Code obfuscation method and system for large model and medium

Abstract

The invention discloses a large-model-oriented code obfuscation method and system and a medium, and relates to the technical field of information security, and the method comprises the following steps: converting a source code into an abstract syntax tree AST through a static analysis tool; performing code obfuscation on the obtained abstract syntax tree AST, including disrupting a function sequence in the abstract syntax tree AST and extracting and splitting variables in the abstract syntax tree AST to obtain an obfuscated abstract syntax tree AST; a name replacement step: performing exchange replacement on the variable name and the function name in the AST, and performing semantic inversion on the exchanged variable name and function name; and a coding encryption step: carrying out base64 or AES coding on the variable name and the function name after semantic inversion based on a random disturbance mode. Through the method, the related system and the medium, the difficulty of understanding the confused JS code by the large language model is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and more specifically to a large-model oriented code obfuscation method, system and medium. Background Art

[0002] JavaScript is an interpreted language widely used on the client side. It is usually deployed on the server, but actually executed in the user's browser. This means that users can directly view and access JavaScript code. In order to protect code security, code obfuscation technology came into being.

[0003] At present, with the development of machine big model technology, more and more people are beginning to use big models to interpret codes. However, the current js code obfuscation technology mainly considers how to prevent professional technicians from interpreting the code. Therefore, these existing js code obfuscation technologies are reverse-designed based on the habit of technicians reading codes. However, when facing the interpretation of codes by big models, the existing js code obfuscation technologies may fail, thereby reducing the difficulty of code cracking.

[0004] Therefore, how to increase the difficulty of code cracking for large models and provide a code obfuscation technology for large models is an urgent problem that technical personnel in this field need to solve. Summary of the invention

[0005] In view of this, the present invention provides a large-model oriented code obfuscation method, system and medium, which are used to at least solve some of the technical problems in the background technology.

[0006] In order to achieve the above object, the present invention adopts the following technical solution:

[0007] On the one hand, the present invention discloses a code obfuscation method for a large model, comprising the following steps:

[0008] Convert source code into an abstract syntax tree AST through static analysis tools;

[0009] Obfuscate the obtained abstract syntax tree AST, including disrupting the order of functions in the abstract syntax tree AST and extracting and splitting the variables in the abstract syntax tree AST to obtain the obfuscated abstract syntax tree AST;

[0010] Name replacement step: swap the variable names and function names in the abstract syntax tree AST, and perform semantic reversal on the swapped variable names and function names;

[0011] Encoding and encryption steps: Base64 or AES encode the semantically inverted variable names and function names based on random perturbation.

[0012] Further, based on a random perturbation method, base64 or AES encoding is performed on the variable names and function names after semantic inversion, specifically including the following steps:

[0013] For all N variable names and function names after semantic inversion, only M variable names and function names will be subjected to base64 or AES encoding operations during the encryption process, where M < N and M / / 2 = 0.

[0014] Further, before converting the source code into an Abstract Syntax Tree (AST) through a static analysis tool, the following steps are also included:

[0015] Scan the source code through a static analysis tool to identify unused variables, functions, imported modules, as well as redundant comments and whitespace;

[0016] Remove the unused variables, functions, imported modules, as well as redundant comments and whitespace to obtain the source code after redundancy removal.

[0017] Further, it also includes verifying the obfuscated code.

[0018] Further, verifying the obfuscated code specifically includes the following steps:

[0019] Use a code parsing tool to restore the obfuscated code back to the code form;

[0020] Use a parser to parse and execute the restored code form to verify the executability of the restored code form and its similarity to the execution result of the source code before obfuscation;

[0021] Compare the restored code form with the original code before obfuscation.

[0022] Further, the following steps are also included

[0023] Add interference comments: Input the restored JS code into an auxiliary large model, and generate comments for the already obfuscated code in chunks.

[0024] On the other hand, the present invention discloses a code obfuscation system for large models, including:

[0025] Source code input module: used to input JS source code;

[0026] AST generation module: used to convert the input source code into an Abstract Syntax Tree (AST);

[0027] AST Code Obfuscation Module: Used to obfuscate the obtained Abstract Syntax Tree (AST), including shuffling the function order in the AST and extracting and splitting variables in the AST to obtain the obfuscated AST;

[0028] Name Replacement Module: Used to swap and replace the variable names and function names in the AST, and semantically reverse the swapped variable names and function names;

[0029] Encoding and Encryption Module: Used to perform base64 or AES encoding on the semantically reversed variable names and function names based on a random perturbation method.

