Binary function similarity detection method and device based on intermediate language graph fusion

Abstract

The invention relates to the technical field of information security, and provides a binary function similarity detection method and device based on intermediate language graph fusion. The method comprises the following steps: 1, converting a first binary code and a second binary code into a first LLVM IR sequence and a second LLVM IR sequence, and standardizing the first LLVM IR sequence and the second LLVM IR sequence; 2, extracting a control flow diagram and a data flow diagram based on the standardized first LLVM IR sequence and the standardized second LLVM IR sequence, and fusing the respectively extracted control flow diagram and data flow diagram to obtain a first fusion instruction diagram and a second fusion instruction diagram; and step 3, inputting the first fusion instruction diagram and the second fusion instruction diagram into an improved Grapher model to perform binary function similarity detection to obtain a binary function similarity detection result in the first binary code and the second binary code.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular, to a binary function similarity detection method and device based on intermediate language graph fusion. Background Art

[0002] Binary Code Similarity Detection (BCSD) plays an important role in ensuring system security, preventing plagiarism, and protecting copyrights, especially in identifying obfuscated functions and malicious codes. However, detecting similar binary regions and finding similar files in libraries face challenges of structural differences and code obfuscation.

[0003] In recent years, Natural Language Processing (NLP) technology has been increasingly applied to binary analysis. For example, BinHunt uses symbolic execution to compare the semantics of basic blocks. Although it has high precision, its computational cost is high, which limits its scalability. Other methods such as SAFE, Asm2Vec, and InnerEye use NLP technology for code search, which are different from natural language processing models such as BERT in the application field and design. Models based on the Transformer architecture such as jTrans and PalmTree represent relatively new research directions in the fields of program analysis and code representation learning.

[0004] Current deep learning-based BCSD solutions still face practical challenges when applied to actual tasks. Existing methods usually assume that the graph structure for feature extraction is static, without fully considering the dynamic relationships between different levels of features. Existing graph neural network methods mainly rely on fixed graph structures and rules to model function similarity, lacking flexibility and adaptability. Especially in tasks of multi-modal feature fusion, they cannot effectively handle the interaction between global and local information. Therefore, although graph-based deep learning methods have made some progress in binary similarity detection, in complex scenarios, especially in obfuscated code, cross-architecture similarity analysis, and large-scale data processing, they still face significant challenges.

[0005] First, the diversity introduced by compilation toolchains and compiler optimizations constitutes an important challenge. Compilers for different Instruction Set Architectures (ISAs) support different compiler optimizations, resulting in significant differences in the structure and performance of the generated binary files. For example, even if x86 and ARM architectures generate binary files from the same source code, the final binary files have large differences in structure and behavior, increasing the difficulty of binary function similarity detection.

[0006] Secondly, when performing similarity search on a large-scale function set using current binary analysis methods, it is often difficult to achieve the expected recall rate, especially when dealing with obfuscated code, where the effect is poor. Many existing models have performance bottlenecks when performing similar function searches. Especially when faced with complex obfuscation techniques, they are unable to fully explore the similarities hidden in complex code, thus affecting the overall detection accuracy and recall rate.

[0007] In addition, most existing binary function similarity detection models have significant defects in feature fusion, failing to effectively integrate features from different levels and scales, especially in capturing complex instruction semantics, context, and dependencies. These models usually focus on local information while ignoring the global structure, resulting in the inability to comprehensively capture key features. These models fail to effectively allocate the importance of each feature during the feature weighting process, leading to insufficient capture of local dependencies, excessive computational overhead for global attention, insufficient multi-level feature fusion capabilities, and a lack of flexible dynamic adjustment capabilities. These problems severely limit the performance of existing models in complex binary analysis tasks, resulting in a decline in matching performance. Summary of the Invention

[0008] In view of the above problems, the present invention proposes a binary function similarity detection method and device based on intermediate language graph fusion. By fusing the control flow graph and the information flow graph to form a fused instruction graph, while considering the function structure features, more complete semantic information is also considered, solving the problems caused by cross-structure and different compiler optimizations. A new module HSMA is developed and integrated with the Graphormer model to enhance the model's adaptability to obfuscated code, enabling the model to capture subtle structural changes and complex dependencies in obfuscated code, thereby improving the model's understanding of function behavior and similarity detection capabilities.

