Cross-architecture binary function embedding method, binary function similarity detection method and device
Through cross-architecture assembly language model and multi-layer hybrid network, the representation inconsistency and robustness problems in cross-architecture binary code similarity detection are solved, and efficient cross-architecture binary function similarity detection is achieved, improving detection accuracy and robustness.
Patent Information
- Application Number
- CN202510394096.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-03-31
- Publication Date
- 2025-07-25
AI Technical Summary
Existing deep learning-driven binary code similarity detection methods perform inconsistently in cross-architecture scenarios, it is difficult to generate robust cross-architecture feature representations, the complexity and performance of the model are difficult to balance, and the method of efficiently fusion of graph structure information and semantic information is insufficient, and the robustness and generalization capabilities are insufficient.
Using a cross-architecture assembly language model and a multi-layer hybrid network, a cross-architecture binary function is transformed into a control flow graph, natural language processing generate word vectors and graph convolution neural network extracts features, and combining BERT model to generate function embeddings to construct cross-architecture binary function representations.
It significantly improves the accuracy and robustness of binary function similarity detection in cross-architecture environments, optimizes the balance between model complexity and performance, and improves the detection effect on large-scale data sets.
Smart Images
Figure CN120371271A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of computer software, and particularly relates to a method for embedding cross-architecture binary functions, a method and device for detecting binary function similarity. Background Art
[0002] Binary Code Similarity Detection (BCSD) is an important and challenging technology that can effectively identify and match binary functions, thereby detecting code reuse and potential security threats. It has played an important role in application scenarios such as vulnerability discovery, malicious code detection and classification, third-party library identification, software plagiarism detection, and patch analysis. With the widespread use of open-source software and the common occurrence of code reuse, the importance of BCSD has become even more prominent, providing strong support for maintaining software security. However, in the face of the increasingly complex software ecosystem, developing a robust and accurate BCSD method has become an urgent problem to be solved.
[0003] In recent years, the rapid development of deep learning technology has provided new solutions for BCSD. A large number of studies have attempted to extract and compare features of binary functions through deep learning models, and identify similar binary functions under different compilers, optimization levels, instruction set architectures (ISAs), and even some obfuscation techniques, showing its potential. Although some progress has been made, current deep learning-driven BCSD methods still face many challenges in practical tasks, especially in cross-architecture scenarios, where the performance bottleneck is particularly significant.
[0004] First of all, the problem of cross-architecture binary representation is one of the main difficulties of BCSD. Existing methods often rely on the instruction set features of a single architecture, but there are significant differences in aspects such as instruction sets, data representations, and register allocations of different architectures, resulting in inconsistent representations of binary codes under different architectures. This heterogeneity limits the performance of the model on cross-architecture datasets, making it difficult to generate a robust cross-architecture feature representation.
[0005] Secondly, the model complexity has a particularly obvious impact on performance in cross-architecture BCSD. Although complex deep models can capture richer features, their computational overhead also increases accordingly, along with the risk of overfitting, especially on large-scale datasets. This makes it a great challenge to balance model complexity and performance.
[0006] Again, efficient cross-architecture similarity embedding calculation remains a difficult problem. Current graph structure-based methods, such as models that only rely on graph convolutional networks (GCNs), usually have a large computational load and are difficult to capture sequence features, and cannot effectively handle the correlation between function sequences and local structures. This limitation significantly affects the representation efficiency and performance of the model in complex function structures, especially in cross-architecture scenarios, and further exploration is still needed on how to effectively fuse graph structure information and semantic information.
[0007] Finally, the robustness and generalization ability of existing methods in cross-architecture environments are still insufficient. The essential differences between different architectures pose challenges for the model to maintain adaptability. The performance of many models drops significantly when the architecture changes, unable to meet the actual application requirements. Therefore, how to improve the robustness and generalization ability of the model in cross-architecture scenarios will be the direction of future research. Summary of the Invention
[0008] In view of the above problems, the present invention proposes a cross-architecture binary function embedding method. By integrating natural language processing and graph neural network technologies, a cross-architecture assembly language model and a multi-layer hybrid network are constructed, significantly improving the accuracy and robustness of similarity detection in heterogeneous environments, and providing an effective solution for cross-architecture binary code similarity detection.
