Method and device for analyzing homology of binary code file and computer equipment

Abstract

The invention relates to a homology analysis method and device for binary code files and computer equipment. The method comprises the following steps: obtaining and identifying a function call graph corresponding to each binary code file through a security monitoring program; identifying isomorphic sub-graphs among the binary code files through a hybrid search strategy, and performing symbol program slicing processing on respective write function nodes in each isomorphic sub-graph to obtain symbol program slicing codes corresponding to the respective write function nodes of each isomorphic sub-graph; performing escape processing on each symbol program slice code corresponding to the isomorphic sub-graph to obtain each piece of mathematical semantic information corresponding to the isomorphic sub-graph, and performing similarity calculation to obtain a code similarity value between the binary code files; therefore, the homologous binary code file is identified. By adopting the method, the homology analysis accuracy of the highly confused binary code file can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of binary code file homology analysis, and in particular to a binary code file homology analysis method, device and computer equipment. Background Art

[0002] Binary Code Similarity Analysis (BCSA) is an important technology for comparing and analyzing the similarities between different binary files. This technology detects and compares binary code fragments to identify files or code fragments that originate from the same or similar source code, thereby determining the homology relationship between them. This analysis not only involves byte-level comparisons, but also includes instruction-level semantic analysis, as well as structural and functional level comparisons. Especially in the field of program vulnerability analysis and security detection, by identifying the presence of known vulnerabilities in different binary files, it can help security researchers quickly locate potential security risks and improve the efficiency of vulnerability repair. Therefore, how to improve the homology analysis of binary code files is the current research focus.

[0003] Existing static analysis technology extracts features such as control flow graphs and data flow graphs from binary files by disassembling or decompiling them, and compares them through graph matching algorithms to analyze the homology information of binary code files. However, when faced with highly obfuscated or optimized codes, this technology is easily affected by various factors such as the compiler, resulting in a high false alarm rate and low timeliness in matching binary code files, resulting in low accuracy in homology analysis of highly obfuscated binary code files. Summary of the invention

[0004] Based on this, it is necessary to provide a binary code file homology analysis method, device, computer equipment, computer-readable storage medium and computer program product to address the above technical issues.

[0005] In a first aspect, the present application provides a method for analyzing the homology of binary code files, comprising:

[0006] Obtain each binary code file obtained by security detection through a security monitoring program, and identify a function call graph corresponding to each binary code file;

[0007] Based on the function call graph of each of the binary code files, the isomorphic subgraphs between the binary code files are identified through a hybrid search strategy, and the symbolic program slicing process is performed on the respective write function nodes in each isomorphic subgraph to obtain the symbolic program slicing code corresponding to the respective write function nodes of each isomorphic subgraph;

[0008] For each isomorphic subgraph, performing escape processing on each symbolic program slice code corresponding to the isomorphic subgraph to obtain each mathematical semantic information corresponding to the isomorphic subgraph, and performing similarity calculation on each mathematical semantic information to obtain the code similarity value between each binary code file corresponding to the isomorphic subgraph;

[0009] Each binary code file corresponding to a code similarity value greater than a similarity threshold is regarded as a homologous binary code file.

[0010] Optionally, identifying a function call graph corresponding to each binary code file includes:

[0011] For each binary code file, convert each binary code file into each intermediate representation file through an intermediate file adjustment strategy, and for each intermediate representation file, identify the function type corresponding to each binary code in the intermediate representation file;

[0012] According to the function type corresponding to each binary code, each binary code is divided into binary code groups of each function type, and based on the binary code groups of each function type, a function call graph construction strategy is used to construct a function call graph of the intermediate representation file, so as to obtain a function call graph of the binary code file corresponding to the intermediate representation file.

[0013] Optionally, the identifying the isomorphic subgraphs between the binary code files by a hybrid search strategy based on the function call graphs of the binary code files includes:

[0014] For each binary code file, randomly select a starting node in a function call graph of the binary code file, and based on the starting node, query each candidate node corresponding to the starting node in other function call graphs of each other binary code file;

[0015] Based on the starting node and each of the candidate nodes, the isomorphic subgraph search strategy is used to query each target other function call graph that has an isomorphic subgraph with the function call graph, and the isomorphic subgraph between the function call graph and each of the target other function call graphs is used as the isomorphic subgraph between the binary code file to which the function call graph belongs and other binary code files to which each of the target other function call graphs belongs.

[0016] Optionally, performing symbolic program slicing processing on each write function node in each isomorphic subgraph to obtain symbolic program slicing codes corresponding to each write function node in each isomorphic subgraph includes:

[0017] For each isomorphic subgraph, identifying a self-written function node of a self-written function type in the isomorphic subgraph, and identifying a node code corresponding to each of the self-written function nodes, and a symbolic parameter corresponding to each of the self-written function nodes;

[0018] Based on the symbolic parameters corresponding to each of the self-written function nodes, the node codes corresponding to each of the self-written function nodes are symbolically sliced ​​by a symbolic slicing algorithm to obtain symbolic program slice codes corresponding to each of the self-written function nodes.

[0019] Optionally, performing escape processing on each symbolic program slice code corresponding to the isomorphic subgraph to obtain each mathematical semantic information corresponding to the isomorphic subgraph includes:

[0020] Identifying the memory heap address semantic instructions of each of the symbolic program slice codes;

[0021] Through the semantic equivalence recognition algorithm, the memory heap address semantic instructions of each symbolic program slice code are respectively converted into instruction formats to obtain the mathematical expression language corresponding to each symbolic program slice code;

[0022] The mathematical expression language corresponding to each of the symbolic program slice codes is used as the mathematical semantic information corresponding to the isomorphic subgraph.

[0023] Optionally, the performing similarity calculation on each of the mathematical semantic information to obtain a code similarity value between each binary code file corresponding to the isomorphic subgraph includes:

[0024] Based on the mathematical semantic information of the corresponding self-written function nodes between the two binary code files corresponding to the isomorphic subgraphs, respectively construct corresponding function sets between the two binary code files;

[0025] By using a semantic similarity calculation algorithm, the mathematical semantic information of each corresponding self-written function node in the corresponding function set is respectively processed by semantic similarity calculation to obtain the semantic similarity value between each corresponding self-written function node;

[0026] Based on the semantic similarity values ​​between the corresponding self-written function nodes, the code similarity value between the two binary code files is calculated using a program semantic similarity algorithm.

