Similarity detection method and device, equipment and medium

Abstract

The invention provides a similarity detection method and device, equipment and a medium. The similarity detection method comprises the steps of obtaining a first assembly code and a second assembly code for similarity detection; encoding the first assembly code and the second assembly code to obtain a first vector corresponding to the first assembly code and a second vector corresponding to the second assembly code; and inputting the first vector and the second vector into a similarity detection model, and determining the similarity of the first vector and the second vector. The method is used for solving the problem that the detection cost is remarkably increased due to the fact that similarity detection needs to consume a large number of resources and the similarity detection precision is low when the calculated data volume is large and data loss exists in the related technology, the similarity between assembly codes is judged by using the similarity detection model, and the detection efficiency is improved. The detection time and the calculation cost are greatly reduced, and the detection precision is remarkably improved.

Description

Technical Field

[0001] The present invention relates to the technical field of assembly language, and in particular to a similarity detection method, device, equipment and medium. Background Art

[0002] In the related art, for the same high-level language, if different compilers are used, different optimization options are changed, and other operations, the generated binary code may change significantly, resulting in a large amount of calculated data when judging the similarity of the binary code, and data loss may occur. As a result, the similarity detection requires a lot of resources and the similarity detection accuracy is low, which in turn leads to a significant increase in the cost of detection. Summary of the invention

[0003] The present invention provides a similarity detection method, device, equipment and medium to solve the problem in the related art that the amount of calculated data is relatively large and there is data loss, which causes the similarity detection to consume a large amount of resources and the similarity detection accuracy is low, thereby causing the cost of detection to increase significantly.

[0004] The present invention provides a similarity detection method, which is applied to an authoritative server and includes the following steps.

[0005] Obtain a first assembly code and a second assembly code for similarity detection; Encode the first assembly code and the second assembly code to obtain a first vector corresponding to the first assembly code and a second vector corresponding to the second assembly code; The first vector and the second vector are input into a similarity detection model to determine the similarity between the first vector and the second vector.

[0006] According to a similarity detection method provided by the present invention, the similarity detection model is trained by the following method: Get assembly code sample pairs; Annotate the assembly code sample pairs to obtain annotation results corresponding to the assembly code sample pairs; Taking the assembly code sample pair as input, the similarity of the corresponding output of the assembly code sample pair is compared with the corresponding annotation result of the assembly code sample pair; A similarity detection model is generated based on the difference between the similarity of the corresponding outputs of the assembly code sample pairs and the corresponding annotation results of the assembly code sample pairs.

[0007] According to a similarity detection method provided by the present invention, before obtaining the assembly code sample pair, the method further includes: Preprocess the assembly code samples.

[0008] According to a similarity detection method provided by the present invention, obtaining an assembly code sample pair includes: According to the preset positive-negative sample ratio, binary function pairs with the same function are selected to form positive sample pairs, and binary function pairs with different functions are selected to form negative sample pairs; the positive sample pairs and the negative sample pairs are combined to form assembly code sample pairs.

[0009] According to a similarity detection method provided by the present invention, annotating an assembly code sample pair to obtain an annotation result corresponding to the assembly code sample pair includes: Annotate the assembly code sample pairs to obtain annotation results corresponding to the assembly code sample pairs; Compile the annotated assembly code sample pairs into target vectors; Determine the cross entropy loss function for the assembly code sample pair based on the target vector; Correct the annotation results according to the cross entropy loss function.

[0010] According to a similarity detection method provided by the present invention, a similarity detection model is generated by training based on the difference between the similarity of the corresponding outputs of the assembly code sample pairs and the corresponding annotation results of the assembly code sample pairs, including: Determine the network parameter gradient of the similarity detection model according to the similarity; Update the similarity detection model based on the network parameter gradient.

[0011] According to a similarity detection method provided by the present invention, a first vector and a second vector are input into a similarity detection model to determine the similarity between the first vector and the second vector, including: The similarity between two representation vectors is calculated using the following formula:

[0012] Among them, A is the first vector, B is the second vector, represents the components of the first vector, Represents the components of the second vector. Represents the similarity between the first vector and the second vector.