[0009] In a first aspect, a cross-architecture binary function embedding method provided by the present invention includes:
[0010] Step 101: Preprocess the target binary function and convert it into a control flow graph;
[0011] Step 102: Input the control flow graph into the cross-architecture assembly language model to obtain the word vector representation of the assembly instructions of the basic blocks in the control flow graph, and generate a function feature map based on the word vectors and the edge information of the control flow graph;
[0012] Step 103: Input the function feature map into the multi-layer hybrid network architecture to obtain the function embedding of the target binary function;
[0013] Wherein, the multi-layer hybrid network architecture generates an embedding representation of the binary function by integrating a graph convolutional neural network and a BERT model.
[0014] Further, the preprocessing includes:
[0015] Replace special types and operands with multiple combination forms in the binary function with a preset token.
[0016] Further, step 102 specifically includes:
[0017] Regarding the control flow graph as a sequence of sentences, use the natural language processing technology in the cross-architecture assembly language model to generate word vectors for the operation codes and operands of each instruction in each basic block of the control flow graph;
[0018] Aggregate all word vectors within each basic block through average pooling to generate a feature vector that comprehensively represents the semantic information of the basic block;
[0019] Use the feature vector of the basic block as the node feature of the function feature graph, and determine the connection relationship between node features according to the edge information in the control flow graph to construct the function feature graph.
[0020] Furthermore, the natural language processing technology adopts the Word2Vec word embedding method.
[0021] Furthermore, the method for constructing the multi-layer hybrid network includes: combining the GCN module and the improved BERT module to form a hybrid layer, and realizing the gradual deepening of feature extraction through stacking multiple hybrid layers;
[0022] Among them, the GCN module updates node features based on the function feature graph; the improved BERT module serializes the basic blocks in the feature graph output by the GCN module and generates a function-level embedding representation.
[0023] Furthermore, the improved BERT module deletes the embedding layer and the NSP task of the BERT model on the basis of the BERT model.
[0024] Furthermore, the node feature sequence after GCN processing is:
[0025]
[0026] Among them, H (l) represents the node feature matrix of the l-th layer of the GCN module, W (l) represents the learnable weight matrix of the l-th layer of the GCN module, A represents the adjacency matrix of the function feature graph, D represents the degree matrix of A, and σ represents the activation function;
[0027] The expression formula of the encoding layer in the BERT module is as follows:
[0028] E i = BERT(h1, h2,..., h n )
[0029] Among them, E i represents the semantic embedding of the i-th node after passing through the encoding layer of the BERT module, {h1, h2,..., h n} represents the node feature sequence processed by the GCN module.
[0030] In a second aspect, a binary function similarity detection method based on binary function embedding provided by the present invention includes:
[0031] Step 201: Embed the first binary function and the second binary function based on the method described above to obtain a first binary embedding representation and a second binary embedding representation;
[0032] Step 202: Perform similarity detection on the first binary embedding representation and the second binary embedding representation to obtain a similarity detection result of the first binary function and the second binary function.
[0033] Further, in step 202, similarity detection is performed through cosine distance measurement.
[0034] In a third aspect, a binary function similarity detection device based on binary function embedding provided by the present invention includes:
[0035] A binary function embedding module that embeds the first binary function and the second binary function based on the method described above to obtain a first binary embedding representation and a second binary embedding representation;
[0036] A binary embedding similarity detection module for performing similarity detection on the first binary embedding representation and the second binary embedding representation to obtain a similarity detection result of the first binary function and the second binary function.
