Binary file vulnerability analysis method based on multi-modal features

Abstract

The invention relates to the technical field of security and artificial intelligence, in particular to a binary file vulnerability analysis method based on multi-modal features, which comprises the following steps of: constructing a binary file sample set, and extracting a vulnerability related function and a context function of a binary file; respectively generating a static feature vector and a dynamic feature vector for the vulnerability correlation function and the context function thereof, fusing the static feature vector and the dynamic feature vector to generate a multi-modal feature vector, and fusing the multi-modal feature vectors of the vulnerability correlation function and the context function thereof to generate a binary sample multi-modal feature vector; according to the binary vulnerability detection method, the binary vulnerability is used as input for training a deep learning model, the deep learning model is preprocessed, further feature learning and mapping are carried out through a plurality of full-connection layers, an output layer is classified by using a softmax activation function, and the coverage rate and precision of binary vulnerability detection are improved.

Description

Technical Field

[0001] The present invention relates to the fields of security and artificial intelligence technology, and in particular to a binary file vulnerability analysis method based on multimodal features. Background Art

[0002] Binary file vulnerability detection is a technology that performs security analysis on programs without source code. It aims to discover defects or vulnerabilities in binary programs that may cause security risks, such as buffer overflows, format string vulnerabilities, null pointer references, etc. Many software releases only provide binary files. Binary file vulnerability detection can identify potential security risks and provide an important basis for vulnerability repair, software reinforcement and risk assessment. It is particularly important for protecting the security of these closed-source applications. Binary file vulnerability detection technology is widely used in security audits in the fields of operating systems, embedded devices, IoT devices, etc., and is of great significance to improving the overall security of software.

[0003] Most existing binary file vulnerability detection methods use rule matching methods, that is, collecting features related to vulnerability behavior patterns in advance, establishing a vulnerability rule base, extracting the behavior pattern features of the binary file to be detected during detection, and detecting the vulnerability of the binary file by matching it with the rules in the vulnerability rule base.

[0004] Prior art, such as the invention patent with application number CN202211634641.3, discloses a binary file vulnerability detection method based on rule matching. According to the CPU architecture of the binary file, the corresponding target coding engine is used to disassemble the binary file to be detected to obtain assembly instructions. Then, the predefined target functions are located according to the assembly instructions. These target functions are selected based on predefined strategies and are node functions that the program control flow containing vulnerabilities will pass through. Finally, taking the target function as the starting point, based on static features such as program control flow, and by comparing with predefined behavior pattern rules, vulnerability detection is performed on the binary file to be detected.

[0005] Some binary file vulnerability detection methods apply machine learning technology. These methods learn the static features of vulnerable binary files, build machine learning models, and use the models to detect binary file vulnerabilities.

[0006] The invention patent with application number CN202210578652.8 discloses a binary vulnerability analysis method for unknown executable programs across languages. The method first disassembles the binary file to obtain the assembly code, then extracts the features related to the programming language in the assembly code, and uses machine learning technology to train the programming language recognition model. At the same time, it extracts the unsafe function features in the assembly code, and uses machine learning technology to train the vulnerability detection model of each programming language. When performing vulnerability detection, the method extracts the programming language features and unsafe function features in the binary file to be detected, uses the programming language recognition model to identify the programming language of the binary file, and then uses the vulnerability detection model of the corresponding programming language to perform binary file vulnerability detection.

[0007] In the traditional binary vulnerability detection method based on rule matching, the rules usually cannot cover all vulnerability scenarios. Vulnerability rules are mainly established based on manual experience, and it is difficult to take into account all vulnerability situations, and it is even more difficult to extract rules for unknown vulnerabilities that have never appeared. In addition, the rules cannot describe overly complex logic and cannot cover vulnerabilities in complex programs or complex scenarios. Since the rules are relatively independent, the rules need to be matched one by one during detection, and the detection efficiency is low. Especially when performing binary vulnerability detection on large-scale programs, the efficiency problem is particularly prominent.

