A multi-level feature fusion binary code similarity detection method and system

Abstract

The present application belongs to the technical field of computer security, and particularly relates to a multi-level feature fusion binary code similarity detection method and system, comprising: obtaining two binary files to be detected, respectively disassembling the two binary files to be detected to obtain code representations of the two binary files, inputting the code representations of the two binary files into a trained binary code similarity detection model after preprocessing to obtain a similarity score; the binary code similarity detection model comprises: a CFG branch, a pseudo code branch, a structure feature extraction module and a feature fusion module; the present application extracts features of assembly instructions and pseudo codes through the CFG and pseudo code branches respectively to capture low-level and high-level information, calculates the similarity between assembly instructions and the similarity between pseudo codes according to the features, and fuses information at different levels by fusing the similarity between assembly instructions and the similarity between pseudo codes, thereby improving the robustness and detection accuracy of binary code similarity detection.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of computer security, and particularly relates to a multi-level feature fusion binary code similarity detection method and system. BACKGROUND

[0002] Binary code similarity detection refers to analyzing and comparing the similarities between different binary files to help identify potential code duplication, malicious tampering or unauthorized modifications. As software development speeds up, developers often prioritize implementing core functions of products and pushing them to market as soon as possible, while paying relatively less attention to software security.

[0003] Traditional binary code similarity detection methods mainly rely on manual features, such as using opcode sequences in assembly instructions to analyze the low-level structure of code, or analyzing control flow relationships between function call graphs (CG) and basic blocks to determine homologous functions. Learning-based methods automatically extract code features by learning higher-level representations, especially when dealing with complex code representations. For example, some methods use graph neural networks (GNN) to model the graph structure of code control flow graphs (CFG) and high-level control flow graphs (ACFG), such as Geinus, Gemini and Vulseeker methods.

[0004] Although learning-based BCSD methods have better performance than traditional methods, they still have the following problems in cross-architecture and cross-compiler scenarios:

[0005] (1) Most existing technologies rely on a single representation of binary code and lack comprehensive analysis of different levels of code features. Assembly instructions mainly reflect the bottom-level structural features of code, while pseudocode is more biased towards high-level abstract semantics, so how to effectively fuse multi-level features is a problem worth further studying.

[0006] (2) Although deep learning networks can automatically extract high-level semantic features of code, the learned deep features may not fully capture the global structural features of code in some cases. SUMMARY

[0007] To solve the above prior art, on the one hand, the application adopts a multi-level feature fusion binary code similarity detection method, which comprises: obtaining two binary files to be detected, respectively disassembling the two binary files to be detected to obtain the code representation of the two binary files, inputting the preprocessed code representation of the two binary files into the trained binary code similarity detection model to obtain a similarity score; the binary code similarity detection model comprises: a CFG branch, a pseudocode branch, a structure feature extraction module and a feature fusion module; the training process of the binary code similarity detection model comprises:

[0008] S1: obtaining two binary files, respectively disassembling the two binary files to obtain the code representation of the two binary files; wherein the code representation comprises a control flow graph CFG n and a pseudocode, the nodes of the control flow graph represent basic blocks, and the edges represent the relationship between the basic blocks, and each basic block contains multiple assembly instructions;

[0009] S2: preprocessing the control flow graph CFG n of the two binary files respectively to obtain the preprocessed control flow graph CFG″ n of the two binary files; wherein n is the index of the binary file;

[0010] S3: inputting the preprocessed control flow graph CFG″ n of the two binary files into the CFG branch to obtain the similarity X between the assembly instructions of the two binary files;

[0011] S4: inputting the pseudocode of the two binary files into the pseudocode branch to obtain the similarity Y between the pseudocodes of the two binary files;

[0012] S5: inputting the preprocessed control flow graph CFG″ n and the pseudocode representation of the two binary files into the structure feature extraction module to obtain the structure features F n , F P,n of the control flow graph CFG″ CFG,n and the pseudocode representation of the two binary files;

[0013] S6: inputting the structure features F CFG,n and F P,n , and the similarities X and Y of the control flow graph CFG″ n and the pseudocode representation of the two binary files into the feature fusion module to obtain the final similarity score;

[0014] S7: calculating the loss function value according to the final similarity score, updating the model parameters according to the loss function value, and obtaining the trained binary code similarity detection model when the loss function value is the minimum.

