Method and device for calculating similarity, equipment, medium and program product

Abstract

The invention discloses a similarity calculation method and device, equipment, a medium and a program product, and is applied to the technical field of network security. The method comprises the steps of obtaining a first binary program and obtaining a second binary program; mapping the first binary program into a plurality of first function vectors, and mapping the second binary program into a plurality of second function vectors; determining a first vector representation of the first binary program based on the number of first function vectors, and determining a second vector representation of the second binary program based on the number of second function vectors; a similarity between the first binary program and the second binary program is calculated based on the first vector representation and the second vector representation. According to the method, the similarity between the first binary program and the second binary program can be accurately determined, and the method can be applied to application scenes such as malicious software detection and software plagiarism detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a similarity calculation method and device, equipment, medium and program product. BACKGROUND

[0002] A program executable by a computer device is a binary program, which is obtained by compiling a source code program, and is composed of "0" and "1".

[0003] In the related art, program information of a binary program itself, such as at least one of an import table, an export table, a string, an author name and a code segment, is extracted, a vector representation of the binary program is obtained by using the program information, and similarity between different binary programs is calculated based on the vector representation.

[0004] However, the semantic information contained in the program information of the binary program itself is insufficient, which makes the vector representations of different binary programs difficult to distinguish, and thus the similarity comparison result of the binary program is inaccurate. SUMMARY

[0005] The present application provides a similarity calculation method, device, equipment, medium and program product. The technical solution is as follows: In one aspect, a similarity calculation method is provided, and the method comprises: obtaining a first binary program and a second binary program; mapping the first binary program into a plurality of first function vectors, and mapping the second binary program into a plurality of second function vectors, each first function vector being used to represent semantic information of a source code function in a source code program corresponding to the first binary program, and each second function vector being used to represent semantic information of a source code function in a source code program corresponding to the second binary program; determining a first vector representation of the first binary program based on the plurality of first function vectors, and determining a second vector representation of the second binary program based on the plurality of second function vectors, the first vector representation being used to represent semantic information of the source code program corresponding to the first binary program, and the second vector representation being used to represent semantic information of the source code program corresponding to the second binary program; calculating similarity between the first binary program and the second binary program based on the first vector representation and the second vector representation.

[0006] In another aspect, a similarity calculation device is provided, and the device comprises: an obtaining module configured to obtain a first binary program and a second binary program; a mapping module configured to map the first binary program into a plurality of first function vectors, each of the first function vectors being used to represent semantic information of a source code function in a source code program corresponding to the first binary program, and map the second binary program into a plurality of second function vectors, each of the second function vectors being used to represent semantic information of a source code function in a source code program corresponding to the second binary program; a determining module configured to determine a first vector representation of the first binary program based on the plurality of first function vectors, and determine a second vector representation of the second binary program based on the plurality of second function vectors, the first vector representation being used to represent semantic information of the source code program corresponding to the first binary program, and the second vector representation being used to represent semantic information of the source code program corresponding to the second binary program; a calculating module configured to calculate a similarity between the first binary program and the second binary program based on the first vector representation and the second vector representation.

[0007] In another aspect, a computer device is provided, which includes a processor and a memory, the memory storing a computer program, the computer program being loaded and executed by the processor to implement the similarity calculation method as described above.

[0008] In another aspect, a computer readable storage medium is provided, which stores a computer program, the computer program being loaded and executed by a processor to implement the similarity calculation method as described above.

[0009] In another aspect, a computer program product is provided, which includes computer instructions stored in a computer readable storage medium, the computer instructions being acquired by a processor from the computer readable storage medium, so that the processor is loaded and executed to implement the similarity calculation method as described above.

[0010] The technical scheme provided by the embodiments of the present application has at least the following beneficial effects: Each first function vector is used to represent semantic information of a source code function in the source code program corresponding to the first binary program, and based on the plurality of first function vectors of the first binary program, a first vector representation is determined, through which rich semantic information of the source code program corresponding to the first binary program can be represented, and each second function vector is used to represent semantic information of a source code function in the source code program corresponding to the second binary program, and based on the plurality of second function vectors of the second binary program, a second vector representation is determined, through which rich semantic information of the source code program corresponding to the second binary program can be represented, thereby improving the accuracy of the first vector representation and the second vector representation, so that when the similarity between the first binary program and the second binary program is calculated based on the first vector representation and the second vector representation, the accuracy of the calculated similarity between the first binary program and the second binary program can be improved.

[0011] Further, since the first vector representation and the second vector representation are determined in the same way, the representation method of the first vector representation and the second vector representation can be kept consistent, thereby improving the calculation speed when calculating the similarity, and the time performance overhead is also taken into account. Further, since the computer device directly obtains the first binary program and the second binary program, performs certain processing on the first binary program and the second binary program, and then calculates the similarity between the first binary program and the second binary program, the data processing efficiency is also improved, and the data acquisition cost is reduced. BRIEF DESCRIPTION OF DRAWINGS

[0012] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0013] Figure 1 is a structural block diagram of a computer system provided by an exemplary embodiment of the present application; Figure 2 is a schematic diagram of a similarity calculation method provided by an exemplary embodiment of the present application; Figure 3 is a flowchart of a similarity calculation method provided by an exemplary embodiment of the present application; Figure 4 is a flowchart of a similarity calculation method provided by an exemplary embodiment of the present application; Figure 5 is a flowchart of a similarity calculation method provided by an exemplary embodiment of the present application; Figure 6is a flow chart of a method for calculating similarity provided by an example embodiment of the present application; Figure 7 is a schematic diagram of a method for calculating similarity provided by an example embodiment of the present application; Figure 8 is a block diagram of a device for calculating similarity provided by an example embodiment of the present application; Figure 9 is a structural block diagram of a computer device provided by an example embodiment of the present application. DETAILED DESCRIPTION

[0014] For the purpose of clarity, technical solutions and advantages of the present application will be further described in detail below with reference to the accompanying drawings.

[0015] The example embodiments will be described in detail herein with reference to the accompanying drawings. The following description is presented for purposes of illustration and description, and is not intended to limit the application to the construction described. Moreover, the description is not intended to limit the scope of the application to the exact construction described herein. The description is presented in order to best explain the example embodiments of the application, and the application will be understood and appreciated by those skilled in the art in light of the description, when considered in conjunction with the accompanying drawings.

[0016] The terminology used in the present application is for the purpose of describing particular embodiments only and is not intended to be limiting of the present application. As used in the present application and the appended claims, the singular forms "a," "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0017] It should be understood that, although the terms first, second, etc. can be used herein to describe various information, these terms are not intended to denote a temporal sequence, but are used only to distinguish one piece of information from another. For example, a first parameter can be termed a second parameter, and similarly, a second parameter can be termed a first parameter, without departing from the scope of the present application. Depending on the context, the word "if' as used herein can be interpreted to mean "when" or "in response to determining" or "in response to a determination."

[0018] It should be noted that the application can display a prompt interface, a pop-up window or output voice prompt information before and during the collection of relevant data of the user (for example, programs, source code programs), the prompt interface, the pop-up window or the voice prompt information being used to prompt the user that the relevant data of the user is being collected at present, so that the application starts to perform the relevant steps of obtaining the relevant data of the user only after obtaining the confirmation operation of the user to the prompt interface or the pop-up window, otherwise (that is, without obtaining the confirmation operation of the user to the prompt interface or the pop-up window), ending the relevant steps of obtaining the relevant data of the user, that is, not obtaining the relevant data of the user. In other words, all the user data collected by the application is collected under the condition that the user agrees and authorizes, and the collection, use and processing of the relevant user data need to comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0019] Firstly, the terms involved in the embodiments of the application are briefly introduced: Binary file: a file containing a binary program, the binary program being obtained by compiling a source code program, the binary program being composed of "0" and "1". The source code program refers to a program written in a certain computer programming language, which is a computer instruction readable by humans. The computer programming language can be at least one of C, C++, Java, Python and vb.net.

[0020] Vector embedding technology: a technology for representing unstructured data as a multidimensional vector using numbers.

[0021] Mean Average Precision (mAP) and Mean Precision (mP): performance indicators used to evaluate the performance of information retrieval, object detection and related field tasks.

[0022] Deep Neural Networks (DNN): a neural network with at least one hidden layer. Deep neural networks can model complex nonlinear systems.

[0023] Contrastive Learning: a machine learning technique. The goal of contrastive learning is to learn representations of data that capture the underlying structure and relationships between different data points.

[0024] Artificial Intelligence (AI): is the use of digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology of computer science, which tries to understand the essence of intelligence and produce a new intelligent machine that can react in a similar way to human intelligence. Artificial intelligence is the design principle and implementation method of various intelligent machines, so that machines have the functions of perception, reasoning and decision-making.

[0025] Artificial intelligence technology is a comprehensive discipline, involving a wide range of fields, both hardware and software technologies. Artificial intelligence basic technologies generally include, such as sensors, special artificial intelligence chips, cloud computing, distributed storage, big data processing technology, pre-training model technology, operation / interaction system, mechatronics, etc. Among them, the pre-training model is also called large model, basic model, which can be widely applied to downstream tasks in various directions of artificial intelligence after fine-tuning. Artificial intelligence software technology mainly includes computer vision technology, speech processing technology, natural language processing technology and machine learning / deep learning, etc.

[0026] Large Language Model (LLM): is a language model with extremely large number of parameters, usually with parameter order of tens of billions to hundreds of billions. The training of large language models requires huge data sets and computing resources. They usually have excellent generalization ability and can learn through few-shot learning or zero-shot learning in various natural language processing tasks, such as text classification, language translation, question answering system, etc. In addition, large language models can also generate high-quality natural language text, including but not limited to articles, dialogues and poetry, etc.

[0027] Figure 1 is the structure block diagram of the computer system 100 provided by an exemplary embodiment of the present application. The computer system 100 can be implemented as a system architecture of the similarity calculation method. The computer system 100 includes a terminal 120 and a server 140.

