Similarity detection method, apparatus, device, and medium

Abstract

The application provides a similarity detection method, device, equipment and medium, comprising: obtaining first assembly code and second assembly code for similarity detection; encoding the first assembly code and the second assembly code to obtain a first vector corresponding to the first assembly code and a second vector corresponding to the second assembly code; inputting the first vector and the second vector into a similarity detection model to determine the similarity of the first vector and the second vector. The method is used to solve the problem that in the related art, the amount of calculation data is large, there is data loss, the similarity detection consumes a large amount of resources, the similarity detection accuracy is low, and the cost of detection is significantly increased. By using the similarity detection model to judge the similarity between the assembly codes, the detection time and the calculation cost are greatly reduced, and the detection accuracy is significantly improved.

Description

Technical Field

[0001] This invention relates to the field of assembly language technology, and in particular to a similarity detection method, apparatus, device, and medium. Background Technology

[0002] In related technologies, for the same high-level language, using different compilers or changing different optimization options can cause significant changes in the generated binary code. This results in a large amount of data being calculated when judging the similarity of binary code, and there is a possibility of data loss. Consequently, similarity detection requires a lot of resources and has low accuracy, leading to a significant increase in detection costs. Summary of the Invention

[0003] This invention provides a similarity detection method, apparatus, device, and medium to address the problem in related technologies where the amount of computational data is enormous, data loss occurs, and similarity detection requires a large amount of resources while maintaining low accuracy, thus significantly increasing detection costs.

[0004] This invention provides a similarity detection method applied to an authoritative server, comprising the following steps.

[0005] Obtain the first assembly code and the second assembly code used for similarity detection;

[0006] Encode the first assembly code and the second assembly code to obtain a first vector corresponding to the first assembly code and a second vector corresponding to the second assembly code;

[0007] The first vector and the second vector are input into the similarity detection model to determine the similarity between the first vector and the second vector.

[0008] According to a similarity detection method provided by the present invention, the similarity detection model is trained by the following method:

[0009] Obtain assembly code sample pairs;

[0010] Annotate the assembly code sample pairs to obtain the annotation results corresponding to the assembly code sample pairs;

[0011] Using assembly code sample pairs as input, the similarity of the output corresponding to the assembly code sample pairs is compared with the annotation results corresponding to the assembly code sample pairs;

[0012] A similarity detection model is trained based on the similarity between the output of the assembly code sample pairs and the difference between the annotation results of the assembly code sample pairs.

[0013] According to a similarity detection method provided by the present invention, before obtaining assembly code sample pairs, the method further includes:

[0014] Preprocess the assembly code sample pairs.

[0015] According to a similarity detection method provided by the present invention, obtaining assembly code sample pairs includes:

[0016] Based on the preset positive and negative sample ratio, binary function pairs with the same function are selected to form positive sample pairs, and binary function pairs with different functions are selected to form negative sample pairs; the positive sample pairs and negative sample pairs are then combined to form assembly code sample pairs.

[0017] According to a similarity detection method provided by the present invention, assembly code sample pairs are labeled to obtain the labeling results corresponding to the assembly code sample pairs, including:

[0018] Annotate the assembly code sample pairs to obtain the annotation results corresponding to the assembly code sample pairs;

[0019] Compile the annotated assembly code sample pairs into target vectors;

[0020] The cross-entropy loss function for assembly code sample pairs is determined based on the target vector;

[0021] The labeling results are corrected based on the cross-entropy loss function.

[0022] According to a similarity detection method provided by the present invention, a similarity detection model is trained and generated based on the difference between the similarity of the corresponding outputs of assembly code sample pairs and the corresponding annotation results of assembly code sample pairs, including:

[0023] The gradient of network parameters for the similarity detection model is determined based on the similarity score.

[0024] The similarity detection model is updated based on the gradient of network parameters.

