A method, device and apparatus for detecting vulnerabilities in binary code

Abstract

The present application relates to a vulnerability detection method, device and equipment for binary code. It includes: obtaining the code to be detected, and generating a corresponding extension dependency graph based on the code to be detected; identifying the potential vulnerability manifestation points and the corresponding potential vulnerability root points in the extension dependency graph, and dividing the extension dependency graph based on the potential vulnerability manifestation points and the corresponding potential vulnerability root points to obtain at least one extension dependency subgraph; inputting the extension dependency subgraph into a well-trained graph neural vulnerability detection model to obtain the corresponding vulnerability detection result. The graph neural vulnerability detection model is trained based on a preset training sample set; the training sample set carries a vulnerability authenticity label and a vulnerability type label. The use of this method can improve the accuracy and efficiency of vulnerability detection for binary code, and can accurately locate vulnerabilities and analyze vulnerability types.

Description

Technical Field

[0001] The present application relates to the field of computer software security technology, and in particular to a vulnerability detection method, apparatus, and device for binary code. Background Art

[0002] For software programs, their security is of paramount importance. If vulnerabilities in software programs are exploited by attackers, they will cause serious problems such as program crashes and privacy leaks. However, programmers cannot completely avoid the occurrence of vulnerabilities when manually writing programs, and in actual applications, vulnerabilities introduced by third-party libraries often affect downstream binary codes. Therefore, detecting binary code vulnerabilities is an important step in software security protection. In the existing technology, most vulnerability detection solutions are targeted at source code such as C / C++, and the tools cannot be directly applied to binary code for security analysis. Binary code stripped of symbolic information lacks rich semantic information at the source code level, and the decompiled code has problems such as low accuracy, unclear meaning, and unclear structure, making it difficult to achieve effective vulnerability detection. Existing vulnerability detection methods for binary code mostly directly compare code similarity at the assembly code level, or use fuzz testing to dynamically discover vulnerabilities. These methods have problems such as low code coverage, high false positive rate, coarse vulnerability analysis granularity, inability to analyze vulnerability types, and inability to accurately locate vulnerabilities.

[0003] Currently, no effective solution has been proposed to address the problem of low accuracy and efficiency in binary code vulnerability detection in existing technologies. Summary of the Invention

[0004] Based on this, it is necessary to provide a vulnerability detection method, device and equipment for binary code to address the above technical problems.

[0005] In a first aspect, the present application provides a vulnerability detection method for binary code. The method comprises:

[0006] Obtain the code to be tested, and generate a corresponding extension dependency graph based on the code to be tested;

[0007] Identifying potential vulnerability manifestation points and corresponding potential vulnerability root points in the extension dependency graph, and partitioning the extension dependency graph based on the potential vulnerability manifestation points and the corresponding potential vulnerability root points to obtain at least one extension dependency subgraph;

[0008] The extension dependency subgraph is input into a fully trained graph neural vulnerability detection model to obtain the corresponding vulnerability detection results, where the vulnerability detection results include vulnerability type and vulnerability authenticity results; the graph neural vulnerability detection model is trained based on a preset training sample set; the training sample set carries vulnerability authenticity labels and vulnerability type labels.

[0009] In one embodiment, identifying potential vulnerability manifestation points and corresponding potential vulnerability root points in the extension dependency graph includes:

[0010] Based on the vulnerability behavior characteristics corresponding to different vulnerability types, the code to be tested is identified for vulnerability, and the potential vulnerability manifestation points and corresponding potential vulnerability root points in the code to be tested are obtained. Among them, the potential vulnerability manifestation points and potential vulnerability root points are in a one-to-many relationship;

[0011] Based on the locations of potential vulnerability root points and potential vulnerability manifestation points in the code to be detected, corresponding potential vulnerability manifestation points and potential vulnerability root points are identified in the extension dependency graph.

[0012] In one embodiment, obtaining vulnerability type labels in a preset training sample set includes:

[0013] Based on a preset vulnerability training code, the vulnerability training code is identified based on vulnerability features to obtain potential training vulnerability manifestation points and potential training vulnerability root points, and the extension program dependency graph corresponding to the vulnerability training code is divided according to the potential training vulnerability manifestation points and the potential training vulnerability root points to obtain at least one training subgraph;

[0014] The vulnerability type label corresponding to each training subgraph is determined based on the vulnerability features of the training vulnerability manifestation points and the vulnerability features of the training vulnerability root points.

[0015] In one embodiment, obtaining vulnerability authenticity labels in a preset training sample set includes:

[0016] Obtain the training patch code corresponding to the vulnerability training code, determine the location of the target training vulnerability root point in the vulnerability training code, and verify each training subgraph according to the location of the target training vulnerability root point to obtain the vulnerability authenticity label corresponding to each training subgraph, wherein the training set samples are composed of training subgraphs.

[0017] In one embodiment, based on potential vulnerability manifestation points and corresponding potential vulnerability root points, the extension dependency graph is partitioned to obtain at least one extension dependency subgraph, including:

[0018] Starting from each potential vulnerability manifestation point, the extension dependency graph is reversely sliced ​​until the preset slicing depth is reached to obtain an extension dependency subgraph; wherein the slicing depth includes the distance between the potential vulnerability manifestation point and the corresponding potential vulnerability root point; each extension dependency subgraph includes a potential vulnerability manifestation point and a corresponding potential vulnerability root point.

