Binary component analysis method and device
By building a binary component knowledge base and combining deep learning algorithms for similarity search, the problem of inaccurate identification of third-party components in binary software component analysis is solved, the accuracy and efficiency of the analysis is improved, and the detection capability of the software supply chain is enhanced.
Patent Information
- Application Number
- CN202411593189.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-08
- Publication Date
- 2025-03-18
AI Technical Summary
The prior art has difficulty in accurately identifying third-party components and their sources in binary software component analysis, resulting in inaccurate security threat detection.
Acquire binary components through component acquisition services, and build a binary component knowledge base on the big data platform in combination with reverse analysis tools and deep learning algorithms. This knowledge base is used for similarity search to identify third-party components in the target binary file.
It improves the accuracy and efficiency of binary component analysis, can more comprehensively evaluate the structure and behavior of functions, and enhances the detection capabilities of software supply chain security.
Smart Images
Figure CN119645491A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of software supply chain, and in particular to a binary component analysis method and device. Background Art
[0002] In the field of software supply chain, software delivery usually appears in the form of binary files. Therefore, binary software security is related to the security of the entire software supply chain, and its importance is self-evident. At present, the security detection and analysis of binary software first obtains the referenced third-party components in the target binary file through component analysis, and then associates the existing defects and vulnerabilities to obtain the possible security threats of the target binary software. The difficulty of binary software component analysis lies in how to accurately identify the third-party components and their sources in the binary program. The current mainstream method is to extract features based on the string constants, import and export functions and other information obtained after reversing the binary file, and obtain the final third-party components and related security vulnerability information by searching and matching in the relevant knowledge base. This method places high demands on the quality of feature extraction and the method of knowledge base construction.
[0003] At present, the main methods of feature extraction are binary file-level function call graph, function-level control flow graph and abstract syntax tree. For the function call graph, it reflects the function call relationship of the entire binary file, but most third-party component introductions are referenced or copied and pasted as a function point. If the function call graph is used for matching, many function-level third-party component introductions will be missed; for the function control flow graph, it mainly reflects the dynamic behavior of the code, that is, the control flow during program execution, including various control transfers, and lacks static semantic information of the code, and is greatly affected by different architectures and platforms; for the abstract syntax tree, it mainly reflects the static structure of the code, that is, the grammatical structure and logical composition of the code. It represents the grammatical elements of the source code and the hierarchical relationship between them, such as function definition, class definition, variable declaration, expression, etc., and lacks the dynamic control behavior of the code.
[0004] In view of this, how to provide a binary component analysis method to improve the accuracy and efficiency of binary component analysis has become a technical problem that needs to be solved urgently. Summary of the invention
[0005] The embodiments of the present application provide a binary component analysis method, a binary component analysis device, an electronic device and a computer storage medium, which are used to solve the problems of low accuracy and low efficiency of current binary component analysis.
[0006] In a first aspect of an embodiment of the present application, a binary component analysis method is provided, comprising:
[0007] Collect binary components through the component collection service and upload them to the big data platform, wherein the binary components carry binary component knowledge, vulnerability knowledge, and dependency knowledge;
[0008] Based on the data processing capability of the big data platform, combined with reverse analysis tools and deep learning algorithms, the binary components are preprocessed, reversely analyzed and feature mapped to build a binary component knowledge base;
[0009] The target binary file uploaded by the user is received through the detection interface, and the target binary file is preprocessed, reversely analyzed and feature mapped through the binary component analysis service, and a similarity search is performed in the binary component knowledge base to obtain a matching result.
[0010] In a second aspect of an embodiment of the present application, a binary component analysis device is provided, comprising:
[0011] A collection module is configured to collect binary components through a component collection service and upload them to a big data platform, wherein the binary components carry binary component knowledge, vulnerability knowledge, and dependency knowledge;
[0012] A construction module is configured to perform preprocessing, reverse analysis and feature mapping on the binary component based on the data processing capability of the big data platform, combined with a reverse analysis tool and a deep learning algorithm, to construct a binary component knowledge base;
[0013] The retrieval module is configured to receive a target binary file uploaded by a user terminal through a detection interface, perform preprocessing, reverse analysis and feature mapping on the target binary file through a binary component analysis service, and perform similarity retrieval in the binary component knowledge base to obtain a matching result.