[0025] According to a similarity detection method provided by the present invention, a first vector and a second vector are input into a similarity detection model to determine the similarity between the first vector and the second vector, including:

[0026] The similarity between two representation vectors can be calculated using the following formula:

[0027]

[0028] Where A is the first vector and B is the second vector. Represents the components of the first vector. This represents the components of the second vector. This represents the similarity between the first vector and the second vector.

[0029] The present invention also provides a similarity detection device, comprising the following modules:

[0030] The acquisition module is used to acquire the first assembly code and the second assembly code for similarity detection;

[0031] The encoding module is used to encode the first assembly code and the second assembly code to obtain a first vector corresponding to the first assembly code and a second vector corresponding to the second assembly code.

[0032] The processing module is used to input the first vector and the second vector into the similarity detection model to determine the similarity between the first vector and the second vector.

[0033] According to the similarity detection apparatus provided by the present invention, the processing module is further configured to train a similarity detection model by the following method:

[0034] Obtain assembly code sample pairs;

[0035] Annotate the assembly code sample pairs to obtain the annotation results corresponding to the assembly code sample pairs;

[0036] Using assembly code sample pairs as input, the similarity of the output corresponding to the assembly code sample pairs is compared with the annotation results corresponding to the assembly code sample pairs;

[0037] A similarity detection model is trained based on the similarity between the output of the assembly code sample pairs and the difference between the annotation results of the assembly code sample pairs.

[0038] According to the similarity detection device provided by the present invention, the processing module is further configured to:

[0039] Preprocess the assembly code sample pairs.

[0040] According to the similarity detection device provided by the present invention, the processing module is specifically used for:

[0041] Based on the preset positive and negative sample ratio, binary function pairs with the same function are selected to form positive sample pairs, and binary function pairs with different functions are selected to form negative sample pairs; the positive sample pairs and negative sample pairs are then combined to form assembly code sample pairs.

[0042] According to the similarity detection device provided by the present invention, the processing module is specifically used for:

[0043] Annotate the assembly code sample pairs to obtain the annotation results corresponding to the assembly code sample pairs;

[0044] Compile the annotated assembly code sample pairs into target vectors;

[0045] The cross-entropy loss function for assembly code sample pairs is determined based on the target vector;

[0046] The labeling results are corrected based on the cross-entropy loss function.

[0047] According to the similarity detection device provided by the present invention, the processing module is specifically used for:

[0048] The gradient of network parameters for the similarity detection model is determined based on the similarity score.

[0049] The similarity detection model is updated based on the gradient of network parameters.

[0050] According to the similarity detection device provided by the present invention, the processing module is specifically used for:

[0051] The similarity between two representation vectors can be calculated using the following formula:

[0052]

[0053] Where A is the first vector and B is the second vector. Represents the components of the first vector. This represents the components of the second vector. This represents the similarity between the first vector and the second vector.

[0054] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement any of the similarity detection methods described above.

[0055] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the similarity detection methods described above.

[0056] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements any of the similarity detection methods described above.

[0057] The similarity detection method provided by this invention first obtains a first assembly code and a second assembly code for similarity detection. Then, the first and second assembly codes are encoded to obtain a first vector corresponding to the first assembly code and a second vector corresponding to the second assembly code. Finally, the first and second vectors are input into a similarity detection model to determine their similarity. By using a similarity detection model to determine the similarity between assembly codes, the detection time and computational cost are significantly reduced, and the detection accuracy is significantly improved. Attached Figure Description

[0058] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0059] Figure 1 This is a flowchart illustrating a similarity detection method provided by the present invention;

[0060] Figure 2 A flowchart illustrating a similarity detection model training method provided by the present invention;

[0061] Figure 3 A schematic diagram illustrating the principle of assembly data processing provided by this invention;

[0062] Figure 4 A schematic diagram of the structure of a similarity detection model provided by this invention;

[0063] Figure 5 A schematic diagram of a similarity detection system provided for the invention;

[0064] Figure 6 This is a schematic diagram of the structure of a similarity detection device provided by the present invention;

[0065] Figure 7 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0066] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0067] In related technologies, for the same high-level language, using different compilers or changing different optimization options can cause significant changes in the generated binary code. This results in a large amount of data being calculated when judging the similarity of binary code, and there is a possibility of data loss. Consequently, similarity detection requires a lot of resources and has low accuracy, leading to a significant increase in detection costs.