[0028] The terminal 120 can be an electronic device such as a mobile phone, a tablet computer, a vehicle terminal (car machine), a wearable device, a PC (Personal Computer), an unmanned terminal, and the like. The terminal 120 can install and run a client of a target application, which can be an application for calculating a similarity of programs, another application providing a function of calculating a similarity, or another application for determining a vector representation of a program, without limitation. In addition, the target application can be in a form of an App (Application) installed in the terminal 120, a widget, or the like, or a web page, without limitation.

[0029] The server 140 can be a physical server, a server cluster or a distributed system composed of a plurality of physical servers, a cloud server providing cloud computing services, a cloud database, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, a CDN (Content Delivery Network), and a basic cloud computing service such as a big data and artificial intelligence platform. The server 140 can be a background server of the target application, and provide a background service for the client of the target application.

[0030] The cloud technology refers to a hosting technology that unifies a series of resources such as hardware, software, and a network to achieve data calculation, storage, processing, and sharing in a wide area network or a local area network. The cloud technology is a general term for network technology, information technology, integration technology, management platform technology, and application technology applied based on a cloud computing business model, and can be composed of a resource pool for on-demand use and flexible convenience. Cloud computing technology will become an important support. The background service of a technical network system requires a large amount of calculation and storage resources, such as a video website, a picture website, and more portals. With the high development and application of the Internet industry, in the future, every item can have its own identification mark and needs to be transmitted to the background system for logical processing. Different levels of data will be processed separately, and various industry data needs strong system support, which can only be achieved through cloud computing.

[0031] In some embodiments, server 140 can also be implemented as a node in a blockchain system. Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and cryptographic algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include a blockchain underlying platform, a platform product service layer, and an application service layer.

[0032] Terminal 120 and server 140 can communicate via a network, such as a wired or wireless network.

[0033] The similarity calculation method provided in this application embodiment can be executed by a computer device, which refers to an electronic device with data calculation, processing, and storage capabilities. Figure 1 Taking the implementation environment of the scheme shown as an example, the similarity calculation method can be performed by the terminal 120 (such as the client of the target application installed and running in the terminal 120 performing the similarity calculation method), or by the server 140, or by the terminal 120 and the server 140 interacting and cooperating to perform the calculation. This application does not limit this.

[0034] Those skilled in the art will understand that the number of terminals 120 can be more or less. For example, there may be only one terminal 120, or there may be dozens or hundreds of terminals 120, or more. The embodiments of this application do not limit the number of terminals 120 or the type of device.

[0035] In related technologies, the methods for calculating the similarity of binary programs have at least the following problems: 1. Functional performance issues The relevant technologies mostly use a single, simple feature to characterize a binary program. When faced with large-scale binary datasets, it is difficult to distinguish different binary programs, resulting in poor performance in similarity analysis and high false positive and false negative rates.

[0036] 2. Robustness issues The binary program can be quite different at the code level and the binary level due to different compilers, different compilation options, different distribution versions, different device architectures, and other factors. The feature and similarity comparison algorithm used in the related art cannot capture this information, resulting in poor performance of the similarity comparison. For example, the same original source code program is compiled using O0 and O3 options, and the generated binary program can have great differences in structure, data flow, control flow, function quantity, instruction sequence, and the like. These differences can greatly affect the accuracy of binary similarity analysis.

[0037] 3. Time performance problem The feature representation of the binary generated in the related art is very long, and the lengths of different features can be different. Analyzing the similarity of two binary programs requires a large amount of time, which cannot be extended to large-scale scenarios to perform binary program similarity analysis tasks.

[0038] Therefore, the embodiments of the present application provide a similarity calculation method, which can take into account the rich semantic information of the binary program and the time performance overhead, support fast binary program similarity analysis under a large-scale binary data set, and the calculation result of the similarity is more accurate, with high accuracy and robustness.

[0039] Figure 2 is a schematic diagram of a similarity calculation method provided by an exemplary embodiment of the present application. The method is executed by a computer device, which can be Figure 1 terminal 120 and / or server 140 shown in FIG. 1. Referring to Figure 2 , the data processing manner of the first binary program 10 and the second binary program 20 is consistent, and the steps are briefly described as follows: 1. Obtain the first binary program 10, and obtain the second binary program 20. It can be understood that the program executable by the computer device is a machine code program, i.e., a binary program, which is obtained by compiling a source code program. The binary program is composed of "0" and "1". Optionally, the first binary program 10 and the second binary program 20 are carried in the form of a file or directly in the form of program code.

[0040] 2. mapping the first binary program 10 into a plurality of first function vectors, and mapping the second binary program 20 into a plurality of second function vectors; for example, the computer device maps the first binary program 10 into a plurality of first function vectors, each of the plurality of first function vectors is used to represent semantic information of a source code function in a source code program corresponding to the first binary program 10, i.e. part of semantic information in the entire source code program. Alternatively, the source code program is obtained by decompiling the first binary program 10. Specifically, the computer device maps each source code function in the source code program obtained by decompiling the first binary program 10 into a first function vector; and the computer device maps the second binary program 20 into a plurality of second function vectors, each of the plurality of second function vectors is used to represent semantic information of a source code function in a source code program corresponding to the second binary program 20, i.e. part of semantic information in the entire source code program. Alternatively, the source code program is obtained by decompiling the second binary program 20. Specifically, the computer device maps each source code function in the source code program obtained by decompiling the second binary program 20 into a second function vector; for reference Figure 2 For example, the first binary program 10 is mapped into a first function vector 11, a first function vector 12 and a first function vector 13, and the second binary program 20 is mapped into a second function vector 21, a second function vector 22 and a second function vector 23.

[0041] 3. determining a first vector representation 41 of the first binary program 10 based on the plurality of first function vectors, and determining a second vector representation 42 of the second binary program 20 based on the plurality of second function vectors, the first vector representation 41 is used to represent semantic information of a source code program corresponding to the first binary program 10, and the second vector representation 42 is used to represent semantic information of a source code program corresponding to the second binary program 20; optionally, the semantic information of the source code program corresponding to the first binary program 10 includes at least one of implemented functions, operation steps and calculation logic. The semantic information of the source code program corresponding to the second binary program 20 includes at least one of implemented functions, operation steps and calculation logic.

[0042] 4. calculating a similarity 50 between the first binary program 10 and the second binary program 20 based on the first vector representation 41 and the second vector representation 42. Optionally, a distance between the first binary program 10 and the second binary program 20 is calculated to determine the similarity 50 between the first binary program 10 and the second binary program 20, and the closer the distance, the greater the similarity.

[0043] In summary, the similarity calculation method provided by the embodiments of the present application has at least the following beneficial effects: 1. The computer device can represent the rich semantic information of the source code program corresponding to the first binary program through the first vector representation, and can represent the rich semantic information of the source code program corresponding to the second binary program through the second vector representation, thereby improving the accuracy of the first vector representation and the second vector representation, and improving the accuracy of the similarity of the first binary program and the second binary program calculated based on the first vector representation and the second vector representation.

[0044] 2. The computer device maps the first binary program into a plurality of first function vectors, and maps the second binary program into a plurality of second function vectors, wherein each first function vector is used to represent the semantic information of a source code function in the source code program corresponding to the first binary program, and each second function vector is used to represent the semantic information of a source code function in the source code program corresponding to the second binary program, thereby the plurality of first function vectors can effectively capture the function semantics of the first binary program, and the plurality of second function vectors can effectively capture the function semantics of the second binary program, thereby improving the accuracy and robustness of the similarity analysis of the first binary program and the second binary program.

[0045] 3. Since the first vector representation and the second vector representation are determined by the same processing method, the representation methods of the first vector representation and the second vector representation are consistent, thereby improving the calculation speed when calculating the similarity, and also taking into account the time performance overhead, which is beneficial to extend to large-scale scenarios to perform the similarity analysis task of the binary program.

[0046] 4. Further, since the computer device directly obtains the first binary program and the second binary program to calculate the similarity of the first binary program and the second binary program, the similarity calculation can be completed without obtaining the source code program, thereby improving the data processing efficiency and reducing the data acquisition cost.

[0047] Figure 3 is a flowchart of the similarity calculation method provided by an exemplary embodiment of the present application. The method is executed by a computer device, which can be a terminal 120 and / or a server 140 as shown in Figure 1 The method includes at least part of steps 220, 240, 260, and 280: Step 220: obtaining a first binary program and a second binary program.

[0048] A binary program, also known as a machine code program, is a program that can be directly understood and executed by a computer device. The binary program is composed of "0" and "1".

[0049] Optionally, the binary program is obtained by compiling a source code program, and the compiling can be implemented by a compiler. The compiler is used to translate the source code program into an equivalent binary program in binary format. The source code program refers to a program written in a certain computer programming language, and is a human-readable computer instruction. The computer programming language can be at least one of C, C++, Java, Python, and vb.net.

[0050] The first binary program and the second binary program refer to two binary programs that need to be calculated for similarity. Optionally, the first binary program and the second binary program are carried in the form of a file or directly in the form of program code, for example, the first binary file includes the first binary program, and the second binary file includes the second binary program. The carrying manner of the first binary program and the second binary program can be the same or different. For example, the computer device obtains the first binary program, and obtains the second binary program.

[0051] In step 240, the first binary program is mapped into a plurality of first function vectors, and the second binary program is mapped into a plurality of second function vectors, each first function vector is used to represent semantic information of a source code function in a source code program corresponding to the first binary program, and each second function vector is used to represent semantic information of a source code function in a source code program corresponding to the second binary program.

[0052] For example, the source code program includes a series of functions of different types, also called source code functions. For example, a function is a basic building block (or basic unit) of a program, and the program code is organized and executed through these different types of functions. For example, a function includes a function header and a function body. The function header includes the declaration and return value type of the function, and the function body includes the specific program code implementation such as function statements.

