Embedded executable file analysis method and system

Abstract

The invention provides an embedded executable file analysis method and system, and the method comprises the steps: obtaining an embedded executable file, and recognizing a data segment of the embedded executable file according to an address mapping file and a link script of the embedded executable file; converting a data segment of the embedded executable file into a tensor of a preset dimension, and then establishing a data set of the data segment; establishing a convolutional neural network; training the convolutional neural network by using the data set to obtain a trained convolutional neural network; inputting a to-be-analyzed embedded executable file into the trained convolutional neural network, and outputting the mode and abnormity of the embedded executable file; and / or analyzing the data segments in the embedded executable file by adopting a spectral analysis and clustering algorithm to determine the abnormality of the embedded executable file. Based on the method, the invention further provides an embedded executable file analysis system. According to the method, the embedded executable file is automatically identified and analyzed, and the analysis accuracy and speed are improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer software, and in particular relates to an embedded executable file analysis method and system. Background Art

[0002] Traditional embedded executable file analysis usually relies on manual or simple text editing tools, which is not only inefficient but also prone to errors. Especially in large projects, analyzing embedded executable files to understand the program's memory layout, find potential problems, or debug is a time-consuming and tedious task. In addition, existing analysis tools often lack intelligent analysis capabilities and cannot automatically detect potential error patterns or provide useful insights. Existing analysis tools are designed for one type of embedded executable file and cannot implement dynamic analysis of multiple embedded executable files.

[0003] As the complexity of embedded systems increases, in-depth understanding and rapid analysis of embedded executable files become increasingly important. However, current tools and technologies have not yet fully met this need. Therefore, developing a system and method that can efficiently and intelligently analyze and parse embedded executable files is of great significance for improving development efficiency and ensuring software quality. Summary of the invention

[0004] In order to solve the above technical problems, the present invention proposes an embedded executable file analysis method and system, which automatically identifies the format of embedded executable files, can realize automatic conversion of multiple file formats, reduce manual operations, and improve the parsing speed of embedded executable files through automated tools.

[0005] To achieve the above object, the present invention adopts the following technical solutions:

[0006] An embedded executable file analysis method comprises the following steps:

[0007] Obtain an embedded executable file through an API interface, and identify a data segment of the embedded executable file according to an address mapping file and a link script of the embedded executable file; and establish a data set of the data segment of the embedded executable file after converting the data segment of the embedded executable file into a tensor of a preset dimension; wherein the data segment includes a data record, an address record, and an end record;

[0008] Establish a convolutional neural network for embedded executable file analysis; use the data set to train the convolutional neural network to obtain a trained convolutional neural network; input the embedded executable file to be analyzed into the trained convolutional neural network to output the mode of the embedded executable file and the anomaly of the embedded executable file; and or use spectrum analysis and clustering algorithms to analyze the data segments in the embedded executable file to determine the anomaly of the embedded executable file.

[0009] Furthermore, the method also includes real-time monitoring of the embedded executable file, and when changes in the embedded executable file are monitored, starting analysis of the embedded executable file.

[0010] Furthermore, the method also includes displaying the memory usage, data flow and abnormal location of the embedded executable file in the form of a chart or a map.

[0011] Furthermore, the method also includes generating a report of the embedded executable file analysis, wherein the report includes: key findings, potential problems, code optimization suggestions and an exception list.

[0012] Furthermore, the method also includes: treating the data in the embedded executable file as symbolic input of the program, simulating the execution and tracing possible execution paths to discover potential path errors and boundary condition problems.

[0013] Further, identifying the data segment of the embedded executable file according to the address mapping file and link script of the embedded executable file specifically includes:

[0014] Determine the location and size of the data segment in memory according to the link script, that is, identify the data record of the embedded executable file;

[0015] The layout of the data segment in memory is determined according to the address mapping file, which is used to determine the starting address, ending address and file size.

[0016] Furthermore, the convolutional neural network includes an input layer, a convolutional layer, a pooling layer, a fully connected layer and an output layer;

[0017] The input layer is used to input tensor data of preset dimensions of the embedded executable file;

[0018] The convolutional layer is used to extract local features in the prediction process;

[0019] The pooling layer is used to reduce the local feature dimension;

[0020] The fully connected layer is used to integrate and classify the local features after dimensionality reduction;

[0021] The output layer is used to output the mode of the embedded executable file and the exception of the embedded executable file.

