In one embodiment, each function in the binary code and its function attribute information may be extracted according to the following S1 and S2: S1: Obtain the binary code of the target software system and convert the binary code into assembly code.

[0047] Here, the binary code may be a machine language code, which is composed of binary numbers 0 and 1. The assembly code is an assembly language code, which is a code that is easy for users to understand.

[0048] During specific implementation, the binary code that needs to be security parsed is obtained from the target software system, and then the binary code can be converted into assembly code through disassembly.

[0049] S2: Extract each function and function attribute information of each function from the assembly code.

[0050] In specific implementation, the existing code parsing method may be used to parse the assembly code to parse out each function included in the assembly code and function attribute information of each function.

[0051] In one embodiment, the above S2 can be implemented according to the following steps: S2-1: Use static analysis tools to extract the function address and static calling relationship of each function from the assembly code.

[0052] Here, the static analysis tool is a tool for analyzing the code without running the code. In the disclosed embodiment, the static analysis tool can use any open source disassembly tool, such as Interactive Disassembler Professional (IDA pro for short), Radare2 tool, Hopper tool, etc. The static call relationship can also be referred to as the direct call relationship between functions.

[0053] Exemplarily, IDA pro may be used to parse the assembly code, thereby extracting each function in the assembly code, as well as the function address of each function and the static calling relationship between functions.

[0054] S2-2: Use program instrumentation technology to extract the dynamic calling relationship of each function, application programming interface API calling information and data reference information from the assembly code.

[0055] Here, the dynamic calling relationship can be referred to as an indirect calling relationship between functions, which is obtained during the program running process. The application programming interface (Application Programming Interface, API for short) calling information is used to indicate the API interface that needs to be called during the program running process.

[0056] In specific implementation, the program plugging technology can be used to plug the program in the process of running the assembly code to obtain the dynamic execution track of the program, and according to the monitoring points of the plugging and the dynamic execution track, the dynamic calling relationship of each function in the assembly code, as well as the API interface that the function in the assembly code needs to call and the various data that need to be referenced when running can be determined. Then, the API calling information of the function can be determined according to the API interface that needs to be called, and the data reference information of the function can be determined according to the various data that need to be referenced.

[0057] That is, in the embodiment of the present disclosure, four types of information closely related to the program structure can be extracted, including the function address, calling relationship (direct calling relationship and indirect calling relationship), data reference, and API call in the binary code.

[0058] For example, after obtaining the binary code, the binary code disassembly process can be completed through static analysis tools to obtain the function address and static call relationship of each function. In addition, the program instrumentation technology can be used to perform program instrumentation on the assembly code or binary code to obtain the dynamic call relationship, application programming interface API call information and data reference information of each function.

[0059] S2-3: The static calling relationship, dynamic calling relationship and API calling information of the function are used as the calling information of the function.

[0060] In specific implementation, for any function, the static calling relationship and dynamic calling relationship of the function can be used as the calling relationship information of the function, and then the calling relationship information and API calling information of the function can be used as the calling information of the function. At the same time, the calling information, function address and data reference information of the function can be used as the function attribute information of the function.

[0061] In one embodiment, the above S101 may be implemented according to the following steps: S101 - 1 : Determine directed edges between various network nodes according to the calling information in the function attribute information.

[0062] Here, the call information may include direct call relationships and indirect call relationships between functions, wherein the direct call relationship is the function call relationship directly identified from the static binary code, and the indirect call relationship is the function call relationship that can only be identified during the running of the binary code. A directed edge is a connection edge with a direction, and the direction of the directed edge is determined by the call relationship of the function.

[0063] In specific implementation, the calling relationship of each function (including direct calling relationship and indirect calling relationship) can be extracted from the function attribute information of each function, and then the relative position and directed edges between each network node can be determined according to the calling relationship of each function.

[0064] S101 - 2: Construct a directed graph network according to the attribute matrix composed of the directed edges between each network node and the function attribute information of each network node.

[0065] Here, the attribute matrix is ​​a vector matrix determined according to the function attribute information. For example, the vector matrix can be obtained by normalizing the function attribute information. The attribute matrix can specifically include the address vector corresponding to the function address. , call information vector corresponding to the call information, data vector corresponding to the data reference information , wherein the call information vector may specifically include a call relationship vector corresponding to the call relationship information , and the API call vector corresponding to the API call information A function corresponds to a network node, and a network node corresponds to an attribute matrix F. The attribute matrix F=[ , , , ]∈ , where n represents the number of functions, and m represents the attribute dimension. In the embodiment of the present disclosure, the attribute dimension includes four dimensions, namely, the function address dimension, the call relationship dimension, the data reference dimension, and the API call dimension.

