Binary code similarity detection method and system based on comparison aggregation and position awareness

Abstract

The invention provides a binary code similarity detection method and system based on comparison aggregation and location awareness, and relates to the field of information security. The method comprises the following steps: acquiring two binary code files to be detected, disassembling the two binary code files, and extracting to obtain corresponding binary code function information; performing graph standardization coding on node and edge features of the attribute control flow graph by adopting an MLP (multi-layer perceptron) to obtain initial node embedding and edge embedding; performing multi-layer propagation processing by adopting a multi-layer gating graph neural network LRGNN, and combining with a residual connection design; after the node features after LRGNN propagation are combined with position perception attention, the node features are input into a self-adaptive comparison Softmax aggregator, and an aggregation embedded vector is obtained through linear mapping, comparison normalization, an SE attention mechanism and dynamic weighted aggregation; and calculating the similarity of the aggregated embedded vectors to obtain a detection result. According to the method, the defects of an existing model in calculation complexity, training stability, feature retention and applicability are overcome.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a binary code similarity detection method and system based on comparative aggregation and location awareness. Background Art

[0002] Binary code similarity detection discovers the similarities between two or more binary code fragments by comparing them. It can evaluate similarity from multiple dimensions such as code structure, syntax, semantics or behavior. It has wide application value in vulnerability detection, malware analysis, software clone detection, software protection and reverse engineering.

[0003] Traditional binary code similarity detection methods are mostly based on static or dynamic analysis techniques of specific architectures, which have significant limitations when dealing with code comparisons of different architectures. With the popularization of advanced compilation optimization technology, the compiled binary code and its source code may have significant structural differences, further increasing the difficulty of similarity detection. Existing multi-architecture binary code similarity detection methods mainly include methods based on feature extraction and graph matching, but they show certain shortcomings when dealing with complex binary codes, which are specifically reflected in the following aspects: (1) Insufficient training stability of deep networks: Traditional graph matching-based methods lack residual connections or skip connections, which can lead to gradient vanishing or explosion problems in deeper network structures, affecting the training stability and performance of the model and limiting the model's ability to express features in multi-layer propagation.

[0004] (2) Feature smoothing problem: Since traditional graph matching-based methods do not have a special mechanism to prevent over-smoothing of node features, the node features tend to be consistent after multi-layer propagation, making it difficult to retain subtle differences in the graph structure, thereby reducing the model’s feature expression capabilities in deep structures.

[0005] (3) Insufficient flexibility in global feature aggregation: Traditional graph matching-based methods usually use simple averaging or weighted averaging methods when aggregating features across the entire graph, and are unable to adjust weights based on the importance of nodes. The features of all nodes contribute equally to the global representation of the graph, making it difficult to accurately highlight key node information.

[0006] (4) Limited flexibility in cross-graph matching: Traditional cross-graph matching mechanisms based on graph matching methods assume symmetry between graph pairs, which makes them difficult to adapt to single-graph tasks. Moreover, their performance is poor in heterogeneous graphs or graphs with different node features, limiting their applicability.

[0007] In view of this, the applicant filed this application after studying the existing technology. Summary of the invention

[0008] The present invention aims to provide a binary code similarity detection method and system based on contrast aggregation and location awareness, so as to address the deficiencies of the prior art in terms of deep training stability, feature smoothing, computational complexity and multi-task adaptability, and to improve the accuracy and robustness of model detection.

[0009] In order to solve the above technical problems, the present invention is implemented through the following technical solutions: A binary code similarity detection method based on contrast aggregation and location awareness, comprising: S1, obtain two binary code files to be tested; S2, disassembling the two binary code files to extract corresponding binary code function information; wherein the binary code function information includes an attribute control flow graph ACFG; S3, using MLP multi-layer perceptron, respectively, the node and edge features of the attribute control flow graph of the two input binary code files are graph-standardized and encoded, generating the initial vector representation of each node and edge, and obtaining the initial node embedding and edge embedding of the corresponding binary code files; S4, a multi-layer gated graph neural network LRGNN is used to perform multi-layer propagation processing on the initial node embedding and edge embedding. Each layer of LRGNN controls the update and transmission of information through the gated unit GRU, and adopts a multi-layer bidirectional information transmission mechanism during transmission to obtain deeper context information from neighboring nodes; then combined with contrast normalization and residual connection design to alleviate the problems of over-smoothing and gradient disappearance of LRGNN; S5, the node features after LRGNN propagation are passed through the position-aware multi-head attention module to generate position encoding information for each node, and the position encoding information is fused with the node features and input into the multi-head attention mechanism to calculate the attention to capture the complex association relationship between nodes; according to the fused node features and attention, the residual connection and layer normalization are used to update the nodes, so as to obtain the node features after position awareness and multi-head attention; S6, input the node features after position perception and multi-head attention into the adaptive contrast Softmax aggregator, and use linear mapping and contrast normalization to prevent excessive smoothing of node features; combine the SE attention mechanism to generate adaptive weights, perform adaptive weighted aggregation on the importance of each node, and input them into the MLP multi-layer perceptron to extract high-order features; perform Softmax dynamic weighted aggregation on the extracted high-order features, and generate a global representation of the graph through the second MLP multi-layer perceptron to obtain an aggregated embedding vector; S7, by calculating the similarity of the aggregated embedding vectors corresponding to the two binary code files, a similarity detection result is obtained.

[0010] Preferably, the process of using MLP multi-layer perceptron to perform graph standardization encoding is: MLP is used to convert the original features of each node and edge into a high-dimensional vector for subsequent graph neural network propagation. The graph standardization encoding process includes node encoding and edge encoding, and the expression is as follows: Node code: ； Edge encoding: ; in, Embed for the initial node; is the edge eigenvector; is the edge composed of nodes i and j; is the feature matrix of node i; is the feature matrix of node i and its neighbor node j; A node set for the attribute control flow graph; is the edge set of the attribute control flow graph; Indicates that the MLP multi-layer perceptron performs graph standardization encoding on nodes; Indicates that the MLP multi-layer perceptron performs graph-standardized encoding on the edges.

[0011] Preferably, the updating and transmission process of the information controlled by the gate control unit GRU is as follows: Step 1: Use the features of nodes and edges as the input of the graph neural network to generate messages; let the initial features of node i be ,side The characteristics are , then the expression for message generation is: ; in, represents the message from node i to neighbor node j, , Indicates that the target node is embedded , source node embedding and Splice it together; Step 2: For each node, aggregate all messages from neighboring nodes to obtain the aggregate message of each node. The aggregate message of node i is The formula is: ; in, Represents the set of neighbor nodes of node i; Step 3: After obtaining the aggregated message, use the gated recurrent unit GRU to update the state of each node; the updated state of node i is expressed as; ； ; ; ; in, is the update gate of node i, is the reset gate of node i; They are the weight matrices of the GRU update gate and reset gate respectively; Represents the sigmoid activation function; is the aggregated message of node i; is the previous state of node i; is the current candidate state of node i; and is the weight matrix of the candidate states; It is the element-wise multiplication, i.e. Hadamard product; is the current update status of node i; Controls the current candidate status and the previous state In update status The proportion in .