[0022] Furthermore, the process of using spectrum analysis and clustering algorithm to analyze the data segments in the embedded executable file to determine the abnormality of the embedded executable file includes:

[0023] The data segments in the preprocessed embedded executable file are converted into frequency domain signals by using fast Fourier transform;

[0024] According to the frequency domain diagram, a frequency range to be analyzed is selected, and statistics in the frequency domain are extracted;

[0025] Constructing feature vectors using statistics in the frequency domain and normalizing the feature vectors;

[0026] The normalized feature vector is input into a preset clustering algorithm to identify anomalies of the embedded executable file.

[0027] Furthermore, the clustering algorithm adopts K-means clustering algorithm, DBSCAN clustering algorithm or hierarchical clustering algorithm.

[0028] The present invention also proposes an embedded executable file analysis system, comprising: a preprocessing module and an analysis module;

[0029] The preprocessing module is used to obtain an embedded executable file through an API interface, identify a data segment of the embedded executable file according to an address mapping file and a link script of the embedded executable file; and establish a data set of the data segment of the embedded executable file after converting the data segment of the embedded executable file into a tensor of a preset dimension; wherein the data segment includes a data record, an address record, and an end record;

[0030] The analysis module is used to establish a convolutional neural network for embedded executable file analysis; use the data set to train the convolutional neural network to obtain a trained convolutional neural network; input the embedded executable file to be analyzed into the trained convolutional neural network to output the mode of the embedded executable file and the anomaly of the embedded executable file; and or use spectrum analysis and clustering algorithms to analyze the data segments in the embedded executable file to determine the anomaly of the embedded executable file.

[0031] The effects provided in the content of the invention are only the effects of the embodiments, not all the effects of the invention. One of the above technical solutions has the following advantages or beneficial effects:

[0032] The present invention proposes an embedded executable file analysis method and system, which includes the following steps: acquiring an embedded executable file through an API interface, identifying the data segment of the embedded executable file according to the address mapping file and link script of the embedded executable file; converting the data segment of the embedded executable file into a tensor of a preset dimension and establishing a data set of the data segment of the embedded executable file; wherein the data segment includes a data record, an address record and an end record; establishing a convolutional neural network for embedded executable file analysis; using the data set to train the convolutional neural network to obtain a trained convolutional neural network; inputting the embedded executable file to be analyzed into the trained convolutional neural network to output the mode of the embedded executable file and the abnormality of the embedded executable file; and or using spectrum analysis and clustering algorithms to analyze the data segment in the embedded executable file to determine the abnormality of the embedded executable file. Based on an embedded executable file analysis method, an embedded executable file analysis system is also proposed. The present invention automatically identifies and parses embedded executable files, reduces the need for manual intervention, and improves the accuracy and speed of analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 A flow chart of an embedded executable file analysis method proposed in Embodiment 1 of the present invention;

[0034] Figure 2 This is a schematic diagram of an embedded executable file analysis system proposed in Example 2 of the present invention. DETAILED DESCRIPTION

[0035] In order to clearly illustrate the technical features of the present solution, the present invention is described in detail below through specific implementation methods and in conjunction with the accompanying drawings. The disclosure below provides many different embodiments or examples for realizing different structures of the present invention. In order to simplify the disclosure of the present invention, the components and settings of specific examples are described below. In addition, the present invention may repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed. It should be noted that the components illustrated in the accompanying drawings are not necessarily drawn to scale. The present invention omits the description of known components and processing techniques and processes to avoid unnecessary limitations on the present invention.

[0036] Example 1

[0037] Embodiment 1 of the present invention proposes an embedded executable file analysis method, which is used to solve the problem that the prior art cannot implement dynamic analysis of multiple embedded executable files; Figure 1 A flow chart of an embedded executable file analysis method proposed in Embodiment 1 of the present invention;

[0038] In step S100, the process starts.

[0039] In step S110, an embedded executable file is obtained through an API interface;

[0040] The present invention provides an open tool operation API interface, provides an access point for other development tools and services, and enables the entire analysis system to interact and work collaboratively with the external environment. This provides a way for other tools to utilize the functions of the analysis system, expanding the application scope of the system. This allows different development tools and services to integrate the analysis system, realizes cross-platform and cross-tool collaborative work, greatly improves development efficiency and flexibility, and provides developers with a wider range of tool choices and more efficient workflows.