[0037] The beneficial effects of the present invention are as follows:
[0038] (1) The present invention proposes a cross-architecture assembly language model. By treating the control flow graph of a binary function as a sentence sequence and using natural language processing techniques to generate word vectors for each instruction. The sentence vectors of basic blocks are generated through average pooling, and the basic blocks are used as node features. At the same time, the relationship between basic blocks is described by the edges of the graph to construct a cross-architecture binary function representation, providing a basis for selecting a suitable language model in a cross-architecture scenario.
[0039] (2) The present invention deeply explores the necessity of combining semantic information and structural information, and selects GCN and BERT to extract structural information and semantic information respectively, improving the effectiveness and robustness of the method.
[0040] (3) The present invention has been comprehensively evaluated on the large-scale cross-architecture dataset BINKIT, verifying the practicability and robustness of the proposed method. In the binary function similarity detection task, the designed hybrid layer network structure significantly improves the detection accuracy in a cross-architecture environment. In addition, the present invention conducts a systematic analysis of the relationship between the complexity and performance of language model construction and function embedding generation, providing valuable references for subsequent research to optimize model selection and improvement methods. BRIEF DESCRIPTION OF THE DRAWINGS
[0041] Figure 1 It is a schematic flowchart of a cross-architecture binary function embedding method provided by an embodiment of the present invention;
[0042] Figure 2 It is a schematic diagram of a cross-institutional binary function embedding process provided by an embodiment of the present invention;
[0043] Figure 3 It is a schematic structural diagram of a multi-layer hybrid network provided by an embodiment of the present invention;
[0044] Figure 4 It is a schematic flowchart of a binary function similarity detection method based on binary function embedding provided by an embodiment of the present invention;
[0045] Figure 5 It is a schematic diagram showing the model performance under different combinations of hyperparameters of different deep learning networks provided by an embodiment of the present invention;
[0046] Figure 6 It is a schematic diagram of the results of the influence of the number of BERT layers on performance when different combinations of the number of GCN layers and the number of hybrid layers are provided by an embodiment of the present invention;
[0047] Figure 7 It is a box plot of different language models under all combinations of network layer hyperparameters provided by an embodiment of the present invention;
[0048] Figure 8 It is a schematic diagram of the comparison results between the model provided by an embodiment of the present invention and the baseline model. DETAILED DESCRIPTION OF THE EMBODIMENTS
[0049] To make the objectives, technical solutions, and advantages of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.
[0050] As Figure 1 and Figure 2As shown in the figure, an embodiment of the present invention provides a cross-architecture binary function embedding method, including:
[0051] Step 101: Preprocess the target binary function and convert it into a control flow graph.
[0052] Among them, the preprocessing includes: replacing special types and operands with multiple combination forms in the binary function with preset tokens.
[0053] Specifically, this is a standardization process in language model pre-training. Since the vocabulary is limited, many highly customized words will be standardized into unified tokens. For example, immediate numbers will become <token_num>, function addresses will become <token_add>, function names will become <token_func>, and strings will become <token_str>.
[0054] Step 102: Input the control flow graph into a cross-architecture assembly language model to obtain the word vector representation of the assembly instructions of the basic blocks in the control flow graph, and generate a function feature map based on the word vectors and the edge information of the control flow graph.
[0055] Step 102 specifically includes:
[0056] Regarding the control flow graph as a sentence sequence, use the natural language processing technology in the cross-architecture assembly language model to generate word vectors for the operation codes and operands of each instruction in each basic block of the control flow graph.
[0057] Specifically, the natural language processing technology in the embodiment of the present invention uses the Word2Vec word embedding method to generate word vectors. It should be noted that one-hot encoding or BERT word embedding method can also be used to generate word vectors.
[0058] Aggregate all word vectors within each basic block through average pooling to generate a feature vector that comprehensively represents the semantic information of the basic block.
[0059] Use the feature vector of the basic block as the node feature of the function feature map, and determine the connection relationship between the node features according to the edge information in the control flow graph to construct the function feature map.
[0060] It can be understood that the function feature map effectively combines the global control flow structure of the control flow graph (through the connection relationship of the edges) and the local semantic information of the basic blocks (through the node feature vectors) to provide a representation form that combines structure and semantics for subsequent tasks.