[0008] Binary vulnerability detection methods based on machine learning can solve the above problems, but most existing machine learning-based methods only use static features for model training, without considering the dynamic behaviors that may occur during program execution. In some cases, vulnerabilities can only be triggered under specific operating conditions, so relying solely on static features can easily miss these vulnerabilities, resulting in limited detection accuracy. Summary of the invention

[0009] In order to solve the above technical problems, the present invention provides a binary file vulnerability analysis method based on multimodal features, improves the existing technology, overcomes the problems of insufficient rule coverage and detection efficiency in traditional rule-based matching methods, and the problem of detection accuracy caused by the use of a single feature in existing deep learning-based methods, thereby improving the coverage and accuracy of binary vulnerability detection.

[0010] To achieve the above object, the technical solution adopted by the present invention is: to provide a binary file vulnerability analysis method based on multimodal features, comprising the following steps:

[0011] S1 builds a sample set of binary files;

[0012] S1.1 Automatically obtain open source vulnerability information from public vulnerability data sources, including vulnerability types and vulnerability repair information, and extract the binary software package name and version containing the vulnerability from the open source vulnerability information;

[0013] S1.2 download the binary package of the open source software from the public software download source according to the binary package name and version described in S1.1, and extract the binary file therefrom;

[0014] S1.3 According to the vulnerability repair information described in S1.1, determine the vulnerability-related functions and locate the binary files where the vulnerability-related functions are located. The binary file sample set only retains the binary files containing the vulnerability-related functions;

[0015] S2 extracts multimodal feature vectors of binary file samples;

[0016] S2.1 converts the binary file into an intermediate language representation, generates an abstract syntax tree AST, a control flow graph CFG, and a data dependency graph PDG based on the intermediate language representation, obtains all functions that have call dependencies or data dependencies on the vulnerability-related functions according to the control flow graph CFG and the data dependency graph PDG, and forms a set of these functions as their context functions;

[0017] S2.2 generates static feature vectors and dynamic feature vectors of vulnerability-related functions and their context functions respectively;

[0018] S2.3 uses a feature fusion method to fuse the static feature vector and the dynamic feature vector generated by S2.2 into a multimodal feature vector, and fuses the multimodal feature vectors of the vulnerability-related function and its context function to generate a binary sample multimodal feature vector;

[0019] S3 trains deep learning models;

[0020] For each binary file sample, first identify all its vulnerability-related functions and their context functions, obtain whether each binary file contains a vulnerability, and its vulnerability type, and optimize the model parameters. The binary sample multimodal feature vector is used as the input of the model, preprocessed, and further feature learning and mapping are performed through multiple fully connected layers. The output layer uses the softmax activation function for classification;

[0021] S4 uses the trained deep learning model to detect binary file vulnerabilities.

[0022] Preferably, the binary package described in S1.2 includes a binary package of a version of the open source software with vulnerabilities and a binary package of a version without vulnerabilities, and a binary package contains one or more binary files.

[0023] Preferably, the static feature vector and dynamic feature vector generation process described in S2.2 is as follows:

[0024] Static feature vector: The three feature vectors of the abstract syntax tree AST, control flow graph CFG and data dependency graph PDG generated by S2.1 are extracted through the graph neural network GNN as static feature vectors;

[0025] Dynamic feature vector: For the binary files corresponding to the vulnerability-related functions and their context functions, symbolic execution technology is used to obtain their execution paths, extract the register operation sequence, memory access sequence, and system function call sequence during the execution process, and convert them into register operation feature vectors, memory access feature vectors, and system function call feature vectors respectively. These three feature vectors are used as dynamic feature vectors.

[0026] Preferably, the feature fusion method described in S2.3 includes:

[0027] Concatenation and fusion: Let Fstatic be the static feature vector with dimension (d1), Fdynamic be the dynamic feature vector with dimension (d2), and the dimension of the concatenated multimodal feature vector Fmulti is (d1+d2), that is:

[0028] F multi =[F static , F dynamic ];

[0029] Weighted fusion: Assume that the static feature vector Fstatic and the dynamic feature vector Fdynamic are assigned weights α and (1-α) respectively, where α is a hyperparameter, and the feature vectors are merged by weighted averaging:

[0030] F multi =α·F static +(1-α)·F dynamic .

[0031] Preferably, the pretreatment process in S3 is as follows:

[0032] First, perform a convolution operation on the multimodal feature vector of the binary sample to extract the local feature vector:

[0033] F conv =σ(W*F multi +b),

[0034] Among them, W is the convolution kernel, * represents the convolution operation, b is the bias term, and σ is the activation function;

[0035] Perform a pooling operation on the extracted local feature vector to reduce the dimension and retain key information:

[0036] F pool =maxpool(F conv ),

[0037] Among them, maxpool is the pooling operation.