[0012] Step 4: After comparing and normalizing the updated node features, connect them with the node features of the previous layer. The expression is: ; ; in, Represents the contrast normalization standardization operation, and Represent the node features of the current layer and the previous layer respectively; Represents the node features of contrast normalization; Indicates the node features after splicing; Represents a hyperparameter that controls the proportion of residual connections.

[0013] Preferably, S5 is specifically: Step 1: Positionally encode the node features after LRGNN propagation, and fuse and add them with the node features after LRGNN propagation to obtain the position fused node feature vector, which is expressed as: ; in, Represents the position fusion node feature vector; represents the node feature vector corresponding to node i after LRGNN propagation, Representation Node The position encoding vector of Step 2: Based on the position fusion node feature vector, the complex interdependence between nodes is learned from different subspaces through the multi-head attention mechanism, and the attention of the position fusion node feature is calculated. The specific expression is: ; in, Indicates attention; represents the query vector; represents the key vector; surface Indicator vector; Representing a location-aware node feature matrix corresponding to the location-fusion node feature vector; , Respectively represent A learnable weight matrix corresponding to the query vector, key vector, and value vector; is the dimension of the key vector, used for scaling; T means transpose; Step 3: According to the position fusion node features and the calculated attention, residual connection and layer normalization are used to update each node feature to obtain the node features after position perception and multi-head attention, so that each node feature can effectively maintain the flow of information and help the model converge faster. The formula is: ; ; in, and They represent the current layer and the previous layer of node features after LRGNN propagation respectively; Represents the node features after multi-head attention update; Represents the hyperparameter that controls the proportion of residual connections; Representation layer normalization and standardization operation; express Node features after layer normalization, i.e., node features after position awareness and multi-head attention.

[0014] Preferably, the linear mapping is specifically: Suppose the node feature set after position perception and multi-head attention, that is, the node feature matrix is ,for dimensional real matrix, is the number of nodes, is the dimension of node features; Map it to the hidden dimension through Linear mapping , and use ReLU activation to get the node mapping feature , the formula is: (Linear( ))with ; ; Among them, the Linear linear mapping function transforms the node features The dimension is mapped from d to , and the result of linear mapping is obtained ; Yes Node mapping features after ReLU; and is the learning parameter; ReLU is the linear rectification activation function.

[0015] Preferably, the process of contrast normalization is specifically as follows: Step 1: Normalize the mapping features of each node in dimension. The expression is: ; in, Represents the normalized node features; represents the L2 norm; Step 2: Use normalized node features , calculate the similarity matrix: ; Where temp is the temperature coefficient, which is used to adjust the range of similarity; T is transpose; is the similarity matrix, whose dimension is ; Step 3: Normalize the similarity matrix using Softmax to obtain the weights , thereby calculating the weighted sum of the features of the negative samples, that is, the negative sample features , the formula is: ; ; Step 4: The original features Subtract negative sample features Then scale it, compare and normalize it, and then normalize the result by Layer Normalization to further standardize the features and get the standardized node features. , the formula is: ; ; in, Compare the normalized update results; scale is the scaling factor of the normalization layer, Represents the Layer Normalization layer normalization operation.

[0016] Preferably, the SE attention mechanism is combined to generate adaptive weights, and the importance of each node is adaptively weighted and aggregated, specifically: First, the global statistical information of the normalized node features is calculated by global average pooling to obtain the global feature vector, which is expressed as: ; in, represents the global eigenvector; is the number of feature dimensions; represents the i-th standardized node feature; Secondly, the global feature vector is processed through two fully connected layers and a nonlinear activation function to generate a weight vector of the feature dimension : ; in, and is the learnable weight matrix, is the sigmoid activation function; Then, according to the importance of the node features, combined with the weight vector, the node features are adaptively weighted and aggregated to obtain the weighted aggregate feature , the formula is: ； in, represents element-wise multiplication, i.e., the Hadamard product; Finally, the adjusted weighted aggregation features Input the multi-layer perceptron MLP to further extract high-order features and obtain the SE aggregate embedding vector , the formula is: ; in, is the SE aggregate embedding vector, is the weighted aggregation feature.

[0017] Preferably, the process of the Softmax dynamic weighted aggregation is specifically as follows: For the nodes after weighted aggregation of SE attention mechanism , whose aggregated messages come from neighboring nodes Features , and the final representation of the node is calculated by Softmax weighting, the expression is: ; in, Represents the Softmax weighted feature, Is a node and nodes The weight calculated by the similarity between is defined as: ; in, , Respectively represent nodes , Corresponding node features; A variable representing a node, Representation Node The corresponding node features.

[0018] Preferably, when calculating the similarity of two aggregated embedding vectors, a Siamese Network is used to calculate the cosine similarity between the two aggregated embedding vectors to obtain a similarity score; if the similarity score exceeds a set threshold, the two binary code files are determined to be similar.

[0019] The present invention also provides a binary code similarity detection system based on comparison aggregation and location awareness, comprising: An acquisition unit, used for acquiring two binary code files to be detected; A disassembly unit, used for disassembling two binary code files to extract corresponding binary code function information; wherein the binary code function information includes an attribute control flow graph ACFG; The graph normalization encoding unit is used to use the MLP multi-layer perceptron to perform graph normalization encoding on the node and edge features of the attribute control flow graph of the two input binary code files, generate the initial vector representation of each node and edge, and obtain the initial node embedding and edge embedding of the corresponding binary code files; LRGNN propagation unit is used to perform multi-layer propagation processing on the initial node embedding and edge embedding using a multi-layer gated graph neural network LRGNN. Each layer of LRGNN controls the update and transmission of information through the gated unit GRU, and adopts a multi-layer bidirectional information transmission mechanism during transmission to obtain deeper context information from neighboring nodes; then, contrast normalization and residual connection design are combined to alleviate the problems of over-smoothing and gradient disappearance of LRGNN; Position-aware multi-head attention unit, used for node features after LRGNN propagation. The position encoding information is generated for each node through the position-aware multi-head attention module, and the position encoding information is fused with the node features and input into the multi-head attention mechanism to calculate the attention to capture the complex association relationship between nodes. According to the fused node features and attention, the residual connection and layer normalization are used to update the nodes, so as to obtain the node features after position awareness and multi-head attention. The global feature aggregation unit is used to input the node features after position perception and multi-head attention into the adaptive contrast Softmax aggregator, and prevent the node features from being over-smoothed through linear mapping and contrast normalization; the SE attention mechanism is combined to generate adaptive weights, and the importance of each node is adaptively weighted and aggregated, and then input into the MLP multi-layer perceptron to extract high-order features; the extracted high-order features are subjected to Softmax dynamic weighted aggregation, and the global representation of the graph is generated by the second MLP multi-layer perceptron to obtain the aggregated embedding vector; The similarity detection unit is used to obtain a similarity detection result by calculating the similarity of the aggregated embedding vectors corresponding to the two binary code files.