[0027] In a second aspect, the present application also provides a binary code file homology analysis device, comprising:

[0028] An acquisition module is used to acquire each binary code file obtained by security detection through a security monitoring program, and identify a function call graph corresponding to each binary code file;

[0029] An identification module is used to identify isomorphic subgraphs between the binary code files based on the function call graphs of the binary code files through a hybrid search strategy, and perform symbolic program slicing processing on the respective write function nodes in each isomorphic subgraph to obtain symbolic program slicing codes corresponding to the respective write function nodes of each isomorphic subgraph;

[0030] A calculation module is used to perform escape processing on each symbolic program slice code corresponding to each isomorphic subgraph to obtain each mathematical semantic information corresponding to the isomorphic subgraph, and perform similarity calculation on each mathematical semantic information to obtain a code similarity value between each binary code file corresponding to the isomorphic subgraph;

[0031] The determination module is used to regard each binary code file corresponding to a code similarity value greater than a similarity threshold as a homologous binary code file.

[0032] Optionally, the acquisition module is specifically used to:

[0033] For each binary code file, convert each binary code file into each intermediate representation file through an intermediate file adjustment strategy, and for each intermediate representation file, identify the function type corresponding to each binary code in the intermediate representation file;

[0034] According to the function type corresponding to each binary code, each binary code is divided into binary code groups of each function type, and based on the binary code groups of each function type, a function call graph construction strategy is used to construct a function call graph of the intermediate representation file, so as to obtain a function call graph of the binary code file corresponding to the intermediate representation file.

[0035] Optionally, the identification module is specifically used to:

[0036] For each binary code file, randomly select a starting node in a function call graph of the binary code file, and based on the starting node, query each candidate node corresponding to the starting node in other function call graphs of each other binary code file;

[0037] Based on the starting node and each of the candidate nodes, the isomorphic subgraph search strategy is used to query each target other function call graph that has an isomorphic subgraph with the function call graph, and the isomorphic subgraph between the function call graph and each of the target other function call graphs is used as the isomorphic subgraph between the binary code file to which the function call graph belongs and other binary code files to which each of the target other function call graphs belongs.

[0038] Optionally, the identification module is specifically used to:

[0039] For each isomorphic subgraph, identifying a self-written function node of a self-written function type in the isomorphic subgraph, and identifying a node code corresponding to each of the self-written function nodes, and a symbolic parameter corresponding to each of the self-written function nodes;

[0040] Based on the symbolic parameters corresponding to each of the self-written function nodes, the node codes corresponding to each of the self-written function nodes are symbolically sliced ​​by a symbolic slicing algorithm to obtain symbolic program slice codes corresponding to each of the self-written function nodes.

[0041] Optionally, the computing module is specifically used for:

[0042] Identifying the memory heap address semantic instructions of each of the symbolic program slice codes;

[0043] Through the semantic equivalence recognition algorithm, the memory heap address semantic instructions of each symbolic program slice code are respectively converted into instruction formats to obtain the mathematical expression language corresponding to each symbolic program slice code;

[0044] The mathematical expression language corresponding to each of the symbolic program slice codes is used as the mathematical semantic information corresponding to the isomorphic subgraph.

[0045] Optionally, the computing module is specifically used for:

[0046] Based on the mathematical semantic information of the corresponding self-written function nodes between the two binary code files corresponding to the isomorphic subgraphs, respectively construct corresponding function sets between the two binary code files;

[0047] By using a semantic similarity calculation algorithm, the mathematical semantic information of each corresponding self-written function node in the corresponding function set is respectively processed by semantic similarity calculation to obtain the semantic similarity value between each corresponding self-written function node;

[0048] Based on the semantic similarity values ​​between the corresponding self-written function nodes, the code similarity value between the two binary code files is calculated using a program semantic similarity algorithm.

[0049] In a third aspect, the present application provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of any one of the methods in the first aspect are implemented.

[0050] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.

[0051] In a fifth aspect, the present application provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.

[0052] The above-mentioned binary code file homology analysis method, device and computer equipment obtain each binary code file obtained by security detection through a security monitoring program, and identify the function call graph corresponding to each binary code file; based on the function call graph of each binary code file, through a hybrid search strategy, identify the isomorphic subgraphs between each binary code file, and perform symbolic program slicing processing on each write function node in each isomorphic subgraph to obtain the symbolic program slicing code corresponding to each write function node of each isomorphic subgraph; for each isomorphic subgraph, perform escape processing on each symbolic program slicing code corresponding to the isomorphic subgraph to obtain each mathematical semantic information corresponding to the isomorphic subgraph, and perform similarity calculation on each mathematical semantic information to obtain the code similarity value between each binary code file corresponding to the isomorphic subgraph; each binary code file corresponding to the code similarity value greater than the similarity threshold is regarded as a homologous binary code file. This scheme, by using a hybrid technology, solves the problem of subgraph isomorphism by matching each node and relationship candidate of the query graph and backtracking other possible candidates. Compared with the existing methods, it effectively improves the computing performance and further improves the efficiency of homology analysis. Then, the scheme adopts symbolic program slicing technology, which does not reanalyze the process multiple times to find the slices of each calling context, but calculates a single symbolic (or parameterized) slice, which can be instantiated at the call site, thus avoiding the costly and error-prone problems caused by reanalysis. Then, the scheme uses semantic conversion to facilitate Boogie to add conditions and assertions. Finally, the scheme uses symbolic execution to determine the equivalence relationship between inputs and outputs through the mapping relationship between variables between corresponding nodes in the isomorphic subgraph to indicate whether the code semantics are equivalent, effectively avoiding scenarios with highly similar syntax but not semantically equivalent, and effectively reducing the false positive rate. This comprehensively improves the accuracy of homology analysis of highly obfuscated binary code files. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0054] Figure 1 A schematic diagram of a process for analyzing the homology of binary code files in one embodiment;

[0055] Figure 2 An example diagram of LLVM IR code in one embodiment;

[0056] Figure 3 A schematic diagram of a symbolic program slice code in one embodiment;