[0041] In step S120, the data segment of the embedded executable file is identified according to the address mapping file and the link script of the embedded executable file;

[0042] The location and size of the data segment in memory are determined according to the link script, that is, the data record of the embedded executable file is identified; the layout of the data segment in memory is determined according to the address mapping file, which is used to determine the starting address, ending address and file size.

[0043] 1. Compilation phase

[0044] Source code compilation: First, the compiler converts the source code into assembly code or directly generates an object file (.o file). During this process, the compiler generates a symbol table to record all the symbols defined in the source code (such as functions, variables, etc.).

[0045] Preprocessing: The compiler also processes preprocessing directives including header files and generates preprocessed code.

[0046] 2. Linking stage

[0047] Linker script: The linker script (or linker configuration file) is used to instruct the linker how to organize the output binary file. It defines the location and size of each segment (such as code segment, data segment, etc.) in memory.

[0048] Symbol resolution: The linker reads the symbol tables in all input target files and resolves undefined external symbol references. If a symbol cannot be found in the current project, the linker will try to find it in the specified library file.

[0049] Relocation: For relative addresses (such as function calls, variable accesses, etc.), the linker adjusts these addresses according to the final memory layout to ensure that the target location can be correctly accessed when the program is running.

[0050] 3. Application of address mapping file

[0051] Memory layout definition: The address mapping file (or configuration file) defines the layout of the program in memory, including the starting address and size of each segment. This is especially important for embedded systems because resources are limited and the storage location of each module needs to be precisely controlled.

[0052] Dynamic allocation: In some cases, it may be necessary to dynamically adjust memory allocation based on the actual operating environment. The address mapping file allows developers to flexibly set the addresses of different segments to meet the needs of different hardware platforms.

[0053] In step S130, the data segment of the embedded executable file is converted into a tensor of a preset dimension, and then a data set of the data segment of the embedded executable file is established; wherein the data segment includes a data record, an address record and an end record;

[0054] Converts data in an embedded executable file into a two-dimensional or three-dimensional tensor. For example, converts a byte stream in a data segment into an image.

[0055] In step S140, a convolutional neural network for embedded executable file analysis is established; the convolutional neural network is trained using the data set to obtain a trained convolutional neural network;

[0056] The convolutional neural network consists of an input layer, a convolutional layer, a pooling layer, a fully connected layer, and an output layer;

[0057] The input layer is used to input tensor data of preset dimensions of the embedded executable file; the input data is preprocessed, such as normalization and denoising.

[0058] The convolutional layer is used to extract local features in the prediction process;

[0059] The pooling layer is used to reduce the local feature dimension;

[0060] The fully connected layer is used to integrate and classify the local features after dimensionality reduction;

[0061] The output layer is used to output the pattern of the embedded executable file and the anomaly of the embedded executable file. Multi-task output: The output layer can be designed as multi-task output to predict the pattern and anomaly respectively.

[0062] Pattern classification: Output one or more class labels representing common patterns in the data;

[0063] Anomaly detection: Outputs one or more anomaly probabilities, indicating the degree of anomaly in the data.

[0064] The model training process includes:

[0065] Loss Function: Define the loss function such as cross entropy loss function (for classification tasks) and mean squared error loss function (for anomaly detection tasks).

[0066] Optimizer: Select an optimizer, such as Adam, SGD, etc.

[0067] Training process: Perform training for multiple epochs and update model parameters in each iteration.

[0068] Forward propagation: Compute the predicted output.

[0069] Calculate loss: Calculate the loss between the predicted output and the true label.

[0070] Backpropagation: Calculate gradients and update model parameters.

[0071] Validation set evaluation: At the end of each epoch, the validation set is used to evaluate the model performance.

[0072] Hyperparameter tuning: Tune hyperparameters such as learning rate, batch size, etc. based on the validation set performance.

[0073] The model evaluation process includes:

[0074] Test set evaluation: Evaluate the final performance of the model on the test set.

[0075] Performance indicators: Calculate performance indicators such as accuracy, recall, and F1 score.

[0076] Anomaly detection performance: Calculate the accuracy, precision, recall, etc. of anomaly detection.

[0077] In step S150, the embedded executable file to be analyzed is input into the trained convolutional neural network to output the mode of the embedded executable file and the anomaly of the embedded executable file;

[0078] And or use spectrum analysis and clustering algorithms to analyze the data segments in the embedded executable file to determine the anomalies of the embedded executable file. This method may not be suitable for all types of error detection, but it is very effective for certain specific problems (such as repetitive patterns or abnormal frequencies).