[0038] Preferably, the calculation formula of the fully connected layer in S3 is:

[0039] F fc =W fc ·F pool +b fc ,

[0040] Where Wfc is the weight matrix of the fully connected layer, and bfc is the bias term;

[0041] The output layer converts the output of the model into a probability distribution, which is used to predict whether a binary file has a vulnerability and the type of vulnerability:

[0042]

[0043] Where P(y=l|F multi ) represents the probability that a binary file contains vulnerability type l given the multimodal feature vector Fmulti.

[0044] Preferably, the S3 training process is optimized using a cross entropy loss function, and the loss function L is:

[0045]

[0046] Among them, y true is the true label of the binary file sample.

[0047] The above technical solution has the following advantages or beneficial effects:

[0048] The coverage of binary vulnerability detection is improved by extracting binary file features, using deep learning technology to train binary vulnerability detection models, and using the model to identify complex feature patterns, thus overcoming the problem of insufficient rule coverage of traditional rule-based detection methods.

[0049] The accuracy of binary vulnerability detection has been improved. This patent uses multimodal feature vectors of binary files, including static feature vectors and dynamic feature vectors, to build a model, capturing binary file feature patterns from different dimensions, so that the model can understand feature data more comprehensively and have stronger generalization capabilities. Compared with existing methods, the accuracy of binary vulnerability detection has been improved.

[0050] The above summary is for illustrative purposes only and is not intended to be limiting in any way. In addition to the illustrative aspects, embodiments and features described above, further aspects, embodiments and features of the present invention will be readily apparent by reference to the accompanying drawings and the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the multiple drawings represent the same or similar parts or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings only depict some embodiments disclosed in the present invention and should not be regarded as limiting the scope of the present invention.

[0052] Figure 1 A flowchart of a binary file vulnerability analysis method based on multimodal features provided by the present invention; DETAILED DESCRIPTION

[0053] In the following, only some exemplary embodiments are briefly described. As those skilled in the art will appreciate, the described embodiments may be modified in various ways without departing from the spirit or scope of the present invention. Therefore, the drawings and descriptions are considered to be exemplary and non-restrictive in nature.

[0054] The present invention provides a binary file vulnerability analysis method based on multimodal features, the process is as follows: Figure 1 As shown, the following steps are included:

[0055] S1 builds a sample set of binary files;

[0056] S1.1 Automatically obtain open source vulnerability information from public vulnerability data sources, including vulnerability type, vulnerability repair information (such as vulnerability repair commits and vulnerability reports), and extract the binary software package name and version containing the vulnerability from the open source vulnerability information;

[0057] The public vulnerability data sources include: NVD (U.S. National Vulnerability Database), CNVD (National Information Security Vulnerability Sharing Platform), and CNNVD (China National Information Security Vulnerability Database).

[0058] S1.2 Download the binary packages of the open source software from public software download sources (such as https: / / pkgs.org / and https: / / rpmfind.net / ) according to the binary software package names and versions described in S1.1, including binary packages of versions of the open source software with vulnerabilities and binary packages of versions without vulnerabilities, and extract binary files therefrom. A binary package contains one or more binary files.

[0059] S1.3 Determine the vulnerability-related functions based on the vulnerability repair information described in S1.1, and use professional analysis tools (IDAPro or Ghidra) to locate the binary files where the vulnerability-related functions are located. The binary file sample set only retains the binary files that contain vulnerability-related functions, including the binary files in the version with the vulnerability and the binary files in the version without the vulnerability.

[0060] The process of determining vulnerability-related functions is as follows: when the vulnerability repair information includes a vulnerability report, the description in the vulnerability report is analyzed to identify the vulnerability-related functions or code paths. The vulnerability report usually provides detailed vulnerability information, including the affected functions and code locations. When it does not include a vulnerability report, static analysis tools (including: Coverity, SonarQube, Clang Static Analyzer) are used to analyze the commit that repairs the vulnerability, so as to confirm the vulnerability-related functions based on the modified content.