[0057] Figure 4 An example diagram of Boogie IVL code generated by SMACK in one embodiment;

[0058] Figure 5 A schematic diagram of a flow chart of an example of homology analysis of binary code files in one embodiment;

[0059] Figure 6 It is a structural block diagram of a device for analyzing homology of binary code files in one embodiment;

[0060] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0062] The method for homology analysis of binary code files provided in the embodiment of the present application can be applied to the application environment of homology analysis of binary code files. Among them, the method can be applied to a terminal, and can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. Among them, the terminal can be, but is not limited to, various personal computers, laptops, etc. Among them, the terminal solves the problem of subgraph isomorphism by using a hybrid technology, by matching each node and relationship candidate of the query graph, and backtracking other possible candidates. Compared with the existing methods, it effectively improves the computing performance and further improves the efficiency of homology analysis. Then, the scheme adopts symbolic program slicing technology, which does not reanalyze the process multiple times to find the slices of each calling context, but calculates a single symbolic (or parameterized) slice, which can be instantiated at the call site, thus avoiding the costly and error-prone problems caused by reanalysis. Then, the scheme uses semantic conversion to facilitate Boogie to add conditions and assertions. Finally, the scheme uses symbolic execution to determine the equivalence relationship between inputs and outputs through the mapping relationship between variables between corresponding nodes in the isomorphic subgraph to indicate whether the code semantics are equivalent, effectively avoiding scenarios with highly similar syntax but not semantically equivalent, and effectively reducing the false positive rate. This comprehensively improves the accuracy of homology analysis of highly obfuscated binary code files.

[0063] In an exemplary embodiment, Figure 1 As shown, a method for analyzing the homology of binary code files is provided, and the method is applied to a terminal as an example for explanation, including the following steps S101 to S104. Among them:

[0064] Step S101, through a security monitoring program, obtaining each binary code file obtained by security detection, and identifying a function call graph corresponding to each binary code file.

[0065] In this embodiment, the terminal obtains each binary code file obtained by the security detection through the security monitoring program, and identifies the function call graph corresponding to each binary code file. Among them, each binary code file is a binary code file obtained by dimensionality enhancement of the initial binary code file directly obtained. Specifically, binary code is easily affected by factors such as multiple compilers and compilation optimization, resulting in large differences in binary code. Therefore, in order to avoid these factors affecting the homology analysis, the present invention first considers promoting the binary code file to the intermediate representation dimension for analysis. Preferably, the present invention selects LLVM IR as the intermediate representation, and mainly uses llvm-mctoll to enhance the static binary code file to LLVM IR, such as Figure 2The following figure shows the binary code file obtained after dimension enhancement. The specific method of constructing the function call graph will be described in detail later.

[0066] Step S102, based on the function call graph of each binary code file, through a hybrid search strategy, identify the isomorphic subgraphs between the binary code files, and perform symbolic program slicing processing on each write function node in each isomorphic subgraph to obtain the symbolic program slicing code corresponding to each write function node of each isomorphic subgraph.

[0067] In this embodiment, the terminal identifies the isomorphic subgraphs between the binary code files through a hybrid search strategy based on the function call graph of each binary code file, and performs symbolic program slicing processing on each write function node in each isomorphic subgraph to obtain the symbolic program slicing code corresponding to each write function node of each isomorphic subgraph. The similarity comparison process at the code semantic level of the binary code file is separated from the similarity comparison process of the function structure of the binary code file. First, the similarity of the function call graph structure of the binary code file is compared, and then the semantic similarity comparison of the intermediate representation of the function code is performed. Such an analysis process can filter out some binary code files and functions with large structural differences in advance, reducing the time cost of homology analysis. Most of the current subgraph isomorphism methods are based on the pruning strategy proposed by Ullmann. These technologies have two obvious disadvantages. First, they cannot effectively handle complex queries. Second, their implementation requires a large index of a large amount of memory resources. The present invention uses a hybrid technology to solve the problem of subgraph isomorphism by matching each node and relationship candidate of the query graph and backtracking other possible candidates. Compared with the existing methods, the computing performance is effectively improved, and the efficiency of homology analysis is further improved. The specific hybrid search strategy will be described in detail later.

[0068] Step S103, for each isomorphic subgraph, each symbolic program slice code corresponding to the isomorphic subgraph is escaped to obtain each mathematical semantic information corresponding to the isomorphic subgraph, and each mathematical semantic information is similarity calculated to obtain the code similarity value between each binary code file corresponding to the isomorphic subgraph.

[0069] In this embodiment, for each isomorphic subgraph, the terminal performs escape processing on each symbolic program slice code corresponding to the isomorphic subgraph, obtains each mathematical semantic information corresponding to the isomorphic subgraph, and performs similarity calculation on each mathematical semantic information to obtain the code similarity value between each binary code file corresponding to the isomorphic subgraph. Since LLVM IR contains a wealth of information including pointers, memory, etc., this information is not conducive to program verification and requires certain filtering. The full name of Boogie IVL is Boogie Intermediate Verification Language, which is an intermediate language designed for program verification. It is convenient for Boogie to add conditions and assertions, and call SMT solver Z3 to solve conditions and assertions and find semantically equivalent instructions. The specific escape process and similarity recognition process will be described in detail later.

[0070] Step S104: taking each binary code file corresponding to a code similarity value greater than a similarity threshold as a same-source binary code file.

[0071] In this embodiment, the terminal regards each binary code file corresponding to a code similarity value greater than a similarity threshold as a homologous binary code file.

[0072] Based on the above scheme, by using hybrid technology, the problem of subgraph isomorphism is solved by matching candidates for each node and relationship of the query graph and backtracking other possible candidates. Compared with existing methods, the computing performance is effectively improved, and the efficiency of homology analysis is further improved. Then, this scheme does not reanalyze the process multiple times to find slices for each call context through the symbolic program slicing technology adopted, but calculates a single symbolic (or parameterized) slice, which can be instantiated at the call site, thereby avoiding the costly and error-prone problems caused by reanalysis. After that, this scheme facilitates Boogie to add conditions and assertions through semantic conversion. Finally, this scheme uses the mapping relationship between variables between corresponding nodes in the isomorphic subgraph, and uses symbolic execution to determine the equivalence relationship between input and output to indicate whether the code semantics are equivalent, which effectively avoids scenarios with highly similar syntax but not semantically equivalent, and effectively reduces the false alarm rate. Thereby comprehensively improving the accuracy of homology analysis of highly obfuscated binary code files.