[0079] The specific process includes:

[0080] 1. Data collection and preprocessing

[0081] 1.1 Data Collection

[0082] Extract data segments: Extract data segments (such as .data, .bss, etc.) from embedded executable files. These segments contain static data used when the program is running.

[0083] Read raw data: Read the contents of the data segment into memory to form a data set.

[0084] 1.2 Data Preprocessing

[0085] Format data: Format the read data, such as converting it into a numerical array or matrix.

[0086] Normalization: Normalize the data to make it within a uniform range for easy subsequent analysis.

[0087] Noise removal: Use filtering techniques (such as low-pass filtering, high-pass filtering, etc.) to remove noise components in the data.

[0088] 2. Spectrum Analysis

[0089] 2.1 Fast Fourier Transform (FFT)

[0090] Apply FFT: Apply Fast Fourier Transform (FFT) to the preprocessed data to convert the time domain signal into the frequency domain signal. This helps to find periodicity and frequency characteristics in the data.

[0091] Spectrogram: Generates a spectrogram showing the amplitudes of different frequency components.

[0092] 2.2 Frequency feature extraction

[0093] Select frequency range: Based on the spectrum plot, select the frequency range of interest for further analysis.

[0094] Calculate frequency domain statistics: extract statistics in the frequency domain, such as maximum, minimum, mean, variance, etc.

[0095] 3. Cluster analysis

[0096] 3.1 Feature vector construction

[0097] Construct feature vector: Combine frequency domain statistics and other useful features (such as time series features) into a feature vector.

[0098] Standardization: Standardize the feature vector to ensure that each feature is on the same scale.

[0099] 3.2 Selecting a clustering algorithm

[0100] K-means: Suitable for finding a fixed number of clusters.

[0101] DBSCAN: Suitable for discovering clusters of arbitrary shapes.

[0102] Hierarchical clustering: suitable for exploring cluster structures at different levels.

[0103] 3.3 Application of clustering algorithm

[0104] Parameter setting: Set the parameters of the clustering algorithm according to the characteristics of the data, such as the number of clusters (K) in K-means.

[0105] Clustering execution: Input the feature vector into the clustering algorithm to obtain the clustering result.

[0106] 4. Anomaly detection and pattern discovery

[0107] 4.1 Anomaly Detection

[0108] Outlier identification: Through clustering results, outliers that are significantly different from most data points are identified.

[0109] Outlier analysis: Further analyze the specific characteristics of the outliers to determine the causes of the anomalies.

[0110] 4.2 Pattern Discovery

[0111] Intra-cluster analysis: Detailed analysis of the data within each cluster to discover its internal regularities.

[0112] Inter-cluster comparison: Compare the differences between different clusters to find commonalities and specificities.

[0113] The method also includes: monitoring the embedded executable file in real time, and starting analysis of the embedded executable file when changes in the embedded executable file are detected.

[0114] Symbolic execution is a powerful software testing method that simulates the execution path of a program by treating the input data in the program as symbolic variables and tracing all possible execution paths. This method can help discover potential defects, vulnerabilities, and errors in the program. The following are detailed steps to explain how to use symbolic execution technology to analyze the data in embedded executable files and simulate the execution process.

[0115] 1. Preparation

[0116] 1.1 Get the executable file

[0117] Extract executable files: Get the executable file to be analyzed (such as .elf file) from the embedded system.

[0118] Disassembly: Use a disassembly tool such as objdump or IDA Pro to convert the executable into assembly code for further analysis.

[0119] 1.2 Defining symbolic variables

[0120] Symbolic variables: treat the input data in the program as symbolic variables rather than specific values. For example, define the input x as a symbolic variable sym_x.

[0121] Symbolic expressions: Arithmetic and logical operations in the program will generate symbolic expressions based on these symbolic variables.

[0122] 2. Initialize the symbol environment

[0123] 2.1 Initialization state

[0124] State management: Create the initial state, including the program counter (PC), registers, memory, etc.

[0125] Symbolic execution engine: Use a symbolic execution engine (such as KLEE, CBMC, etc.) to initialize the symbolic environment.

[0126] Symbolic state: symbolic variables and symbolic expressions that define the initial state.

[0127] 3. Simulation execution

[0128] 3.1 Basic Block Execution

[0129] Basic blocks: Divide the program into basic blocks (i.e. a series of consecutive instructions without branches) and execute them one by one.