[0053] For example, a specific source code function in a source code program is used to represent a part of semantic information of the source code program, and a part of semantic information can be a part of the function, a part of the computing logic, or a part of the operation steps implemented by the source code program. Correspondingly, after the source code program is compiled into a binary program, each source code function in the source code program is compiled into a one-to-one corresponding binary function. Then, a specific binary function in the binary program is used to represent the semantic information of a source code function in the source code program corresponding to the binary program, that is, to represent a part of the semantic information of the binary program, and a part of the semantic information can be a part of the function, a part of the computing logic, or a part of the operation steps implemented by the binary program.

[0054] For example, taking a source code program as an example, a function implemented by the source code program is to input two integers and output a larger one of the two integers. The source code functions in the source code program at least include an input function and an output function, the input function is used to implement the function of inputting the two integers, the output function is used to implement the function of outputting a larger one of the two integers, and the source code functions can further include a condition function, the condition function is used to implement the function of determining a larger one of the two integers. Illustratively, the semantic information of the source code program can be described as follows: the program name is: determining a larger one of two integers; the program input is: two integers (denoted as integer 1 and integer 2 below), the program output is: a larger one of integer 1 and integer 2; the program variables include: integer variable 1, integer variable 2 and maximum value variable; the operation steps include, in sequence, the steps of input operation, comparison operation and output operation, specifically, the step of input operation includes: using the input function to inform the user to input integer 1 and integer 2, storing integer 1 in integer variable 1 and storing integer 2 in integer variable 2; the comparison operation includes: using the condition function to compare the values of integer variable 1 and integer variable 2, if the value of integer variable 1 is greater than the value of integer variable 2, then assigning the value of integer variable 1 to the maximum value variable, otherwise, assigning the value of integer variable 2 to the maximum value variable; the output operation includes: using the output function to output the value of the maximum value variable, that is, outputting a larger one of integer 1 and integer 2.

[0055] The function vector refers to a vector obtained by mapping a plurality of binary functions in a binary program, and the binary function and the function vector correspond one by one. Or, the function vector refers to a vector obtained by mapping a plurality of source code functions (also referred to as computer programming language functions or pseudo code representations) in a source code program (also referred to as a pseudo code program) obtained after reverse compilation of a binary program. It can be set according to actual technical needs. In an example, the reverse compilation can be implemented by a reverse compilation tool. It can be understood that, in the case that the performance and accuracy of the reverse compilation tool are sufficient, the source code program and the source code functions obtained after reverse compilation of the binary program should be the same as the source code program and the source code functions before reverse compilation of the binary program.

[0056] In some embodiments, the function vector refers to an embedding vector. In the embodiments, the function vector is regarded as a text feature, and the function vector is used to represent semantic information of the corresponding function. The function vector can be at least one of a hash function vector and a floating-point function vector. The elements in the hash function vector are hash values, and the elements in the floating-point function vector are floating-point numbers. As an example, the computer device maps the function to a one-to-one corresponding function vector through a feature extraction model. The feature extraction model can be at least one of a recurrent neural network (RNN), an embedding model, a bag-of-words (BOW) model, and a Transformer type neural network model.

[0057] The first function vector refers to a vector obtained by one-to-one mapping of a plurality of first functions in the first binary program. The first function corresponds to the first function vector one-to-one. The first function can be a source code function in a source code program obtained by decompilation. Each of the plurality of first function vectors is used to represent semantic information of a source code function in a source code program corresponding to the first binary program, and the source code program is obtained by decompilation of the first binary program.

[0058] In other examples, the first function can also be a binary function in the first binary program. The binary function can be determined by performing division on the first binary program through a large language model (LLM) based on at least one of semantic information of the first binary program, a compiler, a compilation option, a release version, a device architecture, a central processing unit (CPU) architecture, and an architecture bit number. For example, the CPU architecture includes one of X86, ARM, MIPS, PPC, and RISC-V, the architecture bit number is one of 32-bit and 64-bit, the device architecture is one of Linux, Windows, and Android system architecture, and the compilation option includes one of O0 to O3.

[0059] For example, the computer device includes a large language model. The computer device performs division on the first binary program through the large language model based on at least one of semantic information of the first binary program, a compiler, a compilation option, a release version, a device architecture, a CPU architecture, and an architecture bit number, to determine a plurality of first binary functions in the first binary program.

[0060] Specifically, the computer device obtains a first binary program; retrieves a database based on the first binary program to obtain an example binary program whose similarity with semantic information of the first binary program is greater than a threshold value, and whose compiler, compilation option, release version, device architecture, CPU architecture, and architecture bit number are the same, wherein the database pre-stores different binary programs and a binary function division result pre-labeled for each binary program, the binary function division result includes a plurality of binary functions, and the binary function division result of each binary program is obtained based on division of each source code function in a source code program corresponding to the binary program; next, based on the first binary program, the example binary program, and an example binary function division result corresponding to the example binary program, a prompt information (Prompt) of a large language model is constructed, specifically, the prompt information can be obtained by combining the first binary program, the example binary program, and the example binary function division result corresponding to the example binary program in a set format, and the prompt information is used to make the large language model divide a plurality of binary functions of the first binary program as a reference example based on the example binary program and the example binary function division result corresponding to the example binary program; finally, the prompt information is input into the large language model, and a plurality of first binary functions in the first binary program are determined by the large language model. The embodiment can fully utilize the function of the large language model itself and the learning ability of semantic information, accurately divide a plurality of first binary functions contained in the first binary program, and is beneficial to subsequent one-to-one mapping of the first binary functions to obtain corresponding first function vectors.

[0061] The second function vector refers to a vector obtained by one-to-one mapping of a plurality of second functions in a second binary program, and the second function corresponds to the second function vector one-to-one. The second function can be a source code function in a source code program obtained by decompilation, and each second function vector in the plurality of second function vectors is used to represent semantic information of a source code function in a source code program corresponding to the second binary program, and the source code program is obtained by decompilation of the second binary program.

[0062] In other examples, the second function can also be a binary function in the second binary program, which can be determined by the large language model based on at least one of semantic information, a compiler, a compilation option, a release version, a device architecture, a CPU architecture, and an architecture bit number of the second binary program.

[0063] The computer device includes a large language model. The computer device performs division on the second binary program based on semantic information of the second binary program, a compiler, a compilation option, a release version, a device architecture, a CPU architecture, and at least one of a number of bits of an architecture, to determine a plurality of second binary functions in the second binary program.

[0064] Specifically, the computer device obtains a second binary program; retrieves a database based on the second binary program to obtain an example binary program with a similarity greater than a threshold between semantic information of the second binary program, and the same compiler, compilation option, release version, device architecture, CPU architecture, and number of bits of architecture, wherein the database pre-stores different binary programs and a binary function division result pre-labeled for each binary program, and the binary function division result includes a plurality of binary functions, and the binary function division result of each binary program is obtained based on division of each source code function in a source code program corresponding to the binary program; next, prompt information (Prompt) of a large language model is constructed based on the second binary program, the example binary program, and an example binary function division result corresponding to the example binary program, specifically, the prompt information can be obtained by combining the second binary program, the example binary program, and the example binary function division result corresponding to the example binary program in a set format, and the prompt information is used to make the large language model divide a plurality of binary functions of the second binary program as a reference example based on the example binary program and the example binary function division result corresponding to the example binary program; and finally, the prompt information is input into the large language model to determine a plurality of second binary functions in the second binary program by the large language model. The embodiment can fully utilize the function of the large language model itself and the learning ability of the semantic information, accurately divide a plurality of second binary functions contained in the second binary program, and facilitate subsequent mapping of the second binary functions to obtain corresponding second function vectors.

[0065] Optionally, the first function vector and the second function vector are embedding vectors. The determination manner of the first function vector and the second function vector remains consistent, that is, the type, length, and size of the first function vector and the second function vector remain consistent, so as to facilitate similarity calculation and extension to a large-scale scenario to perform a binary program similarity analysis task. For example, the first function vector and the second function vector are both hash function vectors, or the first function vector and the second function vector are both floating-point function vectors. The computer device maps the first binary program into a plurality of first function vectors, and maps the second binary program into a plurality of second function vectors.

[0066] At step 260, a first vector representation of the first binary program is determined based on the first function vectors, and a second vector representation of the second binary program is determined based on the second function vectors, the first vector representation being used to represent semantic information of a source program corresponding to the first binary program, and the second vector representation being used to represent semantic information of a source program corresponding to the second binary program.

[0067] The vector representation is determined based on the function vectors of the binary program. The vector representation is used to represent semantic information of a source program corresponding to the binary program. The semantic information of the program includes at least one of a function implemented by the program, an operation step, and a calculation logic. Alternatively, the semantic information is also represented by at least one of a data structure, a data flow, a control flow, a function quantity, and a sequence instruction of the program.

[0068] The first vector representation is determined based on the first function vectors. For example, the first vector representation is obtained by combining the first function vectors; or the first vector representation is obtained by performing weighted summation on the first function vectors by determining a weight of each first function vector; or the first vector representation is obtained by representing each first function vector as a corresponding hash value and combining the hash values. The second vector representation is determined based on the second function vectors, and the determination manner can refer to the determination manner of the first vector representation. The first vector representation is used to represent semantic information of a source program corresponding to the first binary program, and the second vector representation is used to represent semantic information of a source program corresponding to the second binary program. The first vector representation and the second vector representation have the same size and length, so as to facilitate subsequent similarity calculation. For example, the computer device determines the first vector representation of the first binary program based on the first function vectors, and determines the second vector representation of the second binary program based on the second function vectors.

[0069] Alternatively, the first vector representation and the second vector representation have a fixed length, and the first vector representation and the second vector representation have the same fixed length.

[0070] In some embodiments, the computer device directly combines the first function vectors in a specified order or a random order to obtain the first vector representation of the first binary program, and directly combines the second function vectors in a specified order or a random order to obtain the second vector representation of the second binary program. In this embodiment, the first vector representation is directly obtained by combining the first function vectors, and the first vector representation can completely retain the original semantic information contained in the first function vectors, so that the semantic accuracy of the first vector representation is improved.