[0015] In another aspect, the application adopts a multi-level feature fusion binary code similarity detection system, which is used to perform the multi-level feature fusion binary code similarity detection method described above, comprising:

[0016] A data input module is configured to obtain two binary files to be detected, and perform disassembly on the two binary files to be detected by using a disassembly tool to obtain code representation of each binary file; the code representation comprises a control flow graph and a pseudo code, a node of the control flow graph represents a basic block, and an edge represents a relationship between the basic blocks, and each basic block contains multiple assembly instructions;

[0017] A data preprocessing module is configured to preprocess the code representation of the two binary files to obtain a preprocessed control flow graph CFG" n ;

[0018] An assembly similarity calculation module is configured to calculate the similarity X between the assembly instructions of the two binary files according to the preprocessed control flow graph CFG" n .

[0019] A pseudo code similarity calculation module is configured to calculate the similarity Y between the pseudo codes of the two binary files.

[0020] A structural feature extraction module is configured to extract the structural features of the preprocessed control flow graph and the pseudo code of the two binary files.

[0021] A feature fusion module is configured to calculate the final similarity according to the structural features of the control flow graph and the pseudo code and the similarities X and Y.

[0022] Advantages:

[0023] 1. The application captures the bottom layer information and the high layer information by extracting the features of the assembly instructions and the pseudo code, calculates the similarity X between the assembly instructions and the similarity Y between the pseudo codes according to the features of the assembly instructions and the pseudo code, and fully fuses the information of different levels by deeply fusing the similarity X between the assembly instructions and the similarity Y between the pseudo codes, thereby improving the robustness and detection accuracy of the binary code similarity detection. 2. The application further integrates the structural features on the basis of the similarities obtained by the CFG branch and the pseudo code branch, fully captures the global structural features of the code, and thereby improves the detection accuracy. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 A flowchart of a multi-level feature fusion binary code similarity detection method provided for an embodiment of the application;

[0025] Figure 2 A preprocessing flowchart provided for an embodiment of the application;

[0026] Figure 3 This is a structural diagram of the binary code similarity detection system provided in an embodiment of the present invention;

[0027] Figure 4 This is a schematic diagram of the data input module of the binary code similarity detection system according to an embodiment of the present invention;

[0028] Figure 5 This is a schematic diagram of the data preprocessing module of the binary code similarity detection system according to an embodiment of the present invention;

[0029] Figure 6 This is a schematic diagram of the assembly similarity calculation module of the binary code similarity detection system according to an embodiment of the present invention;

[0030] Figure 7 This is a schematic diagram of the pseudocode similarity calculation module of the binary code similarity detection system according to an embodiment of the present invention;

[0031] Figure 8 This is a schematic diagram of the structural feature extraction module of the binary code similarity detection system according to an embodiment of the present invention;

[0032] Figure 9 This is a schematic diagram of the feature fusion module of the binary code similarity detection system according to an embodiment of the present invention. Detailed Implementation

[0033] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0034] On the one hand, this invention employs a multi-level feature fusion binary code similarity detection method, such as... Figure 1 As shown, the process includes: acquiring two binary files to be detected; disassembling the two binary files separately using a disassembler to obtain the code representation of each binary file; preprocessing the code representations of the two binary files and inputting them into a trained binary code similarity detection model to obtain a similarity score; the binary code similarity detection model includes: a CFG branch, a pseudocode branch, a structural feature extraction module, and a feature fusion module; the training process of the binary code similarity detection model includes:

[0035] S1: Obtain two binary files, disassemble each binary file to obtain the code representation of the two binary files; the code representation includes the control flow graph (CFG). nAnd pseudocode, the nodes of the control flow graph represent basic blocks, the edges represent the relationships between basic blocks, and each basic block contains multiple assembly instructions;

[0036] Disassembling the two binary files separately includes:

[0037] Use a disassembler to convert a binary file into a sequence of assembly instructions.