[0130] Symbolic execution: In each basic block, symbolic variables are substituted into instructions and symbolic expressions are generated.

[0131] Arithmetic operations: For example, y=x+1 becomes sym_y=sym_x+1.

[0132] Logical operations: For example, z=x<5 becomes sym_z=sym_x<5.

[0133] 3.2 Conditional Branching

[0134] Conditional branch: When a conditional branch (such as an if statement) is encountered, two symbolic substates are generated:

[0135] True path: Assuming the condition is true, generate a substate.

[0136] False path: Assume the condition is false and generate another substate.

[0137] Path constraints: Add corresponding constraints to each path to indicate the branch selection on the path.

[0138] True path constraints: for example, sym_x<5.

[0139] False path constraints: for example, sym_x>=5.

[0140] 3.3 Loop Structure

[0141] Loop unrolling: For loop structures, multiple iterations can be simulated by loop unrolling.

[0142] Loop termination: Use symbolic expressions to determine whether the loop has terminated to avoid infinite loops.

[0143] Loop condition: For example, while(sym_x<10).

[0144] Termination condition: for example, sym_x>=10.

[0145] 4. Path Exploration

[0146] 4.1 Path Search

[0147] Breadth First Search (BFS): Explore all possible paths using a breadth-first search strategy.

[0148] Depth-First Search (DFS): Use a depth-first search strategy to explore deeper paths.

[0149] 4.2 Constraint Solving

[0150] Constraint solver: Use a constraint solver (such as Z3, CVC4, etc.) to solve path constraints and find specific input values ​​that meet the conditions.

[0151] Path selection: Select the next execution path based on the solution results.

[0152] 5. Tracking and analysis

[0153] 5.1 Path Tracing

[0154] Path Recording: Records symbolic expressions and constraints on each path.

[0155] Path status: Maintains the status information of each path, including registers, memory, etc.

[0156] 5.2 Anomaly Detection

[0157] Abnormal paths: Detect paths that may lead to abnormalities, such as division by zero errors, array out of bounds, etc.

[0158] Division by zero error: for example, sym_y / sym_x, where sym_x is 0.

[0159] Array out of bounds: For example, arr[sym_x], where sym_x exceeds the array bounds.

[0160] Coverage analysis: Count the covered basic blocks and paths and evaluate test coverage.

[0161] 5.3 Error Reporting

[0162] Error Reporting: Generates detailed error reports, including the specific input values, paths, and conditions that triggered the error.

[0163] Repair suggestions: Provide repair suggestions to help developers solve problems.

[0164] 6. Results Visualization and Interpretation

[0165] 6.1 Visualization

[0166] Path diagram: Draw a path diagram of the program, showing all possible execution paths.

[0167] Symbolic Expressions: Displays symbolic expressions and constraints on each path.

[0168] 6.2 Interpretation

[0169] Result explanation: Explain the results of symbolic execution and their practical significance in combination with specific application scenarios.

[0170] Report Writing: Write a detailed analysis report summarizing the issues found and providing suggestions for improvements.

[0171] Symbolic execution technology can systematically analyze the data in embedded executable files, simulate the execution path of the program, and track all possible paths. This method can not only help discover potential defects and vulnerabilities in the program, but also improve the security and stability of the program. Symbolic execution technology has a wide range of application value in the fields of software testing and security.

[0172] In step S160, the memory usage, data flow and abnormal location of the embedded executable file are displayed in the form of a chart or a map.

[0173] The interface supports custom views and filtering functions, allowing users to focus on the parts of interest. The user-friendly graphical interface displays the analysis results in the form of charts and maps, which allows developers to more intuitively understand the memory usage, data flow, and abnormal locations of embedded executable files. Custom views and filtering functions further enhance the user experience and allow users to focus on the parts of interest. This visualization method is relatively rare in embedded system development and provides developers with better analysis tools. Help developers better understand the status of embedded executable files. Users can interact with the system through the visual interface and customize views and filters to analyze specific parts in more depth.

[0174] In step S170, a report of the embedded executable file analysis is generated, the report including: key findings, potential problems, code optimization suggestions and an exception list.