[0066] In specific implementation, all functions V can be used as network nodes, and the calling relationship E between functions can be used as directed edges and the attribute matrix F of the function to construct a directed graph network G = (V, E, F).

[0067] In one embodiment, the above S102 may be implemented according to the following steps: S102-1: Input the directed graph network into a pre-trained neural network, and obtain the original feature representation of each network node and the attention coefficient between each network node and each adjacent node according to the attribute matrix of each network node.

[0068] Here, the neural network in the embodiment of the present disclosure may specifically be a graph attention network based on a graph attention mechanism. The original feature representation is obtained by directly extracting, encoding and fusing the attribute matrix F carried by the network nodes through the graph attention network.

[0069] For any network node, the neighboring nodes of the network node are the network nodes adjacent to the network node. A network node can have one or more neighboring network nodes. The attention coefficient is used to characterize the importance of the neighboring nodes in the feature representation of the network node. Each neighboring node of a network node has an attention coefficient with the network node. The attention coefficients of the neighboring nodes and the network nodes can be determined by the graph attention network based on the attribute matrices corresponding to the neighboring nodes and the network nodes respectively and the connecting edges between the two nodes.

[0070] In specific implementation, the directed graph network can be input into the graph attention network, and the graph attention network can be used to determine the original feature representation of each network node and each adjacent node of each network node according to the attribute matrix and connection edges of each network node. In addition, for each network node, the attention coefficient between the network node and each adjacent node can be determined according to the original feature representation of the network node and the original feature representation of each adjacent node of the network node.

[0071] Among them, the attention coefficient between the network node and the adjacent node can be determined using the following formula 1: ; (Formula 1) in, Indicates that in the kth attention head of the graph attention network, the network node With adjacent nodes There are K attention heads in the graph attention network. The number of attention heads can be set according to the specific network structure, and is not specifically limited in the embodiments of the present disclosure. Represents a network node The original feature representation of Represents a network node Neighboring nodes The original feature representation of Represents a network node The set of adjacent nodes of . LeakyReLU represents the ReLU function with a negative slope, and ReLU represents the activation function. Represents a network node The bth adjacent node of The original feature representation of Represents the transpose of the learnable attention vector. After the graph attention network is trained, The value of can be a fixed value; Represents the learnable weight matrix of the kth attention head. After the graph attention network training is completed, The value of can also be a fixed value. ,in, represents a real number set, m represents the attribute dimension of the original feature representation, Table embedding feature representation attribute dimension, || represents the concatenation operation in the multi-head attention mechanism, which is used to indicate that the output results of different attention heads are concatenated.

[0072] In specific implementation, after obtaining the original feature representation of each network node, the graph attention network can use the above formula 1 to determine the attention coefficient between the network node and each adjacent node output by each attention head for any network node, and determine the attention coefficient between the network node and each adjacent node based on the attention coefficient output by each attention head. In this way, in order to measure the importance of different adjacent nodes in the node representation of the network node, the graph attention network updates the feature representation of the current network node by calculating the attention coefficient of each adjacent node and the current network node as a weight coefficient, which can effectively improve the accuracy of the feature representation output of the current network node.

[0073] S102-2: For any network node, determine the embedded feature representation of the network node according to the original feature representation of the network node, the attention coefficient between the network node and each adjacent node, and the original feature representation of each adjacent node of the network node.

[0074] In specific implementation, Formula 2 can be used to determine the embedded feature representation of each network node: ; (Formula 2) in, Represents a network node The embedded feature representation of is the default value.

[0075] In specific implementation, for any network node, the graph attention network can determine the embedded feature representation corresponding to the network node according to the above formula 2, the original feature representation of the network node, the attention coefficient between the network node and each adjacent node, and the original feature representation of each adjacent node of the network node. In this way, the feature update of the network node can be achieved, and the original feature representation of the network node can be updated to the feature representation affected by the surrounding adjacent nodes.

[0076] Optionally, in the embodiment of the present disclosure, the network structure of the graph attention network can be as follows: Figure 3 As shown, the graph attention network may include three first fully connected network layers FC, a self-attention mechanism network layer self-attention mechanism, a connection layer concat and a second fully connected network layer FC. After the directed graph network is input into the graph attention network, the three first fully connected network layers may be used to perform fully connected processing on the attribute matrix of each network node respectively, and the fully connected results corresponding to the three first fully connected network layers may be obtained. The three fully connected results may then be input into the self-attention mechanism network layer for self-attention mechanism processing to obtain the self-attention processing result. The self-attention processing result may then be input into the connection layer for feature connection processing, and the connection result may then be input into the second fully connected network layer for full connection processing, thereby obtaining the embedded feature representation of each network node.

[0077] In one embodiment, the step of clustering network nodes in S103 may be implemented according to the following steps: S103-1: Clustering each network node using the embedded feature representation of each network node to obtain at least one node cluster and a target embedded feature corresponding to the cluster center of each node cluster.