[0068] Therefore, a similarity detection method is urgently needed to solve the above problems.

[0069] The following is combined with Figures 1-7The similarity detection method, apparatus, equipment, and medium of the present invention are described.

[0070] Figure 1 This is one of the flowcharts illustrating the similarity detection method provided by the present invention, such as... Figure 1 As shown, the method includes the following:

[0071] Step 101: Obtain the first assembly code and the second assembly code for similarity detection.

[0072] In practice, two assembly code texts to be tested are obtained and identified as the first assembly code and the second assembly code, respectively.

[0073] Step 102: Encode the first assembly code and the second assembly code to obtain the first vector corresponding to the first assembly code and the second vector corresponding to the second assembly code.

[0074] In specific implementation, the first assembly code and the second assembly code obtained in step 101 are encoded to obtain the first vector corresponding to the first assembly code and the second vector corresponding to the second assembly code, respectively.

[0075] Step 103: Input the first vector and the second vector into the similarity detection model to determine the similarity between the first vector and the second vector.

[0076] In practice, the first and second vectors are input into the similarity detection model to obtain the similarity score. Specifically, A and B are used to represent the first and second vectors, respectively. The similarity score between the first and second assembly code, i.e., the cosine similarity score, is calculated as follows:

[0077]

[0078] A is the first vector, and B is the second vector. Represents the components of the first vector. This represents the components of the second vector.

[0079] The following is combined with Figures 2-5 The training method of the similarity detection model used in the above embodiments will be described in detail, such as... Figure 2 As shown, the method includes the following:

[0080] Step 201: Obtain assembly code sample pairs.

[0081] In practice, the sample data is first preprocessed. Specifically, an assembly language function consists of multiple instructions, each consisting of an opcode and operands. Therefore, based on the characteristics of assembly code strings, the opcode is treated as a separate tag and added to the index dictionary, and common symbols in the operands are used as delimiters to extract different tags. Then, the frequency of occurrence of the tags in the sample set is filtered.

[0082] After preprocessing, based on a preset positive-to-negative sample ratio, pairs of binary functions with the same function are selected to form positive sample pairs, and pairs of binary functions with different functions are selected to form negative sample pairs. These positive and negative sample pairs are then combined to form assembly code sample pairs. Specifically, pairs of binary functions with the same function but different optimization options or compilers are selected to form positive sample pairs, and pairs of binary functions with different functions are randomly selected to form negative sample pairs. In one possible implementation, the positive-to-negative sample ratio is controlled at 1:30; however, other ratios can be chosen, and this embodiment of the invention does not limit this. In this step, samples with identical assembly strings in the positive samples can also be filtered out.

[0083] Step 202: Annotate the assembly code sample pairs to obtain the annotation results corresponding to the assembly code sample pairs.

[0084] In practice, assembly code sample pairs are labeled to obtain the corresponding labeling results. Then, the labeled assembly code sample pairs are compiled into target vectors. Next, the cross-entropy loss function for the assembly code sample pairs is determined based on the target vectors, and the labeling results are corrected according to the cross-entropy loss function. Specifically, for each assembly code sample, an opcode or operand marker is randomly replaced with a marker that exists in the dictionary. This process is repeated multiple times for each assembly code, generating multiple pre-trained samples. The samples are then compiled into vectors, and the dictionary index of the removed marker is recorded as the label.

[0085] During compilation, for an assembly code string consisting of multiple instruction strings, each instruction is treated as a dynamic embedding vector. This dynamic vector is formed by concatenating an embedding vector of an opcode marker, embedding vectors of multiple operand markers, and a position embedding vector along the feature dimension, and then truncating and padding according to the number of markers.

