Vulnerability detection method and system based on code block characteristics

Abstract

The invention relates to the field of code vulnerability detection, in particular to a vulnerability detection method and system based on code block features. The method comprises the steps that firstly, a binary file is analyzed, and a machine instruction is analyzed through a hybrid disassembling engine; secondly, performing static linear scanning on the extracted binary file instruction, constructing a control flow graph, dividing basic blocks, extracting an operation code sequence in the basic blocks, and constructing a cross-basic-block data dependency graph and a system calling sequence called by the basic blocks; secondly, using an LSH algorithm to realize rapid filtering, performing similarity comparison on extracted basic block features and vulnerability feature library features, realizing coarse-grained matching, and screening out a matching candidate set; feature fusion is carried out on the candidate set basic block operation code sequence, the basic block data dependency graph and the system calling sequence called by the basic block, GNN fine-grained matching is carried out on the fused features, and vulnerability detection is carried out. The problems that traditional binary vulnerability detection is poor in adaptability and low in result reliability are solved.

Description

Technical Field

[0001] This invention belongs to the field of code vulnerability detection, specifically relating to a vulnerability detection method and system based on code block features. Background Technology

[0002] Existing vulnerability detection methods can be broadly categorized into dynamic and static domains. In the static analysis domain, commercial binary differentiation tools primarily use BidDiff, which performs many-to-many graph isomorphism detection on call graphs and control flow graphs (CFGs) and utilizes heuristics (e.g., function names, graph edge MD indices) to match functions and basic blocks. Other static analysis-based techniques perform matching on the generated control and data flow graphs or decompose the graph into fragments. These methods mostly consider only the syntax of instructions, neglecting semantics, which is crucial during analysis, especially when dealing with different compiler optimization techniques. Another research area is dynamic analysis. These techniques perform dynamic slicing or contamination on a given binary file by directly executing the given code and checking semantic-level equivalence based on information gathered during execution. Generally, these techniques excel at extracting code semantics and are resilient to compiler optimizations and code obfuscation, but due to the nature of dynamic analysis, they typically exhibit poor scalability and incomplete code coverage. Summary of the Invention

[0003] To address the shortcomings of existing methods, such as limited feature dimensions, low accuracy and execution efficiency, poor scalability, and inability to achieve cross-platform compatibility, this invention provides a code block feature-based vulnerability detection method and system. Through innovative design of dimensional feature zones and hierarchical matching, it achieves efficient and accurate vulnerability identification. This invention supports multiple architectures including x86 / ARM / MIPS / RISC-V and processes ELF / PE / Mach-O full-format files, effectively overcoming the technical bottlenecks of low segmentation accuracy, limited feature representation, and low detection efficiency in traditional binary vulnerability detection.

[0004] To achieve the above objectives, the present invention adopts the following technical solution:

[0005] A vulnerability detection method based on code block characteristics includes:

[0006] Obtain the binary file to be tested, parse the binary file, and use a hybrid disassembler engine to parse the machine instructions;

[0007] Based on the instructions, the basic block segmentation is performed. The extracted binary file instructions are subjected to static linear scanning, control flow graph is constructed, basic blocks are divided, basic block opcode features are generated, cross-basic block data dependency graph is constructed, and system call sequence of basic block calls is constructed.

[0008] LSH fast filtering uses the LSH algorithm and vulnerability feature library features to compare the similarity of basic block features, and coarsely filters the candidate set, which includes: basic block opcode sequences, cross-basic block data dependency graphs, and basic block call system call sequences. The basic block opcode sequences, cross-basic block data dependency graphs, and basic block call system call sequence features in the candidate set are fused, and the fused features are matched with GNN fine-grained features for vulnerability detection.

[0009] A further improvement of the present invention is that the basic block segmentation includes:

[0010] The binary file parsing process yields the binary file parsing structure, file architecture information, and all function information.