[0078] Here, the node cluster may include a network node corresponding to a cluster center and at least one network node matching the cluster center, and there is no duplication of network nodes in different node clusters. The target embedded feature may be an embedded feature representation of the network node corresponding to the cluster center of the node cluster.

[0079] In specific implementation, a clustering algorithm can be used to perform node clustering according to the embedded feature representation of each network node, and obtain the target embedded features corresponding to each node cluster and the cluster center of each node cluster. The clustering algorithm can be, for example, any algorithm suitable for high-dimensional data clustering, such as the k-means algorithm and the DBSCAN algorithm. For example, when using the k-means algorithm, multiple cluster centers can be randomly selected from each network node, and then, the k-means algorithm is used to cluster each network node according to the target embedded features of the randomly selected cluster centers and the embedded feature representation of each network node, so as to obtain each node cluster and the target embedded features of each node cluster.

[0080] Optionally, a clustering algorithm can be used to perform multiple independent clusterings, and the node clusters corresponding to the best clustering effect in the multiple clusterings are used as the node clusters that need iterative clustering. The quality of the clustering effect can be determined based on the similarity between the network nodes in each node cluster obtained by clustering and the cluster center.

[0081] S103-2: Determine the clustering loss in the current clustering process based on the embedded feature representation of each network node and the target embedded feature corresponding to the cluster center of each node cluster, and determine the feature reconstruction loss of the trained neural network based on the embedded feature representation and the original feature representation of each network node.

[0082] Here, the clustering loss is used to characterize the difference between each node cluster obtained by clustering and the real node cluster corresponding to each network node. The node clustering process in the disclosed embodiment can be a multi-round iterative clustering process, and at least node clusters can be obtained after each clustering, and each node cluster obtained by the last clustering is used as the final node cluster. The current clustering process is the clustering currently in progress. The feature reconstruction loss is used to characterize the difference between the original feature representation of the network node output by the neural network and the embedded feature representation of the network node.

[0083] In specific implementation, for each network node, the node clustering loss of the network node can be determined based on the embedded feature representation of the network node, the feature difference of the target embedded feature corresponding to the cluster center of the node cluster to which it belongs in the current clustering process, and the sum of the feature differences of the embedded feature representation of the network node and the target embedded feature corresponding to the cluster center of each node cluster obtained in the current clustering process, and then the clustering loss in the current clustering process can be obtained based on the sum of the node clustering losses of each network node. At the same time, the feature reconstruction loss of the neural network can be determined based on the sum of the feature differences between the embedded feature representation of each network node and the original feature representation.

[0084] S103-3: With the goal of minimizing clustering loss and feature reconstruction loss, the embedded feature representation of each network node is optimized to obtain a new embedded feature representation of each network node.

[0085] In specific implementation, the goal is to minimize the sum of the clustering loss and the feature reconstruction loss of the current clustering process, adjust and optimize the embedded feature representation of each network node, and obtain a new embedded feature representation of each network node, thereby realizing the feature update of the network nodes in the clustering process.

[0086] S103-4: Return to the step of clustering each network node using the embedded feature representation of each network node to obtain at least one node cluster and the target embedded feature corresponding to the cluster center of each node cluster, until the clustering cutoff condition is met to obtain the node clustering result.

[0087] Here, the clustering cutoff condition may be that the number of iterative clustering reaches a preset number, and / or the clustering loss of a certain clustering is less than a preset loss.

[0088] In specific implementation, for any clustering process, after the clustering process completes the update of the embedded feature representation of each network node (that is, after the new embedded feature representation of each network node is obtained in the clustering process), it can be determined whether the clustering cutoff condition is met. If so, the node clusters obtained in the clustering process can be used as the node clustering results. If not, it means that the next clustering is required, and the new embedded feature representation of each network node can be used as the embedded feature representation of each network node and return to execute S103-1 until the clustering cutoff condition is met, and the node clusters obtained at this time are used as the node clustering results. It should be noted that since the embedded feature representation of the network node will be updated after each iterative clustering, the feature reconstruction loss of the next clustering will also be updated. That is, for each clustering, the feature reconstruction loss of the clustering will be updated based on the embedded feature representation updated in the previous clustering.

[0089] In this way, in the process of iterative clustering, the embedded feature representation of the network nodes is updated, and the updated embedded feature representation is used to re-cluster the network nodes, adjust the clustering results, and optimize the clustering results. In this way, through continuous iterative cycles, the accuracy of the obtained clustering results can be effectively improved, and finally functions with similar functions or structures can be divided into the same module, completing the accurate module division of binary code.