[0014] According to a third aspect of an embodiment of the present application, a computing device is provided, including:
[0015] Memory and processor;
[0016] The memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions. When the computer executable instructions are executed by the processor, the steps of the above binary component analysis method are implemented.
[0017] According to a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the steps of the above-mentioned binary component analysis method are implemented.
[0018] The present application provides a binary component analysis method, comprising: firstly, collecting binary components through a component collection service and uploading them to a big data platform, wherein the binary components carry binary component knowledge, vulnerability knowledge and dependency knowledge; then, based on the data processing capability of the big data platform, combined with a reverse analysis tool and a deep learning algorithm, preprocessing, reverse analysis and feature mapping are performed on the binary components to build a binary component knowledge base; finally, a target binary file uploaded by a user end is received through a detection interface, and the target binary file is preprocessed, reverse analyzed and feature mapped through a binary component analysis service, and a similarity search is performed in the binary component knowledge base to obtain a matching result.
[0019] By applying the binary component analysis method provided in the embodiment of the present application to construct a binary component knowledge base, the knowledge base can be better managed and knowledge retrieval can be quickly performed; by combining AST and CFG to perform function similarity comparison, not only the static grammatical structure of the code but also the dynamic control flow of the code is considered. Through this combination of static and dynamic methods, the structure and behavior of the function are more comprehensively evaluated, and the accuracy and reliability of similarity detection are improved; component analysis is performed based on imported functions and user-defined functions to filter out a large number of irrelevant functions and improve analysis efficiency.
[0020] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, which can be implemented in accordance with the contents of the specification, and in order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS
[0021] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:
[0022] Figure 1 A schematic diagram of the structure of a binary component analysis system provided in an embodiment of the present application;
[0023] Figure 2 A schematic diagram of the structure of a binary component knowledge base in a binary component analysis system improved in an embodiment of the present application;
[0024] Figure 3 A schematic diagram of a binary component analysis method provided in an embodiment of the present application;
[0025] Figure 4A schematic diagram of a flow chart of a binary function similarity algorithm in a binary component analysis method provided in an embodiment of the present application;
[0026] Figure 5 A schematic diagram of a flow chart of a binary component analysis method in a binary component analysis method provided in an embodiment of the present application;
[0027] Figure 6 A schematic diagram of the structure of a binary component analysis device provided in an embodiment of the present application;
[0028] Figure 7 A structural block diagram of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0029] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.
[0030] See also Figure 1 , Figure 1 This is a schematic diagram of the structure of a binary component analysis system provided in an embodiment of the present application. Figure 1 As shown, the binary component analysis system includes a component collection service 101, a big data platform 102, a binary component knowledge base 103, a binary component analysis service 104 and a terminal 105.
[0031] Specifically, binary components are collected from various open source platforms through the component collection service 101 and uploaded to the big data platform.
[0032] Based on the massive data processing capability of the big data platform 102 , combined with reverse analysis tools and deep learning algorithms, the components are preprocessed, reverse analyzed and feature mapped, and stored in the binary component knowledge base 103 .
[0033] See also Figure 2 , Figure 2 A schematic diagram of the structure of a binary component knowledge base in a binary component analysis system improved in an embodiment of the present application, such as Figure 2 As shown, the binary component knowledge base 103 is composed of three major modules, including: a data collection module 1031, a big data platform 1032 and a distributed search engine platform 1033.
[0034] Specifically, the data collection module 1031 includes Maven component library, Conan component library and NVD vulnerability database, which are mainly based on package managers of various programming languages and are oriented to various open source platforms on the Internet, such as C / C++ package manager Conan, Java package manager Maven, etc.
[0035] Big data platform 1032 has the ability to process massive amounts of data. Based on the big data platform, it provides data cleaning services, IDAPro reverse analysis, and deep learning algorithm services (which can be feature vector mapping) for massive amounts of data.