[0013] The present invention also provides a similarity detection device, comprising the following modules: An acquisition module, used for acquiring a first assembly code and a second assembly code for similarity detection; An encoding module, used for encoding the first assembly code and the second assembly code to obtain a first vector corresponding to the first assembly code and a second vector corresponding to the second assembly code; The processing module is used to input the first vector and the second vector into a similarity detection model to determine the similarity between the first vector and the second vector.

[0014] According to a similarity detection device provided by the present invention, the processing module is also used to train a similarity detection model by the following method: Get assembly code sample pairs; Annotate the assembly code sample pairs to obtain annotation results corresponding to the assembly code sample pairs; Taking the assembly code sample pair as input, the similarity of the corresponding output of the assembly code sample pair is compared with the corresponding annotation result of the assembly code sample pair; A similarity detection model is generated based on the difference between the similarity of the corresponding outputs of the assembly code sample pairs and the corresponding annotation results of the assembly code sample pairs.

[0015] According to a similarity detection device provided by the present invention, the processing module is further used for: Preprocess the assembly code samples.

[0016] According to a similarity detection device provided by the present invention, the processing module is specifically used for: According to the preset positive-negative sample ratio, binary function pairs with the same function are selected to form positive sample pairs, and binary function pairs with different functions are selected to form negative sample pairs; the positive sample pairs and the negative sample pairs are combined to form assembly code sample pairs.

[0017] According to a similarity detection device provided by the present invention, the processing module is specifically used for: Annotate the assembly code sample pairs to obtain annotation results corresponding to the assembly code sample pairs; Compile the annotated assembly code sample pairs into target vectors; Determine the cross entropy loss function for the assembly code sample pair based on the target vector; Correct the annotation results according to the cross entropy loss function.

[0018] According to a similarity detection device provided by the present invention, the processing module is specifically used for: Determine the network parameter gradient of the similarity detection model according to the similarity; Update the similarity detection model based on the network parameter gradient.

[0019] According to a similarity detection device provided by the present invention, the processing module is specifically used for: The similarity between two representation vectors is calculated using the following formula:

[0020] Among them, A is the first vector, B is the second vector, represents the components of the first vector, Represents the components of the second vector. Represents the similarity between the first vector and the second vector.

[0021] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, any of the similarity detection methods described above is implemented.

[0022] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, any of the similarity detection methods described above is implemented.

[0023] The present invention also provides a computer program product, comprising a computer program, and when the computer program is executed by a processor, any of the above similarity detection methods is implemented.

[0024] The similarity detection method provided by the present invention first obtains a first assembly code and a second assembly code for similarity detection, then encodes the first assembly code and the second assembly code to obtain a first vector corresponding to the first assembly code and a second vector corresponding to the second assembly code, and finally inputs the first vector and the second vector into a similarity detection model to determine the similarity between the first vector and the second vector. By using the similarity detection model to judge the similarity between assembly codes, the detection time and calculation cost are greatly reduced, and the detection accuracy is significantly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0026] Figure 1 It is a flow chart of a similarity detection method provided by the present invention; Figure 2 A schematic diagram of a process flow of a similarity detection model training method provided by the present invention; Figure 3 A schematic diagram of the principle of compilation data processing provided by the present invention; Figure 4 A structural schematic diagram of a similarity detection model provided by the present invention; Figure 5 A schematic diagram of the principle of a similarity detection system provided for the invention; Figure 6 It is a structural schematic diagram of a similarity detection device provided by the present invention; Figure 7 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] In the related art, for the same high-level language, if different compilers are used, different optimization options are changed, and other operations, the generated binary code may change significantly, resulting in a large amount of calculated data when judging the similarity of the binary code, and data loss may occur. As a result, the similarity detection requires a lot of resources and the similarity detection accuracy is low, which in turn leads to a significant increase in the cost of detection.

[0029] Therefore, there is an urgent need for a similarity detection method to solve the above problems.

[0030] Combine the following Figure 1-Figure 7 The similarity detection method, device, equipment and medium of the present invention are described.

[0031] Figure 1 It is one of the flow charts of the similarity detection method provided by the present invention, such as Figure 1 As shown, the method includes the following: Step 101: Obtain a first assembly code and a second assembly code for similarity detection.

