Intelligent software reverse analysis method and system based on large model

Abstract

The invention provides an intelligent software reverse analysis method and system.The method comprises the steps that in the binary code execution process, multi-dimensional dynamic behavior data and bottom layer electric signal fluctuation data are obtained, and the multi-dimensional dynamic behavior data comprise memory read-write data, register state change data and a system calling sequence; generating an execution track sequence corresponding to the binary code execution process based on the multi-dimensional dynamic behavior data in combination with a dynamic instrumentation technology; performing preprocessing of timestamp synchronization on the bottom-layer electric signal fluctuation data and the execution track sequence to generate a fusion data stream; in combination with an attention mechanism of a large model, carrying out asymmetric matching on the fused data stream and a preset malicious behavior feature library; and according to a matching result, adjusting an interpretation path weight of the potential malicious instruction in the binary code to generate a reverse analysis report. According to the invention, the detection accuracy of the reverse analysis process of the intelligent software is improved.

Description

Technical Field

[0001] This application relates to the field of large model technologies, and in particular, to an intelligent software reverse analysis method and system based on a large model. Background Art

[0002] In scenarios such as advanced persistent threat attacks and zero-day vulnerability exploitation, malicious code often evades traditional detection through means such as dynamic behavior obfuscation and hardware-level side-channel attacks. There is an urgent need for a technical solution that can synchronously analyze software instruction logic and hardware behavior characteristics and achieve automated and highly accurate reverse analysis to identify hidden malicious code patterns.

[0003] Current mainstream solutions adopt a hybrid analysis method based on static features and dynamic behavior monitoring. By monitoring behavior data such as system call sequences and memory access patterns generated during the operation of the target program, pattern matching is performed in combination with a predefined malicious behavior rule library. Some solutions introduce hardware performance counter data as an auxiliary feature to improve the ability to identify abnormal behaviors.

[0004] This solution has insufficient capture granularity for hardware-level abnormal signals and is difficult to detect side-channel attack behaviors based on electromagnetic leakage and power consumption mutations; the behavior rule library relies on prior knowledge; the simple superposition of static and dynamic features results in a high false alarm rate for analysis results and lacks the ability to perform in-depth correlation analysis of cross-dimensional features. Summary of the Invention

[0005] This application provides an intelligent software reverse analysis method and system based on a large model to solve the problem of low detection accuracy in the process of intelligent software reverse analysis in the prior art.

[0006] In a first aspect, this application provides an intelligent software reverse analysis method based on a large model, including: During the execution of binary code, obtain multi-dimensional dynamic behavior data and underlying electrical signal fluctuation data, where the multi-dimensional dynamic behavior data includes memory read / write data, register state change data, and system call sequences; Based on the multi-dimensional dynamic behavior data, combined with dynamic instrumentation technology, generate an execution trace sequence corresponding to the binary code execution process; Perform preprocessing of timestamp synchronization on the underlying electrical signal fluctuation data and the execution trace sequence to generate a fused data stream; Combined with the attention mechanism of the large model, perform asymmetric matching between the fused data stream and a preset malicious behavior feature library; According to the matching result, adjust the interpretation path weight of potential malicious instructions in the binary code to generate a reverse analysis report.

[0007] Optionally, the attention mechanism combined with the large model performs an asymmetric matching between the fused data stream and a preset malicious behavior feature library, including: Convert the fused data stream into a structured data stream according to the instruction execution order recorded in the execution trace sequence; Analyze the correlation between the instruction operation codes and the amplitude of the electrical signal fluctuations in the structured data stream through the attention mechanism of the large model; Based on the correlation analysis results, construct an instruction operation code sequence that meets the preset fluctuation conditions, and based on the instruction operation code sequence, determine candidate patterns in combination with a sliding window; Perform an asymmetric matching between the candidate patterns and the preset malicious behavior feature library, generate a matching probability value between the candidate patterns and the malicious behavior patterns, and use the matching probability value as the matching result.

[0008] Optionally, the analysis of the correlation between the instruction operation codes and the amplitude of the electrical signal fluctuations in the structured data stream through the attention mechanism of the large model includes: Combine the instruction operation code of each record in the structured data stream with the corresponding electrical signal fluctuation amplitude into a multi-dimensional coding unit, and combine all the multi-dimensional coding units into a multi-dimensional coding unit sequence; Perform cross-coding analysis on the multi-dimensional coding unit sequence through the attention mechanism of the large model, and calculate the association strength value between the semantic coding of each instruction operation code and the amplitude coding of the electrical signal fluctuation amplitude; According to the association strength value, construct a dynamic mapping relationship between the instruction operation code and the electrical signal fluctuation amplitude, and use the dynamic mapping relationship as the correlation analysis result. Each instruction operation code in the dynamic mapping relationship is associated with at least one fluctuation amplitude interval.

[0009] Optionally, the cross-coding analysis of the multi-dimensional coding unit sequence through the attention mechanism of the large model to calculate the association strength value between the semantic coding of each instruction operation code and the amplitude coding of the electrical signal fluctuation amplitude includes: Based on the multi-dimensional coding unit sequence, splice the semantic coding and the amplitude coding at the same time series position according to a preset ratio to generate an interactive coding pair, and combine all the interactive coding pairs into an interactive coding pair sequence; Perform two-way context scanning on the interactive coding pair sequence through the attention mechanism of the large model to determine the dynamic interaction weight between each semantic coding and the corresponding amplitude coding within the current time series window; Based on the dynamic interaction weight, calculate the feature similarity metric value between each semantic coding and the corresponding amplitude coding, and convert the feature similarity metric value into an association strength value.

[0010] Optionally, based on the correlation analysis result, construct an instruction opcode sequence that meets the preset fluctuation condition, and based on the instruction opcode sequence, determine candidate patterns in combination with a sliding window, including: According to the correlation analysis result, filter out instruction opcodes that meet the preset fluctuation amplitude threshold from the structured data stream, and all instruction opcodes that meet the preset fluctuation amplitude threshold form an instruction opcode sequence; Perform sliding window analysis on the instruction opcode sequence, and according to the analysis result, count the occurrence frequency of opcode combinations in each window; Mark the opcode combinations with the occurrence frequency exceeding the preset frequency threshold as candidate patterns.

[0011] Optionally, the adjusting the interpretation path weight of potential malicious instructions in the binary code according to the matching result to generate a reverse analysis report includes: Based on the matching probability value, filter out potential malicious instruction combinations that exceed the preset risk threshold from the opcode combinations of the candidate patterns; Perform cross-verification on the potential malicious instruction combinations for the amplitude of the electrical signal fluctuation and the instruction opcode, and adjust the weight of the potential malicious instruction combinations according to the verification result and determine the core analysis object; Generate a reverse analysis report based on the instruction opcode sequence, the underlying electrical signal fluctuation data, and the matching malicious behavior characteristics in the core analysis object.

[0012] Optionally, the adjusting the weight of the potential malicious instruction combination according to the verification result and determining the core analysis object includes: Divide the key behavior phases according to the timing distribution characteristics of the potential malicious instruction combination; Extract the associated fluctuation amplitude intervals corresponding to each instruction opcode in the potential malicious instruction combination from the dynamic mapping relationship; When the actual fluctuation amplitude of at least one instruction opcode exceeds the corresponding associated fluctuation amplitude interval, adjust the interpretation path weight of the key behavior phase according to the amplitude ratio; Re - sort the analysis priorities of each key behavior phase according to the adjusted interpretation path weight, and use the key behavior phases with the adjusted interpretation path weight higher than the preset weight threshold as the core analysis objects.