[0071] In some embodiments, the computer device determines semantic weights of the first function vectors corresponding to the plurality of first functions according to semantic importance of the plurality of first functions in the first binary program, performs weighted summation on the plurality of first function vectors based on the semantic weights to obtain a first vector representation of the first binary program, and determines semantic weights of the second function vectors corresponding to the plurality of second functions according to semantic importance of the plurality of second functions in the second binary program, performs weighted summation on the plurality of second function vectors based on the semantic weights to obtain a second vector representation of the second binary program. The semantic weights and the semantic importance are in a positive correlation.

[0072] As an example, the semantic importance can be implemented by a natural language processing model, for example, the natural language processing model is a large language model. The first binary program and the second binary program are processed in the same way. Taking the first binary program as an example, the first binary program is input into the natural language processing model, and the natural language processing model outputs scores corresponding to the plurality of first functions in the first binary program respectively, which are used to represent the semantic importance of the first functions in the first binary program, and the two are in a positive correlation. The training data of the natural language processing model is a sample program, which can be a sample binary program or a sample source code program corresponding to the sample binary program. The sample program includes various sample functions and is also labeled with sample scores determined based on the semantic importance of each sample function in the sample program.

[0073] Specifically, the sample binary program is input into the natural language processing model to be trained, and the natural language processing model is used to obtain predicted scores corresponding to each sample function in the sample binary program respectively. The difference between the predicted scores and the sample scores is reduced as a training target, and the model parameters of the natural language processing model to be trained are trained to obtain the natural language processing model. The natural language processing model can be used to output scores corresponding to the plurality of first functions in the first binary program respectively. In this embodiment, the first vector representation can be obtained according to the semantic importance, which can preserve more important semantic information as much as possible, improve the semantic accuracy of the first vector representation, and as much as possible highlight the more important semantic information in the first binary program, so that the first vector representation is more targeted and the semantic focus is more prominent.

[0074] Step 280, based on the first vector representation and the second vector representation, calculating the similarity between the first binary program and the second binary program.

[0075] The similarity is used to represent the degree of similarity between the first binary program and the second binary program. For example, the computer device calculates the similarity between the first binary program and the second binary program by calculating the distance between the first vector representation based on the first vector representation and the second vector representation, and the closer the distance, the greater the similarity, that is, the more similar the first binary program and the second binary program.

[0076] In summary, the method provided by the embodiment of the application, the computer device represents the rich semantic information of the first binary program through the first vector representation, represents the rich semantic information of the second binary program through the second vector representation, improves the accuracy of the first vector representation and the second vector representation, and thus improves the accuracy of the calculated similarity between the first binary program and the second binary program when calculating the similarity between the first binary program and the second binary program based on the first vector representation and the second vector representation. Further, since the first vector representation and the second vector representation are determined in the same way, the representation of the first vector representation and the second vector representation is consistent, thereby improving the calculation speed when calculating the similarity, and the time performance overhead is also taken into account. Further, since the computer device directly obtains the first binary program and the second binary program, performs certain processing on the first binary program and the second binary program, and then calculates the similarity between the first binary program and the second binary program, the data processing efficiency is also improved, and the data acquisition cost is reduced.

[0077] In this embodiment, the first binary program and the second binary program are processed in the same way. Therefore, the determination method of the second vector representation is consistent with the determination method of the first vector representation. The following embodiment takes the first binary program and the first vector representation of the first binary program as an example for description, and the second vector representation of the second binary program can also be applied by analogy.

[0078] Figure 4 is a flowchart of the similarity calculation method provided by an exemplary embodiment of the application. Step 260 determines the first vector representation of the first binary program based on a plurality of first function vectors, which can be specifically implemented as step 270: Step 270 determines the first vector representation of the first binary program based on a plurality of first function vectors using at least one unsupervised learning method.

[0079] Unsupervised learning (Unsupervised Learning) refers to a way of discovering the potential structure and pattern in the data by analyzing the statistical characteristics and similar characteristics of the unlabeled data. For example, the computer device determines the first vector representation of the first binary program based on a plurality of first function vectors using at least one unsupervised learning method.

[0080] In this embodiment, the computer device determines the first vector representation of the first binary program based on the plurality of first function vectors by using at least one unsupervised learning manner. This manner can discover hidden rules, internal structures and features in the plurality of first function vectors of the first binary program. Moreover, this manner can save cost and be conducive to application in similarity analysis of large-scale binary data sets, since there is no need to label the first binary program, the first function vector or set a learning goal.

[0081] The following embodiments introduce two unsupervised learning manners, and one of them can be selected for use or both of them can be used in combination according to actual technical needs in actual application. For example, the first vector representation of the first binary program and the second vector representation of the second binary program are obtained by using the two manners respectively, the similarities between the first binary program and the second binary program corresponding to the two manners are calculated respectively, and addition, averaging or weighted summation is performed to obtain the final similarity.

[0082] • Unsupervised learning manner 1 In this embodiment, each of the plurality of first function vectors of the first binary function is represented as a hash value, and the first vector representation determined based on the plurality of first function vectors is a hash vector representation, and different elements in the first vector representation are hash values corresponding to different first function vectors. Then, step 270 is specifically implemented as at least part of steps 271, 272 and 273: Step 271, clustering is performed on the plurality of first function vectors to determine the clustering clusters to which the plurality of first function vectors respectively belong.

[0083] Clustering is used to divide the plurality of first function vectors into a plurality of clustering clusters. Each clustering cluster is a set of first function vectors. The first function vectors in the same clustering cluster are similar to each other, and the first function vectors in different clustering clusters are not similar to each other.

[0084] For example, the computer device performs clustering on the plurality of first function vectors by using at least one clustering manner to determine the clustering clusters to which the plurality of first function vectors respectively belong. Optionally, the clustering manner includes at least one of K-Means clustering, hierarchical clustering and density-based clustering DBSCAN. In one example, the number of clustering clusters in this embodiment is 2 22

[0085] Step 272, obtaining the clustering cluster identifiers respectively corresponding to the plurality of clustering clusters.

[0086] ​The cluster identifier ID is used to uniquely identify the cluster. The cluster identifier can be a combination of at least one of numbers, letters, and characters. In this embodiment, the cluster identifier of each cluster is represented as an integer, and the integer is represented in the form of One-Hot coding.

[0087] For example, the computer device obtains the cluster identifiers corresponding to the plurality of clusters. Alternatively, the cluster identifier of each cluster can be pre-set, for example, each cluster and its corresponding cluster identifier are pre-set; or the cluster identifier can be determined in real time according to the number of clusters, for example, if there is only one cluster, the corresponding cluster identifier is determined in real time as 1, and if one more cluster is added, the cluster identifier of the added cluster is determined in real time as 2.

[0088] In step 273, the cluster identifiers corresponding to the plurality of first function vectors are combined to obtain a first vector representation of the first binary program.

[0089] The combination manner includes combination in a specified order or random combination. Alternatively, the random combination is out of order. The specified order can be determined based on the execution order of the first function corresponding to the first function vector in the first binary program. For example, the first binary program includes at least an input function and an output function, and the specified combination order is that the cluster identifier of the function vector corresponding to the input function is in front, and the cluster identifier of the function vector corresponding to the output function is in the back.

[0090] For example, the computer device combines the cluster identifiers corresponding to the plurality of first function vectors to obtain the first vector representation. The first vector representation in this embodiment is in the form of One-Hot coding, and the first vector representation is in the form of hash representation. In the One-Hot coding, the integer of the cluster identifier is represented as a binary value, and the elements in the first vector representation are composed of "0" and "1".

[0091] In this embodiment, a hash method based on unsupervised clustering is provided, which can hash the first binary program to a fixed-length first vector representation, and the first vector representation can represent rich semantic information of the first binary program, which is beneficial to improve the accuracy of similarity calculation.

[0092] In some embodiments, step 273 specifically includes step 2731 and step 2732: In step 2731, the cluster identifiers corresponding to the plurality of first function vectors are combined to obtain a sparse vector representation of the first binary program.

[0093] The sparse vector representation is a vector representation composed of the cluster identifiers.

[0094] Since the cluster identifier corresponding to the first function vector is represented as an integer, the length of which is less than the length of the first function vector, the computer device combines the cluster identifiers corresponding to the plurality of first function vectors, and the plurality of first function vectors are represented as a sparse vector representation, thereby obtaining a sparse vector representation of the first binary program, and the length of the sparse vector representation is the number of cluster groups. In this embodiment, the number of cluster groups is set to 2 22 , and the length of the sparse vector representation is 1*2 22 .

[0095] In step 2732, the length of the sparse vector representation is reduced to a preset length, and a first vector representation of the first binary program is obtained.

[0096] The preset length is set in advance and can be set according to actual technical needs, for example, according to at least one of an application scenario and a calculation amount. In one example, the preset length is set to 1*1024.

[0097] Optionally, the way to reduce the length of the sparse vector representation can be at least one of dimension reduction and a Feature Hash method. For example, the computer device reduces the length of the sparse vector representation to a preset length, and a first vector representation of the first binary program is obtained.

[0098] In this embodiment, the sparse vector representation of the first binary program is obtained, and then the first vector representation is obtained, so that a fixed-length first vector representation with a shorter length is obtained. Since the first vector representation and the second vector representation are processed in the same way, the lengths of the first vector representation and the second vector representation are the same, and both the first vector representation and the second vector representation are hash vector representations, so that the calculation speed when calculating the similarity is improved, that is, this embodiment takes into account the time performance overhead on the basis of taking into account the semantic information.

[0099] • Unsupervised learning method 2 In this embodiment, each of the plurality of first function vectors of the first binary function is a floating-point vector, and the first vector representation determined based on the plurality of first function vectors is a floating-point vector representation, and the elements of the first vector representation are floating-point numbers. Step 270 can be implemented as at least one of steps 275, 276, 277, and 278: Step 275, determining the weight corresponding to each of the plurality of first function vectors.

[0100] In the case of unsupervised learning, different weights can be assigned to the first function vectors according to the information effectiveness and information richness of the first function vectors. Optionally, the information effectiveness and information richness can be represented by at least one of the size, length, and complexity of the first function vectors.