[0090] In one embodiment, the step of determining the clustering loss in S103-2 may be implemented as follows A1 to A3: A1: For any network node, the initial probability that the network node belongs to the cluster center of each node cluster is determined based on the embedded feature representation of the network node and the target embedded feature of each node cluster.

[0091] Here, the initial probability is used to characterize the probability that a network node belongs to the cluster center of a node cluster.

[0092] In specific implementation, for any network node and any node cluster, the initial probability that the network node belongs to the cluster center of the node cluster can be determined based on the feature difference between the embedded feature representation of the network node and the target embedded feature corresponding to the node cluster, and the sum of the feature difference between the embedded feature representation of the network node and the target embedded features corresponding to each node cluster.

[0093] For example, the initial probability corresponding to the network node can be determined according to the following formula 3: ; (Formula 3) in, Represents a network node The initial probability of the cluster center belonging to node cluster u, Represents a network node The embedded feature representation of represents the target embedding feature corresponding to the cluster center of node cluster u, α represents the degree of freedom of T distribution, which can be a preset value. represents the L2 norm, v represents the number of node clusters, Represents the target embedding feature corresponding to the cluster center of the node cluster v, where u∈[1,v].

[0094] In specific implementation, the initial probability that any network node belongs to the cluster center of any node cluster can be determined based on the above formula three according to the embedded feature representation of the network node and the target embedded representation of the cluster center of the node cluster.

[0095] A2: According to the initial probability that each network node belongs to the cluster center of each node cluster, the target probability that each network node belongs to the cluster center of each node cluster is determined.

[0096] Here, the target probability is the probability obtained after adjusting the initial probability.

[0097] In specific implementation, for any network node and any node cluster, the target probability that the network node belongs to the node cluster can be determined based on the initial probability that the network node belongs to the cluster center of the node cluster, the sum of the initial probabilities that each network node belongs to the cluster center of the node cluster, the initial probability that the network node belongs to the cluster center of each node cluster, and the initial probability that each network node belongs to the cluster center of each node cluster.

[0098] For example, the target probability corresponding to each initial probability can be determined according to the following formula 4: ; (Formula 4) in, Represents a network node The target probability of belonging to the cluster center of node cluster u, express The square of i is the number of network nodes. express The square of . Represents the sum of the initial probabilities that each network node belongs to the cluster center of node cluster u; Represents the sum of the initial probabilities that each network node belongs to each node cluster v.

[0099] In specific implementation, the target probability of any network node belonging to the cluster center of any node cluster can be determined based on the above formula 4 according to the initial probability of the network node belonging to the cluster center of each node cluster.

[0100] In this way, by adjusting the probability, the probability distribution of the initial probability corresponding to each network node can be adjusted, thereby enhancing the influence of high-confidence network nodes on clustering and weakening the interference of low-confidence network nodes on clustering.

[0101] A3: Determine the clustering loss in the current clustering process based on the minimized divergence between the initial probability and the target probability that each network node belongs to the cluster center of each node cluster.

[0102] In specific implementation, the clustering loss in any clustering process can be determined according to the following formula 5: ; (Formula 5) in, represents the clustering loss, and KL(P||Q) represents the probability loss under minimizing the divergence.

[0103] Exemplarily, after obtaining the initial probability and target probability that each network node belongs to the cluster center of each node cluster, these initial probabilities and target probabilities can be substituted into the above formula 5 to obtain the clustering loss.

[0104] Furthermore, after obtaining the clustering loss Afterwards, for the above S103-3, the total loss of clustering loss and feature reconstruction loss can be determined according to the following formula 6, and then the embedded feature representation of each network node is optimized with the minimum total loss as the goal to obtain a new embedded feature representation of each network node: ; (Formula 6) in, represents the total loss, represents the feature reconstruction loss, are the preset hyperparameters.

[0105] For ease of understanding, an example clustering process is shown below: (1) Use different random cluster centers and run the clustering algorithm multiple times to obtain multiple initial clustering results, each of which includes at least one node cluster and the target embedding feature corresponding to the cluster center of each node cluster; select the clustering result with the best clustering effect from the multiple initial clustering results.

[0106] (2) Calculate the Q distribution of each network node: Use Formula 3 to calculate the initial probability that each network node belongs to the cluster center of each node cluster, and obtain the soft cluster label of each network node. The Q distribution can be understood as the distribution of each initial probability.

[0107] (3) Optimize the Q distribution and obtain the target distribution P: In the calculation, since all probabilities are taken into account, network nodes with low probability values ​​(i.e., network nodes with low similarity to a certain node cluster) may still have a certain impact on the clustering results. Therefore, by raising the actual Q distribution to the second power and normalizing it as the target distribution, the interference of low-probability network nodes on the clustering results can be alleviated, and the influence of high-confidence labels can be strengthened. Specifically, the above formula 4 can be used to determine the target probability that each network node belongs to the cluster center of each node cluster, and the distribution of the target probability is used as the target distribution P.