[0013] In a second aspect, the present application provides an intelligent software reverse analysis system based on a large model, including: An acquisition module, configured to acquire multi - dimensional dynamic behavior data and underlying electrical signal fluctuation data during the execution of the binary code, where the multi - dimensional dynamic behavior data includes memory read - write data, register status change data, and system call sequences; A first generation module, configured to generate an execution trace sequence corresponding to the execution process of binary code based on the multi-dimensional dynamic behavior data and in combination with dynamic instrumentation technology; A second generation module, configured to perform preprocessing of timestamp synchronization on the underlying electrical signal fluctuation data and the execution trace sequence to generate a fused data stream; A matching module, configured to perform asymmetric matching of the fused data stream with a preset malicious behavior feature library in combination with the attention mechanism of a large model; An adjustment module, configured to adjust the interpretation path weight of potential malicious instructions in the binary code according to the matching result to generate a reverse analysis report.

[0014] In a third aspect, the present application provides a computing device, including a processor and a memory, where a computer program is stored in the memory, and the processor is configured to run the computer program to execute an intelligent software reverse analysis method according to any one of the first aspect.

[0015] In a fourth aspect, the present application provides a computer storage medium, on which computer program instructions are stored, and when the computer program instructions are executed by a processor, an intelligent software reverse analysis method according to any one of the first aspect is implemented.

[0016] In the present application, an intelligent software reverse analysis method based on a large model is provided. The method includes: during the execution process of binary code, acquiring multi-dimensional dynamic behavior data and underlying electrical signal fluctuation data, where the multi-dimensional dynamic behavior data includes memory read / write data, register state change data, and system call sequences; generating an execution trace sequence corresponding to the execution process of binary code based on the multi-dimensional dynamic behavior data and in combination with dynamic instrumentation technology; performing preprocessing of timestamp synchronization on the underlying electrical signal fluctuation data and the execution trace sequence to generate a fused data stream; performing asymmetric matching of the fused data stream with a preset malicious behavior feature library in combination with the attention mechanism of a large model; adjusting the interpretation path weight of potential malicious instructions in the binary code according to the matching result to generate a reverse analysis report.

[0017] The technical solution provided by the present application has the following beneficial effects: The present application realizes the synchronous acquisition of software instruction streams and hardware physical behaviors, providing a data basis for cross-dimensional analysis; accurately restores the binary code execution logic through dynamic instrumentation technology, and retains complete runtime context information; eliminates the time deviation between hardware signals and software behaviors, and constructs a spatio-temporally aligned joint feature representation; mines the deep association between instruction opcodes and electrical signal anomalies, and identifies hidden malicious patterns that are difficult to detect by traditional methods; dynamically focuses on high-risk code fragments and outputs an interpretable analysis result containing a hardware evidence chain.

[0018] Furthermore, after structuring the fused data stream according to the instruction execution order, this application analyzes the correlation between the instruction operation code and the amplitude of the electrical signal through a large model, screens out abnormal instruction sequences, and counts the high-frequency combinations within the sliding window as candidate patterns, and finally performs probabilistic matching with the malicious feature library.

[0019] Moreover, through cross-domain correlation analysis of instructions and signals, abnormal behavior segments are located, the ability to discover patterns is enhanced by combining sliding window statistics, and the false alarm rate is reduced by probabilistic matching, realizing accurate malicious code identification assisted by hardware.

[0020] These aspects or other aspects of this application will be more clearly understood in the following description of the embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the following briefly introduces the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of this application. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0022] Figure 1 It is a flowchart of an intelligent software reverse analysis method based on a large model provided by an embodiment of this application; Figure 2 It is a schematic structural diagram of an intelligent software reverse analysis system based on a large model provided by an embodiment of this application; Figure 3 It is a schematic structural diagram of a computing device provided by an embodiment of this application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0023] In order to enable those skilled in the art to better understand the solution of this application, the following clearly and completely describes the technical solutions in the embodiments of this application with reference to the drawings in the embodiments of this application.

[0024] In some processes described in the specification and claims of this application and the above-mentioned drawings, there are multiple operations that appear in a specific order. However, it should be clearly understood that these operations may not be executed in the order in which they appear in this document or may be executed in parallel. The operation numbers such as 101 and 102 are only used to distinguish different operations, and the numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions such as "first" and "second" in this document are used to distinguish different messages, devices, modules, etc., do not represent a sequence, and do not limit that "first" and "second" are of different types.

[0025] Researchers have found that existing software reverse analysis methods are difficult to effectively detect hidden malicious code combined with hardware-level side-channel attacks and lack the ability to deeply explore the correlation between the dynamic behavior of binary code and underlying electrical signals. Based on this, the embodiments of the present application provide an intelligent software reverse analysis method based on a large model. This method can synchronously collect software behavior data and hardware electrical signals, construct a spatio-temporal aligned fusion data stream, and use the attention mechanism of the large model to achieve asymmetric matching of cross-dimensional features, thereby accurately identifying potential malicious instructions and generating an interpretable analysis report. The technical solution of the present application is applicable to scenarios such as advanced persistent threat detection, zero-day vulnerability analysis, and hardware-assisted security auditing.

[0026] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative efforts shall fall within the protection scope of the present application.

[0027] Figure 1 The flowchart of an intelligent software reverse analysis method based on a large model provided by the embodiments of the present application is shown in Figure 1 As shown, the method includes: Step 101: During the execution of binary code, obtain multi-dimensional dynamic behavior data and underlying electrical signal fluctuation data, where the multi-dimensional dynamic behavior data includes memory read / write data, register state change data, and system call sequences.

[0028] In this step, the multi-dimensional dynamic behavior data refers to a set of behavior characteristics such as memory access records, register value change streams, and operating system call records generated during program operation. Memory read / write data refers to the access records of the memory space during the operation of the target program, including the physical address of the read / write operation, access length, operation timestamp, and read / write content, which are used to analyze the memory operation mode of the program and potential data theft behaviors. The register state change data records the historical changes of the values of hardware registers such as general-purpose registers and flag registers during program execution, including the register values before and after the change, the change instruction address, and the timestamp, reflecting the underlying execution state transition of the program. The system call sequence is a record of requests initiated by the program through the operating system interface, including the call types (such as file operations, network communications), parameter contents, and return results arranged in chronological order, which are used to identify the sensitive behavior chain of the program. The underlying electrical signal fluctuation data represents physical layer feature data such as the processor pin level change and bus signal amplitude collected through hardware probes.

[0029] In the embodiments of the present application, a dynamic monitoring tool is used to capture the memory read / write operation addresses and contents, the register value change history, and the system call types and parameters during the running of the target program. At the same time, a high-speed data acquisition card is used to record the voltage waveform data of the specified pins of the processor. The two types of data are marked with time stamps through a unified clock source and temporarily stored in a buffer.

[0030] For example, when analyzing a certain encrypted ransomware, it is recorded that it frequently calls the memory allocation function to apply for large chunks of memory (memory read / write data), continuously modifies the values of specific registers (register status data), and periodically triggers file system operations (system call sequences); at the same time, regular amplitude mutations (electrical signal fluctuation data) are collected at the power pins of the processor.

[0031] Step 102: Based on the multi-dimensional dynamic behavior data, combined with the dynamic instrumentation technology, generate an execution trace sequence corresponding to the execution process of the binary code.

[0032] In this step, the dynamic instrumentation technology refers to a technical means of inserting probe code during program running to record the execution path. The execution trace sequence refers to a linear record chain composed of instruction operation codes and their context environments arranged in chronological order.

[0033] In the embodiments of the present application, lightweight monitoring instructions are inserted into the critical code segments of the target program to record the machine instruction operation codes and the corresponding memory addresses executed in each step in real time. The discrete monitoring point data is reorganized into a continuous execution flow record in chronological order, and at the same time, the register snapshot data when each instruction is executed is retained.

[0034] For example, for the aforementioned ransomware, it is found through instrumentation that there are loop calls to the memory copy instruction in its execution flow, and the target address is passed through a specific register before each copy. These instruction operation codes and register values are serialized into a time-stamped execution trace.