[0061] Step 103: Input the function feature map into a multi-layer hybrid network architecture to obtain the function embedding of the target binary function;
[0062] As shown Figure 3 in the figure, the multi-layer hybrid network architecture generates an embedded representation of a binary function by integrating a graph convolutional neural network and a BERT model. The method for constructing the multi-layer hybrid network includes:
[0063] Combining the GCN module and the improved BERT module to form a hybrid layer, and realizing the gradual deepening of feature extraction through stacking multiple hybrid layers. Among them, the GCN module updates node features based on the function feature map; the improved BERT module serializes the basic blocks in the feature map output by the GCN module and generates a function-level embedded representation.
[0064] Specifically, the GCN module updates node features with the function feature map. Assuming the function feature map is represented as G=(V, E), where V represents the set of nodes and E represents the set of edges, and each node represents a basic block in the control flow graph. The GCN layer updates the node representation by aggregating neighborhood information, and the formula is as follows:
[0065]
[0066] where H (l) represents the node feature matrix of the l-th layer of the GCN module, W (l) represents the learnable weight matrix of the l-th layer of the GCN module, A represents the adjacency matrix of the function feature map, D represents the degree matrix of A, and σ represents the activation function.
[0067] The improved BERT module, based on the BERT model, deletes the embedding layer and the NSP task of the BERT model. Specifically, first, the embedding layer in the original BERT model is deleted because all embedding work has been completed during the generation of the previous function feature map, and the generated feature sequence can be directly used as the input of the BERT network layer. Second, the NSP (Next Sentence Prediction) task in the original BERT model is removed. The NSP task was originally designed for natural language scenarios to help the model perceive the sequential relationship between sentences. However, in the scenario of the embodiments of the present invention, each function is regarded as an independent sentence input to BERT, and logically there is no concept of the next sentence. In addition, deleting NSP can improve the model performance while simplifying the calculation. Therefore, the NSP task is removed in the improved BERT module in the embodiments of the present invention.
[0068] The improved BERT layer serializes the basic block features and generates a function-level embedded representation. Assuming the node feature sequence after GCN processing is {h1, h2,..., h n}, it is input into the word embedding layer of the BERT model. The expression of the BERT layer can be represented by the following formula:
[0069] E i= BERT(h1, h2, …, h n )
[0070] where E i represents the semantic embedding of the i-th node passing through the encoding layer in the BERT module, and {h1, h2, …, h n} represents the node feature sequence processed by the GCN module. If BERT is the last layer, the output CLS vector Ecls is used as the final function embedding. If the output of BERT is not the last layer, the result will be used to update the node features in the function feature map, and then continue to be input into the GCN for cyclic processing.
[0071] The method provided by the embodiments of the present invention generates a function feature map for a binary function through an assembly language model, and then generates a binary function embedding through a multi-layer hybrid network, significantly improving the accuracy and robustness of similarity detection in a heterogeneous environment, and providing an effective solution for the premise of cross-architecture binary code similarity detection.
[0072] As Figure 4 shown, the embodiments of the present invention also provide a binary function similarity detection method based on binary function embedding, including:
[0073] Step 201: Embed the first binary function and the second binary function based on the method described above to obtain a first binary embedding and a second binary embedding;
[0074] Step 202: Perform a similarity detection on the first binary embedding and the second binary embedding to obtain a similarity detection result of the first binary function and the second binary function.
[0075] Further, in step 202, the similarity detection is performed by using cosine distance measurement.
[0076] The embodiments of the present invention also provide a binary function similarity detection device based on binary function embedding, including:
[0077] A binary function embedding module that embeds the first binary function and the second binary function based on the method described above to obtain a first binary embedding and a second binary embedding;
[0078] A binary embedding similarity detection module that is used to perform a similarity detection on the first binary embedding and the second binary embedding to obtain a similarity detection result of the first binary function and the second binary function.