[0038] A control flow graph is generated by analyzing jump and call instructions in the assembly instruction sequence; each node in the control flow graph represents a basic block, and the edges represent the control flow relationships between basic blocks.

[0039] Assembly instructions are converted into pseudocode using decompilation tools. The pseudocode retains the logical structure of the source code, which facilitates subsequent extraction of high-level semantic features.

[0040] S2: Control flow graphs (CFG) for the two binary files respectively. n Preprocessing is performed to obtain two binary files, resulting in preprocessed control flow graphs CFG″. n Where n is the index of the binary file;

[0041] like Figure 2 As shown, for the control flow graph CFG n Preprocessing includes:

[0042] S21. Control Flow Graph (CFG) n The assembly instructions of each basic block are normalized to obtain the normalized control flow graph CFG′. n ;

[0043] S22. Set a threshold A, and adjust the control flow graph according to the threshold A. By performing filling or truncation, a control flow graph containing A basic blocks is obtained.

[0044] Specifically, for the control flow graph The filling or truncation process includes: determining the control flow graph (CFG'). n If the number of basic blocks exceeds the threshold A, then extract the control flow graph CFG′. n By analyzing the first A basic blocks, we obtain a control flow graph containing A basic blocks. Otherwise, for the control flow graph CFG′ n After padding and completion, a control flow graph containing A basic blocks is obtained.

[0045] S23. Adjust the control flow graph according to threshold A. Each basic block is filled or truncated to obtain the preprocessed control flow graph CFG″. n; wherein the control flow graph CFG" n Each basic block of the control flow graph CFG"

[0046] In particular, the padding or truncation processing of each basic block of the control flow graph CFG" includes: judging whether the number of assembly instructions of the basic block of the control flow graph CFG" exceeds a threshold A, if yes, truncating the first A assembly instructions of the basic block to obtain a basic block containing A assembly instructions; otherwise, padding the assembly instructions of the basic block to obtain a basic block containing A assembly instructions.

[0047] Preferably, the threshold A is 20.

[0048] The normalization of the assembly instructions of each basic block includes:

[0049] All direct numbers are replaced by "const", for example, the instruction sub rsp, 07h is converted to sub rsp, const; for the addition, subtraction and multiplication operators in the operands, the original form is maintained without modification, for example, mov [rbp-08h], rax is converted to mov [rbp-const], rax; for the operands after the call instruction, a uniform placeholder "foo" is used to replace, for example, call sub_401E85 is represented as call foo; the offset in the operands, such as offset, is retained and used as usual, and for those operands containing "var" or "arg", which are usually related to pointers, the symbol is replaced by "ptr", for example, test [ebp+arg_0], 1 is converted to test [ebp+ptr], const; in addition, other symbols are uniformly represented by "tag". These rules help to eliminate the differences between architectures and implementations, and provide standardized input for subsequent similarity detection.

[0050] The control flow graph CFG" n includes an adjacency matrix between the basic blocks; when there is an edge between the basic blocks, the corresponding position of the adjacency matrix is 1, otherwise it is 0.

[0051] S3: inputting the CFG branches of the two preprocessed control flow graphs CFG" n to obtain the similarity X between the assembly instructions of the two binary files;

[0052] The CFG branches include a semantic embedding module and a function-level embedding module; the processing of the CFG branches on the control flow graphs CFG" n of the two binary files includes: respectively processing the control flow graphs CFG" nThe input semantic embedding module obtains the control flow graph CFG of the two binary files n The high-dimensional embedding matrix H of each basic block of the control flow graph CFG of the two binary files n,i The high-dimensional embedding matrix H of each basic block of the control flow graph CFG of the two binary files n The high-dimensional embedding matrix H of each basic block of the control flow graph CFG of the two binary files n,i The input function level embedding module obtains the feature vectors of the assembly instructions of the two binary files, and calculates the similarity X between the assembly instructions of the two binary files according to the feature vectors of the assembly instructions of the two binary files; wherein i is the index of the basic block.