[0036] Distributed search platform 1033 is a powerful and flexible distributed search engine that can process large-scale data and realize efficient data indexing, searching and analyzing functions. It builds a binary component knowledge base based on the distributed search engine and stores basic information of component functions at the function granularity, such as component name, version number, architecture, system, language, function name, associated vulnerabilities, etc., as well as advanced information of component functions, such as the AST mapping vector and CFG mapping vector of the function.
[0037] The terminal 105 (which may be a user) accesses the detection interface by uploading the target binary file, performs preprocessing, reverse analysis, and feature mapping on the target binary through the binary component analysis service 104, and then performs similarity search in the knowledge base to obtain matching results.
[0038] In the embodiments of the present application, the goal of binary component analysis is to ensure the security, reliability and compliance of the software. By detecting third-party components used in the target binary file and associating them with possible security vulnerabilities, license compliance and other issues through third-party components, it can help enterprises better manage the software supply chain and improve software quality and security.
[0039] See also Figure 3 , Figure 3 A schematic diagram of a binary component analysis method provided in an embodiment of the present application. Figure 3 As shown, the specific steps include the following steps.
[0040] Step S302: Collect binary components through component collection service and upload to the big data platform. It should be noted that binary components are collected from the Internet open source platform through component collection service, and the binary components carry binary component knowledge, vulnerability knowledge and dependency knowledge.
[0041] Step S304: Based on the data processing capability of the big data platform, combined with reverse analysis tools and deep learning algorithms, the binary components are preprocessed, reverse analyzed and feature mapped to build a binary component knowledge base.
[0042] Step S306: receiving the target binary file uploaded by the user end through the detection interface, performing preprocessing, reverse analysis and feature mapping on the target binary file through the binary component analysis service, and performing similarity search in the binary component knowledge base to obtain matching results.
[0043] In the embodiment of the present application, the target binary file uploaded by the user end is received through the detection interface, the target binary file is preprocessed, reversely analyzed and feature mapped through the binary component analysis service, and similarity search is performed in the binary component knowledge base to obtain matching results, including:
[0044] The target binary file uploaded by the user is received through the detection interface, and the target binary file is reversely analyzed to obtain the import function and the user-defined function; in the binary component knowledge base, the import function and the user-defined function are similarly searched to obtain the matching result.
[0045] Specifically, in the binary component knowledge base, similarity retrieval is performed on the imported function and the user-defined function to obtain a matching result, including: searching the binary component knowledge base for the function name corresponding to the imported function to obtain an initial matching result; calculating the feature vector of the imported function through a deep learning algorithm, and performing cosine similarity calculation based on the initial matching result to obtain a first matching result corresponding to the imported function, and using the first matching result as a first candidate item set; calculating the feature vector of the user-defined function through a deep learning algorithm, and performing cosine similarity calculation based on the binary component knowledge base to obtain a second matching result corresponding to the user-defined function, and using the second matching result as a second candidate item set; based on the first candidate item set and the second candidate item set, a threshold is set in combination with the similarity score to obtain a target matching result sorted by score.
[0046] More specifically, the method of setting a threshold based on the first candidate item set and the second candidate item set in combination with the similarity score to obtain target matching results sorted by scores includes: combining the abstract syntax tree and control flow graph of the function, performing function similarity comparison on the first candidate item set and the second candidate item set, setting a threshold in combination with the similarity score, and obtaining target matching results sorted by scores.