[0019] In one embodiment, the training sample set includes a training subgraph, where the training subgraph is composed of nodes and edges between the nodes; obtaining the training sample set includes:

[0020] Embed a corresponding node feature vector for each node, and embed a corresponding edge feature vector for each edge, where the node feature vector includes but is not limited to operation node features, structural node features, and semantic node features; the edge feature vector includes but is not limited to the type of edge, the type of data flow corresponding to the edge, and the type of control flow corresponding to the edge.

[0021] In one embodiment, obtaining a fully trained graph neural vulnerability detection model includes:

[0022] Obtain an initial graph neural vulnerability detection model and a preset training sample set with vulnerability authenticity labels and vulnerability type labels, wherein the initial graph neural vulnerability detection model includes a graph embedding network and a classification network;

[0023] The training sample set is input into the initial graph neural vulnerability detection model for training to obtain the prediction results of the training sample set. The loss function result is calculated based on the prediction results of the training sample set and the vulnerability authenticity label and vulnerability type label. The gradient of the loss function result is then transferred back to the initial neural network model for iterative training to generate a fully trained graph neural vulnerability detection model.

[0024] In one embodiment, generating a corresponding extension dependency graph based on the code to be detected includes:

[0025] Scan the instructions in the code to be detected in sequence and obtain a corresponding node based on each instruction, wherein the code to be detected is in the form of an assembly program;

[0026] Determine the relationship between control flow and data flow between instructions based on the previous and subsequent instructions, and determine the edges between instructions based on the control flow and data flow;

[0027] Based on the nodes and edges, the extended program dependency graph is obtained.

[0028] In a second aspect, the present application also provides a vulnerability detection device for binary code. The device includes:

[0029] An acquisition module is used to obtain the code to be detected and generate a corresponding extension dependency graph based on the code to be detected;

[0030] a calculation module, configured to identify potential vulnerability manifestation points and corresponding potential vulnerability root points in an extension program dependency graph, and partition the extension program dependency graph based on the potential vulnerability manifestation points and the corresponding potential vulnerability root points to obtain at least one extension program dependency subgraph;

[0031] The generation module is used to input the extension dependency subgraph into the fully trained graph neural vulnerability detection model to obtain the corresponding vulnerability detection results, where the vulnerability detection results include vulnerability type and vulnerability authenticity results; the graph neural vulnerability detection model is trained based on a preset training sample set; the training sample set carries vulnerability authenticity labels and vulnerability type labels.

[0032] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are performed:

[0033] Obtain the code to be tested, and generate a corresponding extension dependency graph based on the code to be tested;

[0034] Identifying potential vulnerability manifestation points and corresponding potential vulnerability root points in the extension dependency graph, and partitioning the extension dependency graph based on the potential vulnerability manifestation points and the corresponding potential vulnerability root points to obtain at least one extension dependency subgraph;

[0035] The extension dependency subgraph is input into a fully trained graph neural vulnerability detection model to obtain the corresponding vulnerability detection results, where the vulnerability detection results include vulnerability type and vulnerability authenticity results; the graph neural vulnerability detection model is trained based on a preset training sample set; the training sample set carries vulnerability authenticity labels and vulnerability type labels.

[0036] The above-mentioned vulnerability detection method, device and equipment for binary code obtains the code to be detected, and generates a corresponding extension dependency graph based on the code to be detected; then identifies the potential vulnerability manifestation points and the corresponding potential vulnerability root points in the extension dependency graph, and divides the extension dependency graph based on the potential vulnerability manifestation points and the corresponding potential vulnerability root points to obtain at least one extension dependency subgraph; finally, the extension dependency subgraph is input into a well-trained graph neural vulnerability detection model to obtain the corresponding vulnerability detection result, wherein the vulnerability detection result includes the vulnerability type and the vulnerability authenticity result; the graph neural vulnerability detection model is trained based on a preset training sample set, and the training sample set carries a vulnerability authenticity label and a vulnerability type label. Through this application, the trained graph neural vulnerability detection model is applied to the vulnerability detection scenario, which can effectively improve the accuracy of vulnerability detection, and this application has a high vulnerability detection accuracy, which can not only detect whether there is a vulnerability in the software code, but also locate the vulnerability instruction-level position and analyze the vulnerability type, so as to facilitate the subsequent generation of patches for the binary code and effectively reduce the harm of the vulnerability. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1A diagram of an application environment of a vulnerability detection method in one embodiment;

[0038] Figure 2 1 is a flow chart of a vulnerability detection method according to an embodiment;

[0039] Figure 3 Schematic diagram of a flow chart of a vulnerability detection method in a preferred embodiment;

[0040] Figure 4 is a structural block diagram of a vulnerability detection device in one embodiment;

[0041] Figure 5 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0043] The vulnerability detection method for binary code provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Obtain the code to be detected, and generate a corresponding extension dependency graph based on the code to be detected; then identify the potential vulnerability manifestation points and the corresponding potential vulnerability root points in the extension dependency graph, and divide the extension dependency graph based on the potential vulnerability manifestation points and the corresponding potential vulnerability root points to obtain at least one extension dependency subgraph; finally, input the extension dependency subgraph into the fully trained graph neural vulnerability detection model to obtain the corresponding vulnerability detection result, wherein the vulnerability detection result includes the vulnerability type and the vulnerability authenticity result; the graph neural vulnerability detection model is trained based on a preset training sample set, and the training sample set carries a vulnerability authenticity label and a vulnerability type label. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices, and the Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, etc. The portable wearable device may be a smart watch, a smart bracelet, a head-mounted device, etc. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0044] In one embodiment, Figure 2 As shown, a vulnerability detection method is provided, which is applied to Figure 1The following steps are used as an example to illustrate the server in the example:

[0045] Step S210: Obtain the code to be detected, and generate a corresponding extension dependency graph based on the code to be detected.

