Fine-grained binary code similarity detection method based on code retrieval and subgraph matching

Abstract

The present invention proposes a fine-grained binary code similarity detection method based on code retrieval and subgraph matching, which belongs to the field of network security technology. Based on fine-grained retrieval at the code snippet level, the present invention vectorizes and embeds the binary code to be tested at the basic block level; retrieves the embedding vector at the basic block level in the existing binary code database, thereby performing binary code matching at the basic block level. The present invention extends each matched basic block to its adjacent basic blocks to form a subgraph, and uses the matched basic block as a seed node; by performing seed graph matching on multiple discontinuous subgraphs, the similarity between the binary code to be tested and the code in the binary code database is determined, thereby completing fine-grained binary code similarity detection. The present invention solves the problems of low accuracy and weak generalization ability of traditional binary code similarity detection in complex detection scenarios such as function inlining and code reuse after modification.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and in particular relates to a fine-grained binary code similarity detection method based on code retrieval and subgraph matching. Background Art

[0002] In contemporary software development, code reuse has become a key practice for improving development efficiency and promoting innovation. Developers frequently draw on existing code bases, open source projects, and even third-party components to accelerate product iteration and feature implementation. However, while this trend has brought significant productivity gains, it also inevitably presents a series of hidden security challenges. The quality of reused code varies greatly, and hidden vulnerabilities and security flaws within it can, once triggered, lead to catastrophic consequences. To address this situation, the industry is adopting code similarity detection technology to identify and eliminate code fragments that carry security risks at the source. However, current technologies focus on function-level code analysis and fail to fully consider the more granular binary code similarity detection within functions, which is required by downstream applications such as copyright and vulnerability detection. When core software project code, or even vulnerable function code, is reused, developers often add extensive project-specific content. This results in the final software code being unable to fully match the original code with the reused code at the function level; the two are essentially contained within each other. To address this phenomenon, it is necessary to perform similarity detection at a code granularity finer than the function granularity.

[0003] At the binary code level, unlike the source code level, where string matching can be used, binary code undergoes source code compilation. Even if the binary code originates from the same source code, differences in compilation methods can lead to significant differences in the binary code. Therefore, both one-to-one matching at the function level and fine-grained inclusion relationship detection are technically challenging to implement.

[0004] One of the existing technologies is to detect template class codes that have been inline optimized in C++ by extracting the fingerprint of the binary code and matching the fingerprint. The fingerprint extraction part mainly captures the syntactic and semantic features in the assembly code, as well as the control flow graph structure. In addition to the extracted fingerprint, the subgraph isomorphism detection technology is also used to assist in identifying the calls of inline functions in the target binary code. The fingerprint library generation part is based on the known template class source code, performs inline calls and compiles it into a binary file, and then extracts the fingerprint and stores it in the library. This method is limited by the collected fingerprint library. If the detection range exceeds the content in the library, the detection accuracy is limited.

[0005] The second existing technique uses topological graph theory for inline function detection. This technique proposes an instruction topological graph (ITG) to represent the dataflow dependencies of instructions in a basic block. Using the ITG, the problem of distinguishing inline instructions from caller instructions is transformed into a graph connectivity problem, ultimately solved by calculating a minimum vertex partition set. If a minimum connected graph exists, the code at the corresponding location can be detected as inlined function code based on the corresponding threshold setting. This approach has some implications for fine-grained detection, but cannot be directly applied to similarity detection.

[0006] The third prior art method first constructed a cross-inline binary code retrieval database, compiling 51 projects using 9 compilers, 4 optimization levels, 6 architectures, and 2 inline flags, generating two datasets with 216 combinations each. Through analysis of the inline datasets, three function inline patterns were discovered. Different detection models were trained for different patterns to achieve detection for all inline patterns. However, the effectiveness of this method's model detection is limited by the data used. Once the data distribution changes in the application scenario, the detection accuracy will decrease.