[0073] Optionally, identifying the function call graph corresponding to each binary code file includes: for each binary code file, converting each binary code file into each intermediate representation file through an intermediate file adjustment strategy, and for each intermediate representation file, identifying the function type corresponding to each binary code in the intermediate representation file; according to the function type corresponding to each binary code, dividing each binary code into binary code groups of each function type, and based on the binary code groups of each function type, constructing a function call graph of the intermediate representation file through a function call graph construction strategy, so as to obtain the function call graph of the binary code file corresponding to the intermediate representation file.

[0074] In this embodiment, the terminal converts each binary code file into each intermediate representation file through the intermediate file adjustment strategy for each binary code file, and identifies the function type corresponding to each binary code in the intermediate representation file for each intermediate representation file. The function type includes an externally dependent function type and a self-written function type.

[0075] Then, the terminal divides each binary code into binary code groups of each function type according to the function type corresponding to each binary code, and builds the function call graph of the intermediate representation file based on the binary code group of each function type through the function call graph construction strategy, and obtains the function call graph of the binary code file corresponding to the intermediate representation file. Among them, a binary code file will introduce more system functions and external third-party library functions during the compilation process. Some function codes will be embedded in the binary code, but most of them are only external dependencies. When performing homology analysis, the internal codes of these calling functions are not available. Therefore, these system and external dependency functions are marked as one category, and self-written functions are marked as another category. Both types of functions will be used to build the function call graph. All function call graphs are stored in a graph database, such as Neo4j.

[0076] Based on the above solution, by generating a function call graph of the self-written function type of each binary code file, the comprehensiveness and accuracy of the recognition of binary code files are improved.

[0077] Optionally, based on the function call graph of each binary code file, a hybrid search strategy is used to identify isomorphic subgraphs between each binary code file, including: for each binary code file, randomly screening a starting node in the function call graph of the binary code file, and based on the starting node, querying each candidate node corresponding to the starting node in the other function call graphs of each other binary code file; based on the starting node and each candidate node, querying each target other function call graph that has an isomorphic subgraph with the function call graph through an isomorphic subgraph search strategy, and using the function call graph and the isomorphic subgraphs between the function call graph and each target other function call graph as the isomorphic subgraphs between the binary code file to which the function call graph belongs and the other binary code files to which each target other function call graph belongs.

[0078] In this embodiment, the terminal randomly selects the starting node in the function call graph of the binary code file for each binary code file, and based on the starting node, queries the candidate nodes corresponding to the starting node in the other function call graphs of each other binary code file. Specifically, first select a query node to start the matching process (starting node). Then, the database nodes are screened to find possible candidate matches for the starting node using the matching node body mentioned above. Next, the candidate nodes are placed in a list and the query graph isomorphism generated from the match is searched. The entire candidate list traverses a loop so that the next candidate node is selected from the list at each iteration, matched with the starting node, and a recursive isomorphism search is started from this point.

[0079] Then, based on the starting node and each candidate node, the terminal uses the isomorphic subgraph search strategy to query each target other function call graph that has an isomorphic subgraph with the function call graph, and uses the isomorphic subgraph between the function call graph and each target other function call graph as the isomorphic subgraph between the binary code file to which the function call graph belongs and other binary code files to which each target other function call graph belongs. Specifically, in the isomorphic search, the algorithm uses the node matching items obtained previously. Assume that V matched is the set of previously matched node pairs. Similarly, let E matched becomes a set of previously matched relation pairs. For each node matching<u,u′> ∈V matched , where u∈V Q , u′∈V G, the algorithm applies a reciprocal node branching process, which is a process of expanding partially matched image segments to complete exact matches by simultaneously tracking the neighbor relationships of u and u′. To decide which node match to use in the reciprocal node branching process, all node matches are saved in a stack, with the terminal denoted by S. When the algorithm pops a node that matches S<u,u′> When it finds a node that is adjacent to the query node u, it applies reciprocal node branching as follows: First, it detects unmatched relations adjacent to the query node u. Next, for each of these relations, it tries to find a candidate among the relations adjacent to u′. When determining the candidates, it checks whether the matching relation principle holds. After screening, there may be multiple candidates for a relation. The algorithm collects all candidates in a separate list for each unmatched relation adjacent to u.

[0080] Assume r1,r2,...,r k is an unmatched relation adjacent to u, and C1,C2,...,C k is a list of corresponding candidate relations adjacent to u′. In the next stage, the algorithm iteratively selects a candidate relation c for each i i With r i Matching. At each step in each iteration, potential matches r are checked i Does it cause a conflict related to the relationship endpoints? Obviously, if two relations match each other, their corresponding endpoints must also match each other. Here, it is already known that u and u′ already match. Therefore, the algorithm must check r i and c i The other endpoint of , that is, whether v and v′ match. This can be one of the following three cases:

[0081] 1. If v and v′ already match each other, there is no conflict.

[0082] 2. If v matches a node other than v′, or vice versa, a conflict is reported.

[0083] 3. It is possible that both v and v′ are nodes that have not yet been matched. At this point, check whether the nodes meet the matching node principle. If they do, they match each other and the new match is<v,v′> Add to V mached and pushed into S so that the reciprocal node branching process can be applied to them later. Otherwise, a conflict is reported.

[0084] Therefore, the endpoints guarantee that the candidate list of any relationship will not be empty during the candidate screening part. After checking the endpoints of the relationship, if no conflict is reported, the match <r i ,r i ′> was approved and added to V mached , and the algorithm starts executing relation r from the next iteration i+1Matching process. When checking, if a conflict is reported, select C ri The next candidate of , and repeat the check r i potential matches with its new candidates. However, it is possible that all candidate relations r i All have been tried and all have resulted in problems. If this happens, it indicates that the previous matching decision was wrong. At this point the algorithm backtracks to the previous relationship matching, such as <r i-1 ,r i ' -1 > and try r i-1 until a conflict-free match is obtained. If successfully obtained, the algorithm continues its normal flow from the next stage. Otherwise, it backtracks again and applies the same process.