[0046] Specifically, this embodiment is used to perform vulnerability detection on binary code, that is, the above-mentioned code to be detected is the binary code to be detected, and in actual application, since it is impossible to directly perform vulnerability detection on the binary code, after obtaining the binary code, the binary code is first compiled into assembly code, and then the corresponding extended program dependency graph is generated. Among them, each node in the extended program dependency graph represents an instruction in the code to be detected, and contains the distance information between the node and the potential manifestation point of the vulnerability. Each edge represents the dependency relationship between the control flow and data flow between instructions, and can propagate node data and vulnerability context information. Therefore, the extended program dependency graph not only has structural information at the instruction set granularity, but also has contextual semantic association information between each instruction, which can effectively represent CWE (Common Weakness Enumeration) features.

[0047] Step S220 , identifying potential vulnerability manifestation points and corresponding potential vulnerability root points in the extension dependency graph, and partitioning the extension dependency graph based on the potential vulnerability manifestation points and the corresponding potential vulnerability root points to obtain at least one extension dependency subgraph.

[0048] Specifically, the vulnerability manifestation point is the specific manifestation of the vulnerability in the software program, such as data leakage, system crash, code injection, etc., and the vulnerability root point is the root cause of the vulnerability, such as design defects, coding errors, improper configuration, etc. A vulnerability manifestation point corresponds to only one real vulnerability root point, that is, the manifestation of a vulnerability corresponds to the root cause of the vulnerability. However, in actual applications, in the process of identifying the dependency graph of the extension program, there will often be a situation where a potential vulnerability manifestation point corresponds to multiple potential vulnerability root points. This is because the identification of vulnerability root points and vulnerability manifestation points is often based on CWE features (such as for integer overflow in the CWE type, its CWE feature is that the feature of the vulnerability manifestation point is any call to a function that passes integer parameters, and the feature of the vulnerability root point is integer arithmetic operations; for stack overflow in the CWE type, its CWE feature is that the feature of the vulnerability manifestation point is any storage instruction on locally allocated memory, and the feature of the vulnerability root point is write operations on stack memory, etc.). Therefore, in this application, a target vulnerability root point that actually causes the vulnerability manifestation point is identified through a subsequent graph neural vulnerability detection model.

[0049] In this embodiment, identifying potential vulnerability manifestation points and potential vulnerability root sources in an extension dependency graph includes first converting the above-mentioned binary code to be detected into assembly code using a disassembler, then generating an extension dependency graph for the code, and identifying potential vulnerability manifestation points and potential vulnerability root sources in the graph based on CWE features. Then, the graph is divided according to potential vulnerability manifestation points and potential vulnerability root points. According to the above explanation, it can be understood that the potential vulnerability manifestation points and potential vulnerability root points obtained by CWE feature identification are often in a one-to-many relationship, that is, one potential vulnerability manifestation point corresponds to multiple potential vulnerability root points. Therefore, the extended program dependency graph is sliced ​​according to the positions of the potential vulnerability manifestation points and the corresponding potential vulnerability root points in the extended program dependency graph. The specific slicing method includes taking each potential vulnerability manifestation point as the starting point, traversing the extended program dependency graph using a breadth-first search strategy, and slicing in reverse at a preset depth to form multiple corresponding extended program dependency subgraphs, wherein each extended program dependency subgraph includes one of the above potential vulnerability manifestation points and a corresponding potential vulnerability root point. The size of the above depth generally includes the distance between the potential vulnerability manifestation point and the potential vulnerability root point. In some preferred embodiments, the size of the above depth can be set to 100. In actual applications, the size of the depth can be adjusted by relevant technical personnel according to actual needs.

[0050] In step S230, the extension dependency subgraph is input into a fully trained graph neural vulnerability detection model to obtain corresponding vulnerability detection results, wherein the vulnerability detection results include vulnerability types and vulnerability authenticity results, which are obtained based on a preset training sample set; the training sample set carries vulnerability authenticity labels and vulnerability type labels.