[0030] Preferably, in the Encoding and Encryption Module, performing base64 or AES encoding on the semantically reversed variable names and function names based on a random perturbation method specifically includes the following steps:

[0031] For all N variable names and function names after semantic reversal, only M variable names and function names will be subjected to base64 or AES encoding operations during the encryption process, where M < N and M / / 2 = 0.

[0032] Preferably, the above system further includes an Obfuscated Code Verification Module for verifying the obfuscated code.

[0033] The present invention also discloses a computer medium, including a computer program, and when the computer program is executed, it can implement a code obfuscation method, system, and medium for large models according to any one of the present invention.

[0034] From the above technical solutions, it can be seen that compared with the prior art, the present invention discloses a code obfuscation method, system, and medium for large models, having the following beneficial effects:

[0035] On the basis of ensuring the original JavaScript code obfuscation ability, the present invention fully considers the behavioral characteristics of large models analyzing JavaScript code, improves the understanding difficulty of the obfuscated JS code by large language models (LLMs), ensures the understanding cost of JS code, and thus improves the security of JS code in the large model era. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the following drawings are only the embodiments of the present invention, and those of ordinary skill in the art can obtain other drawings according to the provided drawings without creative efforts.

[0037] Figure 1 The figure is a schematic diagram of the overall flow of the code obfuscation method provided by the present invention. DETAILED DESCRIPTION

[0038] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0039] Example 1

[0040] Embodiment 1 of the present invention discloses a code obfuscation method for a large model, comprising the following steps:

[0041] Convert source code into an abstract syntax tree AST through static analysis tools;

[0042] Obfuscate the obtained abstract syntax tree AST, including disrupting the order of functions in the abstract syntax tree AST and extracting and splitting the variables in the abstract syntax tree AST to obtain the obfuscated abstract syntax tree AST;

[0043] Name replacement step: swap the variable names and function names in the abstract syntax tree AST, and perform semantic reversal on the swapped variable names and function names;

[0044] Encoding and encryption steps: Base64 or AES encode the semantically inverted variable names and function names based on random perturbation. Figure 1 The steps of the obfuscation method are described in detail.

[0045] 1. Generate abstract syntax tree and preprocessing

[0046] 1) AST generation

[0047] In this method, the JS code is first converted into an abstract syntax tree (AST) by a static analysis tool. This provides a basic foundation for subsequent code analysis, conversion, and manipulation. The parsed AST can provide a detailed understanding of the code structure and components, making further processing more flexible and feasible.

[0048] 2) Redundancy removal

[0049] In order to reduce the amount of data, the original code is also removed before generating AST. The entire code base is scanned by static analysis tools to identify unused variables, functions, imported modules, redundant comments and blank characters, etc. At the same time, in some large projects, there may be imported but unused modules. By removing these redundant imported modules, the packaged code size can be significantly reduced and the complexity of dependencies can be reduced.

[0050] 2. AST code obfuscation

[0051] The AST code obfuscation process mainly consists of two steps: function disruption and variable splitting and extraction.

[0052] 1) Function disruption

[0053] Function scrambling is to randomly shuffle the functions in the code and disrupt the original function declaration order. In this way, the logical order in the code is disrupted, which greatly increases the difficulty of debugging the code. Scrambling the function order can not only prevent attackers from directly understanding the code logic through static analysis tools, but also effectively hide the execution process of the code.

[0054] 2) Variable Splitting

[0055] For different types of variables such as strings and numbers, this method proposes different splitting strategies.

[0056] For string variables, the splitting technique splits the strings in the code and distributes these split strings to different scopes. By dividing the complete string into multiple fragments and storing them in different locations, the readability of the code and the difficulty of debugging can be effectively reduced.

[0057] For numeric variables, the splitting technology will split them into several digital variables through simple calculations (arithmetic operations, modulus, etc.), and merge them into the original variables through calculation when needed.

[0058] 3) Variable extraction

[0059] For face-changing codes such as numbers, variable extraction technology can randomly extract constant values ​​in the code into multiple arrays, and then access them through array subscripts to increase code complexity.

[0060] 4. Name Replacement

[0061] Existing methods generally replace variable and function names with meaningless characters, single letters, or short identifiers. This type of replacement method will cause great difficulty for human reading, increasing the cost of cracking. Although the big model will judge the role of variables and function names in the code in the process of understanding the code, if all names are changed to meaningless strings, due to the mechanism of the big model, the big model will give up understanding the variables and directly turn to relying on the code structure for interpretation, while the existing method still maintains the structure of the code (which is also a necessary and sufficient condition to ensure that the program can continue to execute), resulting in the failure of this type of replacement strategy when facing the big model code analysis.