[0079] To verify the effectiveness of the method proposed by the embodiments of the present invention, an experimental comparison is carried out:
[0080] I. Experimental settings
[0081] 1. Comparison baseline
[0082] SAFE uses the attention mechanism to generate binary embeddings of functions, and then compares the similarity of the embeddings through the Siamese network structure and cosine distance metric. The present invention reproduces SAFE according to the official source code and default parameter settings.
[0083] JTrans applies the unique position vector concept of BERT in NLP to interpret jump information within functions, enabling sequence-oriented natural language models to process and understand the structural jumps of code functions. In the experiment, the cross-architecture support ability of JTrans was enhanced, including the adaptation of the pre-trained corpus and the enhancement of the position vectors at jump points. The model was reproduced through the official BERT source code and the pre-trained model in the project library, and fine-tuned on the training set constructed based on the BINKIT dataset.
[0084] GraphFormers is an advanced model for text graph representation learning, which integrates GNN layers in the Transformer block to achieve iterative fusion of text encoding and graph aggregation, and effectively processes complex relationships in text graph data.
[0085] These three baselines respectively represent the methods of three technical routes of the attention mechanism, BERT combined with structural information, and GNN + BERT, covering the common technical paradigms in current binary code similarity analysis, ensuring the comparability and comprehensiveness of the experiment.
[0086] 2. Hyperparameter settings
[0087] In the experiment, the number of training epochs is set to 10, which is selected by comprehensively considering the model's learning of data features and avoiding overfitting. In the embodiment of the present invention, common batch sizes (4, 8, 16, 32) and learning rates (from 1e-5 to 5e-6) are tested in hyperparameter settings to ensure the reliability of the results. Due to the large number of hyperparameter combinations, to improve efficiency, a contrastive early stopping strategy is adopted. By monitoring the performance of the test set, the training of the hyperparameter combinations with poor performance is terminated early, which can save computing resources, focus on better combinations, and enhance the reliability of the results.
[0088] The training process is optimized using TripletMarginLoss (with the margin value set to 1.0), and embedding learning is performed in the form of triplets (original function, positive example function, negative example function). This loss function maximizes the embedding similarity between the positive example function and the original function, while minimizing the embedding similarity between the negative example function and the original function, ensuring that the model can effectively distinguish similar and dissimilar function pairs, thereby improving the generalization ability and the quality of embedding representation.
[0089] When training the assembly language model, Word2vec uses the skip-gram model with a window size of 5. The BERT hidden layer dimension is 768, with 12 of them, and the dropout rate is 0.1. The dimension of all word vectors is 128.
[0090] 3. Software and Hardware Environment
[0091] The experiment is based on the Ubuntu 22.04 system, using Python 3.10 and PyTorch 2.1.0, and equipped with CUDA 12.1. In terms of hardware, the H20-NVLink GPU has 96GB of memory, which can accelerate the matrix operations of the GCN and BERT layers to shorten the training time; the AMD EPYC 9K84 96-Core Processor CPU has 16 virtual CPUs for data preprocessing and non-GPU calculations; 150GB of memory ensures the data read and write speed to ensure the smooth progress of large dataset training.
[0092] 4. Dataset
[0093] The embodiments of the present invention use the BINKIT dataset for experimental verification. BINKIT is a comprehensive dataset designed for binary code similarity tasks, containing 243,128 binary files and 36,256,322 functions, which are generated by 51 software packages under 1,352 different combinations of compiler configurations, optimization settings, and target architectures. The dataset covers key parts of existing benchmark tests, supports 8 processor architectures and their multiple versions, and fully considers the impact of various compiler options on binary code.
[0094] During the model evaluation process, functions of all available architectures are extracted from the BINKIT dataset to construct 50,000 pairs of positive and negative function pairs each (a total of 100,000 pairs), and they are divided into training set, validation set, and test set according to the ratio of 8:1:1. Such a division method not only ensures the breadth of the feature space coverage of the training set but also reserves sufficient validation and test samples for model tuning and performance evaluation, ensuring the reliability and generalization of the experimental results.