[0020] The present invention also provides a binary code similarity detection device for comparing aggregation and location awareness, including a processor and a memory, wherein the memory stores a computer program, and the computer program can be executed by the processor to implement a binary code similarity detection method for comparing aggregation and location awareness as described above.

[0021] The present invention also provides a computer-readable storage medium, on which computer-readable instructions are stored. When the computer-readable instructions are executed by a processor of a device where the computer-readable storage medium is located, the method for detecting binary code similarity based on comparative aggregation and location awareness is implemented as described above.

[0022] In summary, compared with the prior art, the present invention has the following beneficial effects: (1) The existing cross-graph matching mechanism is prone to gradient vanishing or exploding in deep structures, resulting in unstable training, especially poor performance in multi-layer propagation. To this end, the present invention adopts a multi-layer gated graph neural network (Long-Range Graph Neural Network, LRGNN) combined with contrast normalization and residual connection, and ensures the stability of gradient transmission through gated units and residual connections, thereby improving the training effect of deep networks and adapting to complex graph structure tasks.

[0023] (2) The existing cross-graph matching mechanism is based on the symmetry assumption, which makes it difficult to cope with single-graph analysis and heterogeneous graph matching tasks, limiting the application scenarios. The present invention adopts LRGNN with internal propagation in a single graph, avoiding the cross-graph symmetry assumption, enabling the model to handle single-graph and heterogeneous graph structure analysis tasks, and further enhancing the model's adaptability in multiple tasks and scenarios.

[0024] (3) In the process of multi-layer propagation, existing methods lack a mechanism to model the relative structural relationships in the graph, resulting in the loss of complex associations between nodes in the graph structure and spatial hierarchical information. The present invention uses a position-aware multi-head attention module and introduces position encoding in the multi-head attention, so that the model not only relies on the similarity of the node features themselves to calculate the attention weight, but also can perform weighted aggregation based on the relative structural relationship of the nodes in the graph. With the help of position encoding, the multi-head attention mechanism can grasp the complex associations and spatial hierarchical structures between nodes from a higher level, thereby effectively improving the model's ability to model fine-grained information and implicit topological relationships in the graph. Combined with the use of layer normalization and residual skip connections, the position-aware multi-head attention module maintains the stability of training and the diversity of features in deep transmission, providing strong support for the expansion and performance improvement of graph neural networks in processing complex graph data and deep structures.

[0025] (4) The computational complexity of the existing cross-graph matching mechanism is high and inefficient in large-scale graph data applications. The present invention uses a multi-layer LRGNN to perform internal propagation of a single graph, avoiding global similarity calculations in cross-graph matching, thereby reducing computational complexity. At the same time, the adaptive contrast Softmax aggregator ACSA reduces the computational burden through an adaptive dynamic aggregation mechanism, making the model more suitable for processing large-scale graph data.

[0026] (5) By combining multi-layer LRGNN, residual connection, position-aware multi-head attention module and adaptive contrast Softmax aggregator (ACSA), the present invention provides a stable, efficient and flexible graph similarity learning scheme, which solves the defects of the existing graph matching network (GMN) model in computational complexity, training stability, feature retention and applicability, making it more widely applicable to large-scale graph data, complex graph structures and diversified task scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0028] Figure 1A schematic diagram of a binary code similarity detection method based on comparison aggregation and location awareness provided in Example 1.

[0029] Figure 2 A flowchart of a binary code similarity detection method based on comparison aggregation and location awareness is provided in Example 1.

[0030] Figure 3 A structural diagram of a binary code similarity detection method based on comparison aggregation and location awareness provided in Example 1.

[0031] Figure 4 A schematic diagram of the structure of the position-aware multi-head attention module provided in Example 1.

[0032] Figure 5 This is a structural diagram of the Adaptive Contrast Softmax Aggregator (ACSA) model provided in Example 1.

[0033] Figure 6 A schematic diagram of a binary code similarity detection system based on comparison aggregation and location awareness provided in Example 2.

[0034] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the invention claimed for protection, but merely represents the selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0036] Embodiment 1 Embodiment 1 of the present invention provides a binary code similarity detection method based on comparative aggregation and location awareness, which can be implemented by a binary code similarity detection device based on comparative aggregation and location awareness (hereinafter referred to as similarity detection device), and in particular, executed by one or more processors in the similarity detection device.

[0037] In this embodiment, the similarity detection device may be an electronic device equipped with a processor, the processor having a computer program of the comparative aggregation and location-aware binary code similarity detection method and the computer program can be executed, such as a computer, a smart phone, a smart tablet, a workstation, etc., which is not limited here.

[0038] There are many challenges in the process of binary code similarity analysis and identification. First, compared with source code, binary code is less readable and significantly more difficult to understand and analyze; the compilation process causes a large amount of program semantic information to be lost (such as function names, variable names, and data structures), which greatly weakens the semantic characteristics of binary code. In addition, different compilers, compiler optimization options, and optimization strategies for different operating systems and CPU architectures may cause the generated binary code to change significantly in structure and behavior, which further increases the difficulty of cross-architecture similarity detection.

[0039] The cross-architecture binary code similarity detection method based on adaptive contrast aggregation graph neural network proposed in this invention is a cross-architecture binary code similarity detection method based on adaptive contrast Softmax aggregator (ACSA), position-aware multi-head attention module and multi-layer gated graph neural network (Long-Range Graph Neural Network, LRGNN), which provides solutions to the technical problems in the existing graph matching network (GMN). Through specific encoding, propagation and aggregation steps, it effectively solves the problems of feature over-smoothing, high computational complexity, unstable training, and feature loss, aiming to improve the accuracy and robustness of detection. Based on the information of attribute control flow graph (ACFG), this method realizes feature extraction and fusion through advanced deep learning models (such as LRGNN and ACSA), achieving higher accuracy and versatility in cross-architecture binary code similarity detection.

[0040] Among them, the existing graph matching network (GMN) can be summarized into three parts: node and edge feature encoding, cross-graph matching mechanism, and global feature aggregation. In the graph matching network (GMN), the cross-graph matching mechanism is the core graph interaction module. Although the cross-graph matching mechanism performs well in capturing the similarity between graphs, its high computational complexity, training instability, feature smoothing, and lack of flexibility limit its application in large-scale and complex graph structure tasks.

[0041] The present invention uses a multi-layer perceptron (MLP) to embed the features of nodes and edges in high dimensions, and uses a multi-layer LRGNN model to process the ACFG to extract its structural features. At the same time, the adaptive contrast Softmax aggregator (ACSA) prevents excessive smoothing of node features through contrastive learning, and generates adaptive weights for more accurate global feature aggregation. Finally, these features are measured for similarity through the SiameseNetwork twin network. This method not only overcomes the shortcomings of the existing technology in feature representation and structural information utilization, but also realizes the unified expression of cross-architecture features through efficient feature fusion, significantly improving the performance and applicability of binary code similarity detection.