[0007] It can be seen that the existing binary code similarity detection method can only meet the detection requirements of one-to-one matching, but cannot cope with detection in complex detection scenarios such as function inlining and code reuse after modification. That is, the detection accuracy in the corresponding scenarios is low and the generalization ability of detection scenarios is weak. Summary of the Invention

[0008] To this end, the present invention proposes a fine-grained binary code similarity detection scheme based on code retrieval and subgraph matching, aiming to solve the technical problems that existing binary code similarity detection methods can only meet the detection requirements of one-to-one matching, but cannot cope with detection in complex detection scenarios such as function inlining and code reuse after modification, that is, the detection accuracy in corresponding scenarios is low and the generalization ability of detection scenarios is weak.

[0009] A first aspect of the present invention provides a fine-grained binary code similarity detection method based on code retrieval and subgraph matching, the method comprising:

[0010] Step S1: Based on fine-grained retrieval at the code snippet level, the binary code to be tested is vectorized and embedded at the basic block level; the basic block level embedding vector is searched in an existing binary code database to perform binary code matching at the basic block level;

[0011] Step S2: Each matched basic block is extended to its adjacent basic blocks to form a subgraph, and the matched basic blocks are used as seed nodes. By performing seed graph matching on multiple discontinuous subgraphs, the similarity between the binary code to be tested and the code in the binary code database is determined, thereby completing fine-grained binary code similarity detection.

[0012] According to the method of the first aspect of the present invention, in step S1, the binary code to be tested is vectorized and embedded at the basic block level; specifically, the method includes:

[0013] The binary code to be tested at the binary function level is segmented into code fragments based on the control flow graph and divided into two levels of code units:

[0014] A continuous basic block-level code unit consisting of two adjacent basic blocks; and

[0015] All individual basic blocks form a single basic block-level code unit;

[0016] By segmenting the binary code to be detected, the detection granularity conversion is performed. The sem2vec tool is used to input the continuous binary assembly code in the basic block and output the embedded representation in the form of a vector.

[0017] According to the method of the first aspect of the present invention, in step S1, a basic block-level embedding vector is retrieved from an existing binary code database; specifically, the method includes:

[0018] The IVF-PQ algorithm is used to perform code retrieval based on vector similarity. IVF-PQ consists of two parts: product quantization PQ and inverted file IVF.

[0019] Product Quantization (PQ) is based on vector compression technology and is used to reduce the dimensionality of embedded vectors and speed up vector similarity calculations. A vector library contains N vectors of dimension D, with each floating-point value represented by d bits. PQ divides the high-dimensional vector into M groups of sub-vectors of dimension D / M. K-means clustering is performed on these M groups of sub-vectors, resulting in K cluster centers for each group, which are then incorporated into the codebook for that group of sub-vectors.

[0020] Inverted file IVF is applied to the retrieval process. The inverted file index uses the fragmented content of the file as the index key and the serial number of all files containing the corresponding content as the value to retrieve the specific file content; K-means clustering is used to divide the points in the space into n list When querying, the target vector is compared with the center of all units, and n probe The nearest unit is selected, and all vectors in the selected unit are compared to obtain the final result.

[0021] According to the method of the first aspect of the present invention, in step S1:

[0022] The IVF-PQ algorithm uses IVF to reduce the range of vectors used for retrieval and uses PQ to perform similarity calculation and search for similar vectors, obtaining one or a cluster of vectors that are most similar to the vector to be tested. This allows similarity calculation of basic block-level embedded vectors in a binary code database.

[0023] After calculating the similarity between all basic block units and the basic block units in the binary code to be tested, the similarity is sorted and the basic block units with similarity higher than the threshold T are sorted. B And the top K with the largest number of matched units top The code segment is used as a matching candidate for similarity detection.

[0024] According to the method of the first aspect of the present invention, in step S2, seed graph matching refers to detecting whether the target code exists in the binary code to be tested, or detecting whether the target code contains the binary code to be tested, based on the matched basic blocks and basic block sequences.