[0051] Specifically, in some preferred embodiments, the graph neural vulnerability detection model consists of two end-to-end modules. The first module is used to transmit messages in the graph structure, thereby generating node embeddings and learning the distance information between nodes. The first model preferably uses an S2V (Structure2Vec, graph embedding) model; the second module preferably uses a neural network classifier to learn each CWE feature, infer the probability of the existence of a vulnerability, and locate the vulnerability manifestation points and vulnerability root points at the instruction level. The extension dependency subgraph is input into the fully trained graph neural vulnerability detection model to obtain the corresponding vulnerability detection results, which include the vulnerability type, the vulnerability authenticity result, the location of the target vulnerability root point and the location of the target vulnerability manifestation point, where the vulnerability type indicates the specific type of the vulnerability, including but not limited to stack overflow (CWE-121), heap overflow (CWE-122), integer overflow (CWE-190), double free (CWE-415) and use after free (CWE-416). It should be noted that according to the content explained above, this application identifies potential vulnerability manifestation points and potential vulnerability root points in the graph based on CWE features. Therefore, the potential vulnerability manifestation point may correspond to a real potential vulnerability root point, or all corresponding potential vulnerability root points may be false. If the code to be detected itself does not have a vulnerability, the potential vulnerability manifestation point and the potential vulnerability root point are both false. Therefore, the target vulnerability root point is the root point that actually triggers the vulnerability. The nodes and edges containing the target vulnerability root point and the target vulnerability manifestation point are the chain that actually triggers the vulnerability. Furthermore, when training the graph neural vulnerability detection model, it is obtained based on the training sample set that carries the vulnerability authenticity label and the vulnerability type label. Among them, the training sample set is composed of a large number of training subgraphs, and each training subgraph includes a potential training vulnerability manifestation point and a corresponding potential training vulnerability root point. Based on the above-mentioned vulnerability behavior characteristics, the preset vulnerability training code is identified to obtain the above-mentioned potential training vulnerability manifestation point and potential training vulnerability root point, and the extension dependency graph corresponding to the vulnerability training code is divided based on the potential training vulnerability manifestation point and the potential training vulnerability root point to obtain the above-mentioned training subgraph. The above-mentioned vulnerability authenticity label takes the training subgraph as a unit, and characterizes the authenticity of the potential training vulnerability manifestation point and the corresponding potential training vulnerability root point in the subgraph, that is, whether the nodes and edges containing the potential training vulnerability manifestation point and the corresponding potential training vulnerability root point are real vulnerability trigger chains. The above-mentioned vulnerability type label characterizes the specific type of the vulnerability.

[0052] In summary, this application first identifies the potential vulnerability manifestation points and potential vulnerability root points in the extension dependency graph, and performs authenticity detection on each potential vulnerability manifestation point and potential vulnerability root point based on the graph neural vulnerability detection model to identify whether the above potential vulnerability manifestation points and potential vulnerability root points are true, and to perform vulnerability type detection. In actual applications, after obtaining the vulnerability authenticity results and vulnerability types, the specific location of the vulnerability on the original code to be detected can be further determined. Among them, the specific positioning method is to establish a mapping relationship between each extension dependency subgraph and the code to be detected when making the extension dependency subgraph. In this way, after obtaining the vulnerability detection results for the extension dependency subgraph, the code to be detected, that is, the location of the vulnerability in the original binary code, can be located through the mapping relationship.

[0053] It should be noted that when detecting binary codes of different architectures, the above-mentioned graph neural vulnerability detection model needs to be trained with corresponding training sample sets of different architectures, so as to realize the detection of binary codes of different architectures. Binary codes of different architectures include but are not limited to ARM (Advanced RISC Machine), X86, MIPS (Microprocessor without Interlocked Pipeline Stages), etc.

[0054] Through steps S210 to S230, the extension dependency graph is sliced ​​based on potential vulnerability manifestation points and potential vulnerability root points to obtain multiple extension dependency subgraphs, and the extension dependency subgraphs are input into a well-trained graph neural vulnerability detection model to obtain corresponding detection results. Through this application, the location of the real vulnerability root point and the location of the vulnerability manifestation point of the binary code, as well as the vulnerability type, can be quickly and accurately determined, so as to facilitate the subsequent generation of patches for the binary code and effectively reduce the harm caused by the vulnerability. In addition, the present application has strong scalability. When applying the well-trained graph neural vulnerability detection model, it does not need to take up too much computing resources and time, and the vulnerability detection efficiency is relatively high. In addition, the present application has a wide range of applications and can locate vulnerabilities in binary codes of different architectures. It is only necessary to complete the training of the corresponding model based on the training set of different architectures when training the detection model.

[0055] In some embodiments, the method further comprises:

[0056] Based on the vulnerability behavior characteristics corresponding to different vulnerability types, the code to be tested is identified for vulnerability, and the potential vulnerability manifestation points and corresponding potential vulnerability root points in the code to be tested are obtained. Among them, the potential vulnerability manifestation points and potential vulnerability root points are in a one-to-many relationship;

[0057] Based on the locations of potential vulnerability root points and potential vulnerability manifestation points in the code to be detected, corresponding potential vulnerability manifestation points and potential vulnerability root points are identified in the extension dependency graph.

[0058] Specifically, in this embodiment, the types of vulnerabilities that need to be detected are pre-set, and the vulnerability behavior characteristics corresponding to different vulnerability types are determined accordingly. In some preferred embodiments, the preset vulnerability types include but are not limited to stack overflow (CWE-121), heap overflow (CWE-122), integer overflow (CWE-190), double release (CWE-415) and use after release (CWE-416), which are five types of vulnerabilities with high incidence and great harmful impact, and the vulnerability behavior characteristics corresponding to each vulnerability type are further clarified. Among them, for the integer overflow type, the corresponding vulnerability behavior characteristics are that the characteristic of the vulnerability manifestation point is any call to a function that passes an integer parameter, and the characteristic of its vulnerability root point is integer arithmetic operation; for the stack overflow type, the corresponding vulnerability behavior characteristics are The characteristic of the vulnerability manifestation point is any storage instruction on locally allocated memory, and the characteristic of the root cause of the vulnerability is the write operation on stack memory; for the heap overflow type, the corresponding vulnerability behavior characteristic is that the characteristic of the vulnerability manifestation point is any storage instruction on dynamically allocated memory, and the characteristic of the root cause of the vulnerability is the write operation on heap memory; for the double release type, the corresponding vulnerability behavior characteristic is that the characteristic of the vulnerability manifestation point is any call to the free() function of the memory manager, and the characteristic of the root cause of the vulnerability is the lack of check whether the heap memory has been released before being released; for the use after free type, the corresponding vulnerability behavior characteristic is that the characteristic of the vulnerability manifestation point is any access to dynamically allocated memory, and the characteristic of the root cause of the vulnerability is the lack of check whether the heap memory has been released before being accessed.