[0032] During specific implementation, two assembly code texts to be detected are obtained and respectively determined to be a first assembly code and a second assembly code.

[0033] Step 102: Encode the first assembly code and the second assembly code to obtain a first vector corresponding to the first assembly code and a second vector corresponding to the second assembly code.

[0034] In a specific implementation, the first assembly code and the second assembly code obtained in step 101 are encoded to obtain a first vector corresponding to the first assembly code and a second vector corresponding to the second assembly code, respectively.

[0035] Step 103: Input the first vector and the second vector into a similarity detection model to determine the similarity between the first vector and the second vector.

[0036] In specific implementation, the first vector and the second vector are input into the similarity detection model to obtain the similarity. Specifically, A and B are used to refer to the first vector and the second vector respectively. The similarity between the first assembly code and the second assembly code, that is, the calculation of the cosine similarity is as follows:

[0037] A is the first vector, B is the second vector, represents the components of the first vector, Represents the components of the second vector.

[0038] Combine the following Figure 2-Figure 5 , the training method of the similarity detection model used in the above embodiment is described in detail, such as Figure 2 As shown, the method includes the following: Step 201: Obtain an assembly code sample pair.

[0039] In the specific implementation, the sample data is first preprocessed. Specifically, an assembly language function consists of multiple instructions, each of which consists of an opcode and an operand. Therefore, according to the characteristics of the assembly code string, the opcode is treated as a separate token and added to the index dictionary, and the common symbols in the operand are used as separators to decompose different tokens. Then the frequency of occurrence of the token in the sample set is filtered.

[0040] After preprocessing, according to the preset positive-negative sample ratio, binary function pairs with the same function are selected to form positive sample pairs, and binary function pairs with different functions are selected to form negative sample pairs; the positive sample pairs and negative sample pairs are used to form assembly code sample pairs. Specifically, binary function pairs with the same function but different optimization options or compilers are selected to form positive sample pairs, and binary function pairs with different functions are randomly selected to form negative sample pairs. In a possible implementation, the positive-negative sample ratio is controlled at 1:30. Of course, other ratios can also be selected, and the embodiment of the present invention does not limit this. In this step, samples with the same assembly string in the positive sample can also be filtered out.

[0041] Step 202: annotate the assembly code sample pair to obtain an annotation result corresponding to the assembly code sample pair.

[0042] In the specific implementation, the assembly code sample pairs are labeled to obtain the corresponding labeling results of the assembly code sample pairs, and then the labeled assembly code sample pairs are compiled into target vectors. Then, the cross entropy loss function of the assembly code sample pairs is determined based on the target vector, and the labeling results are corrected according to the cross entropy loss function. Specifically, for each assembly code sample, an opcode or operand tag is randomly replaced with a tag, and this opcode or operand tag exists in the dictionary. The above operation is repeated multiple times for each assembly code to generate multiple pre-training samples, and then the samples are compiled into vectors, and the dictionary index number of the marked tag is recorded as a label.

[0043] During compilation, for an assembly code string consisting of multiple instruction strings, each instruction is considered as a dynamic embedding vector. This dynamic vector is composed of an opcode embedding vector, multiple operand embedding vectors, and a position embedding vector concatenated along the feature dimension, and then truncated and completed according to the number of tags.

[0044] After that, the embedding vectors of multiple pre-trained samples are randomly selected and input into the small model, a hidden vector is output, and the hidden vector is input into a fully connected classification network. The final output is the probability of each tag in the dictionary. Then, the cross entropy loss function is used to calculate the loss value of the output category probability and the actual tag category. The formula of the cross entropy loss function is as follows:

[0045] where M is the number of categories, Represents a sign function (0 or 1), which takes 1 when the true category of sample i is equal to c, and takes 0 otherwise. The predicted probability that observation i belongs to category c.

[0046] Step 203: Taking the assembly code sample pair as input, comparing the similarity of the corresponding output of the assembly code sample pair with the corresponding annotation result of the assembly code sample pair, and training and generating a similarity detection model based on the difference between the similarity of the corresponding output of the assembly code sample pair and the corresponding annotation result of the assembly code sample pair.