[0085] When the algorithm backtracks from stage i to stage i-1, all global data structures are restored to the old version at stage i-1; that is, the last relationship and node matching is canceled and the last node matching is restored from V. matched and E matched Furthermore, the stack S is restored to its old contents by performing the reverse operations of the push and pop operations at stage i.

[0086] Since the goal is to find all exact matches of the query graph, backtracking is required not only when contradictions occur, but it is necessary to try all possible combinations of all candidate options for each query graph node and relationship. Therefore, when an isomorphism of the query graph is found, the algorithm does not terminate or restart, but continues its flow by backtracking. When the algorithm successfully completes the iterative relationship matching part, all relations adjacent to u are matched with some relations adjacent to u′. This completes the reciprocal branching process for nodes u and u′. The rest of the algorithm maintains the isomorphism search by recursively repeating the reciprocal node branching process for the newly obtained node matches.

[0087] Based on the above scheme, most of the current subgraph isomorphism methods are based on the pruning strategy proposed by Ullmann. These techniques have two obvious disadvantages. First, they cannot effectively handle complex queries. Second, their implementation requires large indexes that require a lot of memory resources. The present invention uses a hybrid technique to solve the problem of subgraph isomorphism by matching candidates for each node and relationship of the query graph and backtracking other possible candidates. Compared with existing methods, it effectively improves computing performance and further improves the efficiency of homology analysis.

[0088] Optionally, symbolic program slicing processing is performed on each write function node in each isomorphic subgraph to obtain symbolic program slicing codes corresponding to each write function node of each isomorphic subgraph, including: for each isomorphic subgraph, identifying self-written function nodes of self-written function types in the isomorphic subgraph, and identifying node codes corresponding to each write function node, and symbolic parameters corresponding to each write function node; based on the symbolic parameters corresponding to each write function node, symbolic slicing processing is performed on the node codes corresponding to each write function node by a symbolic slicing algorithm to obtain symbolic program slicing codes corresponding to each write function node.

[0089] In this embodiment, the terminal identifies the self-written function nodes of the self-written function type in the isomorphic subgraph for each isomorphic subgraph, and identifies the node code corresponding to each write function node, and the symbolic parameters corresponding to each write function node. Specifically, the terminal introduces an IDT structure, IDT (instruction dependency table), that is, an instruction dependency table, which is used to represent the dependency relationship between instructions. In order to avoid the sparse matrix of IDT, an instruction backward dependency set (IDS), L(i), is also introduced to store the dependency information of each CFG node i, that is, all instructions / values ​​that may affect the execution / calculation of i. L(i) can be obtained by the following equation, which initializes L 0 (i) = {i}.

[0090] L k+1 (i)≡L k (i)∪∪ j∈CD(i) L k (j)∪∪ x∈REF(i) S k (x)(1)

[0091] Where k ≥ 0, represents the number of calculation iterations, corresponding to the level of indirect influence; REF(i) returns the set of variables referenced (used) in i (LLVM non-constant values). S(x) represents the current backward static slicing result of x before analyzing i, and its calculation equation is as follows:

[0092]

[0093] where DEF(i) returns the set of variables defined or modified in i (LLVM non-const values). For LLVM IR, non-const values ​​may be multi-valued, such as the 'phi' or 'select' instructions. Therefore, for each possible value of the multi-valued, the terminal expands its slice at the definition node.

[0094] (2) Symbolic parameters: such as l x , l yEtc., provide initial static slices for corresponding formal parameters or global variables at the process entry, as shown in Equation 3 below. Here, the formal parameters of the process P and the global variables used in P are denoted as FRML(P) and GLOB(P), respectively.

[0095]

[0096] Formally, a symbolic slice can be represented as a lambda abstraction 'λx.S(x)', where x is a symbolic parameter. Symbolic slices use one symbolic parameter (such as l) for each global variable or formal parameter (such as x) of the procedure. x ) to initialize the slice of x (here denoted as S 0 (x)), that is, in the first slice calculation of the process, S 0 (x) = {l x}. Symbol l x , as a symbolic parameter of x, is like a placeholder that will be replaced by the dependency set. The slice result S(x) of x may contain some symbolic parameters, such as l x and l y ,Right now and The terminal then represents this symbolic slice as a lambda abstraction 'λl x l y .S(x)'.

[0097] The key idea of ​​the entire symbolic slicing algorithm can be briefly summarized as follows: First, the terminal uses symbolic parameters to provide an initial static slice for the corresponding formal parameters or global variables at the procedure entry, as shown in Equation 3. At each CFG node, the terminal calculates the backward dependencies of the instructions through Equation 1 and stores them in the node / instruction dependency table L. Now, these dependencies can be used to extract IR slices. Therefore, if the analyzed node is a memory modification / definition node, the terminal uses these dependencies to update or extend the IR slice of the variable (according to Equation 2). The algorithm continues in this way until the slice table is stable, that is, the calculation reaches its fixed point.

[0098] Among them, symbolic slicing execution requires the definition of slicing criteria, namely<p,v> , where p represents the end point of the program and v represents the variable of interest. For the current homology analysis scenario, the present invention defines p as the starting point of the function and v as the global variables, local variables and parameters in the function. It mainly performs forward slicing to obtain statements that may be affected by the slicing criteria.

[0099] Finally, based on the symbolic parameters corresponding to the respective write function nodes, the terminal uses the symbolic slicing algorithm to perform symbolic slicing on the node codes corresponding to the respective write function nodes, and obtains the symbolic program slicing codes corresponding to the respective write function nodes. Figure 3As shown, it is a code comparison diagram before and after symbolic program slicing of the node code of the self-written function node, wherein the left figure is the node code before slicing, and the right figure is the symbolic program slicing code after slicing.

[0100] Based on the above scheme, the current mainstream static slicing methods all run on PDG (Program Dependency Graph) or SDG (System Dependency Graph), but these friendly graph representations may be costly and error-prone for some users. Moreover, many methods cannot perform data flow analysis on LLVM. The symbolic program slicing technology adopted by the present invention does not reanalyze the process multiple times to find the slice for each call context, but calculates a single symbolic (or parameterized) slice, which can be instantiated at the call site to avoid reanalysis; and it is implemented in LLVM to perform slicing on its intermediate representation (IR). Compared with existing slicing methods, it is more efficient and more scalable.