[0095] 5. Evaluation Metrics
[0096] When evaluating the performance of the model and the baseline, two metrics, MRR (Mean Reciprocal Rank) and Recall@1, are adopted, and these two metrics show excellent effectiveness in measuring the ranking quality in retrieval tasks. When evaluating the impact of complexity on performance using different hyperparameters for the model, considering the large number of hyperparameter combinations, accuracy is used for evaluation in order to have a quick horizontal comparison and intuitive results.
[0097] In the field of binary software similarity analysis, the actual application scenario of the model is usually one-to-many retrieval. Although metrics such as ROC (Receiver Operating Characteristic) / AUC (Area Under the Curve) and accuracy, which are commonly used in some studies, have certain value. For example, they can reflect the model's ability to distinguish between positive and negative examples to a certain extent and are the basis for one-to-many retrieval evaluation, these metrics have limitations for the one-to-many retrieval scenario of the present invention.
[0098] By calculating the average reciprocal rank of the positive example function in the candidate set, MRR can accurately reflect the sorting accuracy of the model for the positive example function and directly evaluate the quality of the result sorting in the one-to-many retrieval scenario. Recall@1 focuses on whether the positive example function can be accurately identified at the top of the candidate set, which is crucial for measuring whether the model can quickly and accurately find the target positive example during one-to-many retrieval. Therefore, the two retrieval metrics of MRR and Recall@1 are more in line with the actual application scenario of the model in the present invention and can more directly and accurately evaluate the performance of the model in binary software similarity analysis.
[0099] II. Experimental Evaluation
[0100] To verify the effectiveness of the method provided by the present invention for the many challenges in the previously mentioned BCSA field, multiple groups of experiments were designed.
[0101] 1. Hyperparameter Sensitivity Analysis
[0102] To verify the impact of model complexity on performance, models with different numbers of GCN layers, BERT layers, hybrid layers, and different word vector pre-training schemes were tested. The values of the number of GCN layers, BERT layers, and hybrid layers were from 1 to 3, and the word vector schemes were onehot, word2vec, and bert. The accuracy was used to evaluate the performance of the models with different hyperparameters.
[0103] As Figure 5 shown, it presents the performance of the model under different combinations of hyperparameters of the number of deep learning network layers. Each bar data is the average accuracy of the three word vector models under this combination. From Figure 5It can be seen that when the number of GCN layers is 1, it performs the worst in the same group of data. In principle, 1 layer of GCN means that each node only contains the information of 1-hop neighbors and does not well capture the structural characteristics of the binary function CFG. As the model complexity increases, the impact of GCN on the model performance is basically positively correlated. However, in all data with 3 hybrid layers, the performance when the number of GCN layers is 2 is better than that when the number of GCN layers is 3, which means that as the network complexity increases, more GCN layers do not bring performance improvement. When the model complexity is very high and there is only 1 layer of GCN, the model performance is the worst.
[0104] As Figure 6 shown, it demonstrates the impact of the number of BERT layers on the performance under different combinations of the number of GCN layers and the number of hybrid layers. It can be clearly seen from Figure 6 that as the model complexity increases, the performance of 1 layer of BERT increases. When the number of GCN layers is 1, the performance of the 3-layer BERT model is very poor, which means that when facing features without sufficient structural information, stacking BERT layers does not bring performance improvement. When there is sufficient structural information, only 1 layer of BERT model can have good performance.