[0042] like Figure 1-Figure 2 As shown, a binary code similarity detection method based on contrast aggregation and location awareness includes steps S1 to S7.

[0043] S1, obtain two binary code files to be tested; S2, disassemble the two binary code files and extract the corresponding binary code function information; wherein the binary code function information includes the attribute control flow graph ACFG.

[0044] ACFG: Attributed Control Flow Graph. In program analysis and binary code similarity detection, ACFG is an enhanced control flow graph (CFG) that combines node attributes and control flow information to capture program features and improve the accuracy of graph similarity detection.

[0045] CFG: Control Flow Graph, a directed graph that represents the control flow in a program. Nodes represent basic blocks, and edges represent the control flow relationship between basic blocks. It is often used for binary analysis and optimization.

[0046] Disassembly tools are tools that convert machine language (target code) into assembly language code, such as IDA Pro, Hopper, Binary Ninja, etc. They are often used in software reverse analysis, dynamic debugging, software cracking, plug-in technology, virus analysis and other fields.

[0047] S3, using MLP multi-layer perceptron, respectively, the node and edge features of the attribute control flow graph of the two input binary code files are graph-standardized and encoded, generating the initial vector representation of each node and edge, and obtaining the initial node embedding and edge embedding of the corresponding binary code files; In this embodiment, MLP: Multilayer Perceptron, a multilayer perceptron, is a feedforward neural network composed of multiple fully connected layers and is commonly used in tasks such as classification and regression.

[0048] Specifically, an MLP multi-layer perceptron is used to perform graph normalization encoding on the node and edge features of each attribute control flow graph to generate the initial vector representation of each node and edge, namely, the initial node embedding and edge embedding.

[0049] MLP is used to convert the original features of each node and edge into a high-dimensional vector for subsequent graph neural network propagation.

[0050] The feature encoding process includes node encoding and edge encoding: Node code: ; Edge encoding: ; in, Embed for the initial node; is the edge eigenvector; is the edge composed of nodes i and j; is the feature matrix of node i; is the feature matrix of node i and its neighbor node j; A node set for the attribute control flow graph; is the edge set of the attribute control flow graph; Indicates that the MLP multi-layer perceptron performs graph standardization encoding on nodes; Indicates that the MLP multi-layer perceptron performs graph-standardized encoding on the edges.

[0051] The encoding process can generate initial feature vectors for nodes and edges so that the subsequent feature propagation and aggregation stages can perform effective feature learning and expression.

[0052] S4, a multi-layer gated graph neural network LRGNN is used to perform multi-layer propagation processing on the initial node embedding and edge embedding. Each layer of LRGNN controls the update and transmission of information through the gated unit GRU, and adopts a multi-layer bidirectional information transmission mechanism during transmission to obtain deeper contextual information from neighboring nodes; then combined with contrast normalization and residual connection design, to alleviate the problems of over-smoothing and gradient disappearance of LRGNN.

[0053] Specifically, Figure 3As shown, in this embodiment, the initial feature embedding of nodes and edges is input into a 6-layer LRGNN (other numbers of LRGNNs, such as 5 layers, 7 layers, etc., can also be set according to the actual propagation learning requirements) for multi-layer propagation, each layer contains a gated unit (GRU) and the last layer uses a double-layer residual connection (ResNet). The gated unit GRU of each layer is combined with a three-layer bidirectional information transmission mechanism (other levels of bidirectional information transmission mechanisms, such as 5 layers, 4 layers, etc., can also be set according to actual conditions, which is not limited here), so that each layer of the gated graph neural network can obtain deeper contextual information from neighboring nodes, thereby gradually enhancing the ability to capture features of more distant neighbors. Through repeated message passing and aggregation, the model can better understand the complex relationships between nodes and improve the modeling effect of graph data.

[0054] In this embodiment, LRGNN: Long-Range Graph Neural Network, a stacked graph neural network module, is designed to solve the long-range information dependency problem in graph classification tasks. Through neural network structure search, the depth and jump connections are adaptively designed to capture the long-range information in the graph while maintaining the integrity of the structural information. This design avoids the over-smoothing problem and enables the model to more effectively utilize the information interaction of distant nodes.

[0055] Gated Graph Convolution is a convolution operation that introduces a gating mechanism into graph neural networks (GNNs).

[0056] GNN: GatedGraph Neural Network, a gated graph neural network, is a neural network model used to process graph structure data. It transfers information between graph nodes through a gating mechanism to extract the features of the graph structure.

[0057] GRU: Gated Recurrent Unit, a recursive neural network structure that controls the flow of information by resetting gates and updating gates. It is suitable for multi-layer information propagation in graph neural networks.

[0058] The two-way information transmission mechanism refers to the mutual flow of information between the sender and the receiver. That is, after the sender sends information, the receiver not only receives the information, but also responds according to the content of the information and feeds back the response to the sender in the form of information.

[0059] ResNet: Residual Network. ResNet is a deep neural network architecture designed to solve the gradient vanishing problem in deep networks. It can train deeper networks and improve the feature expression ability of the model.

[0060] Specifically, the updating and transmission process of the control information through the gate control unit GRU includes steps S41 to S44: S41, the features of nodes and edges are used as the input of the graph neural network to generate messages; let the initial features of node i be ,side The characteristics are , then the expression for message generation is: ; in, represents the message from node i to neighbor node j, , Indicates that the target node is embedded , source node embedding and Splice it together; S42, for each node, aggregate all messages from neighboring nodes to obtain the aggregate message of each node, the aggregate message of node i The formula is: ; in, Represents the set of neighbor nodes of node i; is the aggregate message of node i.

[0061] S43, after obtaining the aggregated message, the gated recurrent unit GRU is used to update the state of each node; the updated state of node i is expressed as; ； ; ; ; in, is the update gate of node i, is the reset gate of node i; They are the weight matrices of the GRU update gate and reset gate respectively; Represents the sigmoid activation function; is the previous state of node i; is the current candidate state of node i; and is the weight matrix of the candidate states; It is the element-wise multiplication, i.e. Hadamard product; is the current update status of node i; Controls the current candidate status and the previous state In update status The proportion in .

[0062] S44, after comparing and normalizing the updated node features, connect them with the node features of the previous layer. The expression is: ; ; in, Represents the contrast normalization standardization operation, and Represent the node features of the current layer and the previous layer respectively; Represents the node features of contrast normalization; Indicates the node features after splicing; Represents a hyperparameter that controls the proportion of residual connections.

[0063] In this embodiment, the gated unit (GRU) can control the information flow in multi-layer propagation to prevent excessive smoothing of information, thereby effectively maintaining feature diversity. The residual connection (ResNet) can alleviate the gradient vanishing or explosion problem of deep networks and improve the stability of training. The 6-layer design balances the depth and computational complexity of feature extraction and is suitable for similarity learning tasks with complex graph structures.