[0108] (4) Clustering loss: The clustering loss in the clustering process is determined by minimizing the KL divergence. Specifically, the clustering loss can be determined using the above formula 5.

[0109] (5) Total loss: The total loss is determined based on the clustering loss and the reconstruction loss of the neural network. The specific determination of the total loss can refer to the above formula 6.

[0110] (6) With the goal of minimizing the total loss, the embedded feature representation of each network node is optimized to obtain a new embedded feature representation of each network node. The new embedded feature representation of each network node is used for re-clustering, and the cluster center and cluster label are adjusted until the clustering cutoff condition is met to obtain the node clustering result. Based on the node clustering result, functions with similar functions or structures are divided into the same module to complete the module division of the binary code.

[0111] Through iterative clustering, noise nodes and outlier nodes in the node cluster can be removed, thereby improving the accuracy of the clustering results.

[0112] like Figure 4 As shown, it is a schematic diagram of a process of dividing code modules provided by an embodiment of the present disclosure, wherein, Figure 4 In the example, the binary code is abstracted into a directed graph network, which is Figure 2 The graph network shown in the figure inputs the directed graph network into the graph attention network for feature extraction. Each network node in the directed graph network carries an attribute matrix F = [address vector , data vector , call relation vector , API call vector ]. After the directed graph network passes through the first fully connected network layer FC, the self-attention mechanism network layer, the connection layer concat and the second fully connected network layer FC in the graph attention network, the embedded feature representation of each network node is obtained. After that, the embedded feature representation can be used to cluster each network node to obtain the node clustering result, that is, Figure 4 In this way, the node clusters 1 to 3 in Figure 2 The 10 functions in the directed graph network shown are divided into 3 different node clusters.

[0113] In one embodiment, the present disclosure also provides a method for training a neural network as shown in the following steps 1 to 4. By training the neural network in this way, a neural network with reliable prediction accuracy can be obtained for node clustering.

[0114] Step 1: Obtain multiple sample directed graph networks; the sample directed graph network includes multiple sample network nodes.

[0115] Here, the sample directed graph network is a directed graph network used as a network training sample, and each sample directed graph network may include multiple sample network nodes, and there are directed edges between different sample network nodes, and each sample network node carries a sample attribute matrix. The sample directed graph network may be artificially produced sample data, or may be constructed using sample functions and function attribute information in sample binary codes.

[0116] In specific implementation, before training the graph attention network, a large number of sample directed graph networks can be obtained first.

[0117] Step 2: Input the sample directed graph network into the neural network to be trained to obtain the sample original feature representation and predicted embedded feature representation of each sample network node in the sample directed graph network.

[0118] Here, the original feature representation of the sample is the neural network to be trained, which is the original feature representation of the sample network node prediction; the predicted embedded feature representation is the neural network to be trained, which is the embedded feature representation of the sample network node prediction.

[0119] Exemplarily, the sample directed graph network can be input into the graph attention network to be trained to obtain the sample original feature representation and predicted embedded feature representation predicted by the graph attention network for each sample network node in the sample directed graph network.

[0120] Step 3: Determine the prediction loss of the neural network to be trained based on the original feature representation of the sample and the predicted embedded feature representation.

[0121] Here, the prediction loss is the feature reconstruction loss of the neural network to be trained when reconstructing the embedded feature representation of each sample node.

[0122] In specific implementation, the node prediction loss of each sample network node can be determined according to the sample original feature representation and the predicted embedded feature representation of each sample network node, and then the prediction loss of the graph attention network to be trained can be determined according to the node prediction loss of each sample network node.

[0123] Alternatively, the prediction loss of the neural network to be trained can be determined according to the following formulas 7 to 9: ; (Formula 7) ; (Formula 8) ; (Formula 9) in, Represents the prediction loss of the neural network to be trained, which is also the feature reconstruction loss mentioned above; the value of n is equal to the number of sample network nodes; Represents the value of the i-th row and j-th column in the original structure matrix of the sample directed graph network, where the original structure matrix is ​​constructed according to the sample original feature representation of each sample network node in the sample directed graph network; Represents the value of the i-th row and j-th column in the reconstructed structure matrix of the sample directed graph network, where the reconstructed structure matrix is ​​constructed according to the predicted embedded feature representation of each sample network node in the sample directed graph network; Represents a network node The transpose of the predicted embedding feature representation of ; Represents a network node Neighboring nodes The predicted embedding feature representation of ; sigmoid represents the activation function. Represents a network node The transpose of the original feature representation of the samples.

[0124] It is understandable that the feature reconstruction loss in the above S103-2 can also be determined according to Formula 7 to Formula 9.