[0101] Specifically, the computer device determines the respective weights of the first function vectors. The weight of a first function vector is positively correlated with at least one of the size, length, and complexity of the first function vector, i.e., the larger, longer, and more complex the first function vector is, the larger the corresponding weight is.

[0102] At step 276, the computer device performs weighted summation on the first function vectors based on the weights to obtain an initial vector representation of the first binary program.

[0103] The initial vector representation is obtained by performing weighted summation on the first function vectors based on the weights.

[0104] For example, the computer device performs weighted summation on the first function vectors based on the weights to obtain the initial vector representation of the first binary program.

[0105] At step 277, the computer device obtains a common vector representation corresponding to the first function vectors, which is used to represent the common semantic information between the first function vectors.

[0106] The common vector representation is a vector representation corresponding to the common semantic information between the first function vectors.

[0107] Optionally, the common vector representation of the present embodiment is at least one common vector representation. For example, the common vector representation can be determined by a principal component analysis (PCA) method. Specifically, the computer device analyzes the first function vectors by the PCA method to obtain at least one principal component corresponding to the first function vectors, each principal component in the at least one principal component corresponding to one common vector representation. The PCA method is used to sort the principal components according to the size of the contribution of the variance, and the at least one principal component is the first N principal components, where N is greater than 0.

[0108] In some embodiments, the computer device further performs orthogonal decomposition on each two first function vectors in the first function vectors by an orthogonal decomposition method to obtain the common vector representation between each two first function vectors in the first function vectors.

[0109] At step 278, a first vector representation of the first binary program is obtained based on the initial vector representation and the common vector representation; wherein a weight of the first function vector is in a positive correlation with at least one of a size, a length, and a complexity of the first function vector.

[0110] The computer device obtains the first vector representation of the first binary program based on the initial vector representation and the common vector representation. Specifically, the computer device can subtract the common vector representation from the initial vector representation to obtain the first vector representation of the first binary program, which is used to reserve the semantic information with differences between the first function vectors.

[0111] In this embodiment, by determining the initial vector representation of the first binary program, obtaining the common vector representation, and obtaining the first vector representation based on the initial vector representation and the common vector representation, the accuracy of the first vector representation can be improved. Since the common vector representation is used to represent the common semantic information between the first function vectors, when the computer device subtracts the common vector representation from the initial vector representation to obtain the first vector representation of the first binary program, the first vector representation can reserve the semantic information with differences between the first function vectors as much as possible, and further make the first vector representation more accurately represent the first binary program. Moreover, the difference degree between the first vector representation and the second vector representation is further improved, thereby facilitating the accuracy of the calculation of the similarity.

[0112] The foregoing embodiment is a manner of unsupervised learning. In another embodiment, the computer device also pre-trains a deep neural network in a supervised learning manner, and the deep neural network is used to determine the first vector representation of the first binary program based on the plurality of first function vectors. For example, the deep neural network is a graph neural network. In the training stage, the computer device obtains a sample program, which can be a sample binary program or a sample source code program corresponding to the sample binary program. The sample program includes a plurality of sample functions, and the sample program is labeled with a sample vector representation. An embedding model is used to map the sample functions to sample function features. A graph neural network to be trained is constructed according to the semantic calling relationship between the plurality of sample functions in the sample program, wherein each node of the graph neural network to be trained is a sample function, and two nodes are connected to represent that the sample functions of the two nodes have a semantic calling relationship. The sample vector representation is used as a positive sample, and other sample vector representations of other samples are used as negative samples. The model parameters of the graph neural network to be trained are trained by contrastive learning to obtain the graph neural network. In the use stage, the plurality of first function vectors are input into the graph neural network to obtain the first vector representation of the first binary program. The embodiment also provides a manner of supervised learning, which can be selected according to actual technical needs, and improves the flexibility of determining the first vector representation and the second vector representation.

[0113] In this embodiment, the first binary program and the second binary program are processed in the same manner. Therefore, the determination manner of the first function vector is consistent with the determination manner of the second function vector. The following embodiments take the first binary program and the first function vector of the first binary program as an example for description. Similarly, the second function vector of the second binary program can also be applied. The following embodiments introduce two mapping manners, which can be selected according to actual technical needs in actual application, or used in combination.

[0114] • Mapping manner 1 In some embodiments, the first function vector refers to a vector obtained by mapping a plurality of first functions in the first binary program, the first function corresponds to the first function vector in a one-to-one manner, and the first function is a source code function in the source code program after decompilation.

[0115] Figure 5 is a flowchart of a similarity calculation method provided by an exemplary embodiment of the present application. Step 240 maps the first binary program into a plurality of first function vectors, which is implemented as steps 241 and 242: Step 241, the first binary program is decompiled to obtain a source code program corresponding to the first binary program, and the source code program corresponding to the first binary program includes a plurality of source code functions corresponding to a plurality of first binary functions in the first binary program.

[0116] De-compilation is a reverse process of compilation, and de-compilation can be achieved by a de-compilation tool. In the process of compilation, a compiler is used to translate a source code program into an equivalent binary program in binary format. Then, the de-compilation tool is used to translate the binary program in binary format into a pseudo code representation, also known as a pseudo code program. It can be understood that, in the case that the de-compilation tool is intelligent and accurate enough, the pseudo code program is the same as or similar to the original source code program.

[0117] The pseudo code representation is obtained by performing de-compilation on the first binary program. The computer programming language corresponding to the pseudo code representation can be at least one of C, C++, Java, Python, and vb.net. For example, the computer device performs de-compilation on the first binary program to obtain a source code program corresponding to the first binary program, and the source code program includes source code functions (also referred to as pseudo code representations) corresponding to the first binary functions in the first binary program. Each first binary function has a corresponding source code function. In this embodiment, the pseudo code representation is a text representation, and the pseudo code representation and the source code program are both regarded as text features. The pseudo code representation of a first binary function is a text feature.

[0118] In step 242, the source code functions corresponding to the first binary functions are input into a feature embedding model, and the feature embedding model is used to map the source code functions corresponding to the first binary functions one by one into first function vectors.

[0119] The feature embedding model refers to a neural network model of the Transformer type, which is used to represent a source code function or a binary function as a corresponding function vector. The neural network model can be a deep neural network, and the function vector is an embedding vector.

[0120] For example, the computer device inputs the source code functions (pseudo code representations) corresponding to the first binary functions into the feature embedding model, and uses the feature embedding model to map the source code functions corresponding to the first binary functions one by one into first function vectors.

[0121] In this embodiment, the source code program corresponding to the first binary program is obtained by performing de-compilation first, and the source code program includes the source code functions (pseudo code representations) corresponding to the first binary functions in the first binary program one by one. Then, the first function vectors are obtained based on the one-to-one mapping of the pseudo code representations. Since the pseudo code representation is regarded as a text feature, this method can fully retain the semantic information involved in the text feature, thereby facilitating the improvement of the accuracy of the subsequent similarity calculation.

[0122] • Mapping method 2 In some embodiments, the first function vector refers to a vector mapped from a plurality of first function executions in the first binary program, the first function corresponds to the first function vector one-to-one, and the first function is a binary function in the first binary program. For example, continuing to refer to Figure 5 Then, step 240 maps the first binary program into a plurality of first function vectors, which is implemented as step 246: Step 246 inputs a plurality of first binary functions in the first binary program into the feature embedding model respectively, and maps the plurality of first binary functions into first function vectors one-to-one by using the feature embedding model.

[0123] The feature embedding model refers to a neural network model of the Transformer type, which is used to represent a source code function or a binary function as a corresponding function vector, and the function vector is an embedding vector.

[0124] For example, the computer device inputs a plurality of first binary functions in the first binary program into the feature embedding model one-to-one, and maps the plurality of first binary functions into first function vectors one-to-one by using the feature embedding model, wherein one first function vector is used to represent semantic information of a source code function corresponding to one first binary function.

[0125] In some embodiments, since the first binary program is composed of "0" and "1", it is difficult to distinguish the first binary functions contained in the first binary program, so the computer device further divides the first binary program execution to determine a plurality of first binary functions in the first binary program. As an example, the computer device includes a large language model, and divides the first binary program execution by using the large language model based on at least one of semantic information of the first binary program, a compiler, a compilation option, a release version, a device architecture, a CPU architecture, and a number of bits of the architecture, to determine a plurality of first binary functions in the first binary program.

[0126] Specifically, the computer device obtains a first binary program; retrieves a database based on the first binary program to obtain an example binary program with a similarity between semantic information of the first binary program greater than a threshold value, and the same compiler, compilation option, release version, device architecture, CPU architecture, and architecture bit number, wherein the database pre-stores different binary programs and a binary function division result pre-labeled for each binary program, the binary function division result includes a plurality of binary functions, and the binary function division result of each binary program is obtained based on division of each source code function in a source code program corresponding to the binary program; next, based on the first binary program, the example binary program, and an example binary function division result corresponding to the example binary program, a prompt information (Prompt) of a large language model is constructed, specifically, the prompt information can be obtained by combining the first binary program, the example binary program, and the example binary function division result corresponding to the example binary program in a set format, and the prompt information is used to make the large language model divide a plurality of binary functions of the first binary program as a reference example based on the example binary program and the example binary function division result corresponding to the example binary program; and finally, the prompt information is input into the large language model to determine a plurality of first binary functions in the first binary program by the large language model. The embodiment can fully utilize the function of the large language model itself and the learning ability of semantic information, accurately divide a plurality of first binary functions contained in the first binary program, and is beneficial to subsequent one-to-one mapping of the first binary functions to obtain corresponding first function vectors, and the second binary program can also adopt this way, which will not be described herein.

[0127] In the embodiment, the first function vector is directly mapped from the first binary function of the first binary program, without the need for additional processing of the first binary program, thereby improving the data processing speed and quickly obtaining a plurality of first function vectors of the first binary program.