[0064] S5, the node features after LRGNN propagation are passed through the position-aware multi-head attention module to generate position encoding information for each node, and the position encoding information is fused with the node features and input into the multi-head attention mechanism to calculate the attention to capture the complex association relationship between nodes; according to the fused node features and attention, the residual connection and layer normalization are used to update the nodes to obtain the node features after position awareness and multi-head attention; In the LRGNN multi-layer propagation process, existing methods lack a mechanism to model the relative structural relationships in the graph, resulting in the loss of complex associations between nodes in the graph structure and spatial hierarchical structure information. Figure 4As shown, this embodiment uses a position-aware multi-head attention module and introduces position encoding in the multi-head attention (where head n represents the nth head of attention), so that the model not only relies on the similarity of the node features themselves to calculate the attention weights, but also can perform weighted aggregation according to the relative structural relationship of the nodes in the graph. With the help of position encoding, the multi-head attention mechanism can grasp the complex associations and spatial hierarchical structures between nodes from a higher level, thereby effectively improving the model's ability to model fine-grained information and implicit topological relationships in the graph. At the same time, combined with the use of layer normalization and jump connections, the position-aware multi-head attention module maintains the stability of training and the diversity of features in deep transmission, providing strong support for the expansion and performance improvement of graph neural networks in processing complex graph data and deep structures.

[0065] Specifically, it includes steps S51 to S53.

[0066] S51, position encoding is performed on the node features after LRGNN propagation, and fused and added with the node features after LRGNN propagation to obtain the position fused node features, which are expressed as: ; in, Represents the position fusion node feature vector; represents the node feature vector corresponding to node i after LRGNN propagation, Representation Node The position code.

[0067] S52, according to the position fusion node feature, the complex interdependence between nodes is learned from different subspaces through a multi-head attention mechanism, and the attention of the position fusion node feature is calculated. The specific expression is: ; in, Indicates Attention, represents the query vector; represents the key vector; represents a value vector; Representing a location-aware node feature matrix corresponding to the location-fusion node feature vector; 、 Respectively represent A learnable weight matrix corresponding to queries, keys, and values; is the dimension of the key vector, used for scaling; S53, according to the position fusion node features and the calculated attention, using residual connection ResidualConnection and layer normalization Layer Normalization, update each node feature, obtain the node features after position perception and multi-head attention, so that each node feature can effectively maintain the flow of information and help the model converge faster. The formula is: ； ; in, and They represent the current layer and the previous layer of node features after LRGNN propagation respectively; Represents the node features after multi-head attention update; Represents the hyperparameter that controls the proportion of residual connections; Representation layer normalization and standardization operation; express Node features after layer normalization, i.e., node features after position awareness and multi-head attention.

[0068] S6, inputs the node features after position perception and multi-head attention into the adaptive contrast Softmax aggregator, and uses linear mapping and contrast normalization to prevent excessive smoothing of node features; combines the SE attention mechanism to generate adaptive weights, performs adaptive weighted aggregation on the importance of each node, and then inputs the MLP multi-layer perceptron to extract high-order features; performs Softmax dynamic weighted aggregation on the extracted high-order features, and generates a global representation of the graph through the second MLP multi-layer perceptron to obtain an aggregated embedding vector.

[0069] like Figure 5 The Adaptive Contrastive Softmax Aggregator (ACSA) shown in the figure includes a linear layer with ReLU activation, a contrast normalization layer, an SE attention mechanism, a Softmax weighted aggregation layer, and an MLP layer. ACSA combines the idea of ​​contrastive learning during aggregation, enabling the model to automatically adjust the aggregation weights and focus on key node information in the graph structure, thereby better expressing the structural differences of the graph in the global representation. The importance of each node is dynamically weighted through the Softmax aggregation mechanism to effectively retain the fine-grained information in the node features and avoid the feature smoothing problem of the node features tending to be consistent during multi-layer propagation.

[0070] In this embodiment, ReLU: Rectified Linear Unit. ReLU is an activation function that sets negative input values ​​to 0 and keeps positive values ​​unchanged, introducing nonlinearity into the network and enhancing the expressiveness of the model.

[0071] Softmax: Softmax function is a function that maps input to probability distribution, which is used in multi-classification problems or to assign weights to features. Softmax calculates the ratio of the exponential value of each input to the sum of all input exponential values, so that the output is in the range [0,1] and the sum is 1.

[0072] Softmax Aggregator: An aggregator used for dynamic weighted aggregation. It generates weights through the Softmax function, so that the feature aggregation process focuses on key nodes or features, thereby enhancing the discrimination and expressiveness of the graph representation.

[0073] Specifically, it includes steps S61 to S66.

[0074] S61, suppose the node feature embedding set after position perception and multi-head attention, that is, the node feature matrix is ,yes dimensional real matrix, is the number of nodes, is the dimension of node features; S62, mapped to the hidden dimension through Linear mapping , and use ReLU activation to get the node mapping feature , the formula is: (Linear( ))with ; ; Among them, the Linear linear mapping function transforms the node features The dimension is mapped from d to , and the result of linear mapping is obtained ; Yes Node mapping features after ReLU; and is the learning parameter; ReLU is the linear rectification activation function.

[0075] S63 performs contrast normalization to alleviate the problem of feature dimension collapse and over-smoothing. It normalizes the features in dimension, calculates the similarity matrix, and adjusts the node features.

[0076] Specifically, in S631, each node mapping feature is normalized in dimension, and the expression is: ; in, Represents the normalized node features; represents the L2 norm; S632, using normalized node features , calculate the similarity matrix: ; Where temp is the temperature coefficient, which is used to adjust the range of similarity, T is the transpose, is the similarity matrix, whose dimension is ; S633, the similarity matrix Use Softmax normalization to get the weight , thereby calculating the weighted sum of the features of the negative samples, that is, the negative sample features , the formula is: ； ; S634, the original feature Subtract negative sample features Then scale it, compare and normalize it, and then perform Layer Normalization on the result to further standardize the features and obtain standardized node features. , the formula is: ； ; middle, Compare the normalized update results; scale is the scaling factor of the normalized layer, Represents the Layer Normalization standardization operation.

[0077] S64, perform SE attention mechanism. SE attention mechanism includes global average pooling, fully connected layer and nonlinear activation, weighted aggregation and multi-layer perceptron MLP, and finally obtains SE aggregation embedding vector, which includes: Calculate node features through global average pooling The global statistical information of , the global eigenvector is obtained, the expression is: ; in, represents the global eigenvector; is the number of feature dimensions; represents the i-th standardized node feature; The global feature vector is processed through two fully connected layers and a nonlinear activation function to generate a weight vector of the feature dimension : ; in, and is the learnable weight matrix, is the sigmoid activation function; According to the importance of node features, combined with the weight vector, the node features are adaptively weighted and aggregated to obtain the weighted aggregate feature , the formula is: ； in, represents element-wise multiplication, i.e., the Hadamard product; The adjusted weighted aggregate features Input the multi-layer perceptron MLP to further extract high-order features and obtain the SE aggregate embedding vector , the formula is: ; in, is the SE aggregate embedding vector, is the weighted aggregation feature.