[0101] Optionally, each symbolic program slice code corresponding to the isomorphic subgraph is escaped to obtain each mathematical semantic information corresponding to the isomorphic subgraph, including: identifying the memory heap address semantic instructions of each symbolic program slice code; performing instruction format conversion processing on the memory heap address semantic instructions of each symbolic program slice code through a semantic equivalence recognition algorithm to obtain the mathematical expression language corresponding to each symbolic program slice code; and using the mathematical expression language corresponding to each symbolic program slice code as each mathematical semantic information corresponding to the isomorphic subgraph.

[0102] In this embodiment, the terminal identifies the memory heap address semantic instructions of each symbolic program slice code. Then, the terminal uses a semantic equivalence recognition algorithm to convert the memory heap address semantic instructions of each symbolic program slice code into an instruction format, and obtains the mathematical expression language corresponding to each symbolic program slice code. Finally, the terminal uses the mathematical expression language corresponding to each symbolic program slice code as the mathematical semantic information corresponding to the isomorphic subgraph. Specifically, LLVM IR contains a wealth of information including pointers, memory, etc., which is not conducive to the calculation of code similarity and needs to be simplified into an expression that is closer to a mathematical formula. In one embodiment, the terminal uses SMACK to convert the LLVMIR of the extracted instruction sequence slices into the Boogie IVL format, which facilitates Boogie to add conditions and assertions, and call the SMT solver Z3 to solve the conditions and assertions and find semantically equivalent instructions. The most critical difference between LLVM IR and Boogie IVL is the representation of memory addresses, where LLVM IR is represented by dynamically located memory heap addresses, while Boogie IVL is represented by a fixed number of global variables. As Figure 4 As shown, Figure 2 The IVL representation obtained by converting the LLVM IR code in .

[0103] Based on the above scheme, LLVM IR contains a lot of information including pointers and memory, which is not conducive to program verification and needs to be filtered. Boogie IVL stands for Boogie Intermediate Verification Language, an intermediate language designed for program verification. It is convenient for Boogie to add conditions and assertions, call SMT solver Z3 to solve conditions and assertions and find semantically equivalent instructions.

[0104] Optionally, similarity calculation is performed on each mathematical semantic information to obtain code similarity values ​​between each binary code file corresponding to the isomorphic subgraph, including: based on the mathematical semantic information of the corresponding self-written function nodes between the two binary code files corresponding to the isomorphic subgraph, respectively constructing corresponding function sets between the two binary code files; using a semantic similarity calculation algorithm, respectively performing semantic similarity calculation processing on the mathematical semantic information of each corresponding self-written function node in the corresponding function set to obtain semantic similarity values ​​between each corresponding self-written function node; based on the semantic similarity values ​​between each corresponding self-written function node, using a program semantic similarity algorithm, calculate the code similarity value between the two binary code files.

[0105] In this embodiment, the terminal constructs the corresponding function sets between the two binary code files based on the mathematical semantic information of the corresponding self-written function nodes between the two binary code files corresponding to the isomorphic subgraphs. Specifically, all functions corresponding to the isomorphic subgraphs calculated by the subgraph isomorphism algorithm constitute the set:

[0106]

[0107] Assumptions and There are two functions that are isomorphic: and The data structures are represented as follows:

[0108]

[0109]

[0110] {V} represents the variable set of the function; T represents the LLVM IR code slice; {U} represents the set of specific data assigned to the input variable of each code slice.

[0111] Then, the terminal uses a semantic similarity calculation algorithm to perform semantic similarity calculation processing on the mathematical semantic information of each corresponding self-written function node in the corresponding function set, and obtains the semantic similarity value between each corresponding self-written function node. Indicates {V q} and {V t A set of assumed mapping relationships between variables to be verified express The variable set {V q}and The variable set {V t} is a set of all variable matching pairs that can be formed. These matching pairs are used as input for verification and are candidate variables for input-output.

[0112] Each LLVM IR code slice in the execution path T starts with an input and corresponds to an input output. q With T t In the mapping relationship Under this condition, formulas 8 and 9 hold true, then T q With T t is equivalent, recorded as formula 10.

[0113] input(T q )=input(T t ) (8)

[0114] output(T q )=output(T t ) (9)

[0115]

[0116] In the process of executing the execution path T corresponding to each LLVM IR code slice, all variables involved in the T path will also be assigned a specific value. The set of these variables is represented as {σ q} and {σ t},and Find Containing mapping relations and appearing in {σ q} and {σ t}, and count the number of such variable pairs, expressed as NumberOfEquivalentVariable. Then the similarity of the two instruction sequence slices for semantic homology analysis is as shown in Formula 11.

[0117]

[0118] Assumptions have instruction sequence slices, have instruction sequence slices, Each instruction sequence slice will be do Second semantic similarity comparison, take the maximum semantic similarity of the two compared slices as S Similarity , the calculation formula is shown in 12, where The calculation formula is shown in 13.

[0119]

[0120] Finally, the terminal calculates the code similarity value between the two binary code files based on the semantic similarity values ​​between the corresponding self-written function nodes through the program semantic similarity algorithm. Among them, the terminal calculates the semantic similarity values ​​of all functions with subgraph isomorphism relationships, and the semantic similarity of the two compared programs is shown in Formula 15.

[0121]

[0122] Based on the above solution, the LLVM IR slicing code fragment semantic equivalence analysis method can be used to perform homology analysis at the semantic logic level to improve the matching accuracy. Through the mapping relationship between variables between corresponding nodes in the isomorphic subgraph, symbolic execution is used to determine the equivalence relationship between input and output to indicate whether the code semantics are equivalent. This series of transformations and calculations effectively avoids scenarios where the syntax is highly similar but the semantics are not equivalent, and effectively reduces the false alarm rate.

[0123] This application also provides an example of homology analysis of a binary code file, such as Figure 5 As shown, the specific processing process includes the following steps:

[0124] Step S501, obtaining each binary code file obtained by security detection through a security monitoring program.