[0025] According to the method of the first aspect of the present invention, in step S2, top In this code, adjacent nodes are added to multiple matching basic block units with similarity higher than a threshold, thereby expanding them into multiple subgraphs, and similarity matching is performed using a graph matching algorithm; wherein:

[0026] When the number of matched similar subgraphs reaches the threshold T G When , it is determined that the binary code similarity matching is successful; and based on the matched nodes, it is used as a seed node for further graph structure matching.

[0027] According to the method of the first aspect of the present invention, in step S2, a supervised seed graph matching model SeedGNN is used to perform seed graph matching using the matched basic block units as seed nodes; wherein:

[0028] SeedGNN consists of a multi-layer neural network. It uses convolution operations to propagate node attributes. A filtering module is used to address the situation where seed nodes are interfered with by noise nodes. The Hungarian algorithm is used to pre-match nodes in two graphs to maximize similarity, thereby distinguishing the true seed nodes from the noise nodes. After masking the noise nodes, the true seed nodes are used to perform graph neural network operations.

[0029] As the number of convolutional layers increases, new seed nodes are continuously added to the calculation, and the message passing in the graph neural network deepens step by step, eventually obtaining the similarity values ​​between each pair of nodes in the two target graph structures; by setting a threshold for screening to judge the matching results of the graph, the matching ratio between the target code fragment and the subgraph of the binary code fragment to be tested is determined, and further determination is made as to whether the two code segments are similar.

[0030] A second aspect of the present invention provides a fine-grained binary code similarity detection system based on code retrieval and subgraph matching, the system comprising a processing unit configured to execute:

[0031] Based on fine-grained retrieval at the code snippet level, the binary code to be tested is vectorized and embedded at the basic block level. The basic block-level embedding vectors are retrieved from the existing binary code database to perform basic block-level binary code matching.

[0032] Each matched basic block is extended to its adjacent basic blocks to form a subgraph, and the matched basic block is used as a seed node. By performing seed graph matching on multiple discontinuous subgraphs, the similarity between the binary code to be tested and the code in the binary code database is determined, thereby completing fine-grained binary code similarity detection.

[0033] A third aspect of the present invention discloses an electronic device. The electronic device includes a memory and a processor. The memory stores a computer program. When the processor executes the computer program, it implements the fine-grained binary code similarity detection method based on code retrieval and subgraph matching according to the first aspect of the present disclosure.

[0034] A fourth aspect of the present invention discloses a computer-readable storage medium having a computer program stored thereon. When executed by a processor, the computer program implements the fine-grained binary code similarity detection method based on code retrieval and subgraph matching according to the first aspect of the present disclosure.

[0035] The fine-grained binary code similarity detection scheme based on code retrieval and subgraph matching proposed in this invention is targeted at business scenarios such as vulnerability mining, software copyright plagiarism detection, and malicious code detection. Based on code retrieval and subgraph matching, it achieves more fine-grained and accurate similarity detection of binary codes. It has the following technical effects: (1) In a variety of complex software, it matches whether there is reuse of disclosed vulnerability code, thereby achieving vulnerability detection tasks; (2) It characterizes software functions from multiple aspects, thereby discovering whether there are copyright issues in commercial software; (3) It more comprehensively characterizes the characteristics of malware code, thereby achieving more accurate malicious code detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0037] Figure 1 Schematic diagram of fine-grained binary code similarity detection based on code retrieval and subgraph matching.

[0038] Figure 2 Schematic diagram of the principle of product quantization PQ algorithm.

[0039] Figure 3 Schematic diagram of the SeedGNN network structure.