[0035] Step 103: Perform preprocessing of timestamp synchronization on the underlying electrical signal fluctuation data and the execution trace sequence to generate a fused data stream.

[0036] In this step, the fused data stream refers to a unified data structure obtained by aligning the hardware signal sampling points and the software instruction execution points along the time axis.

[0037] In the embodiments of the present application, the time stamps of the peak and valley feature points of the electrical signal data are extracted and matched with the instruction time stamps in the execution trace through a sliding window. When the time difference between the detected hardware signal event and the software instruction event is less than the set tolerance, the signal amplitude is bound to the corresponding instruction to generate a fused data unit, and finally a time-aligned fused data sequence is formed.

[0038] For example, in a ransomware case, it is found that the execution moment of the memory copy instruction is always accompanied by a spike with an amplitude 1.3 times the standard value on the processor power supply pin (confirmed by comparing the instruction timestamp with the timestamp of the electrical signal mutation), and this correlation is recorded in the fusion data unit.

[0039] Step 104: Combine the attention mechanism of the large model to perform asymmetric matching between the fusion data stream and a preset malicious behavior feature library.

[0040] In this step, the large model attention mechanism refers to a technology that dynamically focuses on key feature combinations by calculating the correlation weights between the semantic features of instruction opcodes and electrical signal features. Its core is to establish a cross-domain correlation model between instructions and hardware signals, replacing the traditional fixed-rule feature matching method. The malicious behavior feature library stores a standardized feature set of known attack patterns, including typical malicious instruction sequences, corresponding electrical signal fluctuation patterns, and their hazard levels, as the comparison benchmark for asymmetric matching. The feature sources include historical attack sample analysis and expert experience induction. Asymmetric matching refers to a feature comparison method that considers different weight ratios of hardware features and software features.

[0041] In the embodiment of this application, the fusion data stream is input into a pre-trained large model. The model first performs semantic encoding on the instruction opcode and at the same time performs feature encoding on the electrical signal amplitude. It calculates the interaction weight matrix of the two types of encodings through the multi-head attention mechanism, screens out the instruction-signal combinations with weights exceeding the threshold, calculates the similarity with the patterns in the malicious feature library, and then outputs the matching probability.

[0042] For example, the model identifies a combined pattern of the loop memory copy instruction of ransomware and the power spike, and the matching degree with the known "memory filling type ransomware" feature in the feature library reaches 0.92 (the matching degree calculation formula is the weighted harmonic mean of semantic similarity and signal similarity).

[0043] Step 105: According to the matching result, adjust the interpretation path weight of the potentially malicious instructions in the binary code to generate a reverse analysis report.

[0044] In this step, potentially malicious instructions refer to instruction fragments that, after cross-dimensional matching, simultaneously meet the dual conditions of software behavior anomalies and hardware signal anomalies. Their typical features include: frequently occurring dangerous system calls, unconventional memory access patterns accompanied by electrical signal amplitude mutations, etc. The interpretation path weight represents a quantitative index reflecting the suspicious degree of each code segment during the analysis process. The reverse analysis report includes malicious instruction location markers (address / opcode), corresponding electrical signal anomaly evidence (amplitude deviation / waveform diagram), the name of the matching malicious pattern, the behavior hazard level, and the confidence score, forming a complete analysis conclusion with mutual verification of software and hardware evidence.

[0045] In the embodiments of the present application, the weight of the suspicious instruction segment is initially assigned according to the matching probability, and the weight value is dynamically adjusted in combination with the abnormal amplitude of the electrical signal in the instruction segment. Finally, an analysis report is generated by sorting in descending order of the weight value. The original machine code of the high-weight instruction segment, the corresponding electrical signal abnormal evidence, and the description of the matched malicious pattern are marked in the report. When generating the reverse analysis report, the characteristics of the new attack pattern are injected into the malicious behavior knowledge graph, and the parameters of the large model are updated through incremental learning.

[0046] For example, the memory copy instruction segment of the aforementioned ransomware is given the highest weight of 0.95 because it has both a high matching probability and an abnormal electrical signal. It is marked as "highly suspicious encryption behavior" in the report, and at the same time, the system API sequence it calls and the corresponding power fluctuation curve are listed as evidence.

[0047] This method breaks through the limitation of traditional reverse analysis that only focuses on software behavior by synchronously analyzing the dynamic execution characteristics of binary code and the underlying hardware signals. It uses a large model to establish a cross-dimensional feature correlation model, improves the recognition ability of malicious code using hardware-level concealment techniques, and the generated reverse analysis report contains double-verification information of software instruction logic and hardware abnormal evidence, providing a highly credible judgment basis for security analysts.

[0048] To solve the problem that it is difficult to effectively associate the hardware behavior characteristics and software instruction characteristics in the reverse analysis of binary code, in some embodiments, step 104: combining the attention mechanism of the large model, and performing asymmetric matching between the fused data stream and a preset malicious behavior feature library, including: Step 201: Convert the fused data stream into a structured data stream according to the instruction execution order recorded in the execution trace sequence.

[0049] In step 201, the structured data stream refers to a standardized data sequence formed by reorganizing elements such as instruction operation codes and electrical signal fluctuation amplitudes in the fused data stream according to the execution time sequence. Each record in it contains three fields: the operation code type, the corresponding electrical signal amplitude, and the time sequence mark.

[0050] In the embodiments of the present application, the instruction operation codes and their associated electrical signal amplitudes at each time point are extracted from the fused data stream, arranged in the time stamp order of the execution trace sequence, and a structured table data containing the complete time sequence relationship is generated to ensure that the subsequent analysis can maintain the context relevance of the original execution flow.

[0051] Step 202: Analyze the correlation between the instruction operation codes and the electrical signal fluctuation amplitudes in the structured data stream through the attention mechanism of the large model.

[0052] In step 202, the instruction opcode is the machine instruction encoding extracted from the execution process of the binary code, obtained by capturing the original machine code pointed to by the program counter in real time through dynamic instrumentation technology; the amplitude of the electrical signal fluctuation is the voltage change value measured by a high-speed data acquisition card on the processor power supply pin or a specific bus line. After timestamp synchronization, the two form paired records in the fused data stream. The instruction opcode sequence is a subsequence composed of instruction opcodes that meet the preset fluctuation conditions (such as the electrical signal amplitude exceeding the associated range), arranged in the original execution order. This sequence retains the context execution environment of the abnormal instruction and is used for subsequent pattern statistical analysis. Its generation process must strictly follow the timing relationship of the execution trace sequence. The correlation between the instruction opcode and the amplitude of the electrical signal fluctuation refers to the degree of quantitative association between the semantic features and physical signal features established by the large model, reflecting the possibility of hardware signal abnormalities caused during the execution of specific instructions.

[0053] In the embodiment of the present application, the large model performs a two-way scan on the structured data stream. First, it performs semantic encoding on the instruction opcode to generate a feature vector, and at the same time normalizes and encodes the amplitude of the electrical signal. Then, it calculates the attention weight matrix of the two types of feature vectors. The higher the weight value, the stronger the association between the instruction and the electrical signal abnormality.

[0054] Step 203: Based on the correlation analysis results, construct an instruction opcode sequence that meets the preset fluctuation conditions. Based on the instruction opcode sequence, determine candidate patterns in combination with a sliding window.

[0055] In step 203, the preset fluctuation conditions refer to the electrical signal abnormality determination criteria obtained by analyzing historical data, including dimensions such as the amplitude mutation amplitude and the duration. The candidate pattern refers to an instruction combination fragment that meets the fluctuation conditions and appears frequently.

[0056] In the embodiment of the present application, filter out the instruction opcodes whose attention weights exceed the threshold, splice them into a candidate sequence in the execution order, use a fixed-length window to slide and scan this sequence, count the occurrence frequencies of each instruction combination within the window, mark the combinations whose frequencies exceed the set value as candidate patterns, and record their occurrence positions.