[0125] Step S502: for each binary code file, convert each binary code file into each intermediate representation file through the intermediate file adjustment strategy, and for each intermediate representation file, identify the function type corresponding to each binary code in the intermediate representation file.

[0126] Step S503, according to the function type corresponding to each binary code, each binary code is divided into binary code groups of each function type, and based on the binary code groups of each function type, a function call graph construction strategy is used to construct a function call graph of the intermediate representation file to obtain a function call graph of the binary code file corresponding to the intermediate representation file.

[0127] Step S504: for each binary code file, randomly select a starting node in the function call graph of the binary code file, and based on the starting node, query each candidate node corresponding to the starting node in other function call graphs of each other binary code file.

[0128] Step S505, based on the starting node and each candidate node, through the isomorphic subgraph search strategy, query each target other function call graph that has an isomorphic subgraph with the function call graph, and use the isomorphic subgraph between the function call graph and each target other function call graph as the isomorphic subgraph between the binary code file to which the function call graph belongs and other binary code files to which each target other function call graph belongs.

[0129] Step S506: for each isomorphic subgraph, identify the self-written function nodes of the self-written function type in the isomorphic subgraph, and identify the node codes corresponding to the respective writing function nodes and the symbolic parameters corresponding to the respective writing function nodes.

[0130] Step S507 , based on the symbolic parameters corresponding to the respective write function nodes, a symbolic slicing algorithm is used to perform symbolic slicing processing on the node codes corresponding to the respective write function nodes, so as to obtain symbolic program slicing codes corresponding to the respective write function nodes.

[0131] Step S508, identifying the memory heap address semantic instructions of each symbolic program slice code.

[0132] Step S509 , using a semantic equivalence recognition algorithm, respectively performs instruction format conversion processing on the memory heap address semantic instructions of each symbolic program slice code to obtain a mathematical expression language corresponding to each symbolic program slice code.

[0133] Step S510, using the mathematical expression language corresponding to each symbolic program slice code as each mathematical semantic information corresponding to the isomorphic subgraph.

[0134] Step S511, based on the mathematical semantic information of the corresponding self-written function nodes between the two binary code files corresponding to the isomorphic subgraphs, respectively construct corresponding function sets between the two binary code files.

[0135] Step S512 , using a semantic similarity calculation algorithm, respectively performs semantic similarity calculation processing on the mathematical semantic information of each corresponding self-written function node in the corresponding function set to obtain semantic similarity values ​​between each corresponding self-written function node.

[0136] Step S513, based on the semantic similarity values ​​between the corresponding self-written function nodes, the code similarity value between the two binary code files is calculated by a program semantic similarity algorithm.

[0137] Step S514: taking each binary code file corresponding to a code similarity value greater than a similarity threshold as a same-source binary code file.

[0138] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0139] Based on the same inventive concept, the embodiment of the present application also provides a binary code file homology analysis device for implementing the above-mentioned binary code file homology analysis method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in the embodiment of the homology analysis device for one or more binary code files provided below can refer to the limitations of the binary code file homology analysis method above, and will not be repeated here.

[0140] In an exemplary embodiment, Figure 6 As shown, a binary code file homology analysis device is provided, including: an acquisition module 610, an identification module 620, a calculation module 630 and a determination module 640, wherein:

[0141] The acquisition module 610 is used to acquire each binary code file obtained by the security detection through the security monitoring program, and identify the function call graph corresponding to each binary code file;

[0142] The identification module 620 is used to identify the isomorphic subgraphs between the binary code files based on the function call graphs of the binary code files through a hybrid search strategy, and perform symbolic program slicing processing on the respective write function nodes in each isomorphic subgraph to obtain the symbolic program slicing code corresponding to the respective write function nodes of each isomorphic subgraph;

[0143] The calculation module 630 is used to perform escape processing on each symbolic program slice code corresponding to each isomorphic subgraph to obtain each mathematical semantic information corresponding to the isomorphic subgraph, and perform similarity calculation on each mathematical semantic information to obtain the code similarity value between each binary code file corresponding to the isomorphic subgraph;

[0144] The determination module 640 is used to regard each binary code file corresponding to a code similarity value greater than a similarity threshold as a homologous binary code file.

[0145] Optionally, the acquisition module 610 is specifically configured to:

[0146] For each binary code file, convert each binary code file into each intermediate representation file through an intermediate file adjustment strategy, and for each intermediate representation file, identify the function type corresponding to each binary code in the intermediate representation file;

[0147] According to the function type corresponding to each binary code, each binary code is divided into binary code groups of each function type, and based on the binary code groups of each function type, a function call graph construction strategy is used to construct a function call graph of the intermediate representation file, so as to obtain a function call graph of the binary code file corresponding to the intermediate representation file.

[0148] Optionally, the identification module 620 is specifically configured to:

[0149] For each binary code file, randomly select a starting node in a function call graph of the binary code file, and based on the starting node, query each candidate node corresponding to the starting node in other function call graphs of each other binary code file;

[0150] Based on the starting node and each of the candidate nodes, the isomorphic subgraph search strategy is used to query each target other function call graph that has an isomorphic subgraph with the function call graph, and the isomorphic subgraph between the function call graph and each of the target other function call graphs is used as the isomorphic subgraph between the binary code file to which the function call graph belongs and other binary code files to which each of the target other function call graphs belongs.

[0151] Optionally, the identification module 620 is specifically configured to:

[0152] For each isomorphic subgraph, identifying a self-written function node of a self-written function type in the isomorphic subgraph, and identifying a node code corresponding to each of the self-written function nodes, and a symbolic parameter corresponding to each of the self-written function nodes;

[0153] Based on the symbolic parameters corresponding to each of the self-written function nodes, the node codes corresponding to each of the self-written function nodes are symbolically sliced ​​by a symbolic slicing algorithm to obtain symbolic program slice codes corresponding to each of the self-written function nodes.

[0154] Optionally, the calculation module 630 is specifically used to:

[0155] Identifying the memory heap address semantic instructions of each of the symbolic program slice codes;

[0156] Through the semantic equivalence recognition algorithm, the memory heap address semantic instructions of each symbolic program slice code are respectively converted into instruction formats to obtain the mathematical expression language corresponding to each symbolic program slice code;

[0157] The mathematical expression language corresponding to each of the symbolic program slice codes is used as the mathematical semantic information corresponding to the isomorphic subgraph.