[0047] More specifically, the abstract syntax tree and control flow graph of the combined function are used to compare the function similarity of the first candidate item set and the second candidate item set, and a threshold is set in combination with the similarity score to obtain a target matching result sorted by the score, including: training a Tree-LSTM model based on the abstract syntax tree data to obtain an AST Tree-LSTM model, wherein the AST Tree-LSTM model is used to extract an AST feature vector; training a Tree-LSTM model based on the control flow graph data to obtain a CFG Tree-LSTM model, wherein the CFG Tree-LSTM model is used to extract a CFG feature vector; determining a first binary function corresponding to the first candidate item set, and obtaining a first abstract syntax tree and a first control flow graph corresponding to the first binary function through reverse analysis; determining a second binary function corresponding to the second candidate item set, and obtaining a second abstract syntax tree and a second control flow graph corresponding to the second binary function through reverse analysis; mapping the first abstract syntax tree and the second abstract syntax tree to a first abstract feature vector and a second abstract feature vector through the AST Tree-LSTM model; and The Tree-LSTM model maps the first control flow graph and the second control flow graph into a first control feature vector and a second control feature vector; based on the first abstract feature vector and the second abstract feature vector, the cosine similarity of the abstract syntax tree vector is calculated; based on the first control feature vector and the second control feature vector, the cosine similarity of the control flow graph vector is calculated; based on the cosine similarity of the abstract syntax tree vector and the cosine similarity of the control flow graph vector, a threshold is set in combination with the similarity score to obtain the target matching results sorted by the score.
[0048] The embodiment of the present application is based on a binary function similarity algorithm based on deep learning, which determines whether two binary functions are similar from two aspects, namely, the abstract syntax tree (i.e., Abstract Syntax Tree, AST) and the control flow graph (i.e., Control Flow Graph, CFG) of the function.
[0049] Among them, AST mainly reflects the static structure of the code, that is, the grammatical structure and logical composition of the code; CFG mainly reflects the dynamic behavior of the code, that is, the control flow during program execution.
[0050] Combining AST and CFG for function similarity comparison not only considers the static grammatical structure of the code, but also the dynamic control flow of the code. This combined static and dynamic approach can more comprehensively evaluate the structure and behavior of the function, thereby improving the accuracy and reliability of similarity detection.
[0051] Tree-LSTM (Tree-Structured Long Short-Term Memory) is an extended LSTM model used to process data with a tree structure. The Tree-LSTM model is trained based on AST data to obtain an AST Tree-LSTM model for extracting AST feature vectors. The Tree-LSTM model is trained based on CFG data to obtain a CFG Tree-LSTM model for extracting CFG feature vectors.
[0052] See also Figure 4 , Figure 4 The following is a flow chart of a binary function similarity algorithm in a binary component analysis method provided in an embodiment of the present application. Figure 4 The following is a binary function similarity calculation algorithm based on Tree-LSTM. First, define two different binary functions f1 and f2. Obtain the AST and CFG of functions f1 and f2 through reverse analysis, which are defined as T1, T2 and G1, G2 respectively. T1 and T2 are mapped to feature vectors V through the AST Tree-LSTM model. T1 and V T2 , G1 and G2 are mapped to V through the CFG Tree-LSTM model G1 and V G2 .
[0053] AST vector cosine similarity sim(f1,f2) of functions f1 and f2 AST And CFG vector cosine similarity sim(f1,f2) CFG Respectively expressed as:
[0054]
[0055] The cosine similarity sim(f1,f2) of functions f1 and f2 is expressed as follows, where α and β represent the weights of AST similarity and CFG similarity, respectively.
[0056] sim(f1,f2)=sim(f1,f2) AST α+sim(f1,f2) CFG β.
[0057] In addition, the embodiment of the present application also analyzes the third-party component information that may exist in the target binary file from two aspects: imported functions and user-defined functions from the perspective of a binary component analysis method.
[0058] Among them, imported functions are functions in DLLs and other shared libraries that need to be loaded when the program is running. User-defined functions are functions written by users to implement their own logic and functions.
[0059] After reversing a binary file, a large number of functions will be obtained. Imported functions are functions in third-party libraries called by the target binary file, and user-defined functions are functions implemented by the user's core functions. It can be said that these two functions cover the core functional modules of the target binary file, which can filter out a large number of irrelevant functions and greatly improve the analysis efficiency.