[0057] Step 204: Asymmetrically match the candidate pattern with a preset malicious behavior feature library to generate a matching probability value between the candidate pattern and the malicious behavior pattern, and use the matching probability value as the matching result.

[0058] In step 204, the asymmetric matching refers to a feature comparison method that considers the difference in the importance of instruction semantics. The matching probability value reflects the similarity between the candidate pattern and the known malicious pattern.

[0059] In the embodiments of the present application, a weighted similarity calculation is performed between the instruction sequence feature vectors of candidate patterns and the template vectors in the malicious feature library, where the weights of key instructions (such as system calls) are higher than those of ordinary instructions, and finally a list of matching probability values for each candidate pattern is output.

[0060] The following is a specific example: In a specific embodiment of analyzing the encrypted ransomware, first, the fusion data stream containing memory copy instructions (such as movsb) and corresponding 1.3 - times power spikes is converted into a structured data stream in the chronological order of the execution trace. Each record contains the instruction opcode, the amplitude of the electrical signal, and a timestamp accurate to the microsecond level. Then, the correlation weight between each movsb instruction and the power spike is calculated through the attention mechanism of the large - model. When the amplitude exceeds 1.3 times the standard value (preset fluctuation condition), these instructions are constructed into a sequence to be analyzed in the execution order. Using a sliding window of length 5 to count this sequence, it is found that the combination of "movsb - movsb - push - call - movsb" appears 8 times in every 10 loops (the frequency threshold is set to 5 times), and it is marked as a candidate pattern. When comparing this pattern with the feature library, first calculate the instruction sequence similarity (0.89 based on the edit - distance algorithm) and the electrical signal waveform similarity (0.94 based on the dynamic time warping algorithm). Finally, the matching probability value of 0.92 is obtained from the weighted harmonic mean formula of the two (the weight ratio is 6:4).

[0061] In the embodiments of the present application, by establishing a deep correlation model between instructions and electrical signals, combining dynamic sliding window statistics and weighted feature matching, accurate identification of hardware - level covert attacks is achieved. The generated matching results include both software behavior characteristics and hardware anomaly evidence, providing a multi - dimensional judgment basis for reverse analysis.

[0062] To further improve the accuracy of the correlation analysis between instruction opcodes and electrical signal fluctuation amplitudes, in some embodiments, step 202: Analyzing the correlation between the instruction opcodes and the electrical signal fluctuation amplitudes in the structured data stream through the attention mechanism of the large - model includes: Step 301: Combine the instruction opcode of each record in the structured data stream with the corresponding electrical signal fluctuation amplitude into a multi - dimensional coding unit, and combine all multi - dimensional coding units into a multi - dimensional coding unit sequence.

[0063] In step 301, the multi-dimensional coding unit refers to a composite data structure formed by encapsulating a single instruction opcode and the amplitude of the electrical signal fluctuation at its corresponding moment, containing information in three dimensions: opcode type, amplitude size, and timestamp. The multi-dimensional coding unit sequence refers to a time-series data chain formed by arranging the instruction opcodes and their corresponding electrical signal fluctuation amplitudes collected at each moment in the order of execution time. Each unit contains three key dimensions: the machine coding of the instruction opcode, the quantized amplitude of the electrical signal fluctuation at that moment, and a timestamp marked to the microsecond level. This structure completely preserves the spatio-temporal correspondence between software instructions and hardware signals.

[0064] In the embodiment of the present application, the instruction opcode and the electrical signal amplitude of each record are extracted from the structured data stream, and each pair of opcode-amplitude data is packed into an independent unit in the order of execution time, and then all units are combined into an ordered sequence according to the time sequence, maintaining the spatio-temporal relationship of the original execution flow.

[0065] Step 302: Perform cross-coding analysis on the multi-dimensional coding unit sequence through the attention mechanism of the large model, and calculate the correlation strength value between the semantic coding of each instruction opcode and the amplitude coding of the electrical signal fluctuation amplitude.

[0066] In step 302, the correlation strength value is a quantization index calculated by the large model to reflect the matching degree between the instruction semantic features and the electrical signal features. The larger the value, the stronger the correlation between the instruction and the current electrical signal anomaly. The semantic coding is a vectorized representation obtained by the large model after feature extraction from the original machine instruction opcode. Its generation process is: first, the opcode is disassembled to obtain the mnemonic and operand type, and then it is converted into a dense vector reflecting the instruction function and semantics through a pre-trained language model. For example, a memory operation instruction will be encoded as a vector emphasizing data movement features, while an arithmetic instruction highlights numerical operation features. The amplitude coding is a digital expression after feature compression of the original electrical signal waveform. Its generation process is: the collected analog signal is first discretely sampled, and statistical features such as peak value and mean value within each clock cycle are extracted, and then a low-dimensional feature vector is obtained through autoencoder dimensionality reduction. This coding particularly preserves key waveform features such as signal mutation and periodic law, facilitating cross-modal matching with instruction semantics.

[0067] In the embodiment of the present application, the large model first extracts semantic features from the instruction opcodes in the multi-dimensional coding unit sequence, and at the same time performs feature coding on the electrical signal amplitudes, and then calculates the interaction strength of the two types of features through the attention weight matrix, and finally outputs the correlation strength score of each opcode and the corresponding amplitude.

[0068] Step 303: Based on the correlation strength value, construct a dynamic mapping relationship between the instruction opcode and the amplitude fluctuation of the electrical signal, and use the dynamic mapping relationship as the result of the correlation analysis. Each instruction opcode in the dynamic mapping relationship is associated with at least one amplitude fluctuation range.

[0069] In Step 303, the dynamic mapping relationship is a correspondence rule table between the instruction opcode and the typical electrical signal fluctuation range established based on the correlation strength value, which is used to determine whether abnormal electrical signals will be generated when a specific instruction is executed. The specific process of constructing the dynamic mapping relationship is as follows: First, perform clustering analysis on all correlation strength values of the same type of instruction opcode, use the density clustering algorithm to identify the main distribution range, and take the median of the strength values as the reference value for the correlation between the instruction and the electrical signal; then calculate the standard deviation of each strength value from the reference value, and take the range of plus or minus two standard deviations as the reasonable fluctuation range; finally, establish a triple mapping table of "instruction type - reference strength value - reasonable fluctuation range". For example, the reference strength value of the movsb instruction is set to 0.85, and the reasonable fluctuation range is 0.82 - 0.88. When the correlation strength value of the newly input instruction electrical signal exceeds this range, an abnormal alarm is triggered. This process realizes the adaptive update of the correlation relationship between the instruction and the electrical signal through dynamic statistical learning, ensuring that abnormal patterns generated by new attacks can be captured.

[0070] In the embodiment of the present application, the distribution of all correlation strength values of the same type of instruction opcode is statistically analyzed. After clustering analysis, the corresponding reasonable amplitude fluctuation range is determined, and a mapping dictionary of "instruction type - amplitude range" is established. When the newly input instruction electrical signal exceeds this range, an abnormal alarm is triggered.

[0071] The following is a specific example: In the embodiment of analyzing the encrypted ransomware, first, each record in the structured data stream that contains the movsb instruction and a 1.3 - fold power spike is combined into a multi - dimensional coding unit. The unit contains the instruction machine code, 1.3 - fold amplitude data, and an accurate timestamp, and forms a sequence of 200 units in the execution order; when analyzing through a large - model, first convert the movsb instruction into a semantic coding vector [0.7, 0.2, 0.5] that reflects the memory copy feature, and at the same time encode the 1.3 - fold amplitude as a waveform feature vector [0.8, 0.3]. Calculate the cosine similarity between the two to obtain an initial correlation strength value of 0.85; then adjust it through the attention mechanism weighting, and the final correlation strength value is 0.88 (adjustment formula: correlation strength value = initial similarity × instruction weight coefficient, where the weight coefficient of the movsb instruction is set to 1.04); after statistically analyzing the correlation strength values of all movsb instructions, construct the dynamic mapping relationship.