[0059] In summary, based on the above-mentioned preset vulnerability types and corresponding vulnerability behavior characteristics, vulnerability identification is performed on the code to be detected, that is, vulnerabilities are detected and located by matching whether the code to be detected contains the above-mentioned characteristics, thereby obtaining potential vulnerability manifestation points and corresponding potential vulnerability root points in the code to be detected. In actual applications, the potential vulnerability manifestation points and potential vulnerability root points identified by vulnerability types and vulnerability behavior characteristics are generally a one-to-many relationship.

[0060] Furthermore, after identifying the location of the potential vulnerability root point and the location of the potential vulnerability manifestation point, the position of each point in the extension dependency graph is determined based on the position mark. Finally, the extension dependency graph generated by each assembly code, as well as the potential vulnerability manifestation point position mark and potential vulnerability root point position mark in the graph are all stored in the JSON file.

[0061] In this embodiment, the code to be tested is identified for vulnerabilities through preset vulnerability types and corresponding vulnerability behavior characteristics, and potential vulnerability manifestation points and potential vulnerability root points, as well as their corresponding specific locations, are obtained. This facilitates the subsequent steps of dividing the extension dependency subgraph and identifying the authenticity of the potential vulnerability root points, thereby improving the efficiency and accuracy of vulnerability detection.

[0062] In some embodiments, obtaining vulnerability type labels in a preset training sample set includes:

[0063] Based on a preset vulnerability training code, the vulnerability training code is identified based on vulnerability features to obtain potential training vulnerability manifestation points and potential training vulnerability root points, and the extension program dependency graph corresponding to the vulnerability training code is divided according to the potential training vulnerability manifestation points and the potential training vulnerability root points to obtain at least one training subgraph;

[0064] The vulnerability type label corresponding to each training subgraph is determined based on the vulnerability features of the training vulnerability manifestation points and the vulnerability features of the training vulnerability root points.

[0065] Specifically, the preset vulnerability training code and the corresponding training patch code are obtained. In some preferred embodiments, the vulnerability training code of the open source software in the existing CVE (Common Vulnerabilities & Exposures) vulnerability library and the corresponding patched code can be crawled. Based on the patched code, the vulnerability details in the vulnerability training code can be determined, such as the vulnerability type, the actual training vulnerability root point location, etc., and the vulnerability training code can be labeled according to the training patch code. Preferably, the label can be set as a triple<positive / negative,line,type> , that is, if the vulnerability training code does not have a vulnerability, the first item is negative, and the label of the code is<negative,0,0> ,If there is a vulnerability in the vulnerability training code, the first element is positive, line ,indicates the line number where the root of the vulnerability is located in the ,source code, and type is the type of vulnerability.

[0066] After obtaining the vulnerability training code, the vulnerability training code can be identified based on the vulnerability features to obtain potential training vulnerability manifestation points and potential training vulnerability root points. The specific identification method is the same as the method for identifying the code to be detected based on the vulnerability features mentioned above. Then, based on the potential vulnerability manifestation points and the potential vulnerability root points, the extension program dependency graph corresponding to the vulnerability training code is divided to obtain at least one training subgraph, wherein the division method is the same as the method for dividing the extension program dependency graph of the code to be detected mentioned above. Finally, the vulnerability type label corresponding to each training subgraph is determined based on the characteristics of the training vulnerability manifestation points and the characteristics of the training vulnerability root points. In some preferred embodiments, after the identification is completed, the vulnerability type of the training subgraph can also be rechecked based on the type in the above-mentioned triple result, thereby improving the accuracy of the vulnerability type label production in the training set.

[0067] Through this embodiment, corresponding labels can be set for the training sample set to facilitate subsequent training of the model.

[0068] In some embodiments, obtaining vulnerability authenticity labels in a preset training sample set includes:

[0069] Obtain the training patch code corresponding to the vulnerability training code, determine the location of the target training vulnerability root point in the vulnerability training code, and verify each training subgraph according to the location of the target training vulnerability root point to obtain the vulnerability authenticity label corresponding to each training subgraph, wherein the training set samples are composed of training subgraphs.

[0070] Specifically, during the training phase, the identification result of the vulnerability training code based on vulnerability features is generally that one potential training vulnerability manifestation point corresponds to multiple potential training vulnerability root points, and those skilled in the art know that when there is a vulnerability in the vulnerability training code, the above-mentioned potential training vulnerability root points include a root point that actually causes the vulnerability manifestation point.

[0071] After obtaining the potential training vulnerability root point and potential training vulnerability manifestation point, according to the triple of the vulnerability training code described above<positive / negative,line,type> Label, determine the authenticity of each training subgraph, and thus obtain the above-mentioned authenticity label, wherein the triplet label includes the above-mentioned target training vulnerability root point location, that is, the location of the real training vulnerability root point.