[0078] S65, the SE aggregate embedding vector is then dynamically weighted aggregated through Softmax, specifically: For the nodes after weighted aggregation of SE attention mechanism , whose aggregated messages come from neighboring nodes Features , and the final representation of the node is calculated by Softmax weighting, the expression is: ; in, Represents the Softmax weighted feature, Is a node and nodes The weight calculated by the similarity between is defined as: ; in, , Respectively represent nodes , Corresponding node features; Variables representing nodes, representing each node, Represents the characteristics of each node; S66, the features of the Softmax dynamic weighted aggregation are then input into the multi-layer perceptron MLP to obtain the final aggregated embedding vector.

[0079] Adaptive Contrastive Softmax Aggregator (ACSA) is an innovative graph feature aggregation method that can effectively solve the problems of feature smoothing, dimensionality collapse, and feature loss in graph neural networks by combining contrastive learning normalization and dynamic Softmax aggregation. In the multi-layer propagation process of traditional graph neural networks, node features tend to be consistent, resulting in a decrease in distinguishability. ACSA effectively alleviates this phenomenon through the contrastive learning mechanism of "ContraNorm", making node features evenly distributed in high-dimensional space and avoiding feature concentration and loss.

[0080] In ACSA, the Softmax aggregator can dynamically adjust the weights according to the importance of node features, highlight the feature expressions of key nodes, and make the generated graph-level feature representation more accurate and discriminative. Compared with traditional summation or average aggregation, the dynamic weighting method can focus on important nodes and retain fine-grained information, thereby adapting to different graph structures and node distributions. In addition, through the idea of ​​comparative learning, ACSA can effectively distinguish similar nodes from dissimilar nodes during the aggregation process, enabling the model to learn and extract features more robustly in different task scenarios.

[0081] ACSA's contrastive learning normalization and adaptive Softmax aggregation not only improve the model's adaptability to single-graph analysis and heterogeneous graph matching, but also improve the computational efficiency in large-scale graph data, becoming an efficient and robust graph aggregation solution. It performs well in generating high-quality graph feature representations, enhancing model generalization capabilities, and adapting to multi-task scenarios.

[0082] S7, by calculating the similarity of the aggregated embedding vectors corresponding to the two binary code files, a similarity detection result is obtained.

[0083] Specifically, when calculating the similarity of two aggregated embedding vectors, the Siamese Network twin network can be used to calculate the cosine similarity between the two aggregated embedding vectors to obtain a similarity score; if the similarity score exceeds a set threshold, the two binary code files are determined to be similar.

[0084] In this embodiment, the Siamese Network twin neural network architecture is selected and optimized and trained by the loss function. Siamese Network is a twin neural network specifically used to compare the similarity between two inputs. Siamese Network consists of two sub-networks that share weights. This means that the parameters of the two sub-networks are the same. Therefore, when two different inputs (in this embodiment, the aggregated embedding vectors of two binary code files) pass through the network, they are processed by the same network structure and parameters.

[0085] Compared with the prior art, the present invention has the following beneficial effects: (1) The problem of feature over-smoothing is solved and the distinguishing ability of the model is improved. In the propagation step of the multi-layer gated graph neural network (LRGNN), the present invention introduces a gated recurrent unit (GRU) and a residual connection, so that the model can prevent information from being over-smoothed in multi-layer propagation. The GRU mechanism of LRGNN allows nodes to adaptively update their own states based on the features of neighboring nodes, avoiding feature convergence caused by excessive information flow, and improving the feature distinguishing ability of the model and the fine-grained information retention effect.

[0086] In the LRGNN propagation step, GRU controls the update amplitude of node features through update gates and reset gates. The residual connection further enhances the training stability of the deep network, effectively solving the defect of traditional graph neural networks that features gradually converge in multi-layer propagation.

[0087] (2) Improved the training stability of the model and enhanced the expressive power of the deep network. Since the graph neural network is prone to gradient vanishing or exploding problems after the number of layers increases, the present invention adds contrast normalization and residual connection structure after the propagation process of LRGNN, which significantly improves the training stability of the deep network. The residual connection avoids the gradual attenuation or amplification of the gradient in the deep structure, ensuring that the model can converge stably.

[0088] The present invention designs a contrast normalization and residual connection structure after a 6-layer bidirectional LRGNN, which strikes a balance between feature extraction depth and computational complexity, and can effectively support similarity learning tasks under complex graph structures.

[0089] (3) The problem of complex associations between nodes in the graph structure and loss of spatial hierarchical structure information is solved. The present invention uses a position-aware multi-head attention module and introduces position encoding in the multi-head attention, so that the model not only relies on the similarity of the node features themselves to calculate the attention weight, but also can perform weighted aggregation according to the relative structural relationship of the nodes in the graph. With the help of position encoding, the multi-head attention mechanism can grasp the complex associations and spatial hierarchical structures between nodes from a higher level, thereby effectively improving the model's ability to model fine-grained information and implicit topological relationships in the graph. Combined with the use of layer normalization and residual skip connections, the position-aware multi-head attention module maintains the stability of training and the diversity of features in deep transmission, providing strong support for the expansion and performance improvement of graph neural networks in processing complex graph data and deep structures.

[0090] (4) Alleviates the problem of feature dimension collapse and achieves high-quality feature aggregation. In the Adaptive Contrastive Softmax Aggregator (ACSA), through the ContraNorm` normalization operation, the node features can be evenly distributed in the high-dimensional space during the aggregation process, alleviating the common feature dimension collapse problem in traditional methods. ACSA uses the idea of ​​contrastive learning to generate negative sample features and adjust the uniform distribution of node features, ensuring the diversity and high discrimination of features, thereby improving the quality of graph feature representation.

[0091] In the contrast normalization stage of ACSA, the present invention dynamically adjusts features through negative sample generation and Layer Normalization, effectively avoiding the concentration of feature dimensions and information loss.

[0092] (5) Improved the adaptability and robustness of the model to multi-task scenarios. ACSA introduces a contrastive learning mechanism in the aggregation process, which can effectively distinguish similar nodes from dissimilar nodes, making the model more flexible and robust when dealing with multi-task scenarios such as single-graph analysis, cross-graph similarity analysis, and heterogeneous graph matching. In addition, ACSA's adaptive weighting mechanism can also support the diversity requirements of single and heterogeneous graphs, allowing the model to generate high-quality feature representations under different tasks.

[0093] In the ACSA aggregation process, the dynamic weight allocation and contrastive learning normalization mechanism of the present invention ensure the performance stability and adaptability of the model under different task requirements.

[0094] In summary, the LRGNN of the present invention achieves efficient extraction and accurate aggregation of graph features through multi-layer gated units (GRU), residual connections (ResNet) and adaptive contrast softmax aggregator (ACSA), significantly improving the model's ability to distinguish, training stability and multi-task adaptability. This solution is particularly suitable for similarity learning tasks of large-scale complex graph structures, and provides an innovative solution for improving the feature expression and computational efficiency of graph neural networks.