[0011] Static linear scan: Based on parsing the binary file to obtain all data sections in the binary file structure information, use Capstone disassembly, check whether it is a function start, branch instruction or branch target as a block boundary, create basic blocks, process branch instructions, and output the file basic block set;

[0012] Constructing the control flow graph: Based on all basic blocks collected from the static linear scan results, obtain the predecessor and successor blocks of each basic block, and connect the predecessor and successor blocks to form the control flow graph.

[0013] A further improvement of the present invention is that the basic block includes:

[0014] Basic block address, block size, number of instructions, predecessor block address, successor block address, and opcode sequence information.

[0015] A further improvement of the present invention is that the construction of the cross-basic block data dependency graph includes:

[0016] The formula for constructing a cross-block data dependency graph is:

[0017]

[0018] Represents basic block B i The set of output registers;

[0019] I mem This is a memory dependency indicator function; it takes the value 1 if a memory dependency exists, and 0 otherwise.

[0020] α is the memory weighting coefficient, set to 0.3.

[0021] A further improvement of this invention is that the system call sequence for constructing the basic block includes:

[0022] Based on the basic block information obtained from the static linear scan results, for all instructions in each basic block, the instruction set is precisely matched according to the architecture information of the binary file structure information, and a normalization function that converts case and removes leading and trailing spaces is used, along with a prefix matching function, to output an ordered sequence of all system call instructions in the basic block.

[0023] A further improvement of this invention is that the LSH rapid filtration includes:

[0024] The opcode sequence, control flow graph, cross-block data dependency graph, and system call sequence of basic block are extracted and vectorized into features. The four vector features are then concatenated into a basic block feature vector q.

[0025] Obtain the set v of feature vectors of known vulnerability basic blocks from the vulnerability database, and generate k random projection vectors r1, r2…r from the known vulnerability feature vectors. k Each r j It is a unit vector with the same dimension as v, for each vulnerability feature vector v i Calculate the hash value to generate the signature h j (v i The vulnerability feature vectors are placed into a hash table according to their signatures to build an LSH index;

[0026] Formula for constructing an LSH index:

[0027] The extracted basic block feature vector q is hashed to calculate its signature. The LSH index is then searched for a bucket with the same signature as the basic block feature vector q. All vulnerability feature vectors in this bucket constitute the candidate set C. The basic block feature vector q and each feature vector v in C are then calculated. i The similarity is set to a similarity threshold of 0.85, and candidate sets with similarity values ​​greater than the threshold are filtered out.

[0028] Similarity calculation:

[0029] A further improvement of this invention is that the GNN fine-grained matching includes:

[0030] The basic block opcode sequences, cross-basic block data dependency graphs, and basic block call system call sequences in the candidate set obtained by LSH fast filtering are vectorized into opcode feature vectors h. op , cross-block data dependency graph feature vector h DDG and the system call sequence feature vector h of basic block calls. syscall ;

[0031] Each basic block is used as a node in the graph. The node features are obtained by fusing the opcode feature vector and the system call vector. The edges are determined by the dependency relationships in the cross-basic block data dependency graph to construct the graph structure.

[0032] Given an input graph structure, the node representation is updated iteratively in multiple rounds using the message passing mechanism of GGNN. The final representation of all nodes is then taken and the vulnerability probability of each node is output through a fully connected layer.

[0033] Vulnerability determination is performed on the feature vectors. The fine-grained matching threshold of GNN is set to 0.92. If the feature vector detection result is greater than 0.92, it is judged as a vulnerability.

[0034] A further improvement of this invention lies in the calculation process for the vulnerability determination:

[0035] P vul =σ(W p ·[h op h DDG ·h syscall ])

[0036] p vul The calculated vulnerability probability result;

[0037] σ is the Sigmoid activation function, which "compresses" any real value of the calculation result within the parentheses into the (0,1) interval, making it a valid probability value;

[0038] W p Weight matrix

[0039] When p vul A value greater than 0.92 is considered a vulnerability.