[0047] In the specific implementation, the network parameter gradient of the similarity detection model is determined according to the similarity; the similarity detection model is updated based on the network parameter gradient. Specifically, each sample pair will call the similarity detection model twice, and the similarity detection model will be forward propagated to obtain the feature layer output , That is, the representation vector of the sample, and each sample pair will get two representation vectors. In order to increase the similarity between the representation vectors of homologous samples and reduce the similarity between the representation vectors of non-homologous samples, the cosine similarity loss function is used as the objective function, and the formula is as follows:

[0048] in Represents model parameters. Margin is a hyperparameter and its value can be set according to training requirements. In a possible implementation, it is set to 0.9.

[0049] Finally, the network parameter gradient is calculated, and the Adam (Adaptive Moment Estimation) gradient descent method is used to update the network parameters to complete the training of the similarity detection model.

[0050] The similarity detection method provided by the embodiment of the present invention is described in detail below in conjunction with the structure of a specific similarity detection system.

[0051] The similarity detection system consists of six parts: assembly code preprocessing unit, assembly code encoding unit, training sample sampling unit, pre-training unit, fine-tuning unit, and binary code similarity calculation unit, among which: The assembly code preprocessing unit is used to clean the assembly code text, extract a large number of tokens from the assembly instructions by directly treating the opcode as a token and separating multiple tokens from the operand through a separator, and finally filter the tokens decomposed in the operand according to the frequency of occurrence, retain the tokens with high frequency, and finally save all different tokens into a dictionary. Specifically, in the dictionary, each token corresponds to a different index number, and the index number is less than the dictionary length.

[0052] Specifically, according to the characteristics of the assembly code string, an assembly language function consists of multiple instructions, each instruction consists of an opcode and an operand. The opcode is treated as a separate tag and added to the index dictionary, where each tag corresponds to a different index number, and the index number is less than the dictionary length. In specific operations, common symbols in the operands, such as "+", ":", "", ";" and spaces, can be used as separators to decompose different tags. Then, for the tags in the operands, we filter them according to the frequency of occurrence of the tags in the sample set. In one embodiment, by setting the hyperparameter F, the tags with a frequency less than F are discarded, so that the number of tags is reduced to within the specified range, and these tags are added to the index dictionary.

[0053] The assembly code encoding unit is used to perform word segmentation and tokenization on the assembly text through the dictionary obtained in the assembly code preprocessing unit, and then truncate and fill the tokenized text, and finally map the tokenized text into an embedding vector through a word embedding matrix.

[0054] Specifically, if Figure 3As shown in the figure, for an assembly code string consisting of multiple instruction strings, each instruction is regarded as a dynamic embedding vector. This dynamic vector is composed of an opcode tag embedding vector, multiple operand tag embedding vectors, and a position embedding vector concatenated along the feature dimension. If the number of tags in the instruction is greater than the threshold K, it will be truncated; if it is less than K, it will be completed with a special tag vector.

[0055] The training sample sampling unit is used to construct positive sample pairs and negative sample pairs by random sampling, wherein the positive sample pair represents two samples with the same function but different binary codes, and the negative sample pair represents two samples with different binary codes.

[0056] The pre-training unit is used to randomly replace a token in the assembly text with a special symbol mask, and then predict the original token at the mask position through a small model. The loss function uses the cross entropy loss.

[0057] The fine-tuning unit is used to train the twin network framework based on the small network to obtain a similarity detection model. This unit first inputs the embedding vectors of the two samples in the sample pair into the small network in sequence, and finally outputs the representation vectors of the two samples in sequence. The two representation vectors are then input into the loss function to calculate the loss. The loss function is the cosine loss function.

[0058] Specifically, the similarity detection model is trained through pre-training units and fine-tuning units. The network structure is as follows: Figure 4 As shown, it includes three parts: input layer, hidden layer, and output layer. The input layer is composed of the input text embedding vector, and the hidden layer is composed of the Text-CNN network. Of course, other networks can also be used, such as MLP-Mixer, LSTM, GRU, etc., which are not limited in this embodiment of the present invention. The output layer is a fully connected layer that maps the hidden vector to a representation vector. In the pre-training stage, the dimension of the representation vector is the number of labeled categories.