[0125] Step 4: Use the prediction loss to iteratively train the neural network to be trained until the training cutoff condition is met to obtain a trained neural network.

[0126] Here, the training cutoff condition may include that the number of iterative training times reaches a threshold number, and / or the prediction accuracy of the trained neural network reaches a preset accuracy.

[0127] Exemplarily, the graph attention network to be trained can be optimized by the back-propagation method. Specifically, the graph attention network to be trained can be iteratively trained directly using the prediction loss until the training cutoff condition is met, and the neural network trained at this time is used as the trained neural network.

[0128] In this way, by using the back-propagation algorithm to train the graph attention network to be trained by minimizing the prediction loss, the parameters of the graph autoencoder in the graph attention network can be adjusted to optimize the embedded feature representation of the node.

[0129] Those skilled in the art will appreciate that, in the above method of specific implementation, the order in which the steps are written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of the steps should be determined by their functions and possible internal logic.

[0130] Based on the same inventive concept, a code security analysis device corresponding to the code security analysis method is also provided in the embodiment of the present disclosure. Since the principle of solving the problem by the device in the embodiment of the present disclosure is similar to the above-mentioned code security analysis method in the embodiment of the present disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0131] like Figure 5 FIG. 1 is a schematic diagram of a code security analysis device provided by an embodiment of the present disclosure, comprising: A construction module 501 is used to construct a directed graph network using each function in the binary code of the target software system as a network node according to function attribute information of the function; the function attribute information at least includes function address, call information and data reference information; An extraction module 502 is used to input the directed graph network into a pre-trained neural network to obtain an embedded feature representation of each of the network nodes; A clustering module 503 is used to cluster each network node using the embedded feature representation of each network node to obtain a node clustering result, and determine the code module to which each function belongs according to the node clustering result; The parsing module 504 is used to perform code security analysis on the binary code according to each of the code modules.

[0132] In a possible implementation, the construction module 501, when constructing a directed graph network using each function in the binary code of the target software system as a network node and according to function attribute information of the function, is used to: Determine, according to the call information in the function attribute information, directed edges between the respective network nodes; A directed graph network is constructed according to the attribute matrix composed of the directed edges between the network nodes and the function attribute information of the network nodes.

[0133] In a possible implementation, the extraction module 502, when inputting the directed graph network into a pre-trained neural network to obtain an embedded feature representation of each of the network nodes, is used to: Inputting the directed graph network into a pre-trained neural network, and obtaining the original feature representation of each network node and the attention coefficient between each network node and each adjacent node according to the attribute matrix of each network node; For any of the network nodes, an embedded feature representation of the network node is determined according to the original feature representation of the network node, the attention coefficient between the network node and each adjacent node, and the original feature representation of each adjacent node of the network node.

[0134] In a possible implementation manner, the construction module 501 is further used to: Obtaining binary code of a target software system and converting the binary code into assembly code; Each function and function attribute information of each function are extracted from the assembly code.

[0135] In a possible implementation manner, the construction module 501, when extracting each function and function attribute information of each function from the assembly code, is used to: Using a static analysis tool, extracting the function address and static call relationship of each function from the assembly code; Using program stub technology, extracting dynamic calling relationships of various functions, application programming interface (API) calling information and data reference information from the assembly code; The static calling relationship, the dynamic calling relationship and the API calling information of the function are used as the calling information of the function.

[0136] In a possible implementation, the clustering module 503, when clustering the network nodes using the embedded feature representation of each network node to obtain the node clustering result, is used to: Clustering the network nodes using the embedded feature representation of each of the network nodes to obtain at least one node cluster and a target embedded feature corresponding to the cluster center of each of the node clusters; Determine the clustering loss in the current clustering process according to the embedded feature representation of each of the network nodes and the target embedded feature corresponding to the cluster center of each of the node clusters, and determine the feature reconstruction loss of the trained neural network according to the embedded feature representation and the original feature representation of each of the network nodes; With the goal of minimizing the clustering loss and the feature reconstruction loss, the embedded feature representation of each of the network nodes is optimized to obtain a new embedded feature representation of each of the network nodes; Return to the step of clustering the network nodes using the embedded feature representation of each of the network nodes to obtain at least one node cluster and the target embedded feature corresponding to the cluster center of each of the node clusters, until the clustering cutoff condition is met to obtain the node clustering result.

[0137] In a possible implementation, the clustering module 503, when determining the clustering loss in the current clustering process according to the embedded feature representation of each of the network nodes and the target embedded feature corresponding to the cluster center of each of the node clusters, is used to: For any of the network nodes, determining an initial probability that the network node belongs to the cluster center of each of the node clusters according to the embedded feature representation of the network node and the target embedded feature of each of the node clusters; Determining a target probability that each of the network nodes belongs to the cluster center of each of the node clusters according to an initial probability that each of the network nodes belongs to the cluster center of each of the node clusters; The clustering loss in the current clustering process is determined according to the minimized divergence between the initial probability and the target probability that each of the network nodes belongs to the cluster center of each of the node clusters.