[0040] A vulnerability detection system based on code block characteristics, comprising:

[0041] The file acquisition and parsing unit is used to acquire the binary file to be detected, parse the binary file, and use a hybrid disassembler engine to parse machine instructions.

[0042] The basic block segmentation unit is used to segment basic blocks according to instructions, perform static linear scanning on the extracted binary file instructions, construct a control flow graph, divide basic blocks, generate basic block opcode features, construct a cross-basic block data dependency graph, and construct a system call sequence of basic block calls;

[0043] The vulnerability detection unit is used for fast LSH filtering. It compares the similarity of basic block features with features from the vulnerability feature library using the LSH algorithm, and coarsely filters the candidate set. The candidate set includes: basic block opcode sequences, cross-basic block data dependency graphs, and basic block call system call sequences. The basic block opcode sequences, cross-basic block data dependency graphs, and basic block call system call sequence features in the candidate set are fused. The fused features are then matched with GNN for fine-grained vulnerability detection.

[0044] A further improvement of the present invention is that the basic block segmentation in the basic block segmentation unit includes:

[0045] The binary file parsing process yields the binary file parsing structure, file architecture information, and all function information.

[0046] Static linear scan: Based on parsing the binary file to obtain all data sections in the binary file structure information, use Capstone disassembly, check whether it is a function start, branch instruction or branch target as a block boundary, create basic blocks, process branch instructions, and output the file basic block set;

[0047] Constructing the control flow graph: Based on all basic blocks collected from the static linear scan results, obtain the predecessor and successor blocks of each basic block, and connect the predecessor and successor blocks to form the control flow graph.

[0048] Compared with the prior art, the present invention has at least the following beneficial technical effects:

[0049] To address the technical bottlenecks of low segmentation accuracy, limited feature representation, and low detection efficiency in existing vulnerability detection methods, this invention provides a vulnerability detection method and system based on code block features. The core of this invention lies in the synergistic innovation of multi-dimensional feature extraction and hierarchical matching mechanisms. First, the binary file to be detected is acquired, and its contents are parsed using a hybrid disassembler engine to analyze machine instructions. Second, the extracted binary file instructions undergo static linear scanning, control flow graph construction, basic block segmentation, extraction of opcode sequences within basic blocks, construction of cross-basic block data dependency graphs, and extraction of system call sequences from basic block calls. Third, LSH (Local Sensitive Hash) is used for rapid filtering, and similarity comparison is performed with features in a vulnerability feature library to achieve coarse-grained matching and select a matching candidate set. Finally, the opcode sequences within basic blocks, basic block data dependency graphs, and system call sequences from the LSH-filtered candidate set are fused, and GNN (Generative Neural Network) fine-grained matching is used on the fused features for vulnerability detection, improving the accuracy and efficiency of vulnerability detection. Attached Figure Description

[0050] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0051] Figure 1 This is a flowchart of a vulnerability detection method based on code block features according to the present invention.

[0052] Figure 2 This is a basic block segmentation diagram of a vulnerability detection method based on code block features according to the present invention.

[0053] Figure 3 This is a flowchart of the LSH fast filtering method for vulnerability detection based on code block features according to the present invention.

[0054] Figure 4 This is a flowchart of the GNN fine-grained matching process for a vulnerability detection method based on code block features, as described in this invention.

[0055] Figure 5 This is a structural block diagram of a vulnerability detection system based on code block features according to the present invention. Detailed Implementation

[0056] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the spirit or scope of the invention. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.

[0057] In the description of this invention, it should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0058] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0059] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0060] The accompanying drawings illustrate various structural schematic diagrams according to embodiments disclosed in this invention. These drawings are not to scale, and some details have been enlarged for clarity, and some details may have been omitted. The shapes of the various regions and layers shown in the drawings, as well as their relative sizes and positional relationships, are merely exemplary and may deviate from reality due to manufacturing tolerances or technical limitations. Furthermore, those skilled in the art can design regions / layers with different shapes, sizes, and relative positions as needed.