[0009] In a first aspect, a binary function similarity detection method based on intermediate language graph fusion proposed by the present invention includes: [[ID=--]]

[0010] Step 1: Convert the first binary code and the second binary code into a first LLVM IR sequence and a second LLVM IR sequence, and standardize the first LLVM IR sequence and the second LLVM IR sequence;

[0011] Step 2: Extract a control flow graph and a data flow graph based on the standardized first LLVM IR sequence and second LLVM IR sequence, and fuse the respectively extracted control flow graph and data flow graph to obtain a first fused instruction graph and a second fused instruction graph;

[0012] Step 3: Input the first fusion instruction graph and the second fusion instruction graph into an improved Graphormer model for binary function similarity detection to obtain the binary function similarity detection results in the first binary code and the second binary code;

[0013] Wherein the improved Graphormer model is integrating the HSAM module into the Graphormer model, and the HSAM module performs multi-scale fusion of global and local features by optimizing node embeddings using centrality information.

[0014] Further, the specific steps of Step 2 include:

[0015] Step 2.1: Extract the control flow graph and the data flow graph based on the standardized LLVM IR sequence;

[0016] Step 2.2: Construct a blank graph, add the nodes and edges of the control flow graph to the blank graph, and mark the edges of the control flow graph as control types;

[0017] Step 2.3: Add the nodes and edges of the data flow graph to the blank graph, and mark the edges of the data flow graph as data types;

[0018] Step 2.4: Embed the nodes of the data flow graph in the blank graph into the corresponding nodes of the control flow graph to generate a fusion instruction graph.

[0019] Further, Step 2 also includes: symbolizing the node statements in the fusion instruction graph.

[0020] Further, the symbolization operation specifically includes:

[0021] Changing the self-named function names to %FUNn;

[0022] Do not modify the names of the system-built library / API functions;

[0023] Changing the variable names to %ID;

[0024] Changing the labels to %LABELn;

[0025] Changing the integer values to @INT_VAL;

[0026] Changing the floating-point values to @FLOAT_VAL;

[0027] Changing all structure types in the IR to %STRUCE_TYPE.

[0028] Further, the HSAM module includes three branches. The first branch includes a global average pooling layer, a centrality encoding combination layer, a fully connected layer, and a weighted fusion layer. The second branch includes a softmax attention mechanism layer, a centrality encoding combination layer, a fully connected layer, and a weighted fusion layer. After the first branch and the second branch are fused, they pass through a sigmoid layer, and then are fused with the input of the HSAM module to be used as the output of the HSAM module.

[0029] In a second aspect, a binary function similarity detection device based on intermediate language graph fusion proposed by the present invention includes:

[0030] A binary code conversion module, configured to convert the first binary code and the second binary code into a first LLVM IR sequence and a second LLVM IR sequence, and normalize the first LLVM IR sequence and the second LLVM IR sequence;

[0031] A fused instruction graph generation module, configured to extract a control flow graph and a data flow graph based on the normalized first LLVM IR sequence and second LLVM IR sequence, and fuse the respectively extracted control flow graph and data flow graph to obtain a first fused instruction graph and a second fused instruction graph;

[0032] A binary function detection module, configured to input the first fused instruction graph and the second fused instruction graph into an improved Graphormer model for binary function similarity detection, and obtain a binary function similarity detection result in the first binary code and the second binary code;

[0033] Wherein the improved Graphormer model integrates the HSAM module into the Graphormer model, and the HSAM module performs multi-scale fusion of global and local features by optimizing node embeddings using centrality information.

[0034] In a third aspect, an electronic device proposed by the present invention includes a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, the above-mentioned method is implemented.

[0035] In a fourth aspect, a computer-readable storage medium proposed by the present invention stores a computer program, and when the computer program is run by a processor, the above-mentioned method is executed.