[0105] As Figure 7 shown, it presents the box plots of different language models under all combinations of the number of network layers, showing the maximum value, minimum value, quartiles, and median. It can be found from Figure 7 that the onehot model has the worst performance. Essentially, the basic block features obtained by using onehot as the word vector and then using average pooling are statistical features, and this method is significantly weaker in extracting the semantics of basic blocks than word2vec and bert with the ability to extract semantic information. The median of bert is almost the same as that of word2vce, and the results of the middle 50% of the data are better than those of word2vec. The best result appears in word2vec, and the minimum value in word2vec is also better than the other two models. In the field of NLP, Bert can be said to be the next-generation model of word2vec, solving the problems of polysemy and word selection range that cannot be handled in word2vec, and these problems hardly exist in assembly language. As an exact computer language, code language does not allow the existence of polysemy. At the same time, due to the prior standardization of words, compared with natural language, assembly language does not have a huge vocabulary. Therefore, bert does not have an advantage over word2vec in embedding assembly code word vectors. In the experiments of selecting different hyperparameters provided by the present invention, when the number of GCN layers is 2, the number of BERT layers is 1, and the number of hybrid layers is 3, the model has the best performance, and we select this set of hyperparameters in the subsequent comparison experiments with the baseline model.
[0106] 2. Comparison between the model and the baseline
[0107] In this experiment, the performance of the method provided by the present invention and the baseline model on the Binkit dataset was evaluated. The experimental results are as Figure 8 shown. The Recall@1 performance of all models shows a downward trend as the poolsize increases. When the poolsize is small (log10(poolsize) is close to 1), the Recall@1 of each model is close to 1.0. However, as the poolsize increases, the Recall@1 performance of the model provided by the present invention decreases relatively slowly and remains at a relatively high level.
[0108] Table 1 Statistical results of MRR and Recall@1 of different models
[0109] SAFE Jtrans Graphformers Ours MRR 0.691 0.827 0.875 0.901 Recall@1 0.603 0.787 0.810 0.831
[0110] Further analysis of Table 1 shows that the method provided by the present invention performs excellently in terms of the MRR and Recall@1 metrics. The MRR of the method provided by the present invention reaches 0.901, and the Recall@1 is 0.831. Compared with the best-performing baseline model, GraphFormers, the method provided by the present invention improves by 2.59% in the Recall@1 metric and 2.97% in the MRR metric. Especially under a larger poolsize, the performance advantage of the method provided by the present invention is more obvious, which fully demonstrates that the method provided by the present invention has more excellent performance in processing data of different scales.
[0111] 3. Real-scenario verification
[0112] To deeply explore the performance of the method provided by the present invention in vulnerability detection methods, an embodiment of the present invention constructed a vulnerability dataset focusing on the openssl 1.0.1 version. First, 20 CVEs in this version were carefully screened and selected, and then the corresponding specific functions were accurately located. In the data preprocessing step, by strictly screening out functions with compilation failures and too small basic block counts, the quality of the data was ensured. Finally, through cross-architecture and cross-optimization compilation means, a function set containing 142 binary functions was successfully obtained, and these functions all come from vulnerable samples. At the same time, a function set composed of 358 non-vulnerable functions in the same openssl version was constructed to form a total function pool of 500 functions including vulnerable functions. Then, 100 vulnerable functions were randomly selected and compared with each function in the function pool in turn, and the recall rate was calculated for the group with the highest similarity.
[0113] Table 2 Statistical table of recall rates of different models
[0114] SAFE Jtrans Graphformers Ours Recall 0.238 0.792 0.768 0.813
[0115] The experimental results are shown in Table 2. The method provided by the present invention achieved a recall score of 81.3%, which is 2.65% higher than the best-performing baseline Jtrans. The experimental results clearly show that the method provided by the present invention has significant advantages in the vulnerability detection task, and its recall score is significantly better than other baseline models, strongly proving that the method provided by the present invention has stronger capabilities in dealing with the vulnerability detection task of the openssl 1.0.1 version and can more accurately identify the functions with vulnerabilities.
[0116] In summary, the embodiments of the present invention provide a cross-architecture binary function embedding method to address the challenges in binary code similarity detection. By integrating natural language processing and graph neural network technologies, a cross-architecture assembly language model and a multi-layer hybrid network are constructed. A large number of experiments on the BINKIT dataset show that the method provided by the present invention is superior to the current state-of-the-art baseline methods in performance metrics such as MRR and Recall@1. In the practical application of openssl 1.0.1 version vulnerability detection, the method provided by the present invention also shows significant advantages. Although the inference cost of the method provided by the present invention is relatively high, considering its overall performance, it is comparable to Jtrans. The present invention not only provides an effective solution for cross-architecture binary code similarity detection but also provides valuable insights into the balance between model complexity and performance, making it a promising method for future research and practical applications in the field of software security.