[0138] In a possible implementation, the device further includes a training module 505; The training module 505 is used to train the neural network according to the following steps: Acquire a plurality of sample directed graph networks; the sample directed graph networks include a plurality of sample network nodes; Inputting the sample directed graph network into the neural network to be trained, and obtaining the sample original feature representation and the predicted embedded feature representation of each sample network node in the sample directed graph network; Determining the prediction loss of the neural network to be trained according to the original feature representation of the sample and the predicted embedded feature representation; The neural network to be trained is iteratively trained using the prediction loss until a training cutoff condition is met, thereby obtaining a trained neural network.

[0139] For descriptions of the processing flow of each module in the device and the interaction flow between each module, reference may be made to the relevant descriptions in the above method embodiment, which will not be described in detail here.

[0140] Based on the same technical concept, the embodiment of the present application also provides a computer device. Figure 6 FIG. 1 is a schematic diagram of a computer device provided in an embodiment of the present application, including: Processor 601, memory 602 and bus 603. The memory 602 stores machine-readable instructions executable by the processor 601, and the processor 601 is used to execute the machine-readable instructions stored in the memory 602. When the machine-readable instructions are executed by the processor 601, the processor 601 performs the following steps: S101: using each function in the binary code of the target software system as a network node, constructing a directed graph network according to the function attribute information of the function; the function attribute information at least includes the function address, call information and data reference information; S102: inputting the directed graph network into a pre-trained neural network to obtain an embedded feature representation of each network node; S103: clustering each network node using the embedded feature representation of each network node to obtain a node clustering result, and determining the code module to which each function belongs according to the node clustering result; and S104: performing code security analysis on the binary code according to each code module.

[0141] The above-mentioned memory 602 includes a memory 6021 and an external memory 6022; the memory 6021 here is also called an internal memory, which is used to temporarily store the calculation data in the processor 601, as well as the data exchanged with the external memory 6022 such as a hard disk. The processor 601 exchanges data with the external memory 6022 through the memory 6021. When the computer device is running, the processor 601 communicates with the memory 602 through the bus 603, so that the processor 601 executes the execution instructions mentioned in the above method embodiment.

[0142] The embodiment of the present disclosure also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the code security analysis method described in the above method embodiment are executed. The storage medium can be a volatile or non-volatile computer-readable storage medium.

[0143] The computer program product of the code security analysis method provided in the embodiments of the present disclosure includes a computer-readable storage medium storing program code, and the instructions included in the program code can be used to execute the steps of the code security analysis method described in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0144] The computer program product may be implemented in hardware, software or a combination thereof. In one optional embodiment, the computer program product is embodied as a computer storage medium, and in another optional embodiment, the computer program product is embodied as a software product, such as a software development kit (SDK).

[0145] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here. In the several embodiments provided in the present disclosure, it should be understood that the disclosed device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the device or unit can be electrical, mechanical or other forms.

[0146] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0147] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0148] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present disclosure, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0149] If the technical solution of this application involves personal information, the product using the technical solution of this application has clearly informed the personal information processing rules and obtained the individual's voluntary consent before processing the personal information. If the technical solution of this application involves sensitive personal information, the product using the technical solution of this application has obtained the individual's separate consent before processing the sensitive personal information, and at the same time meets the "explicit consent" requirement. For example, on personal information collection devices such as cameras, clear and prominent signs are set to inform that the personal information collection scope has been entered and personal information will be collected. If the individual voluntarily enters the collection scope, it is deemed that he or she agrees to the collection of his or her personal information; or on the device that processes personal information, the personal information processing rules are notified by obvious signs / information, and the individual's authorization is obtained through pop-up information or by asking the individual to upload his or her personal information; among them, the personal information processing rules may include information such as the personal information processor, the purpose of personal information processing, the processing method, and the type of personal information processed.

[0150] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present disclosure, which are used to illustrate the technical solutions of the present disclosure, rather than to limit them. The protection scope of the present disclosure is not limited thereto. Although the present disclosure is described in detail with reference to the aforementioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the aforementioned embodiments within the technical scope disclosed in the present disclosure, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure shall be based on the protection scope of the claims.

Claims

1. A code security analysis method, characterized in that: include: Taking each function in the binary code of the target software system as a network node, and constructing a directed graph network according to function attribute information of the function; The function attribute information at least includes function address, call information and data reference information; Inputting the directed graph network into a pre-trained neural network to obtain an embedded feature representation of each of the network nodes; Clustering the network nodes using the embedded feature representation of each of the network nodes to obtain a node clustering result, and determining the code module to which each of the functions belongs according to the node clustering result; According to each of the code modules, code security analysis is performed on the binary code.