[0158] Optionally, the calculation module 630 is specifically used to:

[0159] Based on the mathematical semantic information of the corresponding self-written function nodes between the two binary code files corresponding to the isomorphic subgraphs, respectively construct corresponding function sets between the two binary code files;

[0160] By using a semantic similarity calculation algorithm, the mathematical semantic information of each corresponding self-written function node in the corresponding function set is respectively processed by semantic similarity calculation to obtain the semantic similarity value between each corresponding self-written function node;

[0161] Based on the semantic similarity values ​​between the corresponding self-written function nodes, the code similarity value between the two binary code files is calculated using a program semantic similarity algorithm.

[0162] Each module in the above-mentioned binary code file homology analysis device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0163] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 7As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a homology analysis method for a binary code file is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0164] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0165] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of a homology analysis method for binary code files when executing the computer program.

[0166] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the homology analysis method for binary code files are implemented.

[0167] In one embodiment, a computer program product is provided, comprising a computer program, which implements the steps of a homology analysis method for binary code files when executed by a processor.

[0168] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0169] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0170] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0171] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for homology analysis of binary code files, characterized in that: The method comprises: Obtain each binary code file obtained by security detection through a security monitoring program, and identify a function call graph corresponding to each binary code file; Based on the function call graph of each of the binary code files, the isomorphic subgraphs between the binary code files are identified through a hybrid search strategy, and the symbolic program slicing process is performed on the respective write function nodes in each isomorphic subgraph to obtain the symbolic program slicing code corresponding to the respective write function nodes of each isomorphic subgraph; For each isomorphic subgraph, performing escape processing on each symbolic program slice code corresponding to the isomorphic subgraph to obtain each mathematical semantic information corresponding to the isomorphic subgraph, and performing similarity calculation on each mathematical semantic information to obtain the code similarity value between each binary code file corresponding to the isomorphic subgraph; Each binary code file corresponding to a code similarity value greater than a similarity threshold is regarded as a homologous binary code file.

2. The method according to claim 1, characterized in that The step of identifying a function call graph corresponding to each binary code file includes: For each binary code file, convert each binary code file into each intermediate representation file through an intermediate file adjustment strategy, and for each intermediate representation file, identify the function type corresponding to each binary code in the intermediate representation file; According to the function type corresponding to each binary code, each binary code is divided into binary code groups of each function type, and based on the binary code groups of each function type, a function call graph construction strategy is used to construct a function call graph of the intermediate representation file, so as to obtain a function call graph of the binary code file corresponding to the intermediate representation file.

3. The method according to claim 2, characterized in that The function call graphs based on the binary code files, identifying isomorphic subgraphs between the binary code files through a hybrid search strategy, comprises: For each binary code file, randomly select a starting node in a function call graph of the binary code file, and based on the starting node, query each candidate node corresponding to the starting node in other function call graphs of each other binary code file; Based on the starting node and each of the candidate nodes, the isomorphic subgraph search strategy is used to query each target other function call graph that has an isomorphic subgraph with the function call graph, and the isomorphic subgraph between the function call graph and each of the target other function call graphs is used as the isomorphic subgraph between the binary code file to which the function call graph belongs and other binary code files to which each of the target other function call graphs belongs.

4. The method according to claim 1, characterized in that: The step of performing symbolic program slicing processing on each write function node in each isomorphic subgraph to obtain a symbolic program slicing code corresponding to each write function node in each isomorphic subgraph includes: For each isomorphic subgraph, identifying a self-written function node of a self-written function type in the isomorphic subgraph, and identifying a node code corresponding to each of the self-written function nodes, and a symbolic parameter corresponding to each of the self-written function nodes; Based on the symbolic parameters corresponding to each of the self-written function nodes, the node codes corresponding to each of the self-written function nodes are symbolically sliced ​​by a symbolic slicing algorithm to obtain symbolic program slice codes corresponding to each of the self-written function nodes.

5. The method according to claim 1, characterized in that The step of performing escape processing on each symbolic program slice code corresponding to the isomorphic subgraph to obtain each mathematical semantic information corresponding to the isomorphic subgraph includes: Identifying the memory heap address semantic instructions of each of the symbolic program slice codes; Through the semantic equivalence recognition algorithm, the memory heap address semantic instructions of each symbolic program slice code are respectively converted into instruction formats to obtain the mathematical expression language corresponding to each symbolic program slice code; The mathematical expression language corresponding to each of the symbolic program slice codes is used as the mathematical semantic information corresponding to the isomorphic subgraph.

6. The method according to claim 1, characterized in that The performing similarity calculation on each of the mathematical semantic information to obtain the code similarity value between each binary code file corresponding to the isomorphic subgraph includes: Based on the mathematical semantic information of the corresponding self-written function nodes between the two binary code files corresponding to the isomorphic subgraphs, respectively construct corresponding function sets between the two binary code files; By using a semantic similarity calculation algorithm, the mathematical semantic information of each corresponding self-written function node in the corresponding function set is respectively processed by semantic similarity calculation to obtain the semantic similarity value between each corresponding self-written function node; Based on the semantic similarity values ​​between the corresponding self-written function nodes, the code similarity value between the two binary code files is calculated using a program semantic similarity algorithm.

7. A device for analyzing the homology of binary code files, characterized in that: The device comprises: An acquisition module is used to acquire each binary code file obtained by security detection through a security monitoring program, and identify a function call graph corresponding to each binary code file; An identification module is used to identify isomorphic subgraphs between the binary code files based on the function call graphs of the binary code files through a hybrid search strategy, and perform symbolic program slicing processing on the respective write function nodes in each isomorphic subgraph to obtain symbolic program slicing codes corresponding to the respective write function nodes of each isomorphic subgraph; A calculation module is used to perform escape processing on each symbolic program slice code corresponding to each isomorphic subgraph to obtain each mathematical semantic information corresponding to the isomorphic subgraph, and perform similarity calculation on each mathematical semantic information to obtain a code similarity value between each binary code file corresponding to the isomorphic subgraph; The determination module is used to regard each binary code file corresponding to a code similarity value greater than a similarity threshold as a homologous binary code file.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images