[0036] The beneficial effects of the present invention are:

[0037] The present invention designs a new representation of LLVM IR graph fusion (GFS) to add effective and complete semantic information about markings, mitigate the impact caused by toolchain diversity and compiler optimization, and thus lay a foundation for cross-architecture binary similarity detection.

[0038] The present invention designs and introduces a novel modular structure that combines local and global attention mechanisms to fuse multi-scale features through adaptive weights, thereby enhancing the model's ability to capture multi-scale features when processing complex graph-structured data, enabling the model to capture subtle structural changes and complex dependencies in obfuscated code, and thus improving the model's understanding of function behavior and similarity detection ability. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a schematic flow chart of a binary function similarity detection method based on intermediate language graph fusion provided by an embodiment of the present invention;

[0040] Figure 2 It is a schematic structural diagram of the HSAM module provided by an embodiment of the present invention;

[0041] Figure 3 It is a schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0042] To make the objectives, technical solutions, and advantages of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0043] As Figure 1 shown, a binary function similarity detection method based on intermediate language graph fusion provided by an embodiment of the present invention includes:

[0044] Step 1: Convert the first binary code and the second binary code into a first LLVM IR sequence and a second LLVM IR sequence, and standardize the first LLVM IR sequence and the second LLVM IR sequence;

[0045] Specifically, standardizing the LLVM IR sequence means uniformly processing the LLVM sequence according to certain rules or standards, improving the consistency, readability, and maintainability of the code, ensuring that the LLVM IR code generated from different sources or at different stages is consistent in structure and format, and facilitating subsequent analysis, optimization, and verification.

[0046] Step 2: Extract the control flow graph and data flow graph based on the standardized first LLVM IR sequence and second LLVM IR sequence, and fuse the extracted control flow graph and data flow graph respectively to obtain the first fused instruction graph and the second fused instruction graph;

[0047] Specifically, the fused instruction graph is generated as follows:

[0048] Step 2.1: Extract the control flow graph and data flow graph based on the standardized LLVM IR sequence;

[0049] Step 2.2: Construct a blank graph, add the nodes and edges of the control flow graph to the blank graph, and mark the edges of the control flow graph as control types;

[0050] Step 2.3: Add the nodes and edges of the data flow graph to the blank graph, and mark the edges of the data flow graph as data types;

[0051] Step 2.4: Embed the nodes of the data flow graph in the blank graph into the corresponding nodes of the control flow graph to generate the fused instruction graph.

[0052] Step 3: Input the first fused instruction graph and the second fused instruction graph into the improved Graphormer model for binary function similarity detection to obtain the binary function similarity detection results in the first binary code and the second binary code;

[0053] The improved Graphormer model is to integrate the HSAM module into the Graphormer model. The HSAM module fuses the global and local features at multiple scales by optimizing the node embedding using centrality information.

[0054] In the embodiments of the present invention, the binary code is converted into an LLVM IR sequence, and the generated LLVM IR sequence is standardized. By cleaning redundant data and resolving inconsistencies, a unified LLVM IR representation is ensured. Then, the corresponding fused instruction graph is generated, and the binary function similarity of the fused instruction graph is detected and analyzed by the improved Graphormer model. The method provided by the embodiments of the present invention achieves the required accuracy when processing large-scale datasets of obfuscated functions of various types and architectures. Even in scenarios involving significant function obfuscation and cross-architecture comparisons, the accuracy of searching for similar functions can be effectively improved.

[0055] On the basis of the above embodiments, the embodiments of the present invention select Retdec as the decompilation tool.

[0056] Retdec can translate given binary data into a sequence of LLVM IR instructions using its self-developed Capstone2LlvmIr library. Capstone disassembles the data into assembly instructions, and then a C++ program is used to generate an LLVM IR sequence equivalent to these assembly instructions. Capstone2LlvmIr can translate instructions in a full-semantic translation mode, translating binary code into LLVM IR and preserving its full semantics as much as possible.