[0095] Embodiment 2 like Figure 6 As shown, the second embodiment of the present invention further provides a binary code similarity detection system based on comparison aggregation and location awareness, including: An acquisition unit, used for acquiring two binary code files to be detected; A disassembly unit, used for disassembling two binary code files to extract corresponding binary code function information; wherein the binary code function information includes an attribute control flow graph ACFG; The graph normalization encoding unit is used to use the MLP multi-layer perceptron to perform graph normalization encoding on the node and edge features of the attribute control flow graph of the two input binary code files, generate the initial vector representation of each node and edge, and obtain the initial node embedding and edge embedding of the corresponding binary code files; LRGNN propagation unit is used to perform multi-layer propagation processing on the initial node embedding and edge embedding using a multi-layer gated graph neural network LRGNN. Each layer of LRGNN controls the update and transmission of information through the gated unit GRU, and adopts a multi-layer bidirectional information transmission mechanism during transmission to obtain deeper context information from neighboring nodes; then, contrast normalization and residual connection design are combined to alleviate the problems of over-smoothing and gradient disappearance of LRGNN; Position-aware multi-head attention unit, used for node features after LRGNN propagation. The position encoding information is generated for each node through the position-aware multi-head attention module, and the position encoding information is fused with the node features and input into the multi-head attention mechanism to calculate the attention to capture the complex association relationship between nodes. According to the fused node features and attention, the residual connection and layer normalization are used to update the nodes, so as to obtain the node features after position awareness and multi-head attention. The global feature aggregation unit is used to input the node features after position perception and multi-head attention into the adaptive contrast Softmax aggregator, and prevent the node features from being over-smoothed through linear mapping and contrast normalization; the SE attention mechanism is combined to generate adaptive weights, and the importance of each node is adaptively weighted and aggregated, and then input into the MLP multi-layer perceptron to extract high-order features; the extracted high-order features are subjected to Softmax dynamic weighted aggregation, and the global representation of the graph is generated by the second MLP multi-layer perceptron to obtain the aggregated embedding vector; The similarity detection unit is used to obtain a similarity detection result by calculating the similarity of the aggregated embedding vectors corresponding to the two binary code files.

[0096] Embodiment 3 The third embodiment of the present invention also provides a binary code similarity detection device based on comparative aggregation and location awareness, which includes a memory and a processor, wherein a computer program is stored in the memory, and the computer program can be executed by the processor to implement the binary code similarity detection method based on comparative aggregation and location awareness as described above.

[0097] Embodiment 4 The fourth embodiment of the present invention also provides a computer-readable storage medium, on which computer-readable instructions are stored. When the computer-readable instructions are executed by a processor of a device where the computer-readable storage medium is located, the above-mentioned comparative aggregation and location-aware binary code similarity detection method is implemented.

[0098] In several embodiments provided in the embodiments of the present invention, it should be understood that the disclosed devices and methods may also be implemented in other ways.

[0099] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A binary code similarity detection method based on contrast aggregation and location awareness, characterized in that: include: S1, obtain two binary code files to be tested; S2, disassembling the two binary code files to extract corresponding binary code function information; wherein the binary code function information includes an attribute control flow graph ACFG; S3, using MLP multi-layer perceptron, respectively, the node and edge features of the attribute control flow graph of the two input binary code files are graph-standardized and encoded, generating the initial vector representation of each node and edge, and obtaining the initial node embedding and edge embedding of the corresponding binary code files; S4, a multi-layer gated graph neural network LRGNN is used to perform multi-layer propagation processing on the initial node embedding and edge embedding. Each layer of LRGNN controls the update and transmission of information through the gated unit GRU, and adopts a multi-layer bidirectional information transmission mechanism during transmission to obtain deeper context information from neighboring nodes; then combined with contrast normalization and residual connection design to alleviate the problems of over-smoothing and gradient disappearance of LRGNN; S5, the node features after LRGNN propagation are passed through the position-aware multi-head attention module to generate position encoding information for each node, and the position encoding information is fused with the node features and input into the multi-head attention mechanism to calculate the attention to capture the complex association relationship between nodes; according to the fused node features and attention, the residual connection and layer normalization are used to update the nodes, so as to obtain the node features after position awareness and multi-head attention; S6, input the node features after position perception and multi-head attention into the adaptive contrast Softmax aggregator, and use linear mapping and contrast normalization to prevent excessive smoothing of node features; combine the SE attention mechanism to generate adaptive weights, perform adaptive weighted aggregation on the importance of each node, and input them into the MLP multi-layer perceptron to extract high-order features; perform Softmax dynamic weighted aggregation on the extracted high-order features, and generate a global representation of the graph through the second MLP multi-layer perceptron to obtain an aggregated embedding vector; S7, by calculating the similarity of the aggregated embedding vectors corresponding to the two binary code files, a similarity detection result is obtained.

2. According to claim 1, a comparative aggregation and location-aware binary code similarity detection method is characterized in that ,The process of using MLP multi-layer perceptron for graph standardization encoding is: MLP is used to convert the original features of each node and edge into a high-dimensional vector for subsequent graph neural network propagation. The graph standardization encoding process includes node encoding and edge encoding, and the expression is as follows: Node code: ； Edge encoding: ; in, Embed for the initial node; is the edge eigenvector; is the edge composed of nodes i and j; is the feature vector of node i; is the feature vector of node i and its neighbor node j; A node set for the attribute control flow graph; is the edge set of the attribute control flow graph; Indicates that the MLP multi-layer perceptron performs graph standardization encoding on nodes; Indicates that the MLP multi-layer perceptron performs graph-standardized encoding on the edges.

3. According to claim 2, a method for detecting similarity of binary codes by contrast aggregation and location awareness is characterized in that ,The updating and transmission process of information controlled by the gate control unit GRU is as follows: Step 1: Use the features of nodes and edges as the input of the graph neural network to generate messages; let the initial features of node i be ,side The characteristics are , then the expression for message generation is: ； in, represents the message from node i to neighbor node j, , Indicates that the target node is embedded , source node embedding and Splice it together; Step 2: For each node, aggregate all messages from neighboring nodes to obtain the aggregate message of each node. The aggregate message of node i is The formula is: ； in, Represents the set of neighbor nodes of node i; Step 3: After obtaining the aggregated message, use the gated recurrent unit GRU to update the state of each node; the updated state of node i is expressed as; ； ； ； ； in, is the update gate of node i, is the reset gate of node i; They are the weight matrices of the GRU update gate and reset gate respectively; Represents the sigmoid activation function; is the aggregated message of node i; is the previous state of node i; is the current candidate state of node i; and is the weight matrix of the candidate states; It is the element-wise multiplication, that is, the Hadamard product; is the current update status of node i; Controls the current candidate status and the previous state In update status The proportion of Step 4: After comparing and normalizing the updated node features, connect them with the node features of the previous layer. The expression is: ； ； in, Represents the contrast normalization operation, and Represent the node features of the current layer and the previous layer respectively; Represents the node features of contrast normalization; Indicates the node features after splicing; Represents a hyperparameter that controls the proportion of residual connections.