[0062] In this method, we propose to obfuscate variable and function names from a semantic perspective. In this method, the variable and function names in the code will be converted into a form that is semantically different from the original version (that is, the name still makes sense instead of being garbled, but it is different from the function of the current code).

[0063] This method will first extract all variable names and function names based on AST, and then replace these contents (for example: there are variable names {a, b, c}, in the obfuscated code all b are replaced by a, all a are changed to c, and all c are changed to a), thus forming AST1.

[0064] Based on AST1, the method will semantically reverse the names in AST to form AST2. In this process, the method will generate antonym names based on the pre-built semantic reversal dictionary and pre-defined antonym pairs. For example, 'increase' corresponds to 'decrease', 'add' corresponds to 'remove', and 'open' corresponds to 'close'. In addition, users can also add replacement rules to the semantic replacement dictionary based on their personal coding habits, so as to customize the semantic obfuscation rules.

[0065] 5. Encoding and encryption

[0066] In the existing JS code obfuscation technology, variable encryption has been used for code obfuscation. However, this type of encryption technology generally targets key information such as strings, converting them into encoding forms such as Base64 or AES, which can effectively increase the difficulty of human reading. However, this type of encoding generally has strong characteristics and will be accurately captured by large models. At the same time, since this type of information is generally sensitive information, the trained large model will focus on parsing this part of the content during the code parsing process, thereby better cracking the existing obfuscation methods.

[0067] In this method, to prevent large models from cracking the key strings, this encryption method will be changed. This method will utilize the characteristic of pre-trained large models focusing on such encrypted information to obfuscate the JS code. Specifically, similar to the existing methods, this method will first encode and encrypt the string content in the JS code. In addition, this method will also perform base64 or AES encoding on the replaced names based on AST2, so as to disguise these variables as important information and thus interfere with the attention of large models.

[0068] 5. Random perturbation

[0069] Since large models have strong fitting ability (inline learning ability, that is, few-shot learning based on the provided examples), if all names are directly replaced and encoded for encryption, when using large models for code analysis, if more samples are provided, it may cause the large model to fit out the obfuscation method (that is, the large model can figure out the above name encryption process by finding patterns), thus resulting in the cracking of the above obfuscation method.

[0070] To avoid this situation, in this method, we propose a random perturbation method. Specifically, during the process of name replacement and name encryption, for all N function / variable names that can be encrypted, only M of them will be operated on in one encryption process (M < N and M / / 2 = 0). This ensures that some variables in the obfuscated code are true and some are false, thus causing misjudgment when the large model performs code analysis.

[0071] However, considering that this random encryption process will result in N - M names in the code not being processed at all, to prevent key information from existing in these unobfuscated names and causing information leakage, the user can mark specific parts of the code before obfuscation. During the obfuscation process, the marked specific code parts will definitely be obfuscated, thus ensuring that key information will not be leaked.

[0072] 6. Code restoration

[0073] Use a JS code parsing tool to restore the obfuscated code back to the code form.

[0074] 7. Add interfering comments

[0075] Existing comment interference methods generally delete comments directly or generate some irrelevant comments. However, due to the operation mechanism of the big model, comments that are completely irrelevant to the code semantics will basically not be paid attention to. At the same time, considering the important role of comments in the big model code analysis process, this method is committed to proposing a semantically relevant interference comment, so that the generated interference comment is related to the corresponding code (because the code has been obfuscated, the correspondence between the comment and the code will also cause the comment to be obfuscated)

[0076] This method will input the restored JS code from the previous step into the auxiliary large model, and generate comments for the obfuscated code in blocks. Since the generated comments correspond to the obfuscated code, the comments also have obfuscated type. For the C comments generated, the method will also extract T codes and swap their positions, thereby further increasing the difficulty of understanding the obfuscated code.

[0077] 8. Code restoration and verification

[0078] In the existing JS code obfuscation technology, a JS parser is generally used to execute the obfuscated code, thereby ensuring that the running result of the obfuscated code is exactly the same as the execution result before obfuscation.

[0079] In addition, this method also proposes code verification based on a large model to ensure the quality of obfuscation. Specifically, this method will use a large model to restore the obfuscated JS code to obtain the JS restored code. For the JS restored code, on the one hand, this method will use a JS parser to parse it to verify its executableness and the similarity of the execution results. On the other hand, this method will also compare the JS restored code with the source code to verify the LLM's ability to restore the obfuscated code. In order to ensure the rigor of the verification, this method will design multiple prompt words and select multiple models to ensure the fairness and rigor of the verification results.