[0086] Next, the embedding vectors of multiple randomly selected pre-trained samples are input into a small model, outputting a hidden vector. This hidden vector is then input into a fully connected classification network, ultimately outputting the probability of each label in the dictionary. The cross-entropy loss function is then used to calculate the loss between the output class probability and the actual label class. The formula for the cross-entropy loss function is as follows:

[0087]

[0088] The number of categories M, The sign function (0 or 1) is set to 1 when the true class of sample i is equal to c, and 0 otherwise. The predicted probability that observed sample i belongs to category c.

[0089] Step 203: Using assembly code sample pairs as input, compare the similarity of the output corresponding to the assembly code sample pairs with the annotation results corresponding to the assembly code sample pairs. Based on the difference between the similarity of the output corresponding to the assembly code sample pairs and the annotation results corresponding to the assembly code sample pairs, train and generate a similarity detection model.

[0090] In practice, the network parameter gradient of the similarity detection model is determined based on the similarity score; the similarity detection model is then updated based on this gradient. Specifically, the similarity detection model is invoked twice for each sample pair, with forward propagation yielding the feature layer output. , This refers to the representation vector of the sample; each sample pair will yield two representation vectors. To increase the similarity between the representation vectors of similar samples and decrease the similarity between the representation vectors of non-similar samples, the cosine similarity loss function is used as the objective function, as shown in the following formula:

[0091]

[0092] in This represents the model parameters. Margin is a hyperparameter that can be set according to training needs. In one possible implementation, it is set to 0.9.

[0093] Finally, the gradients of the network parameters are calculated, and the Adam (Adaptive Moment Estimation) gradient descent method is used to update the network parameters, thus completing the training of the similarity detection model.

[0094] The similarity detection method provided in the embodiments of the present invention will be described in detail below with reference to the structure of a specific similarity detection system.

[0095] The similarity detection system consists of six parts: an assembly code preprocessing unit, an assembly code encoding unit, a training sample sampling unit, a pre-training unit, a fine-tuning unit, and a binary code similarity calculation unit.

[0096] The assembly code preprocessing unit is used to clean the assembly code text. It extracts a large number of tags from the assembly instructions by treating opcodes directly as tags and using delimiters to separate multiple tags from the operands. Finally, it filters the tags decomposed from the operands according to their frequency of occurrence, retaining the tags with high frequency. Finally, it saves all the different tags into a dictionary. Specifically, in the dictionary, each tag corresponds to a different index number, and the index number is less than the length of the dictionary.

[0097] Specifically, based on the characteristics of assembly code strings, an assembly language function consists of multiple instructions, each consisting of an opcode and operands. The opcode is treated as a separate marker and added to the index dictionary, where each marker corresponds to a different index number, which is less than the dictionary length. In practice, common symbols in the operands, such as "+", ":", "", ";", and spaces, can be used as separators to extract different markers. Then, for the markers in the operands, we filter them based on their frequency of occurrence in the sample set. In one embodiment, by setting a hyperparameter F, markers with a frequency less than F are discarded, thereby reducing the number of markers to within a specified range, and these markers are then added to the index dictionary.

[0098] The assembly code encoding unit is used to perform word segmentation and tokenization on the assembly text using the dictionary obtained from the assembly code preprocessing unit. Then, the tokenized text is truncated and padded. Finally, the tokenized text is mapped to an embedding vector through a word embedding matrix.

[0099] Specifically, such as Figure 3 As shown, for an assembly code string consisting of multiple instruction strings, each instruction is treated as a dynamic embedding vector. This dynamic vector is formed by concatenating an embedding vector of an opcode marker, embedding vectors of multiple operand markers, and a position embedding vector along the feature dimension. If the number of markers in an instruction is greater than a threshold K, it will be truncated; if it is less than K, it will be padded using special marker vectors.