[0072] In some preferred embodiments, the control flow and data flow relationships from the potential training vulnerability root point to the potential training vulnerability manifestation point can be represented in each subgraph of the filtered and pruned training sample set. The authenticity of the vulnerability in each subgraph can be determined based on the label information transmitted by the source code through debugging information, thereby obtaining the authenticity label of the vulnerability. In actual applications, since the line number where the vulnerability is located cannot be directly displayed in the compiled assembly code, it is necessary to rely on the debugging symbol information generated during the compilation process to determine the location of the vulnerability in the compiled assembly code. Therefore, the label information can be transmitted to the instruction-level code of the assembly language through the debugging symbol information, thereby marking the node position of the potential vulnerability root point in the subsequent extended program dependency graph.

[0073] Through this embodiment, the authenticity labels of the vulnerabilities in the training sample set can be determined.

[0074] In some embodiments, the method further comprises:

[0075] Starting from each potential vulnerability manifestation point, the extension dependency graph is reversely sliced ​​until a preset slicing depth is reached to obtain an extension dependency subgraph; wherein the slicing depth includes the distance between the potential vulnerability root points corresponding to the potential vulnerability manifestation point; each extension dependency subgraph includes a potential vulnerability manifestation point and a corresponding potential vulnerability root point.

[0076] Specifically, this embodiment provides a method for obtaining an extension dependency subgraph. The method includes reverse slicing the extension dependency graph, starting with each potential vulnerability manifestation point. Using a breadth-first search strategy, the extension dependency graph is traversed and reverse sliced ​​to a preset slicing depth, forming multiple subgraphs that end at the potential vulnerability manifestation point and start at the potential vulnerability root point. To ensure complete slicing, the preset slicing depth should include both the potential vulnerability manifestation point and the corresponding potential vulnerability root point.

[0077] In some embodiments, the training sample set includes a training subgraph, where the training subgraph is composed of nodes and edges between the nodes; obtaining the training sample set includes:

[0078] Embed a corresponding node feature vector for each node, and embed a corresponding edge feature vector for each edge, where the node feature vector includes but is not limited to operation node features, structural node features, and semantic node features; the edge feature vector includes but is not limited to the type of edge, the type of data flow corresponding to the edge, and the type of control flow corresponding to the edge.

[0079] Specifically, in this embodiment, a corresponding node feature vector is embedded for each node in the subgraph, and the node feature vector represents the basic features of an instruction; a corresponding edge feature vector is embedded for each edge in the subgraph, representing the basic features of the data flow or control flow between instructions, so that the neural network can learn during the training process. Specifically, the node feature vector mainly includes operation node features (such as static values, operation codes, etc.), structural node features (such as the number of data dependencies, the number of control dependencies, the distance between the node and the vulnerability manifestation point, etc.) and semantic node features (such as the output type of the node operation). The edge feature vector mainly includes the type of edge (such as control flow or data flow), the specific data type of the data flow (such as floating point, pointer, etc.), and the specific data type of the control flow (such as sequential execution, jump execution), so that the model can capture the direction of what type of data. By learning the flow direction of static values, external inputs and data types, the model has enough information to simulate the impact of data on the program. The rich features of each node and each edge in the graph help the model capture the semantic information of the code, thereby improving its vulnerability detection performance.

[0080] It should be noted that this embodiment explains that when obtaining a training sample set, it is necessary to embed corresponding feature vectors for each node and each edge to enrich the semantic information. Similarly, after the model training is complete, for the application and reasoning stages of the code to be detected, corresponding feature vectors can also be embedded for the edges and nodes of the extension program dependency subgraph of the code to be detected, thereby improving the accuracy of model detection. The embedding method of the feature vector is the same as the embedding method for the training subgraph in this embodiment.

[0081] In some embodiments, obtaining a fully trained graph neural vulnerability detection model includes:

[0082] Obtain an initial graph neural vulnerability detection model and a preset training sample set with vulnerability authenticity labels and vulnerability type labels, wherein the initial graph neural vulnerability detection model includes a graph embedding network and a classification network;

[0083] The training sample set is input into the initial graph neural vulnerability detection model for training to obtain the prediction results of the training sample set. The loss function result is calculated based on the prediction results of the training sample set and the vulnerability authenticity label and vulnerability type label. The gradient of the loss function result is then transferred back to the initial neural network model for iterative training to generate a fully trained graph neural vulnerability detection model.

[0084] Specifically, the graph neural vulnerability detection model in this application consists of two end-to-end modules. The first module can be S2V, node2vec (node2vec: Scalable Feature Learning for Networks), SDNE (Structural Deep Network Embedding), and the long-distance information between nodes is learned through the first model. The second module is a deep neural network classifier, which is used to learn each CWE feature and infer the probability of the existence of a vulnerability. It should be noted that when applied to vulnerability detection in binary codes of multiple different architectures (such as ARM, X86, MIPS), a corresponding model is trained according to the binary codes of different architectures to achieve vulnerability detection for the binary code of each architecture.

[0085] In addition, the graph neural vulnerability detection model in this application is a fully supervised model. It calculates the loss function result based on the vulnerability authenticity label and vulnerability type label in the training sample set, and transfers the gradient of the loss function result back to the initial neural vulnerability detection model for iterative training to generate the above-mentioned fully trained graph neural vulnerability detection model.

[0086] Through this application, vulnerabilities can be located in binary codes of different architectures, not only for Linux or RTOS-based firmware, but also for other general binary codes.