[0060] See also Figure 5 , Figure 5 A schematic diagram of a binary component analysis method in a binary component analysis method provided in an embodiment of the present application. Figure 5 As shown, the target binary file is first reverse analyzed to obtain the import function and user-defined function list of the target binary file. For the import function, because it is usually provided by the operating system or a third-party library, (1) the function name is first directly retrieved in the binary component knowledge base to obtain the initial matching result of the function, (2) then based on the function vector mapping algorithm, the AST feature vector and CFG feature vector of the function are obtained, (3) by performing cosine similarity matching with the initial matching result, the final matching result of the import function is obtained. For the user-defined function, because it is usually developed by the developer to implement certain specific functions, there is a possibility of directly copying and pasting some open source software codes, so the user-defined function is directly obtained through the function vector mapping algorithm. The AST feature vector and CFG feature vector of the function are matched, and the cosine similarity matching is performed in the binary component knowledge base to obtain the final matching result of the user-defined function. Finally, by setting a certain similarity threshold, the final component analysis result of the target binary file is filtered.
[0061] By applying the binary analysis method provided in the embodiment of the present application, on the one hand, a binary component knowledge base is constructed based on a distributed search engine, which can better manage the knowledge base and quickly perform knowledge retrieval; on the other hand, function similarity comparison is performed in combination with AST and CFG, which not only considers the static grammatical structure of the code, but also the dynamic control flow of the code. Through this combination of static and dynamic methods, the structure and behavior of the function are more comprehensively evaluated, and the accuracy and reliability of similarity detection are improved; on the other hand, component analysis is performed based on imported functions and user-defined functions, a large number of irrelevant functions are filtered out, and analysis efficiency is improved.
[0062] Corresponding to the above method embodiment, this specification also provides a binary component analysis device embodiment, Figure 6 This is a schematic diagram of the structure of a binary component analysis device provided in an embodiment of the present application. Figure 6 As shown, the device comprises:
[0063] The collection module 602 is configured to collect binary components through a component collection service and upload them to the big data platform, wherein the binary components carry binary component knowledge, vulnerability knowledge, and dependency knowledge;
[0064] The construction module 604 is configured to perform preprocessing, reverse analysis and feature mapping on the binary component based on the data processing capability of the big data platform, combined with the reverse analysis tool and the deep learning algorithm, to construct a binary component knowledge base;
[0065] The retrieval module 606 is configured to receive the target binary file uploaded by the user through the detection interface, pre-process, reversely analyze and feature map the target binary file through the binary component analysis service, and perform similarity search in the binary component knowledge base to obtain matching results.
[0066] In an optional embodiment, the retrieval module 606 is further configured to:
[0067] Receive a target binary file uploaded by a user through a detection interface, perform reverse analysis on the target binary file, and obtain imported functions and user-defined functions;
[0068] In the binary component knowledge base, similarity search is performed on the imported function and the user-defined function to obtain a matching result.
[0069] In an optional embodiment, the retrieval module 606 is further configured to:
[0070] In the binary component knowledge base, searching for the function name corresponding to the imported function to obtain an initial matching result;
[0071] Calculate the feature vector of the import function by using a deep learning algorithm, perform cosine similarity calculation based on the initial matching result, obtain a first matching result corresponding to the import function, and use the first matching result as a first candidate item set;
[0072] Calculate the feature vector of the user-defined function by using a deep learning algorithm, perform cosine similarity calculation based on the binary component knowledge base, obtain a second matching result corresponding to the user-defined function, and use the second matching result as a second candidate item set;
[0073] Based on the first candidate item set and the second candidate item set, a threshold is set in combination with the similarity score to obtain target matching results sorted by the score.
[0074] In an optional embodiment, the retrieval module 606 is further configured to:
[0075] Combined with the abstract syntax tree and control flow graph of the function, the first candidate item set and the second candidate item set are compared for function similarity, and a threshold is set based on the similarity score to obtain target matching results sorted by score.
[0076] In an optional embodiment, the retrieval module 606 is further configured to:
[0077] A Tree-LSTM model is trained based on the abstract syntax tree data to obtain an AST Tree-LSTM model, wherein the AST Tree-LSTM model is used to extract an AST feature vector;
[0078] The Tree-LSTM model is trained based on the control flow graph data to obtain a CFG Tree-LSTM model, wherein the CFGTree-LSTM model is used to extract the CFG feature vector.