[0100] The training sample sampling unit is used to construct positive and negative sample pairs through random sampling. Positive sample pairs represent two samples with the same function but different binary codes, and negative sample pairs represent two samples with different binary codes.

[0101] The pre-trained unit is used to randomly replace a token in the assembly text with a special symbol mask, and then a small model predicts the original token at the mask position. The loss function used is cross-entropy loss.

[0102] The fine-tuning unit is used to train a similarity detection model using a Siamese network framework based on a small network. This unit first inputs the embedding vectors of the two samples in the sample pair into the small network in sequence, and then outputs the representation vectors of the two samples in sequence. The two representation vectors are then input into the loss function to calculate the loss, which is a cosine loss function.

[0103] Specifically, the similarity detection model is trained using pre-trained units and fine-tuning units, and the network structure is as follows: Figure 4 As shown, it comprises three parts: an input layer, a hidden layer, and an output layer. The input layer consists of the input text embedding vectors, and the hidden layer consists of a Text-CNN network. Of course, other networks can also be used, such as MLP-Mixer, LSTM, GRU, etc., and this embodiment of the invention does not limit this. The output layer is a fully connected layer that maps the hidden vectors to a representation vector. During the pre-training stage, the dimension of the representation vector is the number of labeled categories.

[0104] The binary code similarity calculation unit is used to embed the assembly text of unknown binary code into a vector input through a trained small network model to obtain a representation vector. Then, the similarity between this representation vector and other representation vectors is calculated by cosine similarity. This similarity is used to display the similarity between binary codes.

[0105] The specific system operation process is as follows: Figure 5 As shown, the assembly code dataset is input into the assembly code preprocessing unit to extract the dictionary. For pre-training, the assembly data is further processed using the assembly code encoding unit and the dictionary, transforming it into vectors. In the pre-training unit, pre-training samples are constructed by randomly replacing the label embedding vector of an operand or opcode with a mask embedding vector, and then the small network is pre-trained. After pre-training, the small model is fine-tuned. First, the assembly code data is input into the training sample sampling unit for sampling. Then, the sampled sample pairs and the dictionary are input into the assembly code encoding unit to generate two embedding vectors. These two embedding vectors are then input into the fine-tuning unit, where the fine-tuning unit initializes using the weights of the small network trained in the pre-training stage and begins fine-tuning training. For input test sample pairs and actual model usage, the two embedding vectors are directly input into the assembly code encoding unit, then input into the fine-tuned small network to obtain two representation vectors. Finally, the two representation vectors are input into the binary code similarity calculation unit to obtain the final similarity.

[0106] The similarity detection device provided by the present invention will be described below. The similarity detection device described below can be referred to in correspondence with the similarity detection method described above.

[0107] like Figure 6 As shown, the similarity detection device provided by the present invention includes the following modules:

[0108] The module 601 is used to acquire the first assembly code and the second assembly code for similarity detection;

[0109] The encoding module 602 is used to encode the first assembly code and the second assembly code to obtain a first vector corresponding to the first assembly code and a second vector corresponding to the second assembly code;

[0110] The processing module 603 is used to input the first vector and the second vector into the similarity detection model to determine the similarity between the first vector and the second vector.

[0111] According to the similarity detection apparatus provided by the present invention, the processing module 603 is further configured to train a similarity detection model by the following method:

[0112] Obtain assembly code sample pairs;

[0113] Annotate the assembly code sample pairs to obtain the annotation results corresponding to the assembly code sample pairs;

[0114] Using assembly code sample pairs as input, the similarity of the output corresponding to the assembly code sample pairs is compared with the annotation results corresponding to the assembly code sample pairs;

[0115] A similarity detection model is trained based on the similarity between the output of the assembly code sample pairs and the difference between the annotation results of the assembly code sample pairs.

[0116] According to the similarity detection device provided by the present invention, the processing module 603 is further configured to:

[0117] Preprocess the assembly code sample pairs.