[0059] The binary code similarity calculation unit is used to obtain a representation vector by inputting the assembly text embedding vector of the unknown binary code into the trained small network model, and then calculate the similarity between the representation vector and other representation vectors through cosine similarity. The similarity is used to display the similarity between binary codes.

[0060] The specific system operation process is as follows Figure 5As shown, the assembly code data set is input into the assembly code preprocessing unit to extract the dictionary. In order to perform pre-training, the assembly code encoding unit and the dictionary are also used to process the assembly data and convert it into a vector. In the pre-training unit, a pre-training sample is constructed by randomly replacing the label embedding vector of an operand or an operation code with a mask embedding vector, and then the small network is pre-trained. After the pre-training is completed, the small model will be fine-tuned. First, the assembly code data will be input into the training sample sampling unit for sampling, and then the sampled sample pairs and the dictionary are input into the assembly code encoding unit to generate two embedding vectors, and then the two embedding vectors are input into the fine-tuning unit. At this time, the fine-tuning unit will be initialized with the weights of the small network trained in the pre-training stage, and fine-tuning training will begin. For the input test sample pairs and the actual use of the model, two embedding vectors are directly input into the assembly code encoding unit to generate two embedding vectors, and then input into the fine-tuned small network to obtain two representation vectors. Finally, the two representation vectors are input into the binary code similarity calculation unit to obtain the final similarity.

[0061] The similarity detection device provided by the present invention is described below. The similarity detection device described below and the similarity detection method described above can be referred to each other.

[0062] like Figure 6 As shown, a similarity detection device provided by the present invention includes the following modules: An acquisition module 601 is used to acquire a first assembly code and a second assembly code for similarity detection; An encoding module 602 is used to encode the first assembly code and the second assembly code to obtain a first vector corresponding to the first assembly code and a second vector corresponding to the second assembly code; The processing module 603 is used to input the first vector and the second vector into a similarity detection model to determine the similarity between the first vector and the second vector.

[0063] According to a similarity detection device provided by the present invention, the processing module 603 is further used to train a similarity detection model by the following method: Get assembly code sample pairs; Annotate the assembly code sample pairs to obtain annotation results corresponding to the assembly code sample pairs; Taking the assembly code sample pair as input, the similarity of the corresponding output of the assembly code sample pair is compared with the corresponding annotation result of the assembly code sample pair; A similarity detection model is generated based on the difference between the similarity of the corresponding outputs of the assembly code sample pairs and the corresponding annotation results of the assembly code sample pairs.

[0064] According to a similarity detection device provided by the present invention, the processing module 603 is further used for: Preprocess the assembly code samples.

[0065] According to a similarity detection device provided by the present invention, the processing module 603 is specifically used for: According to the preset positive-negative sample ratio, binary function pairs with the same function are selected to form positive sample pairs, and binary function pairs with different functions are selected to form negative sample pairs; the positive sample pairs and the negative sample pairs are combined to form assembly code sample pairs.

[0066] According to a similarity detection device provided by the present invention, the processing module 603 is specifically used for: Annotate the assembly code sample pairs to obtain annotation results corresponding to the assembly code sample pairs; Compile the annotated assembly code sample pairs into target vectors; Determine the cross entropy loss function for the assembly code sample pair based on the target vector; Correct the annotation results according to the cross entropy loss function.

[0067] According to a similarity detection device provided by the present invention, the processing module 603 is specifically used for: Determine the network parameter gradient of the similarity detection model according to the similarity; Update the similarity detection model based on the network parameter gradient.

[0068] According to a similarity detection device provided by the present invention, the processing module 603 is specifically used for: The similarity between two representation vectors is calculated using the following formula:

[0069] Among them, A is the first vector, B is the second vector, represents the components of the first vector, Represents the components of the second vector. Represents the similarity between the first vector and the second vector.

[0070] Figure 7 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 7 As shown, the electronic device may include: a processor 710, a communications interface 720, a memory 730 and a communication bus 740, wherein the processor 710, the communications interface 720 and the memory 730 communicate with each other through the communication bus 740. The processor 710 may call the logic instructions in the memory 730 to execute the similarity detection method, which includes: Obtain a first assembly code and a second assembly code for similarity detection; Encode the first assembly code and the second assembly code to obtain a first vector corresponding to the first assembly code and a second vector corresponding to the second assembly code; The first vector and the second vector are input into a similarity detection model to determine the similarity between the first vector and the second vector.