[0072] In the embodiments of the present application, by establishing a dynamic mapping relationship between instruction opcodes and electrical signal characteristics, accurate quantitative analysis of hardware-level abnormal behaviors is achieved, providing a quantifiable determination basis for identifying malicious codes combined with physical layer attacks, and at the same time enhancing the interpretability of reverse analysis results.

[0073] In order to further improve the accuracy of calculating the correlation strength between instruction opcodes and the amplitude fluctuations of electrical signals, in some embodiments, step 302: performing cross-encoding analysis on the multi-dimensional encoding unit sequence through the attention mechanism of the large model, and calculating the correlation strength value between the semantic encoding of each instruction opcode and the amplitude encoding of the electrical signal amplitude fluctuations, including: Step 401: Based on the multi-dimensional encoding unit sequence, splicing the semantic encoding and the amplitude encoding at the same time series position according to a preset ratio to generate an interactive encoding pair, and combining all the interactive encoding pairs into an interactive encoding pair sequence.

[0074] In step 401, the interactive encoding pair refers to a composite feature vector formed by splicing the instruction semantic encoding vector and the electrical signal amplitude encoding vector at the same moment according to a fixed dimension ratio, where the semantic encoding occupies the first 60% of the dimensions and the amplitude encoding occupies the last 40% of the dimensions. The interactive encoding pair sequence refers to an ordered set formed by arranging the composite feature vectors obtained by splicing the instruction semantic encoding and the electrical signal amplitude encoding corresponding to each execution moment in the original instruction execution order. Each interactive encoding pair contains two key parts: the front segment is the feature vector extracted from the instruction opcode through the semantic understanding model (reflecting the instruction function semantics), and the rear segment is the amplitude encoding vector obtained by compressing the electrical signal waveform at the corresponding moment (characterizing the hardware behavior characteristics). After being spliced according to the preset ratio, both retain their respective modal characteristics and establish cross-domain associations. The entire sequence strictly follows the actual execution time series of the binary code, ensuring that subsequent analysis can accurately reflect the instruction-signal spatio-temporal association characteristics during program operation.

[0075] In the embodiments of the present application, the semantic encoding and the amplitude encoding at each time point are extracted from the multi-dimensional encoding unit sequence, spliced head-to-tail according to a dimension ratio of 6:4 to generate an interactive encoding pair containing complete cross-modal features, and then all the interactive encoding pairs are combined into a new sequence structure according to the original execution time series.

[0076] Step 402: Perform bidirectional context scanning on the interactive encoding pair sequence through the attention mechanism of the large model to determine the dynamic interaction weight between each semantic encoding and the corresponding amplitude encoding within the current time series window.

[0077] In step 402, the timing position represents the absolute execution order position of a single multi-dimensional coding unit in the overall sequence, reflecting the linear execution flow order of binary code instructions. Example: the position where the amplitude encoding corresponding to the Nth instruction opcode is located. The timing window represents a dynamic range interval centered on the current timing position, used to define the context range window for relevance analysis. The size of the window is adjusted by the "instruction opcode type distribution" (e.g., the window is enlarged for function call instructions). The dynamic interaction weight is a coefficient matrix calculated through the attention mechanism, reflecting the degree of association between semantic encoding and amplitude encoding. Each element in the matrix represents the interaction intensity between a specific instruction feature dimension and an electrical signal feature dimension.

[0078] In the embodiment of the present application, the large model performs forward and backward two-way scans on the interaction coding pair sequence. First, it calculates the dot product similarity between each semantic coding dimension and the amplitude coding dimensions within multiple front and rear timing windows, and then obtains the weight matrix through normalization, retaining the interaction relationships with weights exceeding the average value.

[0079] Step 403: Based on the dynamic interaction weight, calculate the feature similarity metric value between each semantic coding and the corresponding amplitude coding, and convert the feature similarity metric value into an association strength value.

[0080] In step 403, the feature similarity metric value is the cross-modal feature matching degree weighted by the dynamic weight, and its conversion process includes non-linear activation and normalization processing. The specific process of converting the association strength value: The specific process of converting the feature similarity metric value into an association strength value is: Based on a preset linear mapping rule, project the original range of the feature similarity metric value to the interval [0,1], where the projection formula is: Association strength value = (Feature similarity metric value - Minimum similarity threshold) / (Maximum similarity threshold - Minimum similarity threshold). The minimum / maximum similarity threshold is determined by statistically analyzing the similarity distribution of all instruction opcodes and electrical signal amplitudes in the training dataset. When the feature similarity metric value exceeds the maximum threshold, the association strength value is taken as 1, and when it is lower than the minimum threshold, it is taken as 0. Exemplarily, taking the detection of stack overflow attacks as an example: The feature similarity metric value of analyzing the semantic coding of a certain strcpy instruction and the corresponding amplitude coding of the electrical signal is 0.85 (Calculation process: Calculate the similarity between the semantic coding vector [0.2, 0.6] and the amplitude coding vector [0.3, 0.5] through cosine similarity, obtaining a value of 0.936, and scaling it to 0.85 through normalization). Given that the minimum similarity threshold in the dataset is 0.2 and the maximum threshold is 0.9, then the association strength value = (0.85 - 0.2) / (0.9 - 0.2) = 0.93, indicating a high association between this instruction and the electrical signal anomaly.

[0081] In the embodiments of the present application, dynamic interaction weights are used to perform weighted fusion on semantic encoding and amplitude encoding, and the inner product of the weighted vectors is calculated as the initial similarity, which is linearly mapped to the standard correlation strength interval after being activated by the sigmoid (Sigmoid Function) function.

[0082] The following is a specific example: In the embodiment of analyzing the encrypted ransomware, first, the semantic encoding vector [0.7, 0.2, 0.5] of the movsb instruction is concatenated with the amplitude encoding vector [0.8, 0.3] of 1.3 times the power spike according to the 6:4 dimension ratio to generate an interaction encoding pair in the form of [0.7, 0.2, 0.5, 0.8, 0.3], and the interaction encoding pairs of all 200 time series points are formed into a sequence according to the execution order; when scanning bidirectionally through the large model, calculate the attention weights of the semantic encoding of the current movsb instruction and the amplitude encoding within the front and back 5 time series windows respectively, and the interaction weight with the abnormal amplitude [0.8, 0.3] reaches 0.92 (the weight calculation formula is the dot product of the semantic encoding and the amplitude encoding after normalization); based on this weight, perform weighted calculation on the feature similarity. First, perform weighted fusion on the semantic encoding [0.7, 0.2, 0.5] and the amplitude encoding [0.8, 0.3] according to the weight of 0.92, then calculate the modulus of the fused vector to obtain the similarity metric value of 0.89, and finally convert it to the standard correlation strength value of 0.87 through the sigmoid function.

[0083] In the embodiments of the present application, through the cross-modal feature fusion and dynamic weight calculation of the interaction encoding pairs, the accurate quantification of the deep association relationship between instructions and electrical signals is realized, providing a reliable technical means for detecting covert attacks that utilize processor microarchitecture defects.

[0084] To further improve the recognition accuracy of abnormal instruction patterns, in some embodiments, step 203: Based on the correlation analysis result, construct an instruction opcode sequence that meets the preset fluctuation condition, and based on the instruction opcode sequence, combine a sliding window to determine candidate patterns, including: Step 501: According to the correlation analysis result, screen out the instruction opcodes that meet the preset fluctuation amplitude threshold from the structured data stream, and all the instruction opcodes that meet the preset fluctuation amplitude threshold constitute the instruction opcode sequence.