[0053] The process of the semantic embedding module of the CFG branch includes:

[0054] Each assembly instruction carries low-level semantic information, which directly reflects the execution logic of the code. The model needs to convert the assembly instructions into high-dimensional embedding vectors, which is crucial for understanding the semantics of the basic block.

[0055] Specifically, the high-dimensional embedding vector of each basic block of the control flow graph CFG of each binary file is obtained by inputting each basic block of the control flow graph CFG of each binary file into the Word2Vec model. n n

[0056] The formula of each instruction embedding can be expressed as:

[0057] h n,i,j =W emb (instr n,i,j )

[0058] Wherein h n,i,j represents the high-dimensional embedding vector of the jth assembly instruction in the ith basic block of the nth binary file, W emb is a pre-trained word vector matrix, instr n,i,j is the jth instruction in the basic block i of the nth binary file.

[0059] Optionally, the Word2Vec model is a pre-trained continuous bag-of-words (CBOW) model.

[0060] The high-dimensional embedding vectors h n,i,j of all instructions in the basic block i are combined to obtain the high-dimensional embedding matrix H Wherein L i is the number of instructions in the basic block, and d is the dimension of the word vector. This vectorization lays a foundation for subsequent intra-block and inter-block learning of the model.

[0061] ​​The goal of function-level embedding is to aggregate the basic block features within each function into a holistic function feature representation, thereby providing input for similarity detection. Specifically, the function-level embedding module includes: Bi-GRU, GCN, and Bi-GRU with attention modules. The function-level embedding module of the CFG branch controls the CFG″ binary file's control flow graph. n The high-dimensional embedding matrix H of each basic block n,i Processing with the adjacency matrix includes:

[0062] The high-dimensional embedding matrix H of each basic block is respectively... n,i The input is used to learn the global dependencies within each basic block in a Bi-GRU network, resulting in the intra-block global dependency feature H′ for each basic block. n,i ; The intra-block global dependency feature H′ of each basic block n,i and Control Flow Graph (CFG) n The adjacency matrix is ​​input to the GCN to learn the control flow graph CFG″. n The relationships between the basic blocks are used to obtain the inter-block features H″ of each basic block. n,i The inter-block features H″ of each basic block n,i Inputting Bi-GRU and attention modules yields the feature vectors of assembly instructions in the binary file; where Bi-GRU is a bidirectional gated recurrent unit and GCN is a graph convolutional network.

[0063] By combining Bi-GRU and attention mechanisms, the model can not only capture the dependencies between basic blocks within a function, but also automatically identify the most representative basic blocks in the function. This mechanism enables the model to handle function representations across architectures more effectively, improving the accuracy and robustness of similarity calculation.

[0064] Calculating the similarity X between the assembly instructions of two binary files based on their feature vectors involves: concatenating the two feature vectors, then passing them through a two-layer fully connected network to achieve feature dimensionality reduction and enhanced classification, and finally outputting a similarity score using a sigmoid activation function. The output similarity score ranges from 0 to 1, with values ​​closer to 1 indicating greater similarity and values ​​closer to 0 indicating less similarity.

[0065] S4: Input the pseudocode of the two binary files into the pseudocode branch to obtain the similarity Y between the pseudocode of the two binary files;

[0066] The pseudocode branch processes the pseudocode of each binary file, including:

[0067] The pseudocodes of the two binary files are input into the Word2Vec model to obtain the embedding vectors of the pseudocodes of the two binary files. Specifically, each pseudocode, after word embedding, is converted into a vector representation of dimension d, and the specific function can be expressed as:

[0068] e = W word2vec ·p

[0069] Where e represents the embedding vector of the pseudocode, p represents the pseudocode, and W word2vec It is a pre-trained word vector matrix.