2. The method according to claim 1, characterized in that The method uses each function in the binary code of the target software system as a network node and constructs a directed graph network according to the function attribute information of the function, including: Determine, according to the call information in the function attribute information, directed edges between the respective network nodes; A directed graph network is constructed according to the attribute matrix composed of the directed edges between the network nodes and the function attribute information of the network nodes.

3. The method according to claim 2, characterized in that The step of inputting the directed graph network into a pre-trained neural network to obtain an embedded feature representation of each of the network nodes includes: Inputting the directed graph network into a pre-trained neural network, and obtaining the original feature representation of each network node and the attention coefficient between each network node and each adjacent node according to the attribute matrix of each network node; For any of the network nodes, an embedded feature representation of the network node is determined according to the original feature representation of the network node, the attention coefficient between the network node and each adjacent node, and the original feature representation of each adjacent node of the network node.

4. The method according to claim 1, characterized in that: The method further comprises: Obtaining binary code of a target software system and converting the binary code into assembly code; Each function and function attribute information of each function are extracted from the assembly code.

5. The method according to claim 4, characterized in that The step of extracting each function and function attribute information of each function from the assembly code includes: Using a static analysis tool, extracting the function address and static call relationship of each function from the assembly code; Using program stub technology, extracting dynamic calling relationships of various functions, application programming interface (API) calling information and data reference information from the assembly code; The static calling relationship, the dynamic calling relationship and the API calling information of the function are used as the calling information of the function.

6. The method according to claim 1, characterized in that The method of clustering each network node using the embedded feature representation of each network node to obtain a node clustering result includes: Clustering the network nodes using the embedded feature representation of each of the network nodes to obtain at least one node cluster and a target embedded feature corresponding to the cluster center of each of the node clusters; Determine the clustering loss in the current clustering process according to the embedded feature representation of each of the network nodes and the target embedded feature corresponding to the cluster center of each of the node clusters, and determine the feature reconstruction loss of the trained neural network according to the embedded feature representation and the original feature representation of each of the network nodes; With the goal of minimizing the clustering loss and the feature reconstruction loss, the embedded feature representation of each of the network nodes is optimized to obtain a new embedded feature representation of each of the network nodes; Return to the step of clustering the network nodes using the embedded feature representation of each of the network nodes to obtain at least one node cluster and the target embedded feature corresponding to the cluster center of each of the node clusters, until the clustering cutoff condition is met to obtain the node clustering result.

7. The method according to claim 6, characterized in that Determining the clustering loss in the current clustering process according to the embedded feature representation of each of the network nodes and the target embedded feature corresponding to the cluster center of each of the node clusters includes: For any of the network nodes, determining an initial probability that the network node belongs to the cluster center of each of the node clusters according to the embedded feature representation of the network node and the target embedded feature of each of the node clusters; Determining a target probability that each of the network nodes belongs to the cluster center of each of the node clusters according to an initial probability that each of the network nodes belongs to the cluster center of each of the node clusters; The clustering loss in the current clustering process is determined according to the minimized divergence between the initial probability and the target probability that each of the network nodes belongs to the cluster center of each of the node clusters.

8. The method according to any one of claims 1 to 7, characterized in that: The neural network is trained according to the following steps: Acquire a plurality of sample directed graph networks; the sample directed graph networks include a plurality of sample network nodes; Inputting the sample directed graph network into the neural network to be trained, and obtaining the sample original feature representation and the predicted embedded feature representation of each sample network node in the sample directed graph network; Determining the prediction loss of the neural network to be trained according to the original feature representation of the sample and the predicted embedded feature representation; The neural network to be trained is iteratively trained using the prediction loss until a training cutoff condition is met, thereby obtaining a trained neural network.

9. A code security analysis device, characterized in that: include: A construction module, used to construct a directed graph network based on function attribute information of each function in the binary code of the target software system as a network node; The function attribute information at least includes function address, call information and data reference information; An extraction module, used for inputting the directed graph network into a pre-trained neural network to obtain an embedded feature representation of each of the network nodes; A clustering module, used to cluster each network node using the embedded feature representation of each network node, obtain a node clustering result, and determine the code module to which each function belongs according to the node clustering result; The parsing module is used to perform code security analysis on the binary code according to each of the code modules.

10. A computer device, characterized in that: include: A processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and the processor is used to execute the machine-readable instructions stored in the memory. When the machine-readable instructions are executed by the processor, the processor executes the steps of the code security parsing method as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program. When the computer program is executed by a computer device, the computer device executes the steps of the code security analysis method according to any one of claims 1 to 8.

Images