[0175] After automatic analysis, the system generates a detailed report, including key findings, potential issues, code optimization suggestions, and exception lists. The report can be exported to multiple formats for easy team sharing and review. The system automatically generates a detailed report and can be exported to multiple formats for easy team sharing and review. This saves developers time and improves the efficiency of team collaboration. The key findings, potential issues, code optimization suggestions, and exception lists in the report provide developers with valuable references and help improve the quality and reliability of embedded systems. Provide developers with key findings, potential issues, code optimization suggestions, and exception lists. The report can be exported to multiple formats for easy team sharing and review, promoting team collaboration and problem solving.

[0176] In step S180, the process ends.

[0177] An embedded executable file analysis method proposed in Example 1 of the present invention automatically identifies and parses embedded executable files, reduces the need for manual intervention, and improves the accuracy and speed of analysis.

[0178] Example 2

[0179] Based on the embedded executable file analysis method proposed in Embodiment 1 of the present invention, Embodiment 2 of the present invention further proposes an embedded executable file analysis system. Figure 2 A schematic diagram of an embedded executable file analysis system proposed in Embodiment 2 of the present invention, the system comprising: a preprocessing module and an analysis module;

[0180] The preprocessing module is used to obtain an embedded executable file through an API interface, identify the data segment of the embedded executable file according to the address mapping file and link script of the embedded executable file; convert the data segment of the embedded executable file into a tensor of a preset dimension and then establish a data set of the data segment of the embedded executable file; wherein the data segment includes a data record, an address record and an end record;

[0181] The analysis module is used to establish a convolutional neural network for embedded executable file analysis; use the data set to train the convolutional neural network to obtain a trained convolutional neural network; input the embedded executable file to be analyzed into the trained convolutional neural network to output the mode of the embedded executable file and the anomaly of the embedded executable file; and or use spectrum analysis and clustering algorithms to analyze the data segments in the embedded executable file to determine the anomaly of the embedded executable file.

[0182] In the preprocessing module: identifying the data segment of the embedded executable file according to the address mapping file and the link script of the embedded executable file specifically includes: determining the position and size of the data segment in the memory according to the link script, that is, identifying the data record of the embedded executable file; determining the layout of the data segment in the memory according to the address mapping file, which is used to determine the starting address, the ending address and the file size.

[0183] In the analysis module, the convolutional neural network includes an input layer, a convolution layer, a pooling layer, a fully connected layer and an output layer; the input layer is used to input tensor data of a preset dimension of an embedded executable file; the convolution layer is used to extract local features in the prediction process; the pooling layer is used to reduce the dimension of local features; the fully connected layer is used to integrate and classify the local features after dimensionality reduction; the output layer is used to output the pattern of the embedded executable file and the anomalies of the embedded executable file.

[0184] The process of using spectrum analysis and clustering algorithm to analyze the data segments in the embedded executable file to determine the abnormality of the embedded executable file includes: using fast Fourier transform to convert the time domain signal into the frequency domain signal for the preprocessed data segments in the embedded executable file; selecting the frequency range to be analyzed according to the frequency domain diagram, extracting the statistics in the frequency domain; constructing the feature vector using the statistics in the frequency domain, and normalizing the feature vector; inputting the normalized feature vector into the preset clustering algorithm to identify the abnormality of the embedded executable file. The clustering algorithm uses K-means clustering algorithm, DBSCAN clustering algorithm or hierarchical clustering algorithm.

[0185] Monitor the embedded executable file in real time, and start the analysis of the embedded executable file when the embedded executable file is monitored to change;

[0186] Display the memory usage, data flow and abnormal location of embedded executable files in the form of charts or maps;

[0187] Generate a report of embedded executable file analysis, the report including: key findings, potential issues, code optimization suggestions and exception list;

[0188] The data in the embedded executable file is treated as the symbolic input of the program, the execution is simulated and the possible execution paths are traced to find potential path errors and boundary condition problems.

[0189] An embedded executable file analysis system proposed in Example 2 of the present invention automatically identifies and parses embedded executable files, reduces the need for manual intervention, and improves the accuracy and speed of analysis.

[0190] The description of the relevant parts of an embedded executable file analysis system provided in Example 2 of the present application can be found in the detailed description of the corresponding parts of an embedded executable file analysis method provided in Example 1 of the present application, and will not be repeated here.

[0191] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the term "include", "comprise" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or equipment that includes a series of elements are inherent to the elements. In the absence of more restrictions, the elements limited by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or equipment that includes the elements. In addition, the above-mentioned technical solution provided in the embodiment of the present application is consistent with the corresponding technical solution in the prior art in principle, and the part is not described in detail, so as not to repeat too much.