[0070] The embedding vectors of the pseudocodes of the two binary files are input into the R-CNN model to obtain the feature vectors of the pseudocodes of the two binary files; R-CNN stands for Region-CNN (Region Convolutional Neural Network).

[0071] R-CNN can not only capture local contextual dependencies in pseudocode, but also capture long-range dependencies in sequences through its recursive structure. The formula for R-CNN is as follows:

[0072] h t =ReLU(W conv ·[e t-m ,…,e t ,…,e t+m ]+b conv )

[0073] Where, h t e represents the hidden state at time step t. t e represents the embedding vector of the pseudocode at time step t. t-m W represents the embedding vector of the pseudocode at time step tm. conv It is a convolution kernel, b conv It is a bias term.

[0074] The similarity Y between the pseudocodes of the two binary files is calculated based on the feature vectors of the pseudocodes of the two binary files; the steps for calculating the similarity here are the same as those in the CFG branch.

[0075] S5: Control flow graph (CFG) after preprocessing the two binary files. n The pseudocode represents the input structural feature extraction module, which produces two binary files containing the control flow graphs CFG″. n The structural features F represented by the pseudocode CFG,n F P,n ;

[0076] The structural feature extraction module extracts the control flow graphs (CFG) from the two binary files. n and the structural features F of the pseudocode CFG,n F P,nComprise:

[0077] analyze CFG" n and structural features in the pseudocode, a series of statistical information is extracted. Specifically, 11 structural features are extracted from CFG" n and 8 structural features are extracted from the pseudocode, as shown in Table 1, which helps to capture the execution logic and structural similarity of the code.

[0078] Table 1 Structural feature table

[0079]

[0080]

[0081] S6: input the structural features F n and F CFG,n of the two binary files CFG P,n and the similarity X and Y into the feature fusion module to obtain the final similarity score;

[0082] splice the structural features F CFG,n and F P,n and the similarity X and Y to obtain the spliced features; input the spliced features into a multi-layer perception (MLP) to calculate the final similarity score s. The MLP is composed of multiple hidden layers with nonlinear activation functions, which enables it to learn the complex relationship between the input features and the final similarity.

[0083] The final similarity score s represents the overall similarity between the two binary codes being compared, which considers the features and similarities from the assembly instruction branches and the pseudocode branches.

[0084] S7: calculate the loss function value according to the final similarity score, update the model parameters according to the loss function value, and obtain the trained binary code similarity detection model when the loss function value is minimized.

[0085] The loss function L is:

[0086] L = -(ylog(p)) + (1-y)log(1-p)

[0087] where y is the true similarity label (0 or 1), and p is the model's prediction value.

[0088] On the other hand, as Figure 3 shown, the present application adopts a binary code similarity detection system based on multi-level feature fusion, which is used to perform the above-mentioned multi-level feature fusion binary code similarity detection method, comprising:

[0089] The data input module is configured to obtain two binary files to be detected, and perform disassembly on the two binary files to be detected by using a disassembly tool to obtain code representations of the two binary files; the code representations include a control flow graph and pseudo code, and nodes of the control flow graph represent basic blocks and edges represent relationships between the basic blocks, and each basic block includes a plurality of assembly instructions.

[0090] As shown in Figure 4 , the data input module includes a disassembly unit, a control flow graph generation unit, and a pseudo code generation unit.

[0091] The disassembly unit converts binary code into an assembly instruction sequence by using a disassembly tool, and provides basic data for subsequent control flow graph generation and pseudo code generation.

[0092] The control flow graph generation unit generates a control flow graph by analyzing jump instructions and call instructions in the assembly instruction sequence; each node of the control flow graph represents a basic block, and edges represent control flow relationships between the basic blocks.

[0093] The pseudo code generation unit converts assembly instructions into pseudo code by using a decompilation tool; the pseudo code retains the logical structure of the source code, and facilitates subsequent high-level semantic feature extraction.