[0079] Determine a first binary function corresponding to the first candidate item set, and obtain a first abstract syntax tree and a first control flow graph corresponding to the first binary function through reverse analysis;
[0080] Determine a second binary function corresponding to the second candidate item set, and obtain a second abstract syntax tree and a second control flow graph corresponding to the second binary function through reverse analysis;
[0081] Mapping the first abstract syntax tree and the second abstract syntax tree into a first abstract feature vector and a second abstract feature vector through an AST Tree-LSTM model;
[0082] Mapping the first control flow graph and the second control flow graph into a first control feature vector and a second control feature vector through a CFG Tree-LSTM model;
[0083] Calculating the cosine similarity of abstract syntax tree vectors based on the first abstract feature vector and the second abstract feature vector;
[0084] Calculating the cosine similarity of the control flow graph vector based on the first control feature vector and the second control feature vector;
[0085] Based on the cosine similarity of the abstract syntax tree vector and the cosine similarity of the control flow graph vector, a threshold is set in combination with the similarity score to obtain target matching results sorted by score.
[0086] By using the binary analysis device provided in the embodiment of the present application, on the one hand, a binary component knowledge base is constructed based on a distributed search engine, which can better manage the knowledge base and quickly perform knowledge retrieval; on the other hand, function similarity comparison is performed in combination with AST and CFG, which not only considers the static grammatical structure of the code, but also the dynamic control flow of the code. Through this combination of static and dynamic methods, the structure and behavior of the function are more comprehensively evaluated, and the accuracy and reliability of similarity detection are improved; on the other hand, component analysis is performed based on imported functions and user-defined functions, a large number of irrelevant functions are filtered out, and analysis efficiency is improved.
[0087] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the binary component analysis device, since it is basically similar to the binary component analysis method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the binary component analysis method embodiment.
[0088] Figure 7 This is a block diagram of a computing device provided in an embodiment of the present application. The components of the computing device 700 include but are not limited to a memory 710 and a processor 720. The processor 720 is connected to the memory 710 via a bus 730, and the database 750 is used to store data.
[0089] The computing device 700 also includes an access device 740, which enables the computing device 700 to communicate via one or more networks 760. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 740 may include one or more of any type of network interface (e.g., a network interface card (NIC)) of wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a world-wide interoperability for microwave access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, and a near field communication (NFC).
[0090] In one embodiment of the present specification, the above components of the computing device 700 and Figure 7 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 7 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.
[0091] The computing device 700 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or a personal computer (PC). The computing device 700 may also be a mobile or stationary server.
[0092] The processor 720 is used to execute the following computer executable instructions, which, when executed by the processor, implement the steps of the above-mentioned binary component analysis method.
[0093] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the computing device embodiment, since it is basically similar to the binary component analysis method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the binary component analysis method embodiment.
[0094] An embodiment of the present specification further provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the above-mentioned binary component analysis method.
[0095] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the computer-readable storage medium embodiment, since it is basically similar to the binary component analysis method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the binary component analysis method embodiment.
[0096] An embodiment of the present specification further provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned binary component analysis method.
[0097] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the computer program embodiment, since it is basically similar to the binary component analysis method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the binary component analysis method embodiment.
[0098] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.
[0099] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.
[0100] It should be noted that the above is a description of a specific embodiment of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of the present specification.
[0101] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.
[0102] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.
Claims
1. A binary component analysis method, characterized in that: include: Collect binary components through the component collection service and upload them to the big data platform, wherein the binary components carry binary component knowledge, vulnerability knowledge, and dependency knowledge; Based on the data processing capability of the big data platform, combined with reverse analysis tools and deep learning algorithms, the binary components are preprocessed, reversely analyzed and feature mapped to build a binary component knowledge base; The target binary file uploaded by the user is received through the detection interface, and the target binary file is preprocessed, reversely analyzed and feature mapped through the binary component analysis service, and a similarity search is performed in the binary component knowledge base to obtain a matching result.