[0061] S2 extracts multimodal feature vectors of binary file samples;

[0062] S2.1 converts the binary file into an intermediate language representation between source code and assembly language, for example, using a conversion tool to convert the binary into LLVM's IR intermediate language. The IR intermediate language is LLVM's intermediate language representation of the code between source code and assembly language. This representation retains information about the program structure and is independent of the CPU architecture, which is helpful for subsequent analysis.

[0063] Generate an Abstract Syntax Tree (AST), a Control Flow Graph (CFG), and a Program Dependency Graph (PDG) based on the intermediate language representation. For example, use the Joern code analysis tool to convert the intermediate language representation into a Code Property Graph (CPG), and generate AST, CFG, and PDG based on CPG. CPG is a graph generated by superimposing AST, CFG, and PDG. Compared with the traditional single AST or CFG, CPG can carry more code information on the one hand, and on the other hand, it makes the subsequent analysis program more versatile.

[0064] According to the control flow graph CFG and the data dependency graph PDG, all functions that have call dependencies or data dependencies on the vulnerability-related functions are obtained, and the set of these functions is their context function.

[0065] S2.2 generates static feature vectors and dynamic feature vectors of vulnerability-related functions and their context functions respectively;

[0066] The static feature vector and dynamic feature vector generation process are as follows:

[0067] Static feature vector: The three feature vectors of the abstract syntax tree AST, control flow graph CFG and data dependency graph PDG generated by S2.1 are extracted through the graph neural network GNN as static feature vectors;

[0068] In this process, graph2vec (graph2vec: Learning Distributed Representations of Graphs) is used to convert the graph into a vector.

[0069] Graph2vec is a deep learning method for converting graph data into fixed-dimensional vector representations. Its main goal is to map structured graphs into a low-dimensional embedding space so that each graph can be represented as a fixed-length vector that contains node information and edge information between nodes. These vectors can be directly used for downstream tasks such as classification, clustering, regression, and other machine learning tasks.

[0070] The main idea of ​​graph2vec is to regard the graph as a document, regard the subgraph of each node (i.e. the subgraph of the part around the node) as a word in the document, and regard the subgraph of the surrounding nodes of a node as the context of the current node subgraph (i.e. the sentence in the document). Then, the neural network is trained using the same method as document embedding (i.e. converting the document containing the word into a vector), optimizing the vector representation of the subgraph and the whole graph, maximizing the probability of the subgraph appearing in the whole graph, and finally obtaining the vector representation of the whole graph.

[0071]

[0072] Among them, d i represents a graph in the training sample, w j Representation diagram d i The subgraph of a node in j |d i ) represents the probability of a subgraph appearing in a graph. The training goal of graph2vec is to train the vectors of graphs and subgraphs so that the sum of the probabilities of all subgraphs appearing in the graph in the context sampled from the graph (i.e., a set of adjacent subgraphs) is maximized. i Indicates the length of the context. j |d i ) is calculated as:

[0073]

[0074] in, and Figure d i and subgraph w j The vector representation of , υ is the set of all subgraphs appearing in the training sample, w is the subgraph in the set, Let w be a vector representation. The specific calculation is performed using negative sampling.

[0075] When applying graph2vec, first represent each node and each edge of the graph as data. Each node of AST represents a program element (such as a statement, expression, etc.), and each edge represents a parent-child relationship or a structural connection between nodes; each node of CFG represents a basic block (for example, if it is a conditional judgment, there can be different jumps), and each edge represents the control flow relationship between basic blocks; each node of PDG represents a data operation, and each edge represents the data dependency. Then define different unique functions for AST, CFG, and PDG, so that different subgraphs in the three graphs have different unique representations. Finally, train the graph2vec deep learning model separately to obtain the feature vectors of the abstract syntax tree (AST), control flow graph (CFG), and data dependency graph (PDG).

[0076] Dynamic feature vector: For the binary files corresponding to the vulnerability-related functions and their context functions, symbolic execution technology is used to obtain their execution paths, extract the register operation sequence, memory access sequence, and system function call sequence during the execution process, and convert them into register operation feature vectors, memory access feature vectors, and system function call feature vectors respectively. These three feature vectors are used as dynamic feature vectors.