[0094] The data preprocessing module is configured to preprocess the code representations of the two binary files, so as to facilitate subsequent semantic feature extraction.

[0095] As shown in Figure 5 , the data preprocessing module includes a control flow graph preprocessing unit and a result output unit.

[0096] The control flow graph preprocessing unit is configured to preprocess a control flow graph CFG n to obtain a preprocessed control flow graph CFG" n ; wherein n is an index of the binary file. The preprocessing process of the control flow graph preprocessing unit is step S2 of the binary code similarity detection method.

[0097] The result output unit is configured to output the preprocessed control flow graph CFG" n for use by subsequent modules.

[0098] The assembly similarity calculation module is configured to calculate the similarity X between assembly instructions of the two binary files according to the preprocessed control flow graph CFG" n .

[0099] As shown in Figure 6 , the assembly similarity calculation module includes a word embedding unit, a function-level embedding unit, and a similarity calculation unit.

[0100] The word embedding unit uses a pre-trained Word2Vec model to embed the control flow graph (CFG) of the two binary files. n Embedded as a high-dimensional vector representation, the control flow graphs CFG″ of the two binary files are obtained. n The high-dimensional embedding matrix H of each basic block n,i .

[0101] The function-level embedding unit controls the binary file's control flow graph (CFG) through Bi-GRU, GCN, and the Bi-GRU and attention module. n The high-dimensional embedding matrix H of each basic block n,i Function-level embedding is performed to obtain the feature vectors of the assembly instructions in the two binary files.

[0102] The similarity calculation unit calculates the similarity X between the assembly instructions of the two binary files based on the feature vectors of the assembly instructions of the two binary files.

[0103] The pseudocode similarity calculation module is used to calculate the similarity Y between the pseudocodes of two binary files.

[0104] like Figure 7 As shown, the pseudocode similarity calculation module includes a word embedding unit, a function embedding unit, and a similarity calculation unit:

[0105] The word embedding unit embeds the pseudocode into a high-dimensional vector representation using a pre-trained Word2Vec model, obtaining the embedding vector of the pseudocode, which provides input for subsequent function embedding.

[0106] The function embedding unit embeds the pseudocode into a function-level vector representation through a recurrent convolutional neural network (R-CNN) to obtain the feature vector of the pseudocode.

[0107] The similarity calculation unit calculates the similarity Y between the pseudocodes of the two binary files based on the feature vectors of the pseudocodes of the two binary files.

[0108] The structural feature extraction module is used to extract the structural features of the control flow graph and pseudocode of binary files;

[0109] like Figure 8 As shown, this module includes a control flow graph structure feature extraction unit, a pseudocode structure feature extraction unit, and a result output unit:

[0110] The control flow graph structure feature extraction unit is used to extract structural features from the control flow graph, such as the number of cycles, the number of strongly connected components, and the average in-degree and out-degree of nodes. These features can reflect the structure of the control flow graph and provide richer information for similarity detection.

[0111] The pseudo code structure feature extraction unit is configured to extract structure features from the pseudo code, such as the number of loops, the number of conditional statements, the number of function calls, and the like. These features can reflect the logical structure of the pseudo code and provide additional information for the similarity detection.

[0112] The result output unit is configured to output the extracted control flow graph and the structure features of the pseudo code for use by the subsequent feature fusion module.

[0113] The feature fusion module is configured to calculate the final similarity based on the control flow graph and the structure features of the pseudo code, and the similarities X and Y.

[0114] As shown in FIG. 8, the module includes a feature splicing unit, a similarity calculation unit, and a result output unit. Figure 9

[0115] The feature splicing unit splices the control flow graph and the structure features of the pseudo code, and the similarities X and Y, to obtain spliced features.

[0116] The similarity calculation unit calculates the final similarity score based on the spliced features using a multi-layer perception (MLP).

[0117] The result output unit is configured to output the final similarity score for further analysis and decision-making by the user.