[0071] In addition, the logic instructions in the above-mentioned memory 730 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0072] On the other hand, the present invention further provides a computer program product, the computer program product comprising a computer program, the computer program can be stored in a non-transitory computer-readable storage medium, when the computer program is executed by a processor, the computer can execute the similarity detection method provided by the above methods, the method comprising: Obtain a first assembly code and a second assembly code for similarity detection; Encode the first assembly code and the second assembly code to obtain a first vector corresponding to the first assembly code and a second vector corresponding to the second assembly code; The first vector and the second vector are input into a similarity detection model to determine the similarity between the first vector and the second vector.

[0073] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the similarity detection method provided by the above methods is implemented, and the method includes: Obtain a first assembly code and a second assembly code for similarity detection; Encode the first assembly code and the second assembly code to obtain a first vector corresponding to the first assembly code and a second vector corresponding to the second assembly code; The first vector and the second vector are input into a similarity detection model to determine the similarity between the first vector and the second vector.

[0074] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0075] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0076] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A similarity detection method, characterized in that: The method comprises: Obtain a first assembly code and a second assembly code for similarity detection; Encode the first assembly code and the second assembly code to obtain a first vector corresponding to the first assembly code and a second vector corresponding to the second assembly code; The first vector and the second vector are input into a similarity detection model to determine the similarity between the first vector and the second vector.

2. The similarity detection method according to claim 1, characterized in that: The similarity detection model is trained by the following method: Get assembly code sample pairs; Annotating the assembly code sample pair to obtain an annotation result corresponding to the assembly code sample pair; Taking the assembly code sample pair as input, comparing the similarity of the output corresponding to the assembly code sample pair with the annotation result corresponding to the assembly code sample pair; The similarity detection model is generated by training based on the difference between the similarity of the corresponding outputs of the assembly code sample pair and the corresponding annotation results of the assembly code sample pair.

3. The similarity detection method according to claim 2, characterized in that: Before obtaining the assembly code sample pair, the method further includes: The assembly code sample pair is preprocessed.

4. The similarity detection method according to claim 3, characterized in that: The obtaining of the assembly code sample pair comprises: According to the preset positive-negative sample ratio, binary function pairs with the same functions are selected to form positive sample pairs, and binary function pairs with different functions are selected to form negative sample pairs; The positive sample pair and the negative sample pair constitute the assembly code sample pair.

5. The similarity detection method according to claim 3, characterized in that: The step of marking the assembly code sample pair to obtain a marking result corresponding to the assembly code sample pair includes: Annotating the assembly code sample pair to obtain an annotation result corresponding to the assembly code sample pair; Compile the annotated assembly code sample pair into a target vector; Determining a cross entropy loss function for the assembly code sample pair based on the target vector; The labeling result is corrected according to the cross entropy loss function.

6. The similarity detection method according to claim 3, characterized in that: The generating the similarity detection model based on the difference between the similarity of the outputs corresponding to the assembly code sample pair and the annotation results corresponding to the assembly code sample pair includes: Determining a network parameter gradient of the similarity detection model according to the similarity; The similarity detection model is updated based on the network parameter gradient.

7. The similarity detection method according to claim 1, characterized in that: The step of inputting the first vector and the second vector into a similarity detection model to determine the similarity between the first vector and the second vector includes: The similarity between two representation vectors is calculated using the following formula: Wherein, A is the first vector, B is the second vector, represents the components of the first vector, represents the components of the second vector. represents the similarity between the first vector and the second vector.

8. A similarity detection device, characterized in that: include: An acquisition module, used for acquiring a first assembly code and a second assembly code for similarity detection; an encoding module, configured to encode the first assembly code and the second assembly code to obtain a first vector corresponding to the first assembly code and a second vector corresponding to the second assembly code; The processing module is used to input the first vector and the second vector into a similarity detection model to determine the similarity between the first vector and the second vector.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the similarity detection method according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the similarity detection method according to any one of claims 1 to 7 is implemented.

Images