[0085] In step 501, the preset fluctuation amplitude threshold refers to the abnormal determination standard of electrical signals set according to historical data analysis. When the fluctuation amplitude of the electrical signal corresponding to an instruction exceeds this standard, it is considered that the instruction has a suspicion of abnormal behavior.

[0086] In the embodiments of the present application, each instruction opcode and its associated electrical signal amplitude are extracted from the structured data stream, the amplitude is compared with the reasonable fluctuation range of this instruction type in the dynamic mapping relationship, the abnormal instructions with amplitudes exceeding the upper limit of the range are screened out, and a sequence to be analyzed is formed according to the original execution order.

[0087] Step 502: Perform a sliding window analysis on the instruction opcode sequence. According to the analysis results, count the occurrence frequencies of opcode combinations within each window.

[0088] In step 502, the sliding window analysis means that an analysis window with a fixed length slides along the instruction sequence in order, and when the window stops each time, the complete instruction combination form within the window is extracted for statistics. The opcode combination refers to the complete sequence composed of consecutive instruction opcodes currently covered by the sliding window. For example, when the window length is 5, the 5 consecutive instruction opcodes within each window (such as "mov-call-push-jmp-ret") are regarded as an independent combination. When counting, it is required that the opcode types and arrangement orders are exactly the same to be counted as the same combination. The occurrence frequency refers to the proportion of the number of times a specific instruction opcode combination is detected in all sliding windows during the sliding window analysis process, reflecting the degree of repeated occurrence of this combination during the program execution process. The specific calculation method is: count the number of occurrences of the target instruction combination in all valid sliding windows, and divide by the total number of sliding windows to obtain the ratio. For example, when the window length is 5 instructions, if a combination is detected 15 times in 100 window slides, its occurrence frequency is 0.15, and this value is used to judge whether the instruction combination has characteristics in terms of behavior patterns.

[0089] In the embodiments of the present application, the window length is set to 5 adjacent instructions, which slide one by one along the instruction opcode sequence. Each time, the opcode types and arrangement orders of 5 instructions within the window are taken as independent combinations, and the occurrence times of each combination in all windows are recorded.

[0090] Step 503: Mark the opcode combinations with occurrence frequencies exceeding the preset frequency threshold as candidate patterns.

[0091] In step 503, the preset frequency threshold is the minimum abnormal repetition times set according to the baseline of normal program behavior, and is used to filter out accidental instruction combinations.

[0092] In the embodiments of the present application, count the occurrence frequencies of instruction combinations within all sliding windows, mark the combinations with occurrence times exceeding the set threshold as candidate patterns, and at the same time record the occurrence positions of these patterns in the sequence and the corresponding electrical signal abnormal characteristics.

[0093] The following is a specific example: In the embodiment of analyzing the encrypted ransomware, first, 120 movsb instructions with the amplitude of all electrical signals exceeding 1.3 times the standard value are screened out from the structured data stream and form a sequence to be analyzed according to the execution order. A sliding window with a window length of 5 is used to scan this sequence, and a total of 116 valid windows are generated. It is statistically found that the specific combination of "movsb-movsb-push-call-movsb" appears in 58 windows (frequency = 58 / 116 = 0.5), far exceeding the preset frequency threshold of 0.3. The frequency threshold of 0.3 is set by rounding up after analyzing that the maximum occurrence frequency of this combination in 100 normal samples is 0.28. And the current frequency value of 0.5 indicates the abnormality of this combination. Combining the abnormality of the electrical signal amplitude corresponding to it, finally, this mode is marked as a highly suspicious candidate encrypted behavior mode.

[0094] In the embodiment of the present application, by combining the electrical signal anomaly threshold and the sliding window statistical method, malicious instruction patterns with repetitive characteristics are effectively identified, enhancing the detection ability against advanced persistent threat attacks and providing a reliable evidence chain of behavior patterns for reverse analysis.

[0095] In order to further improve the accuracy and credibility of the reverse analysis report, in some embodiments, step 105: adjusting the interpretation path weight of potential malicious instructions in the binary code according to the matching result to generate a reverse analysis report, including: Step 601: Based on the matching probability value, screen out potential malicious instruction combinations that exceed the preset risk threshold from the opcode combinations of the candidate patterns.

[0096] In step 601, the preset risk threshold is the lowest determination standard set according to the harm degree of different malicious behavior types, and is used to distinguish general suspicious behaviors and highly suspicious malicious behaviors. A potential malicious instruction combination refers to an instruction sequence that simultaneously meets the following conditions after being screened by the matching probability: composed of multiple consecutive or intermittently appearing suspicious opcodes; the overall matching probability exceeds the preset risk threshold; and it shows repetitive or regular characteristics in the program execution flow. This combination reflects possible fragments of malicious behavior patterns, such as typical attack characteristics like encryption loops and code injection.

[0097] In the embodiment of the present application, the matching probability values are extracted from all candidate patterns, compared with the preset hierarchical risk threshold, and instruction combinations that exceed the critical value are screened out. At the same time, the types and probability values of the malicious behaviors they match are recorded as input data for subsequent in-depth analysis.

[0098] Step 602: Perform cross-verification on the amplitude of the electrical signal fluctuation and the instruction opcode of the potential malicious instruction combination, and adjust the weight of the potential malicious instruction combination according to the verification result and determine the core analysis object.

[0099] In step 602, cross-validation refers to verifying the credibility of candidate patterns by comparing the dynamic mapping relationship of instruction opcodes with the actual electrical signal fluctuation characteristics. The weight is a numerical indicator that quantifies the possibility of maliciousness of instruction combinations. The generation process is as follows: the initial weight comes from the matching probability value, and is adjusted according to the following rules after cross-validation: the weight increases by 10% of the base value for each operation code whose electrical signal exceeds the dynamic mapping interval; when multiple consecutive operation codes are abnormal at the same time, the weight increases exponentially according to the number of abnormalities; when the key system call instruction is abnormal, the weight is increased by an additional 20%. The final weight value comprehensively reflects the abnormality of software behavior and the sufficiency of hardware evidence. The core analysis object is the highest risk instruction combination set determined after cross-validation, which includes the following elements: potential malicious instruction combinations that rank high after weight adjustment; corresponding abnormal electrical signal fluctuation evidence; matching known malicious behavior feature descriptions. These objects are the main basis for generating reverse analysis reports and represent the most likely real attack behaviors.

[0100] In an embodiment of the present application, for the screened high-probability instruction combination, the electrical signal fluctuation data corresponding to each operation code contained therein is extracted to check whether all the abnormal conditions defined in the dynamic mapping relationship are met, and the final weight value of the instruction combination is dynamically adjusted according to the number and severity of the abnormal conditions met.

[0101] Step 603: Generate a reverse analysis report based on the instruction operation code sequence, the underlying electrical signal fluctuation data and the matching malicious behavior characteristics in the core analysis object.

[0102] In an embodiment of the present application, the first several instruction combinations with the highest weight values ​​are taken as core analysis objects, and their complete instruction sequences, corresponding electrical signal waveforms, malicious behavior feature descriptions matching the objects, and verification basis during the weight adjustment process are extracted, and an analysis report containing text descriptions and visual evidence is generated according to a standard template.

[0103] Here is a specific example: In the embodiment of analyzing the encrypted ransomware, first, the instruction combination of "movsb - movsb - push - call - movsb" with a matching probability of 0.92 is screened out from the candidate patterns as a potential malicious instruction combination (the preset risk threshold is 0.85); when cross - validating this combination, it is found that the amplitude of the electrical signals corresponding to the 3 movsb instructions all exceed 1.3 times the upper limit of the dynamic mapping interval (the standard interval is 1.1 - 1.2 times). According to the rule of increasing the weight by 0.05 for each abnormal instruction, the initial weight of 0.92 is adjusted to 1.07 (0.92 + 3×0.05); finally, this combination is determined as the core analysis object, and the memory address distribution of this instruction sequence, the 1.3 - times power spike waveform diagram, and the comparison result with the features of "memory - filling ransomware" in the feature library are detailedly marked in the reverse - analysis report, forming a complete encrypted - behavior determination evidence chain. The calculation process of the weight value of 1.07 is: the basic matching probability of 0.92 plus the weight increment of 0.05 for each abnormal movsb instruction (a total of 3), and the final value directly reflects the confidence level of this malicious behavior.