4. The method for detecting binary code similarity based on comparative aggregation and location awareness according to claim 1, characterized in that , the S5 is specifically: Step 1: Positionally encode the node features after LRGNN propagation, and fuse and add them with the node features after LRGNN propagation to obtain the position fused node feature vector, which is expressed as: ； in, Represents the position fusion node feature vector; represents the node feature vector corresponding to node i after LRGNN propagation, Representation Node The position encoding vector of Step 2: Based on the position fusion node feature vector, the complex interdependence between nodes is learned from different subspaces through the multi-head attention mechanism, and the attention of the position fusion node feature is calculated. The specific expression is: ； in, Indicates attention; represents the query vector; represents the key vector; represents a value vector; A location-aware node feature matrix representing the location-fusion node feature vector; , Respectively represent A learnable weight matrix corresponding to the query vector, key vector, and value vector; is the dimension of the key vector, used for scaling; T means transpose; Step 3: According to the position fusion node features and the calculated attention, residual connection and layer normalization are used to update each node feature to obtain the node features after position perception and multi-head attention, so that each node feature can effectively maintain the flow of information and help the model converge faster. The formula is: ； ； in, and They represent the current layer and the previous layer of node features after LRGNN propagation respectively; Represents the node features after multi-head attention update; Represents the hyperparameter that controls the proportion of residual connections; Representation layer normalization and standardization operation; express Node features after layer normalization, i.e., node features after position awareness and multi-head attention.

5. The method for detecting binary code similarity based on comparative aggregation and location awareness according to claim 1, characterized in that , the linear mapping is specifically: Suppose the node feature set after position perception and multi-head attention, that is, the node feature matrix is ,for dimensional real matrix, is the number of nodes, is the dimension of node features; Map it to the hidden dimension through Linear mapping , and use ReLU activation to get the node mapping feature , the formula is: (Linear( ))with ; ； Among them, the Linear linear mapping function transforms the node features The dimension is mapped from d to , and the result of linear mapping is obtained ; Yes Node mapping features after ReLU; and is the learning parameter; ReLU is the linear rectification activation function.

6. A method for detecting similarity of binary codes by comparing aggregation and location awareness according to claim 5, characterized in that ,The process of contrast normalization is specifically as follows: Step 1: Normalize the mapping features of each node in dimension. The expression is: ; in, Represents the normalized node features; represents the L2 norm; Step 2: Use normalized node features , calculate the similarity matrix: ； Where temp is the temperature coefficient, which is used to adjust the range of similarity; T is transpose; is the similarity matrix, whose dimension is ; Step 3: Normalize the similarity matrix using Softmax to obtain the weights , thereby calculating the weighted sum of the features of the negative samples, that is, the negative sample features , the formula is: ； ； Step 4: The original features Subtract negative sample features Then scale it, compare and normalize it, and then normalize the result by Layer Normalization to further standardize the features and get the standardized node features. , the formula is: ； ； in, Compare the normalized update results; scale is the scaling factor of the normalization layer, Represents the Layer Normalization layer normalization operation.

7. A method for detecting similarity of binary codes by comparing aggregation and location awareness according to claim 6, characterized in that ,Combined with the SE attention mechanism, adaptive weights are generated to perform adaptive weighted aggregation on the importance of each node, specifically: First, the global statistical information of the normalized node features is calculated by global average pooling to obtain the global feature vector, which is expressed as: ； in, represents the global eigenvector; is the number of feature dimensions; represents the i-th standardized node feature; Secondly, the global feature vector is processed through two fully connected layers and a nonlinear activation function to generate a weight vector of the feature dimension : ； in, and is the learnable weight matrix, is the sigmoid activation function; Then, according to the importance of the node features, combined with the weight vector, the node features are adaptively weighted and aggregated to obtain the weighted aggregate feature , the formula is: ； in, represents element-wise multiplication, i.e., the Hadamard product; Finally, the adjusted weighted aggregation features Input the multi-layer perceptron MLP to further extract high-order features and obtain the SE aggregate embedding vector , the formula is: ； in, is the SE aggregate embedding vector, is the weighted aggregation feature.

8. The method for detecting similarity of binary codes by comparing aggregation and location awareness according to claim 7, characterized in that ,The process of Softmax dynamic weighted aggregation is specifically as follows: For the nodes after weighted aggregation of SE attention mechanism , whose aggregated messages come from neighboring nodes Features , and the final representation of the node is calculated by Softmax weighting, the expression is: ; in, represents the Softmax weighted feature, Is a node and nodes The weight calculated by the similarity between is defined as: ； in, , Respectively represent nodes , Corresponding node features; A variable representing a node, Representation Node The corresponding node features.

9. The method for detecting binary code similarity by comparing aggregation and location awareness according to claim 1, characterized in that ,When calculating the similarity of two aggregated embedding vectors, the Siamese Network twin network is used to calculate the cosine similarity between the two aggregated embedding vectors to obtain a similarity score; if the similarity score exceeds the set threshold, the two binary code files are determined to be similar.

10. A binary code similarity detection system based on contrast aggregation and location awareness, characterized in that: include: An acquisition unit, used for acquiring two binary code files to be detected; A disassembly unit, used for disassembling two binary code files to extract corresponding binary code function information; wherein the binary code function information includes an attribute control flow graph ACFG; The graph normalization encoding unit is used to use the MLP multi-layer perceptron to perform graph normalization encoding on the node and edge features of the attribute control flow graph of the two input binary code files, generate the initial vector representation of each node and edge, and obtain the initial node embedding and edge embedding of the corresponding binary code file; LRGNN propagation unit is used to perform multi-layer propagation processing on the initial node embedding and edge embedding using a multi-layer gated graph neural network LRGNN. Each layer of LRGNN controls the update and transmission of information through the gated unit GRU, and adopts a multi-layer bidirectional information transmission mechanism during transmission to obtain deeper context information from neighboring nodes; then, contrast normalization and residual connection design are combined to alleviate the problems of over-smoothing and gradient disappearance of LRGNN; Position-aware multi-head attention unit, used for node features after LRGNN propagation. The position encoding information is generated for each node through the position-aware multi-head attention module, and the position encoding information is fused with the node features and input into the multi-head attention mechanism to calculate the attention to capture the complex association relationship between nodes. According to the fused node features and attention, the residual connection and layer normalization are used to update the nodes, so as to obtain the node features after position awareness and multi-head attention. The global feature aggregation unit is used to input the node features after position perception and multi-head attention into the adaptive contrast Softmax aggregator, and prevent the node features from being over-smoothed through linear mapping and contrast normalization; the SE attention mechanism is combined to generate adaptive weights, and the importance of each node is adaptively weighted and aggregated, and then input into the MLP multi-layer perceptron to extract high-order features; the extracted high-order features are subjected to Softmax dynamic weighted aggregation, and the global representation of the graph is generated by the second MLP multi-layer perceptron to obtain the aggregated embedding vector; The similarity detection unit is used to obtain a similarity detection result by calculating the similarity of the aggregated embedding vectors corresponding to the two binary code files.

Images