[0192] Although the above describes the specific implementation of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. For those skilled in the art, other different forms of modifications or deformations can be made on the basis of the above description. It is not necessary and impossible to list all the implementation methods here. On the basis of the technical solution of the present invention, various modifications or deformations that can be made by those skilled in the art without creative work are still within the scope of protection of the present invention.

Claims

1. An embedded executable file analysis method, characterized in that: The following steps are involved: Obtain the embedded executable file through the API interface, and identify the data segment of the embedded executable file according to the address mapping file and link script of the embedded executable file; After converting the data segment of the embedded executable file into a tensor of a preset dimension, a data set of the data segment of the embedded executable file is established; The data segment includes data record, address record and end record; Establishing a convolutional neural network for embedded executable file analysis; using the data set to train the convolutional neural network to obtain a trained convolutional neural network; inputting the embedded executable file to be analyzed into the trained convolutional neural network to output the mode of the embedded executable file and the anomaly of the embedded executable file; And or use spectrum analysis and clustering algorithm to analyze the data segments in the embedded executable file to determine the abnormality of the embedded executable file.

2. The embedded executable file analysis method according to claim 1, characterized in that: The method also includes real-time monitoring of the embedded executable file, and when changes in the embedded executable file are detected, starting analysis of the embedded executable file.

3. The embedded executable file analysis method according to claim 1, characterized in that: The method also includes displaying the memory occupancy, data flow and abnormal location of the embedded executable file in the form of a chart or a map.

4. The embedded executable file analysis method according to claim 1, characterized in that: The method also includes generating a report of the embedded executable file analysis, the report including: key findings, potential problems, code optimization suggestions and an exception list.

5. The embedded executable file analysis method according to claim 1, characterized in that: The method also includes: considering the data in the embedded executable file as symbolic input of the program, simulating execution and tracing possible execution paths to discover potential path errors and boundary condition problems.

6. The embedded executable file analysis method according to claim 1, characterized in that: According to the address mapping file and link script of the embedded executable file, the data segment of the embedded executable file is identified as follows: Determine the location and size of the data segment in memory according to the link script, that is, identify the data record of the embedded executable file; The layout of the data segment in memory is determined according to the address mapping file, which is used to determine the starting address, ending address and file size.

7. The embedded executable file analysis method according to claim 1, characterized in that: The convolutional neural network includes an input layer, a convolution layer, a pooling layer, a fully connected layer and an output layer; The input layer is used to input tensor data of preset dimensions of the embedded executable file; The convolutional layer is used to extract local features in the prediction process; The pooling layer is used to reduce the local feature dimension; The fully connected layer is used to integrate and classify the local features after dimensionality reduction; The output layer is used to output the mode of the embedded executable file and the exception of the embedded executable file.

8. The embedded executable file analysis method according to claim 1, characterized in that: The process of analyzing the data segments in the embedded executable file by using spectrum analysis and clustering algorithm to determine the abnormality of the embedded executable file includes: The data segments in the preprocessed embedded executable file are converted into frequency domain signals by using fast Fourier transform; According to the frequency domain diagram, a frequency range to be analyzed is selected, and statistics in the frequency domain are extracted; Constructing feature vectors using statistics in the frequency domain and normalizing the feature vectors; The normalized feature vector is input into a preset clustering algorithm to identify anomalies of the embedded executable file.

9. The embedded executable file analysis method according to claim 8, characterized in that: The clustering algorithm adopts K-means clustering algorithm, DBSCAN clustering algorithm or hierarchical clustering algorithm.

10. An embedded executable file analysis system, characterized in that: Includes a preprocessing module and an analysis module; The preprocessing module is used to obtain the embedded executable file through the API interface, and identify the data segment of the embedded executable file according to the address mapping file and link script of the embedded executable file; After converting the data segment of the embedded executable file into a tensor of a preset dimension, a data set of the data segment of the embedded executable file is established; The data segment includes data record, address record and end record; The analysis module is used to establish a convolutional neural network for embedded executable file analysis; train the convolutional neural network using the data set to obtain a trained convolutional neural network; input the embedded executable file to be analyzed into the trained convolutional neural network to output the mode of the embedded executable file and the abnormality of the embedded executable file; And or use spectrum analysis and clustering algorithm to analyze the data segments in the embedded executable file to determine the abnormality of the embedded executable file.

Images