[0077] The concept of symbolic execution technology is as follows:

[0078] Symbolic execution is a program analysis technique that simulates the execution path of a program and explores all possible paths by treating the program input as symbolic values ​​(rather than specific numerical values). You can use the angr symbolic execution framework to perform symbolic execution on binary files to obtain the execution path of the program. At the same time, by monitoring the register operations of the executed instructions, the register operation sequence during the execution process is obtained; by monitoring the memory read and write operations of the executed instructions, the memory access sequence during the execution process is obtained; by monitoring the content of the executed instructions, the system call sequence during the execution process is obtained.

[0079] The steps to extract an example of the above sequence using the angr symbolic execution tool are as follows:

[0080] Step S01: Load the binary file;

[0081] Step S02: Get the starting address of the program;

[0082] Step S03: Create a symbolic execution path explorer;

[0083] Step S04: perform symbolic execution to explore paths;

[0084] Step S05: monitor the executed instructions and extract the above sequence;

[0085] After obtaining the register operation, memory access, and system call sequences, these sequences are converted into feature vectors. For sequence data, a common vectorization method is Seq2Vec. Seq2Vec is a tool that converts sequences (register operation sequences, memory access sequences, and system call sequences processed in this patent) into vectors. It can map the elements in each sequence (such as instructions, register values, etc.) to a high-dimensional space and finally output a vector.

[0086] Through symbolic execution and sequence embedding technology, the register operation sequence, memory access sequence, and system function call sequence are converted into a fixed-length vector respectively to prepare for subsequent analysis and model training.

[0087] S2.3 uses a feature fusion method to fuse the static feature vector and the dynamic feature vector generated by S2.2 into a multimodal feature vector, fuses the multimodal features of the vulnerability-related function and its context function, and generates a binary sample multimodal feature vector;

[0088] The feature fusion method comprises:

[0089] Concatenation and fusion: Concatenate different feature vectors together to form a longer feature vector. Let Fstatic be the static feature vector with dimension (d1), and Fdynamic be the dynamic feature vector with dimension (d2). The dimension of the concatenated multimodal feature vector Fmulti is (d1+d2), that is:

[0090] F multi =[F static , F dynamic ];;

[0091] For example, after feature extraction of a binary file, the following static feature vector and dynamic feature vector are obtained:

[0092] The dimension of the static feature vector Fstatic is 256 and is represented as a 256-dimensional vector.

[0093] The dimension of the dynamic feature vector Fdynamic is 256 and is represented as a 256-dimensional vector.

[0094] Select the splicing fusion method to obtain the multimodal feature vector F multi The dimension of is (256+256=512).

[0095] Weighted fusion: Different weights are assigned according to the importance of features, and the static feature vector and the dynamic feature vector are weighted and synthesized according to the weights. The static feature vector Fstatic and the dynamic feature vector Fdynamic are assigned weights α and (1-α) respectively, where α is a hyperparameter that controls the fusion ratio of the static feature vector and the dynamic feature vector. The two types of features are merged by weighted averaging:

[0096] F multi =α·F static +(1-α)·F dynamic .

[0097] S3 trains deep learning models;

[0098] Convolutional neural network (CNN) is selected as the basis for training the model. CNN is particularly suitable for processing input data with spatial structure, especially when extracting local features and patterns. Although CNN is usually applied to image processing, it can effectively capture the local relationship of different features when processing multimodal feature vectors. For an input binary sample multimodal feature vector, the model extracts features through multiple convolutional layers and pooling layers, and finally classifies and outputs through a fully connected layer.

[0099] When using CNN for binary file vulnerability detection, all vulnerability-related functions and their context functions are identified for each binary file sample, and whether each binary file contains a vulnerability and its vulnerability type (such as buffer overflow, SQL injection, etc.) are obtained to guide the optimization of model parameters.

[0100] The specific steps for training a deep learning model using multimodal feature vectors are as follows:

[0101] The binary sample multimodal feature vector is used as the input of the model, which is preprocessed and further feature learning and mapping is performed through multiple fully connected layers. The output layer uses the softmax activation function for classification.

[0102] The pre-processing process is as follows:

[0103] First, perform a convolution operation on the multimodal feature vector of the binary sample to extract the local feature vector:

[0104] F conv =σ(W*F multi +b),

[0105] Among them, W is the convolution kernel, * represents the convolution operation, b is the bias term, and σ is the activation function;

[0106] Perform a pooling operation on the extracted local feature vector to reduce the dimension and retain key information:

[0107] F pool =maxpool(F conv ),

[0108] Among them, maxpool is the pooling operation.