[0057] Based on the above embodiments, further, perform a symbolic operation on the fused instruction graph, specifically including: changing the self-named function names to %FUNn; not modifying the system-provided library / API function names; changing the variable names to %ID; changing the labels to %LABELn; changing the integer values to @INT_VAL; changing the floating-point values to @FLOAT_VAL; changing all structure types in the IR to %STRUCE_TYPE.

[0058] Before vectorizing the fused instruction graph, first perform a symbolic operation on the node statements, which can reduce the semantic differences caused by self-naming. As shown in Table 1, five examples of symbolic operations on IR statements are listed.

[0059] Table 1 Examples of symbolic operations on IR statements

[0060]

[0061] HSAM focuses on the multi-scale fusion of global and local features, and uses centrality information to optimize node embeddings, thus significantly enhancing the model's ability to model complex dependencies. This process lays a solid foundation for generating high-quality general feature representations, ensuring that the model exhibits excellent generalization performance in diverse tasks.

[0062] Based on the above embodiments, the specific structure of the HSAM module is proposed, as Figure 3 shown: The HSAM module includes three branches. The first branch includes a global average pooling layer, a centrality encoding combination layer, a fully connected layer, and a weighted fusion layer. The second branch includes a softmax attention mechanism layer, a centrality encoding combination layer, a fully connected layer, and a weighted fusion layer. After the first branch and the second branch are fused, they pass through a sigmoid layer, and then are fused with the input of the HSAM module as the output of the HSAM module.

[0063] Specifically, encapsulate the HSAM module into a pytorch layer. Specifically, encapsulate the HSAM module as a pytorch layer and insert it before the Graphormer Encoder.

[0064] An embodiment of the present invention further provides a binary function similarity detection device based on intermediate language graph fusion, including:

[0065] A binary code conversion module, configured to convert the first binary code and the second binary code into a first LLVM IR sequence and a second LLVM IR sequence, and standardize the first LLVM IR sequence and the second LLVM IR sequence;

[0066] A fused instruction graph generation module, which extracts a control flow graph and a data flow graph based on the standardized first LLVM IR sequence and second LLVM IR sequence, and fuses the respectively extracted control flow graph and data flow graph to obtain a first fused instruction graph and a second fused instruction graph;

[0067] A binary function detection module, configured to input the first fused instruction graph and the second fused instruction graph into an improved Graphormer model for binary function similarity detection, and obtain a binary function similarity detection result in the first binary code and the second binary code;

[0068] Wherein the improved Graphormer model is obtained by integrating the HSAM module into the Graphormer model. The HSAM module performs multi-scale fusion of global and local features by optimizing node embeddings using centrality information.

[0069] As Figure 3 shown, an embodiment of the present invention further provides an electronic device, which may include: a processor 301, a communication interface 302, a memory 303, and a communication bus 304. Among them, the processor 301, the communication interface 302, and the memory 303 complete communication with each other through the communication bus 304. The processor 301 can call the logical instructions in the memory 303 to execute the method provided in the above embodiment, for example, including:

[0070] Step 1: Convert the first binary code and the second binary code into a first LLVM IR sequence and a second LLVM IR sequence, and normalize the first LLVM IR sequence and the second LLVM IR sequence; Step 2: Extract a control flow graph and a data flow graph based on the normalized first LLVM IR sequence and second LLVM IR sequence, and fuse the extracted control flow graph and data flow graph to obtain a first fused instruction graph and a second fused instruction graph; Step 3: Input the first fused instruction graph and the second fused instruction graph into an improved Graphormer model for binary function similarity detection to obtain the binary function similarity detection result in the first binary code and the second binary code; wherein the improved Graphormer model is to integrate the HSAM module into the Graphormer model, and the HSAM module performs multi-scale fusion of global and local features by optimizing node embeddings using centrality information.

[0071] In addition, when the logical instructions in the above-mentioned memory 303 are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs that can store program codes.