[0128] In some embodiments, the feature embedding model is pre-trained, and the training data thereof is associated with the source code functions and the binary functions. Figure 6 is a flowchart of a similarity calculation method provided by an example embodiment of the present application. Based on the mapping mode 1 and the mapping mode 2, the method further includes at least one of steps 310, 320, 330, 340, and 350: Step 310: obtaining a sample source code program, the sample source code program including a plurality of sample source code functions.

[0129] The sample source code program is a source code program obtained in a training stage of the feature embedding model. The sample source code program is a program written in a computer programming language, and the sample source code program includes a plurality of sample source code functions.

[0130] Optionally, the computer device obtains a sample source code program from the disclosed program data set, and the sample source code program includes a plurality of sample source code functions. As an example, in order to further improve the accuracy of the feature embedding model, the computer programming language used by the sample source code program is consistent with the computer programming language corresponding to the aforementioned pseudo code representation obtained by decompiling.

[0131] At step 320, the sample source code program is compiled to obtain a plurality of sample binary functions corresponding to the plurality of sample source code functions in the sample source code program.

[0132] The compilation is used to translate the plurality of sample source code functions in the sample source code program into a plurality of sample binary functions corresponding thereto. Optionally, the computer device performs a debugging symbol compilation on the sample source code program by using a compiler to obtain a plurality of sample binary functions corresponding to the plurality of sample source code functions in the sample source code program.

[0133] At step 330, the sample source code functions are mapped into sample source code function features, and the sample binary functions are mapped into sample binary function features by using the feature embedding model to be trained.

[0134] As an example, the computer device inputs the sample source code functions into the feature embedding model to be trained, and maps the sample source code functions into sample source code function features by using the feature embedding model to be trained. The computer device also inputs the sample binary functions into the feature embedding model to be trained, and maps the sample binary functions into sample binary function features by using the feature embedding model to be trained.

[0135] At step 340, a positive-negative sample pair is constructed based on the sample source code function features and the sample binary function features.

[0136] In this embodiment, the feature embedding model to be trained is trained in a contrastive learning manner. The contrastive learning is used to make similar samples close to each other in a feature space, and make dissimilar samples far away from each other in the feature space.

[0137] Optionally, the computer constructs a positive-negative sample pair based on the sample source code function features and the sample binary function features. The positive-negative sample pair includes a positive sample pair and a negative sample pair. The positive sample pair includes the sample source code function features and the corresponding sample binary function features. The negative sample pair includes other sample pairs except the positive sample pair, such as a sample pair composed of two sample source code function features, a sample pair composed of two sample binary function features, and a sample pair composed of a sample source code function and a sample binary function feature not corresponding thereto.

[0138] At step 350, based on the positive-negative sample pair, contrastive learning training is performed on the model parameters of the feature embedding model to be trained to obtain the feature embedding model; wherein the positive-negative sample pair includes a positive sample pair and a negative sample pair, the positive sample pair includes a sample source code function feature and a corresponding sample binary function feature, and the negative sample pair includes other sample pairs except the positive sample pair.

[0139] For example, the computer device performs contrastive learning training on the model parameters of the feature embedding model to be trained based on the positive-negative sample pair, so that the two samples in the positive sample pair are close to each other in the feature space, and the two samples in the negative sample pair are far away from each other in the feature space, and when a training end condition is reached, the feature embedding model is obtained. Optionally, the training end condition includes at least one of reaching a set number of iterations or a prediction accuracy reaching a threshold.

[0140] In this embodiment, the training data of the feature embedding model is set based on the program code scenario related to the present application, so that the feature embedding model is more targeted for processing of programs and functions in programs, and when a plurality of function vectors of a program are obtained through the feature embedding model, the accuracy of the function vectors can be improved, thereby facilitating similarity calculation.

[0141] In some embodiments, on the basis of the foregoing embodiments, step 280 is specifically implemented as step 282: At step 282, a distance between the first vector representation and the second vector representation is calculated to obtain a similarity between the first binary program and the second binary program; wherein the distance includes at least one of a Hamming distance, a Jaccard distance, and a Cosine distance.

[0142] The distance is determined based on the first vector representation of the first binary program and the second vector representation of the second binary program. The closer the distance, the more similar the first binary program and the second binary program. The distance includes at least one of a Hamming distance, a Jaccard distance, and a Cosine distance.

[0143] For example, the specific type of the distance matches the type of the first vector representation and the second vector representation. When the first vector representation and the second vector representation are both hash vector representations, the distance can be specifically a Hamming distance and / or a Jaccard distance, and when the first vector representation and the second vector representation are both floating-point vector representations, the distance can be specifically a Cosine distance. In some examples, when different types of distances are used and multiple distances are calculated, the multiple distances can be averaged or weighted to obtain a final distance, and based on the final distance, the similarity between the first binary program and the second binary program is obtained.

[0144] In this embodiment, multiple distance calculation methods are provided for the first vector representation and the second vector representation. The corresponding calculation method can be selected according to actual technical needs, and the flexibility of the similarity calculation is improved.

[0145] The overall flow of the similarity calculation method provided by the embodiment of the application is described below in combination with a specific schematic diagram, mainly including an algorithm part, beneficial effects, and application scenarios.

[0146] • Algorithm part Figure 7 is a schematic diagram of the similarity calculation method provided by an exemplary embodiment of the application. The method is executed by a computer device, which can be the terminal 120 and / or the server 140 shown in Figure 1 The entire method includes two parts, which are a binary function vector embedding algorithm based on a neural network model and an unsupervised hashing / vectorization algorithm for a vector set.

[0147] 1. Binary function vector embedding algorithm based on neural network model In some embodiments, the computer device pre-adopts a neural network model of the Transformer type as a model structure, performs contrastive learning training, and obtains a feature embedding Embedding model 70.

[0148] 1.1. Training phase The training data of the Embedding model 70 is a positive-negative sample pair. Among them, the sample source code program is compiled with debugging symbols to obtain a sample binary function corresponding to each sample source code function in the sample source code program, and the sample source code function and the corresponding sample binary function are taken as a positive sample pair. Other sample pairs except the positive sample pair are taken as negative sample pairs. After multiple rounds of contrastive learning training, the Embedding model 70 is obtained, which is used to represent the source code function or the binary function as a corresponding Embedding function vector.

[0149] 1.2. Use phase The computer device obtains the first binary program 10, performs decompilation 60 on the first binary program 10 by using a decompilation tool, obtains the pseudo code representation corresponding to each of the first binary functions in the first binary program 10, and regards the pseudo code representation and the source code program as text features, which corresponds to the neural network model with the model structure of the Transformer type, to obtain function features 11', 12', 13', etc. corresponding to the first binary program 10. The Embedding model 70 is used to obtain the function vector 11 corresponding to the function feature 11', the function vector 12 corresponding to the function feature 12', the function vector 13 corresponding to the function feature 13', etc.

[0150] The computer device obtains the second binary program 20, performs decompilation 60 on the second binary program 20 by using a decompilation tool, obtains the pseudo code representation corresponding to each of the second binary functions in the second binary program 20, and regards the pseudo code representation and the source code program as text features, which corresponds to the neural network model with the model structure of the Transformer type, to obtain function features 21', 22', 23', etc. corresponding to the second binary program 20. The Embedding model 70 is used to obtain the function vector 21 corresponding to the function feature 21', the function vector 22 corresponding to the function feature 22', the function vector 23 corresponding to the function feature 23', etc.

[0151] 2. Unsupervised hashing / vectorization algorithm for vector set After the computer device processes the first binary program 10 and the second binary program 20 in the foregoing manner, a plurality of function vectors of the first binary program 10 are obtained, and a plurality of function vectors of the second binary program 20 are obtained. Optionally, the plurality of function vectors of the first binary program 10 are combined into a vector set, and then the processing of the unsupervised learning manner 30 is performed, or the processing of the unsupervised learning manner 30 is directly performed on each of the plurality of function vectors of the first binary program 10. In addition, the plurality of function vectors of the second binary program 20 are combined into a vector set, and then the processing of the unsupervised learning manner 30 is performed, or the processing of the unsupervised learning manner 30 is directly performed on each of the plurality of function vectors of the second binary program 20. The unsupervised learning manner 30 includes at least one of a hashing method based on unsupervised clustering and a vectorization method based on unsupervised weighted summation.

[0152] 2.1 Hashing method based on unsupervised clustering For the first binary program 10, the computer device determines the cluster to which each function vector of the first binary program 10 belongs by using the K-Means clustering method, and the number of clusters is set to 2 in this embodiment. 22The computer device obtains the cluster ID corresponding to the cluster to which each function vector belongs, and each cluster ID is represented by an integer. The cluster IDs corresponding to each function vector are combined in disorder to represent the function vectors of the second binary program 20 as a sparse vector representation. The length of the sparse vector representation is the number of clusters, and the sparse vector representation is in the form of One-Hot encoding. The sparse vector representation is converted into a fixed-length vector representation 42 by using the Feature Hash method, and the fixed length is set to 1*1024 in this embodiment.

[0153] For the second binary program 20, the computer device determines the cluster to which each function vector of the second binary program 20 belongs by using the K-Means clustering method. In this embodiment, the number of clusters is set to 2 22 The computer device obtains the cluster ID corresponding to the cluster to which each function vector belongs, and each cluster ID is represented by an integer. The cluster IDs corresponding to each function vector are combined in disorder to represent the function vectors of the second binary program 20 as a sparse vector representation. The length of the sparse vector representation is the number of clusters, and the sparse vector representation is in the form of One-Hot encoding. The sparse vector representation is converted into a fixed-length vector representation 42 by using the Feature Hash method, and the fixed length is set to 1*1024 in this embodiment.

[0154] The computer device calculates the Hamming distance or the Jaccard distance between the vector representation 41 and the vector representation 42 to obtain the similarity between the first binary program 10 and the second binary program 20. In the case of calculating the Hamming distance or the Jaccard distance at the same time, the Hamming distance and the Jaccard distance are averaged or weighted to obtain the final distance, thereby obtaining the similarity between the first binary program 10 and the second binary program 20.