[0040] Figure 4 Schematic diagram of the SeedGNN seed graph matching process. DETAILED DESCRIPTION

[0041] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0042] First embodiment

[0043] This paper proposes a fine-grained binary code similarity detection scheme based on code retrieval and subgraph matching, such as Figure 1 As shown in the figure, the proposed method mainly consists of two parts (modules): code text retrieval and seed graph matching. First, through fine-grained retrieval at the code snippet level, the binary code to be tested is vectorized and embedded at the basic block level. Then, these basic block-level embedding vectors are efficiently retrieved from an existing binary code database to achieve precise binary code matching at the basic block level. Next, each matched basic block is expanded to its adjacent basic blocks to form a subgraph, and these matched basic blocks are used as seed nodes. By performing seed graph matching on multiple discontinuous subgraphs, the degree of similarity between the binary code to be tested and the code in the database is determined, ultimately achieving fine-grained binary code similarity detection.

[0044] 1. Code text retrieval

[0045] The code text retrieval proposed in this method vectorizes and indexes the binary code at the basic block level, and uses an efficient vector retrieval algorithm for similarity matching, ultimately obtaining the binary code matching results at the basic block level.

[0046] For binary code vectorization, the binary function-level code is first segmented into two levels of code units based on the control flow graph: continuous basic block-level code units consisting of two adjacent basic blocks, and single basic block-level code units consisting of all individual basic blocks. After segmenting the binary code to be tested and achieving a change in the test granularity, sem2vec is used to output a vector representation of the continuous binary assembly code within the basic block.

[0047] For efficient vector retrieval, since the generated representation vectors are typically large in dimensionality, dimensionality reduction would result in a decrease in representation performance. Therefore, the Approximate Nearest Neighbor (ANN) algorithm, IVF-PQ, is used to achieve efficient code retrieval based on vector similarity. IVF-PQ consists of two main components: Product Quantization (PQ) and Inverted File (IVF).

[0048] PQ is a vector compression technology, also known as quantization technology, used to reduce the dimension of embedded vectors and speed up the calculation of vector similarity. Assuming that there are N vectors of dimension D in the vector library, each floating-point value is represented by d bits. PQ divides the high-dimensional vector into M blocks of sub-vectors with dimensions D / M. K-means clustering is performed on the M groups of sub-vectors, so that K cluster centers are generated in each group and are included in the codebook of this group of sub-vectors, such as Figure 2 shown.

[0049] IVF is commonly used in retrieval systems. Unlike the traditional method of searching for file contents based on file numbers (number as key, file contents as value), inverted file index uses the fragmented contents of files as the index key and the serial numbers of all files containing the corresponding contents as the value. This allows for faster retrieval of which files or files contain specific file contents. It uses clustering methods such as K-means to divide the points in space into n list When querying, first compare the distance between the target vector and the center of all cells, and select n probe The nearest cells are selected, and then all vectors in these selected cells are compared to get the final result.

[0050] The IVF-PQ algorithm first reduces the range of vectors used for retrieval through IVF, and then uses PQ to perform efficient similarity calculation and retrieval of similar vectors, and finally obtains one or a cluster of vectors in the library that are most similar to the vector to be tested. In this way, it is possible to achieve fast similarity calculation of basic block-level embedded vectors in a large-scale binary code database. After calculating the similarity of all basic block units in the database and the basic block units in the code to be tested, the similarity is sorted, and the basic block units with similarity higher than the threshold T are sorted. B , and the top K with the largest number of matched units top The code segment is used as a matching candidate for the next similarity detection.

[0051] 2. Seed graph matching

[0052] The method involves a seed graph matching process, and based on the matched basic blocks and basic block sequences, detects whether the target code actually exists in the code to be tested, or detects whether the target code contains the code to be tested.

[0053] K obtained in the previous module top In the candidate code, multiple matching basic block units with similarity higher than the threshold are expanded into multiple subgraphs by adding adjacent nodes, and similarity matching is performed through the graph matching algorithm. When the number of similar subgraphs matched reaches the threshold T G When , we can determine that the two binary codes are similar and matched. Since some basic blocks have been matched in the subgraph, we can use the seed graph matching algorithm, that is, based on the matched nodes, we use them as seed nodes to further match the graph structure.