[0080] Example 2

[0081] In order to implement the code obfuscation method of embodiment 1, embodiment 2 discloses a code obfuscation system for large models, including:

[0082] Source code input module: used to input JS source code;

[0083] AST generation module: used to convert the input source code into an abstract syntax tree AST;

[0084] AST code obfuscation module: used to confuse the obtained abstract syntax tree AST, including disrupting the order of functions in the abstract syntax tree AST and extracting and splitting the variables in the abstract syntax tree AST to obtain the obfuscated abstract syntax tree AST;

[0085] Name replacement module: used to swap and replace variable names and function names in the Abstract Syntax Tree (AST), and semantically reverse the swapped variable names and function names;

[0086] Coding and encryption module: used to perform base64 or AES encoding on the semantically reversed variable names and function names based on a random perturbation method.

[0087] Among them, in the coding and encryption module, performing base64 or AES encoding on the semantically reversed variable names and function names based on a random perturbation method specifically includes the following steps:

[0088] For all N variable names and function names after semantic reversal, only M variable names and function names will be subjected to base64 or AES encoding operations during the encryption process, where M < N and M / / 2 = 0.

[0089] Preferably, the above system further includes a obfuscated code verification module for verifying the obfuscated code.

[0090] Embodiment 3

[0091] Embodiment 3 discloses a computer-readable medium for storing a computer program, and when the computer program is executed, it can implement any one of the code obfuscation methods for large models in Embodiment 1.

[0092] In this specification, each embodiment is described in a progressive manner. The key point of each embodiment is the difference from other embodiments. The same or similar parts among the embodiments can be referred to each other. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method part.

[0093] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be obvious to those skilled in the art. The general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but will be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A code obfuscation method for large models, characterized in that: It includes the following steps: Convert the source code into an Abstract Syntax Tree (AST) through a static analysis tool; Obfuscate the obtained AST, including shuffling the function order in the AST and extracting and splitting variables in the AST to obtain the obfuscated AST; Name replacement step: Swap and replace the variable names and function names in the AST, and semantically reverse the swapped variable names and function names; Encoding and encryption step: Perform base64 or AES encoding on the semantically reversed variable names and function names based on a random perturbation method.

2. A code obfuscation method for large models according to claim 1, characterized in that: Perform base64 or AES encoding on the semantically reversed variable names and function names based on a random perturbation method, specifically including the following steps: For the N semantically reversed variable names and function names, only M variable names and function names will be subjected to base64 or AES encoding operations during the encryption process, where M < N and M / / 2 = 0.

3. A code obfuscation method for large models according to claim 1, characterized in that: Before converting the source code into an AST through a static analysis tool, it also includes the steps: Scan the source code through a static analysis tool to identify unused variables, functions, imported modules, as well as redundant comments and whitespace; Remove the unused variables, functions, imported modules, as well as redundant comments and whitespace to obtain the source code after redundancy removal.

4. A code obfuscation method for large models according to claim 1, characterized in that: It also includes validating the obfuscated code.

5. A code obfuscation method for large models according to claim 4, characterized in that: Validating the obfuscated code specifically includes the following steps: Use a code parsing tool to restore the obfuscated code back to the code form; Use a parser to parse and execute the restored code form to verify the executability of the restored code form and the similarity of the execution result to the source code before obfuscation; Compare the restored code form with the original code before obfuscation.

6. A code obfuscation method for large models according to claim 5, characterized in that: It also includes the steps Add interference comments: Input the restored JS code into an auxiliary large model and generate comments for the obfuscated code in chunks.

7. A code obfuscation system for large models, characterized in that: It includes: Source code input module: Used to input the JS source code; AST generation module: Used to convert the input source code into an Abstract Syntax Tree (AST); AST code obfuscation module: Used to obfuscate the obtained AST, including shuffling the function order in the AST and extracting and splitting variables in the AST to obtain the obfuscated AST; Name replacement module: Used to swap and replace the variable names and function names in the AST, and semantically reverse the swapped variable names and function names; Encoding and encryption module: Used to perform base64 or AES encoding on the semantically reversed variable names and function names based on a random perturbation method.

8. A code obfuscation system for large models according to claim 7, characterized in that: In the encoding and encryption module, performing base64 or AES encoding on the semantically reversed variable names and function names based on a random perturbation method specifically includes the following steps: For the N variable names and function names after all semantic inversions, only M variable names and function names among them will be subjected to base64 or AES encoding operations during the encryption process, where M < N and M / / 2 = 0.

9. A code obfuscation system for large models according to claim 7, characterized in that: It also includes an obfuscated code verification module for verifying the obfuscated code.

10. A computer medium, characterized in that It includes a computer program that, when executed, can implement a code obfuscation method for large models according to any one of claims 1-6.

Images