[0109] The calculation formula of the fully connected layer is:

[0110] F fc =W fc ·F pool +b fc ,

[0111] Where Wfc is the weight matrix of the fully connected layer, and bfc is the bias term;

[0112] The output layer converts the output of the model into a probability distribution, which is used to predict whether a binary file has a vulnerability and the type of vulnerability:

[0113]

[0114] Where P(y=l|F multi ) represents the probability that a binary file contains vulnerability type l given the multimodal feature vector Fmulti.

[0115] The training process is optimized using the cross entropy loss function, and the loss function L is:

[0116]

[0117] Among them, y true is the true label of the binary file sample.

[0118] During the training process, the network parameters are continuously adjusted and the loss function is optimized until the model converges.

[0119] The vulnerability information of the binary file (whether it contains a vulnerability and if so, its type) is used as feedback information for model training to adjust the model parameters until the model converges. Through repeated training and adjustment, the model can gradually improve its ability to identify vulnerabilities and eventually output accurate vulnerability prediction results.

[0120] The specific process of S4 using the trained deep learning model to detect binary file vulnerabilities is as follows:

[0121] S4.1 Input data preparation:

[0122] Binary file parsing: First, extract each function in the binary file and its context function. The context function includes the functions related to the calling relationship (such as the directly called function and the called function).

[0123] Multimodal feature vector generation: For each extracted function and its context function, a multimodal feature vector is generated. Static feature vectors (including abstract syntax tree (AST), control flow graph (CFG), data dependency graph (PDG)) are obtained through graph2vec, and dynamic feature vectors (including register operations, memory access, system call sequence) are generated through symbolic execution. The features are fused to generate a multimodal feature vector Fmulti for each function and its context function.

[0124] S4.2 Multimodal feature vector fusion and input model:

[0125] For each function Ffunc and its context function Fcontext, their multimodal feature vectors are fused to form the final input feature vector Finput, which contains both the static feature vector and dynamic feature vector information of each function and its context function:

[0126] F input =[F func , F context ].

[0127] S4.3 Predicted binary file vulnerabilities:

[0128] After forward propagation of the deep learning model convolutional neural network CNN, the model outputs whether the function has a vulnerability, and if so, predicts the type of vulnerability.

[0129] Model output: The model finally outputs a prediction information containing vulnerabilities, including whether the binary file has a vulnerability, and if so, the predicted vulnerability type (such as buffer overflow, SQL injection, etc.).

[0130] S4.4 Vulnerability report generation:

[0131] Based on the model output, a vulnerability report is generated for each binary file function, including the vulnerability status and vulnerability type of the function. If a vulnerability exists, the report can further provide possible vulnerability locations and repair suggestions.

[0132] Use the trained deep learning model to detect vulnerabilities in binary files. By extracting the multimodal feature vectors of each function and its related functions and inputting them into the deep learning model, the model outputs the vulnerability status and vulnerability type of each function. This method can efficiently detect and classify vulnerabilities in binary files and provide strong support for security analysis.

[0133] The above technical solution has the following advantages or beneficial effects: The present invention improves the coverage of binary vulnerability detection by extracting binary file features, using deep learning technology to train a binary vulnerability detection model, and using the model to identify complex feature patterns, thereby overcoming the problem of insufficient rule coverage of traditional rule-based detection methods.

[0134] The accuracy of binary vulnerability detection has been improved. This patent uses multimodal feature vectors of binary files, including static feature vectors and dynamic feature vectors, to build a model, capturing binary file feature patterns from different dimensions, so that the model can understand feature data more comprehensively and have stronger generalization capabilities. Compared with existing methods, the accuracy of binary vulnerability detection has been improved.