[0054] The project intends to use SeedGNN, a supervised seed graph matching model, and use the matched basic block units as seed nodes for seed graph matching. SeedGNN consists of a multi-layer neural network, and the structure of each layer is as follows Figure 3 As shown in the figure, convolution operation is first used to propagate node attributes; then the filtering module is used to solve the problem that the seed nodes in the nodes are affected by noise nodes (high similarity, but not corresponding nodes). The Hungarian algorithm is used to pre-match the nodes of the two graphs to maximize the similarity, thereby distinguishing the real seed nodes from the noise nodes. Then, after masking the noise nodes, the real seed nodes are used to continue to perform graph neural network operations.

[0055] As the number of convolutional layers increases, new seed nodes are constantly added to the calculation, and the message passing in the graph neural network is also deepened at each level, such as Figure 4As shown in the figure, we can finally obtain the similarity values ​​between each pair of nodes in the two target graph structures. By setting a threshold for screening, we can judge the graph matching results, thereby determining the matching ratio between the target code snippet and the subgraph of the code snippet to be tested, and ultimately determine whether the two code snippets are similar.

[0056] like Figure 4 As shown, where: S l is the input seed node of the lth layer, that is, the output seed node of the l-1th layer; S l+1 is the output seed node of the lth layer, that is, the input seed node of the l+1th layer; H l =A1S l A2; A1 and A2 are input values ​​S l Perform matrix multiplication with the two parameter matrices in the lth convolutional layer, and the result is H l Softmax is used to convert each element in a vector into a probability value, which ranges from (0, 1) and all values ​​add up to 1.

[0057] Second embodiment

[0058] Take the code similarity detection of the version_etc function in the md5sum binary program in the coreutils suite as an example.

[0059] Coreutils, part of the GNU Project, provides a set of basic file, shell, and text manipulation tools. These tools are an integral part of Unix and Unix-like systems (such as Linux), providing many commonly used command-line utilities. Coreutils includes a large number of commands covering file management, text processing, system information, and more.

[0060] 1. Binary code feature extraction

[0061] First, we selected the md5sum binary program from the coreutils package, version 6.5, for the x86_32 architecture, compiled with the clang compiler version 4.0 using the O0 option, and the md5sum binary program from the coreutils package, version 6.5, for the mips_32 architecture, compiled with the gcc compiler version 7.3.0 using the O0 option. We performed feature extraction on the version_etc function in each binary, extracting both text sequence features and topological graph structure features.

[0062] 2. Multimodal feature independent embedding representation

[0063] Different embedding representation models are used for features of different modalities to generate embedding vectors after embedding the features. For text sequence features, the CLAP model is used for embedding representation; for topological graph structure features, the GMN model is used for embedding representation, and the embedding vectors are obtained after embedding representation.

[0064] 3. Multimodal Feature Fusion Embedding Representation

[0065] For two different coreutils-md5sum binary programs, the text sequence features and topology structure features of the version_etc function are respectively input into the multimodal feature fusion module to generate vectorized features of the binary code.

[0066] 4. Binary code similarity detection

[0067] We read the embedded vectors of the version_etc function in each program, obtained by fusion of multimodal features, and calculated the distance using cosine similarity. The cosine similarity between the vectors was 1, indicating similarity. Therefore, this method can accurately represent the features of the same function code in programs compiled under different conditions and is well suited for binary code similarity detection.

[0068] It can be seen that the goal of the binary code similarity detection method described in the present invention is to: given a binary code to be tested, it can be compared with a known binary code database by sequentially performing two steps: code text retrieval and seed graph matching to achieve fine-grained binary code similarity detection at the basic block level within the function, and calculate the similarity based on vector distance to determine whether it comes from the same source code.