[0104] In the embodiment of the present application, through a multi - level verification and weight - adjustment mechanism, it is ensured that the analysis result has the dual support of both software - behavior logic and hardware - physical evidence, greatly improving the detection accuracy of advanced malicious code and the credibility of the analysis result.

[0105] To further improve the accuracy and interpretability of malicious - behavior analysis, in some embodiments, step 602: adjusting the weight of the potential malicious instruction combination according to the verification result and determining the core analysis object includes: Step 701: Divide the key - behavior stages according to the timing - distribution characteristics of the potential malicious instruction combination.

[0106] In step 701, the key - behavior stage refers to a continuous instruction interval divided according to the density of the potential malicious instruction combination in the execution - trajectory sequence. The number of stages is dynamically determined by the spatio - temporal distribution of the instruction combination (no fixed number). Each stage must contain at least one potential malicious instruction combination and its associated context instructions before and after (usually covering a range of 50 - 200 instructions). The criterion for criticality is that the stage contains more than 30% of high - risk instruction opcodes (based on the matching - probability value of right 6).

[0107] In the embodiment of the present application, analyze the time intervals and functional correlations of the instructions in the potential malicious instruction combination, and merge the instructions with time intervals less than the set value and related functions into the same stage to ensure that each stage contains a complete attack sub - process.

[0108] Step 702: Extract the associated fluctuation amplitude intervals corresponding to the instruction operation codes in the potential malicious instruction combination from the dynamic mapping relationship.

[0109] In step 702, the associated fluctuation amplitude interval is extracted from the dynamic mapping relationship and reflects the range of electrical signal fluctuations that should occur during the normal execution of a specific instruction operation code.

[0110] In the embodiment of the present application, query the dynamic mapping relationship dictionary according to the instruction operation code type to obtain the standard amplitude fluctuation upper and lower limits corresponding to the instruction, which are used as the reference values for anomaly determination.

[0111] Step 703: When the actual fluctuation amplitude of at least one instruction operation code exceeds the corresponding associated fluctuation amplitude interval, adjust the interpretation path weight of the key behavior stage according to the amplitude ratio.

[0112] In step 703, the amplitude ratio adjustment refers to a dynamic adjustment mechanism in which the weight change amount is proportional to the abnormal amplitude of the electrical signal. The amplitude ratio means that the weight adjustment ratio has a linear relationship with the percentage by which the actual electrical signal fluctuation amplitude exceeds the associated interval. Specifically: weight adjustment coefficient = 1 + (actual amplitude - upper limit of the interval) / upper limit of the interval × sensitivity factor (default 1.5). For example, when the actual amplitude exceeds the upper limit of the interval by 20%, the weight is increased by 30% (20% × 1.5). This proportional relationship is pre-calibrated by statistically analyzing the correlation between the abnormal amplitude of the electrical signal and the harm level in historical malicious code samples. The interpretation path weight is a numerical index that quantifies the suspiciousness of the key behavior stage. Its generation process is as follows: the initial weight comes from the matching probability value. After being verified by the abnormal electrical signal, it is dynamically adjusted according to the formula "basic weight + ∑(abnormal amplitude × adjustment coefficient)". Among them, the abnormal amplitude is the percentage by which the actual electrical signal amplitude exceeds the upper limit of the dynamic mapping interval, and the adjustment coefficient is preset according to the instruction type. For example, the memory operation instruction is set to 0.01, and the system call instruction is set to 0.015. The final weight value comprehensively reflects the software behavior anomaly degree and the hardware evidence sufficiency.

[0113] In the embodiment of the present application, calculate the percentage by which the actual electrical signal amplitude exceeds the associated interval, multiply this percentage by the basic adjustment coefficient to obtain the weight increment, and linearly superimpose it on the initial weight of the key behavior stage.

[0114] Step 704: Re-sort the analysis priorities of each key behavior stage according to the adjusted interpretation path weight, and use the key behavior stages with the adjusted interpretation path weight higher than the preset weight threshold as the core analysis objects.

[0115] In step 704, the analysis priority is the processing order of key behavior stages sorted according to the interpretation path weight. The stage with a higher weight represents a greater possibility of containing real malicious behavior and will be preferentially displayed in the reverse analysis report with a more detailed evidence chain. The priority setting follows the dual criteria of "descending weight + harm degree of attack type" to ensure that high-threat behaviors are analyzed with emphasis. The preset weight threshold is the minimum analysis standard set according to the harmfulness of different attack types.

[0116] In the embodiment of the present application, all key behavior stages are arranged in descending order of the adjusted weight, and the stages with weights exceeding the type-related threshold are screened out to ensure that the core analysis object has sufficient evidence of behavioral anomalies and a basis for malicious feature matching.

[0117] The following is a specific example: In the embodiment of analyzing the encrypted ransomware, first, the code segment containing the loop movsb instruction is divided into the key encryption stage; the standard electrical signal amplitude range of the movsb instruction is queried from the dynamic mapping relationship as 1.1 - 1.2 times the reference value, while the actually detected abnormal amplitude is 1.3 times (exceeding the upper limit by 8.3%); according to the adjustment rule of increasing the weight by 0.006 for every 1% increase (calculation formula: weight increment = percentage exceeding × 0.006), the weight of this stage is increased from the initial matching probability of 0.92 to 0.97 (0.92 + 8.3 × 0.006); after screening with the preset weight threshold of 0.95, this encryption stage is determined as the core analysis object.

[0118] In the embodiment of the present application, through the combination of spatio-temporal feature division and dynamic weight adjustment, the refined analysis and credibility quantification of complex attack behaviors are realized, making the reverse analysis result have both the integrity of behavioral logic and the support of physical evidence.

[0119] Figure 2 The structural schematic diagram of an intelligent software reverse analysis system based on a large model provided by the embodiment of the present application is as Figure 2 shown, and the system includes: An acquisition module 21, configured to acquire multi-dimensional dynamic behavior data and underlying electrical signal fluctuation data during the execution of the binary code, where the multi-dimensional dynamic behavior data includes memory read and write data, register state change data, and system call sequences.

[0120] A first generation module 22, configured to generate an execution trace sequence corresponding to the execution process of the binary code based on the multi-dimensional dynamic behavior data in combination with the dynamic instrumentation technology.

[0121] A second generation module 23, configured to perform preprocessing of timestamp synchronization on the underlying electrical signal fluctuation data and the execution trace sequence to generate a fused data stream.

[0122] A matching module 24, configured to combine with the attention mechanism of the large model to perform asymmetric matching between the fused data stream and a preset malicious behavior feature library.

[0123] An adjustment module 25, configured to adjust the interpretation path weight of potential malicious instructions in the binary code according to the matching result to generate a reverse analysis report.

[0124] Figure 2 The described intelligent software reverse analysis system based on a large model can execute Figure 1 The described intelligent software reverse analysis method based on a large model in the illustrated embodiment, and its implementation principle and technical effects will not be elaborated further. For the intelligent software reverse analysis system based on a large model in the above embodiment, the specific manners in which each module and unit perform operations have been described in detail in the embodiments related to the method, and will not be elaborated here.

[0125] In a possible design, Figure 2 The intelligent software reverse analysis system based on a large model in the illustrated embodiment can be implemented as a computing device, such as Figure 3 as shown, the computing device may include a storage component 31 and a processing component 32; The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32.