[0087] In some embodiments, the method further comprises:

[0088] Scan the instructions in the code to be detected in sequence and obtain a corresponding node based on each instruction, wherein the code to be detected is in the form of an assembly program;

[0089] Determine the relationship between control flow and data flow between instructions based on the previous and subsequent instructions, and determine the edges between instructions based on the control flow and data flow;

[0090] Based on the nodes and edges, the extended program dependency graph is obtained.

[0091] Specifically, this embodiment provides a method for generating an extended program dependency graph. This represents code as a program dependency graph, facilitating the description of code control flow and data flow, and facilitating deep learning applications. In the extended program dependency graph, each node represents an atomic machine-level instruction and includes information about the distance between that node and a potential vulnerability label point, enabling the model to better identify underlying machine instruction features associated with vulnerabilities.

[0092] For each assembly program, we statically scan the code to generate an extended program dependency graph. We first scan each instruction, starting with the first instruction. Each instruction forms a node in the graph. Then, we scan the edges between nodes a second time. Based on each instruction's predecessor and successor instructions, as well as the values ​​defined and used, we determine the relationship between control flow and data flow between instructions. This is the type and attributes of the edges in the graph. Control flow edges are assigned the void data type, while data flow edges are assigned the data type (e.g., int, double, etc.) depending on the specific data type being passed. In summary, through the nodes and edges, we obtain the extended program dependency graph.

[0093] This application also provides a preferred embodiment of a vulnerability detection method for binary code. Figure 3 It is a flow chart of a preferred embodiment.

[0094] Step S311: Obtain vulnerability training code and training patch code. The vulnerability training code can be the vulnerability code of open source software in the CVE vulnerability database and the corresponding patched code. Based on the vulnerability training code and training patch code, detailed vulnerability information in the vulnerability training code, such as the vulnerability type and the actual training vulnerability root point location, can be obtained. The vulnerability training code is then marked according to the training patch code.

[0095] In step S312 , the vulnerability training code is compiled into assembly code. The binwalk tool can be used to identify the architecture, and then a disassembler is used to disassemble the binary into assembly code.

[0096] Step S313 , generating a training extension program dependency graph based on the training code in the form of assembly code, wherein the training potential vulnerability manifestation points and the training potential vulnerability root points are marked in the graph based on the CWE features.

[0097] Step S314 , obtaining a training subgraph by reverse slicing the training extension dependency graph.

[0098] In step S315, a feature vector is embedded in the training subgraph, and then a training sample set is obtained based on the training subgraph. The model is trained based on the training sample set to obtain a graph neural vulnerability detection model. The above steps S311 to S315 are the model training process.

[0099] Step S321: Obtain the code to be tested and convert the binary code to assembly language to obtain assembly code. The code to be tested is the binary code that needs to be tested for vulnerabilities. This application has a wide range of applications. The code to be tested can be in various forms, such as ARM, x86, MIPS, etc. Those skilled in the art can select the code to be tested according to actual needs and train the graph neural vulnerability detection model of the corresponding architecture.

[0100] Step S322: Generate an extended program dependency graph of the code to be detected based on the assembly code.

[0101] Step S323 : Identify the extension dependency graph based on the vulnerability features to obtain potential vulnerability manifestation points and potential vulnerability root points.

[0102] Step S324 , reverse slicing the extension program dependency graph according to the potential vulnerability manifestation points and the potential vulnerability root points to obtain an extension program dependency subgraph.

[0103] In step S325, a feature vector is embedded into the extension dependency subgraph, and the extension dependency subgraph is identified using the trained graph neural vulnerability detection model to obtain vulnerability detection results. Steps S321 to S325 above are the model application process, i.e., the model inference process.

[0104] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0105] Based on the same inventive concept, the present application also provides a vulnerability detection device for implementing the vulnerability detection method described above. The solution provided by this device is similar to the solution described in the method described above. Therefore, the specific limitations of one or more vulnerability detection device embodiments provided below can be found in the above-mentioned limitations of the vulnerability detection method and will not be repeated here.

[0106] In one embodiment, Figure 4 As shown, a vulnerability detection device is provided, including: an acquisition module 41, a calculation module 42 and a generation module 43, wherein:

[0107] An acquisition module 41 is used to acquire the code to be detected and generate a corresponding extension program dependency graph based on the code to be detected;

[0108] A calculation module 42 is configured to identify potential vulnerability manifestation points and corresponding potential vulnerability root points in the extension program dependency graph, and to partition the extension program dependency graph based on the potential vulnerability manifestation points and the corresponding potential vulnerability root points to obtain at least one extension program dependency subgraph;

[0109] The generation module 43 is used to input the extension dependency subgraph into the fully trained graph neural vulnerability detection model to obtain the corresponding vulnerability detection results, wherein the vulnerability detection results include the vulnerability type, the target vulnerability root point and the target vulnerability manifestation point; the graph neural vulnerability detection model is trained based on a preset training sample set carrying vulnerability authenticity labels and vulnerability type labels.

[0110] Each module in the vulnerability detection device described above can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in hardware form, or can be stored in a computer device memory in software form, so that the processor can call and execute the corresponding operations of each module.

[0111] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 5 As shown. The computer device includes a processor, a memory, and a network interface connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store vulnerability detection-related data. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a vulnerability detection method is implemented.

[0112] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0113] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0114] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processor involved in the various embodiments provided herein may be, but are not limited to, a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, and the like.