[0117] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments or equivalently replace some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A cross-architecture binary function embedding method, characterized in that Including: Step 101: Preprocess the target binary function and convert it into a control flow graph; Step 102: Input the control flow graph into a cross-architecture assembly language model to obtain the word vector representation of the assembly instructions of the basic blocks in the control flow graph, and generate a function feature map based on the word vectors and the edge information of the control flow graph; Step 103: Input the function feature map into a multi-layer hybrid network architecture to obtain the function embedding of the target binary function; Among them, the multi-layer hybrid network architecture generates the embedding representation of the binary function by integrating a graph convolutional neural network and a BERT model.
2. The cross-architecture binary function embedding method according to claim 1, wherein The preprocessing includes: Replacing special types and operands with multiple combination forms in the binary function with a preset token.
3. A cross-architecture binary function embedding method according to claim 1, characterized in that The specific content of Step 102 includes: Regarding the control flow graph as a sentence sequence, using the natural language processing technology in the cross-architecture assembly language model to generate word vectors for the operation codes and operands of each instruction in each basic block of the control flow graph; Aggregating all word vectors within each basic block through average pooling to generate a feature vector that comprehensively represents the semantic information of the basic block; Taking the feature vector of the basic block as the node feature of the function feature map, and determining the connection relationship between node features according to the edge information in the control flow graph to construct the function feature map.
4. A cross-architecture binary function embedding method according to claim 3, characterized in that The natural language processing technology adopts the Word2Vec word embedding method.
5. A cross-architecture binary function embedding method according to claim 1, wherein The method for constructing the multi-layer hybrid network includes: combining a GCN module and an improved BERT module to form a hybrid layer, and realizing the gradual deepening of feature extraction through stacking multiple hybrid layers; Among them, the GCN module updates the node features based on the function feature map; the improved BERT module serializes the basic blocks in the feature map output by the GCN module and generates a function-level embedding representation.
6. The cross-architecture binary function embedding method according to claim 5, characterized in that The improved BERT module deletes the embedding layer and the NSP task of the BERT model on the basis of the BERT model.
7. A cross-architecture binary function embedding method according to claim 5, characterized in that The node feature sequence after GCN processing is: Among them, H (l) represents the node feature matrix of the l-th layer of the GCN module, W (l) represents the learnable weight matrix of the l-th layer of the GCN module, A represents the adjacency matrix of the function feature map, D represents the degree matrix of A, and σ represents the activation function; The expression formula of the encoding layer in the BERT module is as follows: E i = BERT(h1, h2, …, h n ) Among them, E i represents the semantic embedding of the i-th node passing through the encoding layer in the BERT module, and {h1, h2, …, h n} represents the node feature sequence processed by the GCN module.
8. A method for detecting the similarity of binary functions based on binary function embedding, characterized in that, Including: Step 201: Embed the first binary function and the second binary function based on the method described in any one of Claims 1 to 7 to obtain the first binary embedding representation and the second binary embedding representation; Step 202: Perform similarity detection on the first binary embedding representation and the second binary embedding representation to obtain the similarity detection result of the first binary function and the second binary function.
9. A method for detecting binary function similarity based on binary function embedding according to claim 7, characterized in that, In Step 202, similarity detection is performed through cosine distance measurement.
10. A binary function similarity detection device based on binary function embedding, characterized in that, Including: A binary function embedding module that embeds the first binary function and the second binary function based on the method described in any one of Claims 1 to 7 to obtain the first binary embedding representation and the second binary embedding representation; A binary embedding similarity detection module for performing similarity detection on the first binary embedding representation and the second binary embedding representation to obtain the similarity detection result of the first binary function and the second binary function.