[0072] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the method provided in the above embodiment, for example, including:

[0073] Step 1: Convert the first binary code and the second binary code into a first LLVM IR sequence and a second LLVM IR sequence, and normalize the first LLVM IR sequence and the second LLVM IR sequence; Step 2: Extract a control flow graph and a data flow graph based on the normalized first LLVM IR sequence and second LLVM IR sequence, and fuse the extracted control flow graph and data flow graph to obtain a first fused instruction graph and a second fused instruction graph; Step 3: Input the first fused instruction graph and the second fused instruction graph into an improved Graphormer model for binary function similarity detection to obtain the binary function similarity detection result in the first binary code and the second binary code; wherein the improved Graphormer model is integrating the HSAM module into the Graphormer model, and the HSAM module performs multi-scale fusion of global and local features by optimizing node embeddings using centrality information.

[0074] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A binary function similarity detection method based on intermediate language graph fusion, characterized in that, Including: Step 1: Convert the first binary code and the second binary code into a first LLVM IR sequence and a second LLVM IR sequence, and normalize the first LLVM IR sequence and the second LLVM IR sequence; Step 2: Extract a control flow graph and a data flow graph based on the normalized first LLVM IR sequence and second LLVM IR sequence, and fuse the extracted control flow graph and data flow graph to obtain a first fused instruction graph and a second fused instruction graph; Step 3: Input the first fused instruction graph and the second fused instruction graph into an improved Graphormer model for binary function similarity detection to obtain the binary function similarity detection result in the first binary code and the second binary code; Wherein the improved Graphormer model integrates the HSAM module into the Graphormer model, and the HSAM module performs multi-scale fusion of global and local features by optimizing node embedding using centrality information.

2. The binary function similarity detection method based on intermediate language graph fusion according to claim 1, wherein The fused instruction graph is generated as follows: Extract a control flow graph and a data flow graph based on the normalized LLVM IR sequence; Construct a blank graph, add the nodes and edges of the control flow graph to the blank graph, and mark the edges of the control flow graph as control types; Add the nodes and edges of the data flow graph to the blank graph, and mark the edges of the data flow graph as data types; Embed the nodes of the data flow graph in the blank graph into the corresponding nodes of the control flow graph to generate a fused instruction graph.

3. The binary function similarity detection method based on intermediate language graph fusion according to claim 1, characterized in that Step 2 further includes: symbolizing the node statements in the fused instruction graph.

4. A binary function similarity detection method based on intermediate language graph fusion according to claim 3, characterized in that The symbolization operation specifically includes: Changing the self-named function name to %FUNn; Not modifying the names of system-provided library / API functions; Changing the variable name to %ID; Changing the label to %LABELn; Changing the integer value to @INT_VAL; Changing the floating-point value to @FLOAT_VAL; Changing all structure types in the IR to %STRUCE_TYPE.

5. The binary function similarity detection method based on intermediate language graph fusion according to claim 1, characterized in that The HSAM module includes three branches. The first branch includes a global average pooling layer, a centrality encoding combination layer, a fully connected layer, and a weighted fusion layer. The second branch includes a softmax attention mechanism layer, a centrality encoding combination layer, a fully connected layer, and a weighted fusion layer. After the first branch and the second branch are fused, they pass through a sigmoid layer, and then are fused with the input of the HSAM module as the output of the HSAM module.

6. A binary function similarity detection device based on intermediate language graph fusion, characterized in that, Including: A binary code conversion module for converting the first binary code and the second binary code into a first LLVM IR sequence and a second LLVM IR sequence, and normalizing the first LLVM IR sequence and the second LLVM IR sequence; A fused instruction graph generation module that extracts a control flow graph and a data flow graph based on the normalized first LLVM IR sequence and second LLVM IR sequence, and fuses the extracted control flow graph and data flow graph to obtain a first fused instruction graph and a second fused instruction graph; The binary function detection module is configured to input the first fusion instruction graph and the second fusion instruction graph into an improved Graphormer model for binary function similarity detection, so as to obtain the binary function similarity detection results in the first binary code and the second binary code; The improved Graphormer model is obtained by integrating the HSAM module into the Graphormer model, and the HSAM module performs multi-scale fusion of global and local features by optimizing node embeddings using centrality information.

7. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the program, the method according to any one of claims 1-5 is implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is run by the processor, the method according to any one of claims 1-5 is executed.

Images