[0118] According to the similarity detection device provided by the present invention, the processing module 603 is specifically used for:

[0119] Based on the preset positive and negative sample ratio, binary function pairs with the same function are selected to form positive sample pairs, and binary function pairs with different functions are selected to form negative sample pairs; the positive sample pairs and negative sample pairs are then combined to form assembly code sample pairs.

[0120] According to the similarity detection device provided by the present invention, the processing module 603 is specifically used for:

[0121] Annotate the assembly code sample pairs to obtain the annotation results corresponding to the assembly code sample pairs;

[0122] Compile the annotated assembly code sample pairs into target vectors;

[0123] The cross-entropy loss function for assembly code sample pairs is determined based on the target vector;

[0124] The labeling results are corrected based on the cross-entropy loss function.

[0125] According to the similarity detection device provided by the present invention, the processing module 603 is specifically used for:

[0126] The gradient of network parameters for the similarity detection model is determined based on the similarity score.

[0127] The similarity detection model is updated based on the gradient of network parameters.

[0128] According to the similarity detection device provided by the present invention, the processing module 603 is specifically used for:

[0129] The similarity between two representation vectors can be calculated using the following formula:

[0130]

[0131] Where A is the first vector and B is the second vector. Represents the components of the first vector. This represents the components of the second vector. This represents the similarity between the first vector and the second vector.

[0132] Figure 7 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 7 As shown, the electronic device may include: a processor 710, a communications interface 720, a memory 730, and a communication bus 740, wherein the processor 710, the communications interface 720, and the memory 730 communicate with each other via the communication bus 740. The processor 710 can call logical instructions in the memory 730 to execute a similarity detection method, which includes:

[0133] Obtain the first assembly code and the second assembly code used for similarity detection;

[0134] Encode the first assembly code and the second assembly code to obtain a first vector corresponding to the first assembly code and a second vector corresponding to the second assembly code;

[0135] The first vector and the second vector are input into the similarity detection model to determine the similarity between the first vector and the second vector.

[0136] Furthermore, the logical instructions in the aforementioned memory 730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0137] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program, the computer program being able to be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer being able to execute the similarity detection method provided by the above methods, the method comprising:

[0138] Obtain the first assembly code and the second assembly code used for similarity detection;

[0139] Encode the first assembly code and the second assembly code to obtain a first vector corresponding to the first assembly code and a second vector corresponding to the second assembly code;

[0140] The first vector and the second vector are input into the similarity detection model to determine the similarity between the first vector and the second vector.

[0141] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the similarity detection methods provided by the methods described above, the method comprising:

[0142] Obtain the first assembly code and the second assembly code used for similarity detection;

[0143] Encode the first assembly code and the second assembly code to obtain a first vector corresponding to the first assembly code and a second vector corresponding to the second assembly code;

[0144] The first vector and the second vector are input into the similarity detection model to determine the similarity between the first vector and the second vector.

[0145] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0146] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0147] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A similarity detection method, characterized in that, The method includes: Obtain the first assembly code text and the second assembly code text used for similarity detection; The first assembly code text and the second assembly code text are encoded to obtain a first vector corresponding to the first assembly code text and a second vector corresponding to the second assembly code text. The encoding of the first assembly code text and the second assembly code text includes: for an assembly code string consisting of multiple instruction strings, each instruction is regarded as a dynamic embedding vector; the dynamic embedding vector is formed by concatenating an embedding vector of an opcode marker, an embedding vector of multiple operand markers and a position embedding vector along the feature dimension, and is truncated and padded according to the number of markers in the instruction; The first vector and the second vector are input into the similarity detection model to determine the similarity between the first vector and the second vector; The similarity detection model is trained using the following method: Obtain assembly code text sample pairs; The assembly code text sample pairs are annotated to obtain the annotation results corresponding to the assembly code text sample pairs; Using the assembly code text sample pairs as input, the similarity of the output corresponding to the assembly code text sample pairs is compared with the annotation results corresponding to the assembly code text sample pairs; The similarity detection model is trained based on the difference between the similarity of the output corresponding to the assembly code text sample pair and the annotation result corresponding to the assembly code text sample pair; Before obtaining the assembly code text sample pair, the method further includes: The assembly code text sample pairs are preprocessed; The preprocessing of the assembly code text sample pairs includes: treating the opcodes in the assembly code string as separate tokens and adding them to the index dictionary; using common symbols in the operands of the assembly code string as delimiters to extract different tokens; and filtering the frequency of occurrence of the tokens in the sample set.