[0135] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of various changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A binary file vulnerability analysis method based on multimodal features, characterized in that: The steps include: S1 builds a sample set of binary files; S1.1 Automatically obtain open source vulnerability information from public vulnerability data sources, including vulnerability types and vulnerability repair information, and extract the binary software package name and version containing the vulnerability from the open source vulnerability information; S1.2 download the binary package of the open source software from the public software download source according to the binary package name and version described in S1.1, and extract the binary file therefrom; S1.3 According to the vulnerability repair information described in S1.1, determine the vulnerability-related functions and locate the binary files where the vulnerability-related functions are located. The binary file sample set only retains the binary files containing the vulnerability-related functions; S2 extracts multimodal feature vectors of binary file samples; S2.1 converts the binary file into an intermediate language representation, generates an abstract syntax tree AST, a control flow graph CFG, and a data dependency graph PDG based on the intermediate language representation, obtains all functions that have call dependencies or data dependencies on the vulnerability-related functions according to the control flow graph CFG and the data dependency graph PDG, and forms a set of these functions as their context functions; S2.2 generates static feature vectors and dynamic feature vectors of vulnerability-related functions and their context functions respectively; S2.3 uses a feature fusion method to fuse the static feature vector and the dynamic feature vector generated by S2.2 into a multimodal feature vector, and fuses the multimodal feature vectors of the vulnerability-related function and its context function to generate a binary sample multimodal feature vector; S3 trains deep learning models; For each binary file sample, first identify all its vulnerability-related functions and their context functions, obtain whether each binary file contains a vulnerability, and its vulnerability type, and optimize the model parameters. The binary sample multimodal feature vector is used as the input of the model, preprocessed, and further feature learning and mapping are performed through multiple fully connected layers. The output layer uses the softmax activation function for classification; S4 uses the trained deep learning model to detect binary file vulnerabilities.

2. The binary file vulnerability analysis method based on multimodal features as claimed in claim 1, characterized in that: The binary package described in S1.2 includes binary packages of versions of open source software with vulnerabilities and binary packages of versions without vulnerabilities. A binary package contains one or more binary files.

3. The binary file vulnerability analysis method based on multimodal features as claimed in claim 1, characterized in that: The process of generating the static feature vector and the dynamic feature vector described in S2.2 is as follows: Static feature vector: The three feature vectors of the abstract syntax tree AST, control flow graph CFG and data dependency graph PDG generated by S2.1 are extracted through the graph neural network GNN as static feature vectors; Dynamic feature vector: For the binary files corresponding to the vulnerability-related functions and their context functions, symbolic execution technology is used to obtain their execution paths, extract the register operation sequence, memory access sequence, and system function call sequence during the execution process, and convert them into register operation feature vectors, memory access feature vectors, and system function call feature vectors respectively. These three feature vectors are used as dynamic feature vectors.

4. The binary file vulnerability analysis method based on multimodal features as claimed in claim 1, characterized in that: S2.3 The feature fusion method includes: Concatenation and fusion: Let Fstatic be the static feature vector with dimension (d1), Fdynamic be the dynamic feature vector with dimension (d2), and the dimension of the concatenated multimodal feature vector Fmulti is (d1+d2), that is: F multi =[F static ,F dynamic ]; Weighted fusion: Assume that the static feature vector Fstatic and the dynamic feature vector Fdynamic are assigned weights α and (1-α) respectively, where α is a hyperparameter, and the feature vectors are merged by weighted averaging: F multi =α·F static +(1-α)·F dynamic 。 5. The binary file vulnerability analysis method based on multimodal features as claimed in claim 1, characterized in that: The preprocessing process described in S3 is as follows: First, perform a convolution operation on the multimodal feature vector of the binary sample to extract the local feature vector: F conv =σ(W*F multi +b), Among them, W is the convolution kernel, * represents the convolution operation, b is the bias term, and σ is the activation function; Perform a pooling operation on the extracted local feature vector to reduce the dimension and retain key information: F pool =maxpool(F conv ), Among them, maxpool is the pooling operation.

6. The binary file vulnerability analysis method based on multimodal features as claimed in claim 1, characterized in that: The calculation formula of the fully connected layer in S3 is: F fc =W fc ·F pool +b fc , Where Wfc is the weight matrix of the fully connected layer, and bfc is the bias term; The output layer converts the output of the model into a probability distribution, which is used to predict whether the binary file has a vulnerability and the type of vulnerability: Where P(y=l|F multi ) represents the probability that a binary file contains vulnerability type l given the multimodal feature vector Fmulti.

7. The binary file vulnerability analysis method based on multimodal features as claimed in claim 1, characterized in that: The S3 training process is optimized using the cross entropy loss function, and the loss function L is: Among them, y true is the true label of the binary file sample.

Images