[0126] The processing component 32 is the above Figure 1 The intelligent software reverse analysis method based on a large model in the illustrated embodiment.

[0127] Among them, the processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component may also be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components for executing the above method.

[0128] The storage component 31 is configured to store various types of data to support the operation of the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random-access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk, or optical disk.

[0129] Of course, the computing device may necessarily further include other components, such as an input / output interface, a display component, a communication component, and the like.

[0130] The input / output interface provides an interface between the processing component and the peripheral interface module, and the peripheral interface module may be an output device, an input device, and the like.

[0131] The communication component is configured to facilitate communication between the computing device and other devices in a wired or wireless manner, etc.

[0132] Among them, the computing device may be a physical device or an elastic computing host provided by a cloud computing platform, etc. At this time, the computing device may refer to a cloud server, and the above-mentioned processing component, storage component, etc. may be basic server resources leased or purchased from a cloud computing platform.

[0133] The embodiment of the present application also provides a computer storage medium storing a computer program, and when the computer program is executed by a computer, it can implement the above Figure 1 intelligent software reverse analysis method based on a large model shown in the embodiment.

[0134] Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the above-described systems, devices, and units can refer to the corresponding processes in the foregoing method embodiments and will not be described herein again.

[0135] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art can understand and implement it without creative efforts.

[0136] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the essence of the above technical solution, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0137] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, and are not intended to limit them. Although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features. And these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An intelligent software reverse analysis method based on a large model, characterized in that: include: During the binary code execution process, multi-dimensional dynamic behavior data and underlying electrical signal fluctuation data are obtained, wherein the multi-dimensional dynamic behavior data includes memory read and write data, register state change data, and system call sequence; Based on the multi-dimensional dynamic behavior data and in combination with dynamic instrumentation technology, an execution trajectory sequence corresponding to the binary code execution process is generated; Preprocessing the underlying electrical signal fluctuation data and the execution trajectory sequence for timestamp synchronization to generate a fused data stream; Combined with the attention mechanism of the large model, the fused data stream is asymmetrically matched with the preset malicious behavior feature library; According to the matching results, the interpretation path weights of potential malicious instructions in the binary code are adjusted to generate a reverse analysis report.

2. The method according to claim 1, characterized in that The attention mechanism combined with the large model performs asymmetric matching of the fused data stream with the preset malicious behavior feature library, including: Converting the fused data stream into a structured data stream according to the instruction execution order recorded in the execution trace sequence; Analyze the correlation between the instruction operation code and the fluctuation amplitude of the electrical signal in the structured data stream through the attention mechanism of the large model; Based on the correlation analysis result, construct an instruction operation code sequence that meets the preset fluctuation condition, and determine a candidate mode based on the instruction operation code sequence in combination with a sliding window; The candidate pattern is asymmetrically matched with a preset malicious behavior feature library to generate a matching probability value between the candidate pattern and the malicious behavior pattern, and the matching probability value is used as a matching result.

3. The method according to claim 2, characterized in that The analyzing the correlation between the instruction operation code and the fluctuation amplitude of the electrical signal in the structured data stream by using the attention mechanism of the large model includes: Combining the instruction operation code of each record in the structured data stream with the corresponding electrical signal fluctuation amplitude into a multidimensional coding unit, and combining all the multidimensional coding units into a multidimensional coding unit sequence; Perform cross-coding analysis on the multidimensional coding unit sequence through the attention mechanism of the large model, and calculate the correlation strength value between the semantic coding of each instruction operation code and the amplitude coding of the electrical signal fluctuation amplitude; According to the association strength value, a dynamic mapping relationship between the instruction operation code and the electrical signal fluctuation amplitude is constructed, and the dynamic mapping relationship is used as a correlation analysis result, in which each instruction operation code is associated with at least one fluctuation amplitude interval.

4. The method according to claim 3, characterized in that The cross-coding analysis of the multidimensional coding unit sequence is performed by the attention mechanism of the large model to calculate the correlation strength value between the semantic coding of each instruction operation code and the amplitude coding of the electrical signal fluctuation amplitude, including: Based on the multidimensional coding unit sequence, the semantic codes and amplitude codes at the same temporal position are spliced ​​according to a preset ratio to generate interactive coding pairs, and all interactive coding pairs are combined into an interactive coding pair sequence; Performing a bidirectional context scan on the interaction encoding sequence through the attention mechanism of the large model to determine the dynamic interaction weight between each semantic encoding and the corresponding amplitude encoding in the current time window; Based on the dynamic interaction weight, a feature similarity metric value between each semantic code and the corresponding amplitude code is calculated, and the feature similarity metric value is converted into an association strength value.

5. The method according to claim 2, characterized in that: The step of constructing an instruction operation code sequence that meets a preset fluctuation condition based on the correlation analysis result, and determining a candidate mode based on the instruction operation code sequence and in combination with a sliding window includes: According to the correlation analysis result, the instruction operation codes satisfying the preset fluctuation amplitude threshold are screened out from the structured data stream, and all the instruction operation codes satisfying the preset fluctuation amplitude threshold constitute an instruction operation code sequence; Performing a sliding window analysis on the instruction opcode sequence, and counting the occurrence frequency of opcode combinations in each window according to the analysis result; The operation code combination whose occurrence frequency exceeds a preset frequency threshold is marked as a candidate pattern.

6. The method according to claim 3, characterized in that According to the matching results, the interpretation path weight of the potential malicious instructions in the binary code is adjusted to generate a reverse analysis report, including: Based on the matching probability value, screening out potential malicious instruction combinations exceeding a preset risk threshold from the operation code combinations of the candidate patterns; Cross-validating the electrical signal fluctuation amplitude and the instruction operation code of the potential malicious instruction combination, adjusting the weight of the potential malicious instruction combination according to the validation result and determining the core analysis object; A reverse analysis report is generated based on the instruction operation code sequence, the underlying electrical signal fluctuation data and the matching malicious behavior characteristics in the core analysis object.

7. The method according to claim 6, characterized in that The step of adjusting the weight of the potential malicious instruction combination according to the verification result and determining the core analysis object includes: Dividing key behavior stages according to the temporal distribution characteristics of the potential malicious instruction combination; Extracting, from the dynamic mapping relationship, an associated fluctuation amplitude interval corresponding to each instruction operation code in the potential malicious instruction combination; When the actual fluctuation amplitude of at least one instruction operation code exceeds the corresponding associated fluctuation amplitude range, the interpretation path weight of the key behavior stage is adjusted proportionally according to the amplitude; According to the adjusted explanatory path weights, the analysis priority of each key behavioral stage is re-ranked, and the key behavioral stages whose adjusted explanatory path weights are higher than the preset weight threshold are taken as the core analysis objects.

8. An intelligent software reverse analysis system based on a large model, characterized in that: include: An acquisition module, used to acquire multi-dimensional dynamic behavior data and underlying electrical signal fluctuation data during the binary code execution process, wherein the multi-dimensional dynamic behavior data includes memory read and write data, register state change data, and system call sequence; A first generating module, configured to generate an execution trace sequence corresponding to the binary code execution process based on the multi-dimensional dynamic behavior data and in combination with a dynamic plugging technology; A second generating module is used to pre-process the underlying electrical signal fluctuation data and the execution trajectory sequence for timestamp synchronization to generate a fused data stream; A matching module, used to combine the attention mechanism of the large model to asymmetrically match the fused data stream with a preset malicious behavior feature library; The adjustment module is used to adjust the interpretation path weight of the potential malicious instructions in the binary code according to the matching result to generate a reverse analysis report.

9. A computing device, characterized in that It comprises a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement an intelligent software reverse analysis method based on a large model as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that: A computer program is stored, and when the computer program is executed by a computer, an intelligent software reverse analysis method based on a large model as described in any one of claims 1 to 7 is implemented.

Images