[0069] The main technical improvements of the present invention include: (1) Design of code text retrieval method: First, it is necessary to select a semantic representation model for representing the continuous binary assembly code in the basic block to perform accurate representation at the semantic level; second, it is necessary to select a vector retrieval method with efficient operation process, which can save time consumption in massive computing scenarios; finally, it is necessary to use a manually determined threshold to filter basic blocks with similarity matching higher than the threshold. (2) Design of seed graph matching method: First, the filtered matching basic blocks are extended to the adjacent basic block nodes to form a subgraph; second, for each subgraph, it is necessary to select a suitable seed graph matching algorithm to match the graph matching results between the binary code to be tested and the binary code in the library; finally, it is necessary to use a manually determined threshold to judge the similarity between the binary codes based on the number of matched nodes in the subgraph and the number of successfully matched subgraphs.

[0070] Please note that the technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification. The above embodiments only express several implementation methods of the present application. The description is relatively specific and detailed, but it cannot be understood as a limitation on the scope of the invention patent. It should be pointed out that for ordinary technicians in this field, without departing from the concept of this application, several variations and improvements can be made, which all fall within the scope of protection of this application. Therefore, the scope of protection of the patent in this application shall be based on the attached claims.

Claims

1. A fine-grained binary code similarity detection method based on code retrieval and subgraph matching, characterized in that: The method comprises: Step S1: Based on fine-grained retrieval at the code snippet level, the binary code to be tested is vectorized and embedded at the basic block level; the basic block level embedding vector is searched in an existing binary code database to perform binary code matching at the basic block level; Step S2: Each matched basic block is extended to its adjacent basic blocks to form a subgraph, and the matched basic blocks are used as seed nodes. By performing seed graph matching on multiple discontinuous subgraphs, the similarity between the binary code to be tested and the codes in the binary code database is determined, thereby completing fine-grained binary code similarity detection; In step S2, a supervised seed graph matching model SeedGNN is used to perform seed graph matching using the matched basic blocks as seed nodes; wherein: SeedGNN consists of a multi-layer neural network. It uses convolution operations to propagate node attributes. A filtering module is used to address the situation where seed nodes are interfered with by noise nodes. The Hungarian algorithm is used to pre-match nodes in two graphs to maximize similarity, thereby distinguishing the true seed nodes from the noise nodes. After masking the noise nodes, the true seed nodes are used to perform graph neural network operations. As the number of convolutional layers increases, new seed nodes are continuously added to the calculation, and the message passing in the graph neural network deepens step by step, eventually obtaining the similarity values ​​between each pair of nodes in the two target graph structures; by setting a threshold for screening to judge the matching results of the graph, the matching ratio between the target code fragment and the subgraph of the binary code fragment to be tested is determined, and further determination is made as to whether the two code segments are similar.

2. A fine-grained binary code similarity detection method based on code retrieval and subgraph matching according to claim 1, characterized in that: In step S1, the binary code to be tested is vectorized and embedded at the basic block level; specifically, the following steps are performed: The binary code to be tested at the binary function level is segmented into code fragments based on the control flow graph and divided into two levels of code units: A continuous basic block-level code unit consisting of two adjacent basic blocks; and All individual basic blocks form a single basic block-level code unit; By segmenting the binary code to be detected, the detection granularity conversion is performed. The sem2vec tool is used to input the continuous binary assembly code in the basic block and output the embedded representation in the form of a vector.