2. The method according to claim 1, characterized in that The target binary file uploaded by the user end is received through the detection interface, and the target binary file is preprocessed, reversely analyzed and feature mapped through the binary component analysis service, and similarity search is performed in the binary component knowledge base to obtain matching results, including: Receive a target binary file uploaded by a user through a detection interface, perform reverse analysis on the target binary file, and obtain imported functions and user-defined functions; In the binary component knowledge base, similarity search is performed on the imported function and the user-defined function to obtain a matching result.
3. The method according to claim 2, characterized in that The performing similarity search on the imported function and the user-defined function in the binary component knowledge base to obtain a matching result includes: In the binary component knowledge base, searching for the function name corresponding to the imported function to obtain an initial matching result; Calculate the feature vector of the import function by using a deep learning algorithm, perform cosine similarity calculation based on the initial matching result, obtain a first matching result corresponding to the import function, and use the first matching result as a first candidate item set; Calculating the feature vector of the user-defined function by a deep learning algorithm, and performing cosine similarity calculation based on the binary component knowledge base, obtaining a second matching result corresponding to the user-defined function, and using the second matching result as a second candidate item set; Based on the first candidate item set and the second candidate item set, a threshold is set in combination with the similarity score to obtain target matching results sorted by the score.
4. The method according to claim 3, characterized in that The step of setting a threshold based on the first candidate item set and the second candidate item set in combination with the similarity score to obtain target matching results sorted by score includes: Combined with the abstract syntax tree and control flow graph of the function, the first candidate item set and the second candidate item set are compared for function similarity, and a threshold is set based on the similarity score to obtain target matching results sorted by score.
5. The method according to claim 4, characterized in that The combining the abstract syntax tree and the control flow graph of the function, performing function similarity comparison on the first candidate item set and the second candidate item set, setting a threshold based on the similarity score, and obtaining target matching results sorted by score, includes: A Tree-LSTM model is trained based on the abstract syntax tree data to obtain an AST Tree-LSTM model, wherein the ASTTree-LSTM model is used to extract an AST feature vector; A Tree-LSTM model is trained based on the control flow graph data to obtain a CFG Tree-LSTM model, wherein the CFGTree-LSTM model is used to extract a CFG feature vector; Determine a first binary function corresponding to the first candidate item set, and obtain a first abstract syntax tree and a first control flow graph corresponding to the first binary function through reverse analysis; Determine a second binary function corresponding to the second candidate item set, and obtain a second abstract syntax tree and a second control flow graph corresponding to the second binary function through reverse analysis; Mapping the first abstract syntax tree and the second abstract syntax tree into a first abstract feature vector and a second abstract feature vector through an AST Tree-LSTM model; Mapping the first control flow graph and the second control flow graph into a first control feature vector and a second control feature vector through a CFG Tree-LSTM model; Calculating the cosine similarity of abstract syntax tree vectors based on the first abstract feature vector and the second abstract feature vector; Calculating the cosine similarity of the control flow graph vector based on the first control feature vector and the second control feature vector; Based on the cosine similarity of the abstract syntax tree vector and the cosine similarity of the control flow graph vector, a threshold is set in combination with the similarity score to obtain target matching results sorted by score.
6. A binary component analysis device, characterized in that: include: A collection module is configured to collect binary components through a component collection service and upload them to a big data platform, wherein the binary components carry binary component knowledge, vulnerability knowledge, and dependency knowledge; A construction module is configured to perform preprocessing, reverse analysis and feature mapping on the binary component based on the data processing capability of the big data platform in combination with a reverse analysis tool and a deep learning algorithm to construct a binary component knowledge base; The retrieval module is configured to receive a target binary file uploaded by a user terminal through a detection interface, perform preprocessing, reverse analysis and feature mapping on the target binary file through a binary component analysis service, and perform similarity retrieval in the binary component knowledge base to obtain a matching result.
7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores an implementation program for information transmission, and when the program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.