[0155] 2.2 Vectorization method based on unsupervised weighted summation For the first binary program 10, the computer device determines the weight corresponding to each function vector of the first binary program 10 based on the information validity and the information richness of the function vectors. The weighted summation is performed on the function vectors of the first binary program 10 based on the weight to obtain the initial vector representation of the first binary program 10. The first N principal components determined by the PCA analysis are obtained, each principal component corresponds to a public vector representation, and the initial vector representation is subtracted from the public vector representation corresponding to the first N principal components obtained by the PCA analysis to obtain the vector representation 41 of the first binary program 10. The vector representation 41 retains the semantic information of the differences between the functions in the first binary program 10 as much as possible.

[0156] For the second binary program 20, the computer device determines the weight corresponding to each function vector of the second binary program 20 based on the information validity and information richness of the function vectors of the second binary program 20. The computer device performs weighted summation on the function vectors of the second binary program 20 based on the weight, and obtains an initial vector representation of the second binary program 20. The computer device obtains the first N principal components determined by the PCA analysis, each principal component corresponding to a public vector representation, and subtracts the public vector representation corresponding to the first N principal components obtained by the PCA analysis from the initial vector representation, to obtain a vector representation 42 of the second binary program 20. The vector representation 42 retains the semantic information of the differences between the functions in the second binary program 20 as much as possible.

[0157] The computer device calculates the cosine distance between the vector representation 41 and the vector representation 42, to obtain the similarity between the first binary program 10 and the second binary program 20. In the case of obtaining the similarity between the first binary program 10 and the second binary program 20 in the manner of 2.1 and 2.2, the two similarities are averaged or weighted summed to obtain the similarity between the first binary program 10 and the second binary program 20.

[0158] ·Beneficial effects In the similar binary program file recall task, compared with other binary program similarity calculation methods, the beneficial effects shown in Table 1 exist. The comparison indicators are mAP@100 and mP@100. mAP and mP are different performance indicators for evaluating the performance of information retrieval, object detection and related fields. It can be seen that the method of the embodiments of the present application has better performance indicators on normal software sample set and malicious software sample set compared with the two methods of the related art.

[0159] Table 1

[0160] In summary, the method of the embodiments of the present application can balance rich semantic features and time performance overhead, extract semantic features of each function in the program, represent the program as a more accurate vector representation containing more semantic information, support fast binary program similarity analysis under large-scale binary program data set, and improve the accuracy of the calculated similarity between programs, with high accuracy and robustness.

[0161] ·Application scenarios 1. Malware detection For example, the computer device determines whether a target binary program is a malicious software program by calculating the similarity between the target binary program and a malicious binary program of known malicious software.

[0162] Specifically, the computer device obtains a target binary program and a malicious binary program; performs decompilation on the target binary program to obtain pseudo-code representations corresponding to a plurality of first binary functions in the target binary program; inputs the pseudo-code representations corresponding to the plurality of first binary functions into a feature embedding model, and uses the feature embedding model to map the pseudo-code representations corresponding to the plurality of first binary functions into first function vectors one by one. In addition, the computer device performs decompilation on the malicious binary program to obtain pseudo-code representations corresponding to a plurality of second binary functions in the malicious binary program; inputs the pseudo-code representations corresponding to the plurality of second binary functions into the feature embedding model, and uses the feature embedding model to map the pseudo-code representations corresponding to the plurality of second binary functions into second function vectors one by one. Based on a hash method based on unsupervised clustering or a vectorization method based on unsupervised weighted summation, the computer device determines a first vector representation of the target binary program based on the plurality of first function vectors, and determines a second vector representation of the malicious binary program based on the plurality of second function vectors; calculates a distance between the first vector representation and the second vector representation to obtain a similarity between the target binary program and the malicious binary program. If the similarity between the target binary program and the malicious binary program exceeds a threshold value, the computer device determines that the target binary program is a malicious software program.

[0163] The embodiment can quickly calculate the similarity between the target binary program and the malicious binary program without obtaining the source code of the target binary program and the malicious binary program, and improves the accuracy of the calculated similarity.

[0164] 2. Software plagiarism detection For example, the computer device calculates a target binary program of target software and a known binary program of known software to determine whether the target software plagiarizes the known software.

[0165] Specifically, the computer device acquires a target binary program, and acquires a known binary program; performs decompilation on the target binary program to obtain pseudo-code representations corresponding to a plurality of first binary functions in the target binary program respectively; inputs the pseudo-code representations corresponding to the plurality of first binary functions respectively into a feature embedding model, and uses the feature embedding model to map the pseudo-code representations corresponding to the plurality of first binary functions respectively into first function vectors one by one. In addition, the known binary program is decompiled to obtain pseudo-code representations corresponding to a plurality of second binary functions in the known binary program respectively; the pseudo-code representations corresponding to the plurality of second binary functions respectively are input into the feature embedding model, and the feature embedding model is used to map the pseudo-code representations corresponding to the plurality of second binary functions respectively into second function vectors one by one. Based on a hash method of unsupervised clustering or a vectorization method of unsupervised weighted summation, a first vector representation of the target binary program is determined based on the plurality of first function vectors, and a second vector representation of the known binary program is determined based on the plurality of second function vectors; the distance between the first vector representation and the second vector representation is calculated to obtain the similarity between the target binary program and the known binary program. In a case where the similarity between the target binary program and the known binary program exceeds a threshold value, the target binary program is determined to be a malicious software program.

[0166] The embodiment can quickly calculate the similarity between the target binary program and the known binary program without acquiring the source code programs of the target binary program and the known binary program, and improve the accuracy of the calculated similarity.

[0167] Figure 8 is a block diagram of a similarity calculation apparatus 800 provided by an exemplary embodiment of the present application. The similarity calculation apparatus 800 includes at least a part of the following modules: an acquisition module 810, a mapping module 820, a determination module 830, and a calculation module 840. The acquisition module 810 is configured to acquire a first binary program and a second binary program. The mapping module 820 is configured to map the first binary program into a plurality of first function vectors, and map the second binary program into a plurality of second function vectors. Each of the first function vectors is used to represent semantic information of a source code function in a source code program corresponding to the first binary program, and each of the second function vectors is used to represent semantic information of a source code function in a source code program corresponding to the second binary program. The determining module 830 is configured to determine a first vector representation of the first binary program based on the first function vectors, and determine a second vector representation of the second binary program based on the second function vectors, the first vector representation being used to represent semantic information of a source code program corresponding to the first binary program, and the second vector representation being used to represent semantic information of a source code program corresponding to the second binary program. The calculating module 840 is configured to calculate a similarity between the first binary program and the second binary program based on the first vector representation and the second vector representation.

[0168] In some embodiments, the second vector representation is determined in a manner consistent with the first vector representation, and the determining module 830 is configured to determine the first vector representation of the first binary program based on the first function vectors by using at least one unsupervised learning manner.

[0169] In some embodiments, the determining module 830 is configured to: perform clustering on the first function vectors to determine clusters to which the first function vectors respectively belong; obtain cluster identifiers respectively corresponding to the clusters; combine the cluster identifiers respectively corresponding to the first function vectors to obtain the first vector representation of the first binary program.

[0170] In some embodiments, the determining module 830 is configured to: combine the cluster identifiers respectively corresponding to the first function vectors to obtain a sparse vector representation of the first binary program; and reduce a length of the sparse vector representation to a preset length to obtain the first vector representation of the first binary program.

[0171] In some embodiments, the determining module 830 is configured to: determine weights respectively corresponding to the first function vectors; perform weighted summation on the first function vectors based on the weights to obtain an initial vector representation of the first binary program; obtain a common vector representation corresponding to the first function vectors, the common vector representation being used to represent common semantic information between the first function vectors; obtain the first vector representation of the first binary program based on the initial vector representation and the common vector representation; The weight of the first function vector is in a positive correlation with at least one of a size, a length, and a complexity of the first function vector.

[0172] In some embodiments, the determining module 830 is configured to: subtract the common vector representation from the initial vector representation to obtain the first vector representation of the first binary program.

[0173] In some embodiments, the mapping module 820 is configured to: perform decompilation on the first binary program to obtain a source code program corresponding to the first binary program, the source code program corresponding to the first binary program including a plurality of first binary functions in the first binary program corresponding to a plurality of source code functions, respectively; input the plurality of source code functions corresponding to the plurality of first binary functions, respectively, into a feature embedding model, and map the plurality of source code functions corresponding to the plurality of first binary functions, respectively, into the first function vector using the feature embedding model.

[0174] In some embodiments, the mapping module 820 is further configured to: input a plurality of first binary functions in the first binary program into a feature embedding model, and map the plurality of first binary functions into the first function vector using the feature embedding model.

[0175] In some embodiments, the apparatus further includes a training module configured to: obtain a sample source code program, the sample source code program including a plurality of sample source code functions; perform compilation on the sample source code program to obtain a plurality of sample binary functions corresponding to the plurality of sample source code functions in the sample source code program, respectively; map the sample source code functions into sample source code function features and map the sample binary functions into sample binary function features using a feature embedding model to be trained; construct a positive-negative sample pair based on the sample source code function features and the sample binary function features; perform contrastive learning training on model parameters of the feature embedding model to be trained based on the positive-negative sample pair to obtain the feature embedding model; wherein the positive-negative sample pair includes a positive sample pair and a negative sample pair, the positive sample pair includes the sample source code function features and corresponding sample binary function features, and the negative sample pair includes other sample pairs except the positive sample pair.

[0176] In some embodiments, the computing module 840 is configured to: calculate a distance between the first vector representation and the second vector representation, to obtain the similarity between the first binary program and the second binary program; The distance includes at least one of a Hamming distance, a Jaccard distance, and a cosine distance.