[0118] The above examples further illustrate the purpose, technical solutions, and advantages of the present application. It should be understood that the above examples are only preferred embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent replacements, improvements, and the like made to the present application within the spirit and principles of the present application should be included in the protection scope of the present application.​

Claims

1. A multi-level feature fusion binary code similarity detection method, characterized in that, The method comprises the following steps: Obtain two binary files to be detected, disassemble the two binary files to be detected respectively to obtain code representations of the two binary files, and input the code representations of the two binary files into a trained binary code similarity detection model after preprocessing to obtain a similarity score; The binary code similarity detection model comprises a CFG branch, a pseudo code branch, a structure feature extraction module, and a feature fusion module; the training process of the binary code similarity detection model comprises the following steps: S1: Obtain two binary files, respectively disassemble the two binary files to obtain the code representation of the two binary files; wherein the code representation includes a control flow graph CFG n and a pseudo code, the nodes of the control flow graph represent basic blocks, the edges represent the relationship between the basic blocks, and each basic block contains multiple assembly instructions; S2: Control flow graphs (CFG) for the two binary files respectively. n Preprocessing is performed to obtain two binary files, resulting in preprocessed control flow graphs CFG″. n Where n is the index of the binary file; S3: Preprocess the control flow graph CFG" of the two binary files n Input CFG branches to get similarity X between assembly instructions of the two binary files; S4: input the pseudo codes of the two binary files into the pseudo code branch to obtain a similarity Y between the pseudo codes of the two binary files; S5: preprocess the control flow graph CFG" of the two binary files n and pseudo-code representation of the input structure feature extraction module, get the control flow graph CFG" of the two binary files n and pseudo-code representation of the structure feature F CFG,n , F P,n ; S6: the control flow graph CFG of the two binary files n and the structural features F represented by pseudo code CFG,n and F P,n and the similarity X and Y input feature fusion module to obtain the final similarity score; S7: calculate a loss function value according to the final similarity score, update the model parameters according to the loss function value, and obtain the trained binary code similarity detection model when the loss function value is the minimum.

2. The multi-level feature fusion binary code similarity detection method according to claim 1, characterized in that, Preprocessing of a control flow graph CFG n Preprocessing includes: S21, normalizing the assembly instructions of each basic block of the control flow graph CFG n to obtain a normalized control flow graph CFG' n ; S22, set threshold value A, according to threshold value A to control flow graph CFG' n filling or intercepting processing, get the control flow graph containing A basic blocks S23, filling or intercepting each basic block of the control flow graph according to the threshold value A, to obtain a preprocessed control flow graph CFG" n ; wherein each basic block of the control flow graph CFG" n includes A assembly instructions.​ 3. The multi-level feature fusion binary code similarity detection method according to claim 1, characterized in that, The CFG branch comprises a semantic embedding module and a function level embedding module. CFG branch pair control flow graphs CFG of two binary files n The processing includes: respectively inputting the control flow graphs CFG of two binary files n The input semantic embedding module obtains the high-dimensional embedding matrix H of each basic block of the control flow graph CFG of two binary files n The input semantic embedding module obtains the high-dimensional embedding matrix H of each basic block of the control flow graph CFG of two binary files n,i The input semantic embedding module obtains the high-dimensional embedding matrix H of each basic block of the control flow graph CFG of two binary files n The input semantic embedding module obtains the high-dimensional embedding matrix H of each basic block of the control flow graph CFG of two binary files n,i The input function level embedding module obtains the feature vectors of the assembly instructions of two binary files according to the feature vectors of the assembly instructions of two binary files, and calculates the similarity X between the assembly instructions of two binary files; wherein, i is the index of the basic block.

4. The multi-level feature fusion binary code similarity detection method according to claim 3, characterized in that, The semantic embedding module is a Word2Vec model; wherein, the Word2Vec is a word vector model.