2. The similarity detection method according to claim 1, characterized in that, The acquisition of assembly code text sample pairs includes: Based on the preset positive and negative sample ratio, binary function pairs with the same function are selected to form positive sample pairs, and binary function pairs with different functions are selected to form negative sample pairs. The positive sample pairs and the negative sample pairs constitute the assembly code text sample pairs.

3. The similarity detection method according to claim 1, characterized in that, The step of annotating the assembly code text sample pairs to obtain the annotation results corresponding to the assembly code text sample pairs includes: The assembly code text sample pairs are annotated to obtain the annotation results corresponding to the assembly code text sample pairs; The annotated assembly code text sample pairs are compiled into target vectors; The cross-entropy loss function for the assembly code text sample pairs is determined based on the target vector; The labeling results are corrected based on the cross-entropy loss function.

4. The similarity detection method according to claim 1, characterized in that, The similarity detection model is trained based on the difference between the similarity of the output corresponding to the assembly code text sample pair and the annotation result corresponding to the assembly code text sample pair, including: The network parameter gradient of the similarity detection model is determined based on the similarity. The similarity detection model is updated based on the gradient of the network parameters.

5. The similarity detection method according to claim 1, characterized in that, The step of inputting the first vector and the second vector into a similarity detection model to determine the similarity between the first vector and the second vector includes: The similarity between two representation vectors can be calculated using the following formula: Where A is the first vector and B is the second vector. This represents the components of the first vector. Indicates the components of the second vector. This represents the similarity between the first vector and the second vector.

6. A similarity detection device, characterized in that, include: The acquisition module is used to acquire the first assembly code text and the second assembly code text for similarity detection; An encoding module is used to encode the first assembly code text and the second assembly code text to obtain a first vector corresponding to the first assembly code text and a second vector corresponding to the second assembly code text. Encoding the first assembly code text and the second assembly code text includes: for an assembly code string consisting of multiple instruction strings, treating each instruction as a dynamic embedding vector; the dynamic embedding vector is formed by concatenating an embedding vector of an opcode marker, embedding vectors of multiple operand markers, and a position embedding vector along the feature dimension, and is truncated and padded according to the number of markers in the instruction. The processing module is used to input the first vector and the second vector into the similarity detection model to determine the similarity between the first vector and the second vector; The similarity detection model is trained using the following method: Obtain assembly code text sample pairs; The assembly code text sample pairs are annotated to obtain the annotation results corresponding to the assembly code text sample pairs; Using the assembly code text sample pairs as input, the similarity of the output corresponding to the assembly code text sample pairs is compared with the annotation results corresponding to the assembly code text sample pairs; The similarity detection model is trained based on the difference between the similarity of the output corresponding to the assembly code text sample pair and the annotation result corresponding to the assembly code text sample pair; Before obtaining the assembly code text sample pair, the process also includes: The assembly code text sample pairs are preprocessed; The preprocessing of the assembly code text sample pairs includes: treating the opcodes in the assembly code string as separate tokens and adding them to the index dictionary; using common symbols in the operands of the assembly code string as delimiters to extract different tokens; and filtering the frequency of occurrence of the tokens in the sample set.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the similarity detection method as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the similarity detection method as described in any one of claims 1 to 5.

Images