[0177] It should be noted that the specific definitions and beneficial effects in the embodiments of the above-provided one or more similarity calculation apparatuses 800 can refer to the definitions and beneficial effects of the similarity calculation methods and the beneficial effects described above, and will not be described here. The modules of the above apparatuses can be realized by software, hardware, and combinations thereof, and the modules can be embedded in the processor of the computer device in hardware form or independent of the processor of the computer device, or can be stored in the memory of the computer device in software form to be called and executed by the processor to perform the operations corresponding to the modules.

[0178] The embodiments of the present application further provide a computer device, which comprises a processor and a memory, the memory storing a computer program; the processor is configured to execute the computer program in the memory to implement the similarity calculation method provided by the above-mentioned method embodiments.

[0179] For example, Figure 9 is a structural block diagram of a computer device 1000 provided by an exemplary embodiment of the present application. Optionally, the computer device 1000 is a server 1000.

[0180] Generally, the server 1000 comprises a processor 1001 and a memory 1002.

[0181] The processor 1001 can include one or more processing cores, such as a 4-core processor, an 8-core processor, and the like. The processor 1001 can be implemented in at least one of a hardware form of a digital signal processing (DSP), a field-programmable gate array (FPGA), a programmable logic array (PLA), and the like. The processor 1001 can also include a main processor and a coprocessor, the main processor being a processor for processing data in an awake state, also referred to as a central processing unit (CPU), and the coprocessor being a low-power processor for processing data in a standby state. In some embodiments, the processor 1001 can be integrated with a graphics processor (GPU) that is responsible for rendering and drawing content required to be displayed on a display screen. In some embodiments, the processor 1001 can further include an artificial intelligence (AI) processor for processing computing operations related to machine learning.

[0182] The memory 1002 can include one or more computer-readable storage media that can be non-transitory. The memory 1002 can also include high-speed random access memory and nonvolatile memory such as one or more disk storage devices, flash storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory 1002 is used to store at least one instruction for being executed by the processor 1001 to implement a similarity calculation method provided by the method embodiments in the present application.

[0183] In some embodiments, the server 1000 can further optionally include an input interface 1003 and an output interface 1004. The processor 1001, the memory 1002, and the input interface 1003 and the output interface 1004 can be connected through a bus or a signal line. Each peripheral device can be connected to the input interface 1003 and the output interface 1004 through a bus, a signal line, or a circuit board. The input interface 1003 and the output interface 1004 can be used to connect at least one peripheral device related to input / output (I / O) to the processor 1001 and the memory 1002. In some embodiments, the processor 1001, the memory 1002, and the input interface 1003 and the output interface 1004 are integrated on the same chip or circuit board; in some other embodiments, any one or both of the processor 1001, the memory 1002, and the input interface 1003 and the output interface 1004 can be implemented on a separate chip or circuit board, and the embodiments of the present application are not limited thereto.

[0184] Those skilled in the art can understand that, Figure 9 The structure shown in the figure is not a limitation on the computer device 1000, and can include more or fewer components than shown, or combine certain components, or use different component arrangements.

[0185] In an example embodiment, the present application provides a chip, which includes programmable logic circuit and / or program instructions, and when the chip is running on a computer device, is used to implement the similarity calculation method provided by the above method embodiments.

[0186] The present application provides a computer readable storage medium, which stores a computer program, and the computer program is loaded and executed by a processor to implement the similarity calculation method provided by the above method embodiments.

[0187] The present application provides a computer program product or computer program, which includes computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the processor of the computer device loads and executes to implement the similarity calculation method provided by the above method embodiments.

[0188] The above-mentioned serial numbers of the embodiments of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0189] Those skilled in the art can understand that all or part of the steps of the above-mentioned embodiments can be completed by hardware, or can be instructed by programs to complete the related hardware, and the programs can be stored in a computer readable storage medium. The computer readable storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0190] Those skilled in the art should be aware that in one or more examples described above, the functions described in the embodiments of the present application can be implemented in hardware, software, firmware or any combination thereof. When implemented in software, the functions can be stored in a computer readable medium or transmitted as one or more instructions or codes on a computer readable medium. The computer readable medium includes computer storage medium and communication medium, wherein the communication medium includes any medium that facilitates the transfer of computer programs from one place to another. The storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0191] The above description is only optional embodiments of the present application, and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A similarity calculation method characterized by comprising: The method comprises: obtaining a first binary program and a second binary program; mapping the first binary program into a plurality of first function vectors, each of which is used to represent semantic information of a source code function in a source code program corresponding to the first binary program, and mapping the second binary program into a plurality of second function vectors, each of which is used to represent semantic information of a source code function in a source code program corresponding to the second binary program; determining a first vector representation of the first binary program based on the plurality of first function vectors, and determining a second vector representation of the second binary program based on the plurality of second function vectors, the first vector representation being used to represent semantic information of the source code program corresponding to the first binary program, and the second vector representation being used to represent semantic information of the source code program corresponding to the second binary program; calculating a similarity between the first binary program and the second binary program based on the first vector representation and the second vector representation.

2. The method of claim 1, wherein, The determination manner of the second vector representation is consistent with the determination manner of the first vector representation. The determination of the first vector representation based on the plurality of first function vectors comprises: determining the first vector representation of the first binary program based on the plurality of first function vectors by using at least one unsupervised learning manner.

3. The method of claim 2, wherein, The determination of the first vector representation of the first binary program based on the plurality of first function vectors by using at least one unsupervised learning manner comprises: performing clustering on the plurality of first function vectors to determine a cluster to which each of the plurality of first function vectors belongs; obtaining a cluster identifier corresponding to each of the plurality of clusters; combining the cluster identifiers corresponding to the plurality of first function vectors to obtain the first vector representation of the first binary program.

4. The method of claim 3, wherein, The combination of the cluster identifiers corresponding to the plurality of first function vectors to obtain the first vector representation of the first binary program comprises: combining the cluster identifiers corresponding to the plurality of first function vectors to obtain a sparse vector representation of the first binary program; reducing the length of the sparse vector representation to a preset length to obtain the first vector representation of the first binary program.

5. The method of claim 2, wherein, The determination of the first vector representation of the first binary program based on the plurality of first function vectors by using at least one unsupervised learning manner comprises: determining a weight corresponding to each of the plurality of first function vectors; performing weighted summation on the plurality of first function vectors based on the weight to obtain an initial vector representation of the first binary program; obtaining a common vector representation corresponding to the plurality of first function vectors, the common vector representation being used to represent common semantic information between the plurality of first function vectors; obtaining the first vector representation of the first binary program based on the initial vector representation and the common vector representation; and calculating a similarity between the first binary program and the second binary program based on the first vector representation and the second vector representation. The weight of the first function vector is in positive correlation with at least one of a size, a length, and a complexity of the first function vector.

6. The method of claim 5, wherein, The first vector representation of the first binary program is obtained based on the initial vector representation and the common vector representation, and includes: The first vector representation of the first binary program is obtained by subtracting the common vector representation from the initial vector representation.

7. The method according to any one of claims 1 to 6, characterized in that, The first binary program is mapped into a plurality of first function vectors, and includes: The first binary program is decompiled to obtain a source code program corresponding to the first binary program, and the source code program corresponding to the first binary program includes a plurality of source code functions corresponding to a plurality of first binary functions in the first binary program respectively; The plurality of source code functions corresponding to the plurality of first binary functions are input into a feature embedding model, and the plurality of source code functions are one-to-one mapped into the first function vectors by using the feature embedding model.

8. The method according to any one of claims 1 to 6, characterized in that, The first binary program is mapped into a plurality of first function vectors, and includes: The plurality of first binary functions in the first binary program are input into a feature embedding model, and the plurality of first binary functions are one-to-one mapped into the first function vectors by using the feature embedding model.

9. The method according to claim 7 or 8, characterized in that, The method further includes: Obtaining a sample source code program, the sample source code program including a plurality of sample source code functions; Compiling the sample source code program to obtain a plurality of sample binary functions corresponding to the plurality of sample source code functions in the sample source code program respectively; Mapping the sample source code functions into sample source code function features and mapping the sample binary functions into sample binary function features by using a feature embedding model to be trained; Based on the sample source code function features and the sample binary function features, constructing a positive-negative sample pair; Based on the positive-negative sample pair, performing contrastive learning training on model parameters of the feature embedding model to be trained to obtain the feature embedding model; The positive-negative sample pair includes a positive sample pair and a negative sample pair, the positive sample pair includes the sample source code function features and corresponding sample binary function features, and the negative sample pair includes other sample pairs except the positive sample pair.

10. The method according to any one of claims 1 to 9, characterized in that, The similarity between the first binary program and the second binary program is calculated based on the first vector representation and the second vector representation, and includes: The distance between the first vector representation and the second vector representation is calculated to obtain the similarity between the first binary program and the second binary program. The distance includes at least one of a Hamming distance, a Jaccard distance, and a cosine distance.

11. A similarity calculation apparatus characterized by comprising: The apparatus includes: An obtaining module configured to obtain a first binary program and a second binary program; The mapping module is configured to map the first binary program into a plurality of first function vectors, each of which is used to represent semantic information of a source code function in a source code program corresponding to the first binary program, and map the second binary program into a plurality of second function vectors, each of which is used to represent semantic information of a source code function in a source code program corresponding to the second binary program. The determining module is configured to determine a first vector representation of the first binary program based on the plurality of first function vectors, and determine a second vector representation of the second binary program based on the plurality of second function vectors, the first vector representation being used to represent semantic information of the source code program corresponding to the first binary program, and the second vector representation being used to represent semantic information of the source code program corresponding to the second binary program. The computing module is configured to compute a similarity between the first binary program and the second binary program based on the first vector representation and the second vector representation.

12. A computer device, comprising: The computer device comprises a processor and a memory, and the memory stores a computer program, which is loaded and executed by the processor to implement the similarity computing method according to any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, which is loaded and executed by the processor to implement the similarity computing method according to any one of claims 1 to 10.

14. A computer program product, characterised in that, The computer program product comprises computer instructions stored in a computer readable storage medium, and the processor acquires the computer instructions from the computer readable storage medium, so that the processor is loaded and executed to implement the similarity computing method according to any one of claims 1 to 10.

Images