3. A fine-grained binary code similarity detection method based on code retrieval and subgraph matching according to claim 2, characterized in that: In step S1, the basic block level embedding vector is retrieved from the existing binary code database; specifically, the following steps are performed: The IVF-PQ algorithm is used to perform code retrieval based on vector similarity. IVF-PQ consists of two parts: product quantization PQ and inverted file IVF. Product Quantization (PQ) is based on vector compression technology and is used to reduce the dimensionality of embedded vectors and speed up vector similarity calculations. A vector library contains N vectors of dimension D, with each floating-point value represented by d bits. PQ divides the high-dimensional vector into M groups of sub-vectors of dimension D / M. K-means clustering is performed on these M groups of sub-vectors, resulting in K cluster centers for each group, which are then incorporated into the codebook for that group of sub-vectors. Inverted file IVF is applied to the retrieval process. The inverted file index uses the fragmented content of the file as the index key and the serial number of all files containing the corresponding content as the value to retrieve the specific file content; K-means clustering is used to divide the points in the space into n list When querying, the target vector is compared with the center of all units, and n probe The nearest unit is selected, and all vectors in the selected unit are compared to obtain the final result.

4. A fine-grained binary code similarity detection method based on code retrieval and subgraph matching according to claim 3, characterized in that: In step S1: The IVF-PQ algorithm uses IVF to reduce the range of vectors used for retrieval and uses PQ to perform similarity calculation and search for similar vectors, obtaining one or a cluster of vectors that are most similar to the vector to be tested. This allows similarity calculation of basic block-level embedded vectors in a binary code database. After calculating the similarity between all basic block units and the basic block units in the binary code to be tested, the similarity is sorted and the basic block units with similarity higher than the threshold T are sorted. B And the top K with the largest number of matched units top The code segment is used as a matching candidate for similarity detection.

5. The fine-grained binary code similarity detection method based on code retrieval and subgraph matching according to claim 4 is characterized in that: In step S2 , seed graph matching refers to detecting whether the target code exists in the binary code to be tested, or detecting whether the target code contains the binary code to be tested, based on the matched basic blocks and basic block sequences.

6. A fine-grained binary code similarity detection method based on code retrieval and subgraph matching according to claim 5, characterized in that: In step S2, at K top In this code, adjacent nodes are added to multiple matching basic block units with similarity higher than a threshold, thereby expanding them into multiple subgraphs, and similarity matching is performed using a graph matching algorithm; wherein: When the number of matched similar subgraphs reaches the threshold T G When , it is determined that the binary code similarity matching is successful; and based on the matched nodes, it is used as a seed node for further graph structure matching.

7. A fine-grained binary code similarity detection system based on code retrieval and subgraph matching, characterized in that: The system comprises a processing unit configured to perform: Based on fine-grained retrieval at the code snippet level, the binary code to be tested is vectorized and embedded at the basic block level. The basic block-level embedding vectors are retrieved from the existing binary code database to perform basic block-level binary code matching. Each matched basic block is extended to its adjacent basic blocks to form a subgraph, and the matched basic blocks are used as seed nodes. By performing seed graph matching on multiple discontinuous subgraphs, the similarity between the binary code to be tested and the code in the binary code database is determined, thereby completing fine-grained binary code similarity detection. Among them, the supervised seed graph matching model SeedGNN is used to use the matched basic blocks as seed nodes for seed graph matching; SeedGNN consists of a multi-layer neural network. It uses convolution operations to propagate node attributes. A filtering module is used to address the situation where seed nodes are interfered with by noise nodes. The Hungarian algorithm is used to pre-match nodes in two graphs to maximize similarity, thereby distinguishing the true seed nodes from the noise nodes. After masking the noise nodes, the true seed nodes are used to perform graph neural network operations. As the number of convolutional layers increases, new seed nodes are continuously added to the calculation, and the message passing in the graph neural network deepens step by step, eventually obtaining the similarity values ​​between each pair of nodes in the two target graph structures; by setting a threshold for screening to judge the matching results of the graph, the matching ratio between the target code fragment and the subgraph of the binary code fragment to be tested is determined, and further determination is made as to whether the two code segments are similar.

8. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, it implements the fine-grained binary code similarity detection method based on code retrieval and subgraph matching as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, it implements the fine-grained binary code similarity detection method based on code retrieval and subgraph matching according to any one of claims 1 to 6.

Images