[0115] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0116] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A vulnerability detection method for binary code, characterized in that: The method comprises: Obtaining the code to be detected, and generating a corresponding extension dependency graph based on the code to be detected; identifying potential vulnerability manifestation points and corresponding potential vulnerability root points in the extension dependency graph, and partitioning the extension dependency graph based on the potential vulnerability manifestation points and the corresponding potential vulnerability root points to obtain at least one extension dependency subgraph; The extension dependency subgraph is input into a well-trained graph neural vulnerability detection model to obtain corresponding vulnerability detection results, wherein the vulnerability detection results include vulnerability types and vulnerability authenticity results; the graph neural vulnerability detection model is trained based on a preset training sample set; the training sample set carries vulnerability authenticity labels and vulnerability type labels.

2. The method according to claim 1, characterized in that The identifying of potential vulnerability manifestation points and corresponding potential vulnerability root points in the extension dependency graph includes: Based on vulnerability behavior characteristics corresponding to different vulnerability types, vulnerability identification is performed on the code to be detected to obtain potential vulnerability manifestation points and corresponding potential vulnerability root points in the code to be detected, wherein the potential vulnerability manifestation points and the potential vulnerability root points are in a one-to-many relationship; Based on the positions of the potential vulnerability root points and the potential vulnerability manifestation points in the code to be detected, the corresponding potential vulnerability manifestation points and the potential vulnerability root points are identified in the extension dependency graph.

3. The method according to claim 1, characterized in that Obtaining the vulnerability type label in the preset training sample set includes: Based on a preset vulnerability training code, the vulnerability training code is identified based on vulnerability features to obtain potential training vulnerability manifestation points and potential training vulnerability root points, and an extension program dependency graph corresponding to the vulnerability training code is divided according to the potential training vulnerability manifestation points and the potential training vulnerability root points to obtain at least one training subgraph; The vulnerability type label corresponding to each of the training subgraphs is determined based on the vulnerability features of the training vulnerability manifestation points and the vulnerability features of the training vulnerability root points.

4. The method according to claim 3, characterized in that Obtaining the vulnerability authenticity label in the preset training sample set includes: Obtain a training patch code corresponding to the vulnerability training code, determine the location of a target training vulnerability root point in the vulnerability training code, and verify each of the training subgraphs according to the location of the target training vulnerability root point to obtain a vulnerability authenticity label corresponding to each of the training subgraphs, wherein the training sample set is composed of the training subgraphs.

5. The method according to claim 1, wherein The step of dividing the extension dependency graph based on the potential vulnerability manifestation points and the corresponding potential vulnerability root points to obtain at least one extension dependency subgraph includes: Taking each potential vulnerability manifestation point as a starting point, the extension program dependency graph is reversely sliced ​​to a preset slicing depth to obtain the extension program dependency subgraph; wherein the slicing depth includes the distance between the potential vulnerability manifestation point and the corresponding potential vulnerability root point; each extension program dependency subgraph includes a potential vulnerability manifestation point and a corresponding potential vulnerability root point.

6. The method according to claim 1, characterized in that The training sample set includes a training subgraph, and the training subgraph is composed of nodes and edges between the nodes; obtaining the training sample set includes: A corresponding node feature vector is embedded for each of the nodes, and a corresponding edge feature vector is embedded for each of the edges, wherein the node feature vector includes operation node features, structured node features, and semantic node features; the edge feature vector includes the type of the edge, the type of data flow corresponding to the edge, and the type of control flow corresponding to the edge.

7. The method according to claim 1, characterized in that Obtain the fully trained graph neural vulnerability detection model, including: Obtaining an initial graph neural vulnerability detection model and a preset training sample set carrying the vulnerability authenticity label and the vulnerability type label, wherein the initial graph neural vulnerability detection model includes a graph embedding network and a classification network; The training sample set is input into the initial graph neural vulnerability detection model for training to obtain the prediction result of the training sample set, the loss function result is calculated based on the prediction result of the training sample set and the vulnerability authenticity label and the vulnerability type label, and the gradient of the loss function result is reversely transmitted to the initial graph neural vulnerability detection model for iterative training to generate the fully trained graph neural vulnerability detection model.

8. The method according to claim 1, characterized in that The generating a corresponding extension program dependency graph based on the code to be detected includes: Scanning instructions in the code to be detected in sequence, and obtaining a corresponding node based on each instruction, wherein the code to be detected is in the form of an assembly program; Determining a control flow and a data flow relationship between the instructions based on a preceding instruction and a subsequent instruction of the instruction, and determining an edge between the instructions based on the control flow and the data flow; The extended program dependency graph is obtained based on the nodes and the edges.

9. A vulnerability detection device for binary code, characterized in that: The device comprises: An acquisition module, configured to acquire the code to be detected and generate a corresponding extension dependency graph based on the code to be detected; a calculation module, configured to identify potential vulnerability manifestation points and corresponding potential vulnerability root points in the extension program dependency graph, and partition the extension program dependency graph based on the potential vulnerability manifestation points and the corresponding potential vulnerability root points to obtain at least one extension program dependency subgraph; A generation module is used to input the extension dependency subgraph into a well-trained graph neural vulnerability detection model to obtain corresponding vulnerability detection results, wherein the vulnerability detection results include vulnerability types and vulnerability authenticity results; the graph neural vulnerability detection model is trained based on a preset training sample set; the training sample set carries vulnerability authenticity labels and vulnerability type labels.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

Images