5. The multi-level feature fusion binary code similarity detection method according to claim 3, characterized in that, Function-level embedding modules include: Bi-GRU, GCN, and Bi-GRU combined with attention modules; the function-level embedding modules control the binary file's CFG″. n The high-dimensional embedding matrix H of each basic block n,i Processing the adjacency matrix includes: processing the high-dimensional embedding matrix H of each basic block. n,i Inputting the data into a Bi-GRU network yields the intra-block global dependency features H′ for each basic block. n,i ; The intra-block global dependency feature H′ of each basic block n,i and Control Flow Graph (CFG) n The adjacency matrix is ​​input into the GCN to obtain the inter-block features H″ of each basic block. n,i The inter-block features H″ of each basic block n,i Inputting Bi-GRU and attention module yields feature vectors of assembly instructions; where Bi-GRU is a bidirectional gated recurrent unit and GCN is a graph convolutional network.

6. The multi-level feature fusion binary code similarity detection method according to claim 1, characterized in that, The pseudo code branch comprises a Word2Vec model and an R-CNN model; the processing of the pseudo codes of the two binary files by the pseudo code branch comprises the following steps: input the pseudo codes of the two binary files into the Word2Vec model respectively to obtain embedding vectors of the pseudo codes of the two binary files, input the embedding vectors of the pseudo codes of the two binary files into the R-CNN model respectively to obtain feature vectors of the pseudo codes of the two binary files, and calculate a similarity Y between the pseudo codes of the two binary files according to the feature vectors of the pseudo codes of the two binary files; wherein, the Word2Vec is a word vector model, and the R-CNN is a region-based convolutional neural network.

7. The method of claim 1, wherein the multi-level feature fusion binary code similarity detection method is characterized by, The feature fusion module processes the structure features F CFG,n and F P,n and the similarities X and Y includes: splicing the structure features F CFG,n and F P,n and the similarities X and Y to obtain spliced features; processing the spliced features by using a multi-layer perception to obtain a final similarity score.

8. The method of claim 1, wherein the multi-level feature fusion binary code similarity detection method is characterized by, The structural features of the control flow graph include: the number of loops, the number of strongly connected components, the number of back edges, the maximum width of CFG" n , the maximum depth of CFG" n , the number of nodes per loop, the number of nodes per strongly connected component, the average number of nodes per loop, the average number of nodes per strongly connected component, the average in-degree of nodes, and the average out-degree of nodes; the structural features of the pseudocode include: the number of loops, the number of conditional statements, the number of function calls, the number of jump statements, the number of variable declarations, the number of pointer operations, the number of arithmetic operations, and the number of memory allocations.

9. A multi-level feature fusion binary code similarity detection system, which is used to execute the multi-level feature fusion binary code similarity detection method in any one of claims 1-8, characterized in that, The method comprises the following steps: A data input module is configured to obtain two binary files to be detected, and disassemble the two binary files to be detected by using a disassembly tool to obtain code representations of each binary file; the code representation comprises a control flow graph and pseudo code, the nodes of the control flow graph represent basic blocks, and the edges represent the relationships between the basic blocks; each basic block comprises a plurality of assembly instructions; a data preprocessing module, configured to preprocess code representations of the two binary files to obtain a preprocessed control flow graph CFG" n ; The assembly similarity calculation module is used to calculate the similarity based on the preprocessed control flow graph CFG″. n Calculate the similarity X between the assembly instructions of two binary files; A pseudo code similarity calculation module is configured to calculate a similarity Y between the pseudo codes of the two binary files; A structure feature extraction module is configured to extract structure features of the preprocessed control flow graph and pseudo code of the two binary files; A feature fusion module is configured to calculate a final similarity according to the structure features of the control flow graph and the pseudo code, and the similarities X and Y.

10. The multi-tiered feature-fused binary code similarity detection system of claim 9, wherein, The feature fusion module comprises a feature splicing unit, a similarity calculation unit, and a result output unit; the feature splicing unit is configured to splice the structure features of the control flow graph and the pseudo code, and the similarities X and Y to obtain spliced features; the similarity calculation unit is configured to calculate the final similarity according to the spliced features; and the result output unit is configured to output the final similarity.

Images