[0061] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0062] Example 1

[0063] This invention provides a vulnerability detection method based on code block features, comprising the following steps:

[0064] Step S1: Obtain the binary file to be tested, parse the binary file, and use a hybrid disassembler engine to parse the machine instructions.

[0065] Step S2: As Figure 2 A vulnerability detection method based on code block features is shown in the basic block segmentation diagram. It performs static linear scanning based on the extracted binary file instructions, constructs a control flow graph, divides the basic blocks, extracts the opcode sequence within the basic blocks, constructs a cross-basic block data dependency graph, and extracts the system call sequence of the basic block calls.

[0066] Step S3: As Figure 3 A vulnerability detection method based on code block features is shown in the flowchart of the basic block fast filtering method. The basic block is compared with the features of the vulnerability feature library to achieve coarse-grained matching and filter out the matching candidate set.

[0067] Step S4: As Figure 4 The flowchart of a vulnerability detection method based on code block features, GNN fine-grained matching, is shown. It fuses the opcode sequence, basic block data dependency graph, and system call sequence of basic block calls within the candidate set results of LSH fast filtering. The fused features are then used for vulnerability detection using GNN fine-grained matching.

[0068] Based on the above steps and Figure 1The flowchart of a vulnerability detection method based on code block features is shown. This method first acquires the binary file to be detected, parses the binary file, and analyzes machine instructions using a hybrid disassembler engine. Next, it performs static linear scanning on the extracted binary file instructions, constructs a control flow graph, divides the file into basic blocks, extracts the opcode sequences within each basic block, constructs a cross-basic block data dependency graph, and extracts the system call sequences from the basic blocks. Then, it uses LSH to quickly filter the extracted basic block features and compares them with features in a vulnerability feature library to achieve coarse-grained matching and select a matching candidate set. Finally, it fuses the opcode sequences, basic block data dependency graphs, and system call sequences from the basic blocks within the LSH-filtered candidate set, and uses GNN for fine-grained matching of the fused features to perform vulnerability detection.

[0069] Furthermore, the specific operation steps in step S1 above are as follows:

[0070] S1.1: Obtain the binary file to be tested.

[0071] S1.2: Parse the binary file to generate the binary file parsing structure, file architecture information, and all function information.

[0072] S1.3: Use a hybrid disassembler engine to parse machine instructions.

[0073] Furthermore, the specific operation steps in step S2 above are as follows:

[0074] S2.1: Obtain the binary file parsing structure information output in step S1.1 above, perform further static linear scanning on the binary file structure, use Capstone to disassemble each data segment in the binary file parsing structure information, check whether it is a function start, obtain the branch instruction or branch target as the block boundary, if it is a branch instruction or branch target, create a basic block, process the branch instruction, and generate file basic block information. The basic block information includes: basic block address, block size, number of instructions, predecessor block address, successor block address, and opcode sequence information.

[0075] S2.2: Constructing the control flow graph: Obtain the file basic block information dataset output from step S2.1 above, obtain the predecessor and successor blocks of each basic block, and connect the predecessor and successor blocks to form a control flow graph.

[0076] S2.3: Based on the file basic block dataset output in step S2, construct a cross-basic block data dependency graph.

[0077] Formula for constructing a cross-block data dependency graph:

[0078]

[0079] S2.4: Based on the basic block dataset of the file to which the file belongs, output in step S2, construct the system call sequence of the basic block, obtain all instructions in each basic block, accurately match the instruction set according to the architecture information of the binary file structure information, convert case and remove leading and trailing spaces using a normalization function, a prefix matching function, and output an ordered sequence of all system call instructions in the basic block.

[0080] Furthermore, the specific operation steps in step S3 above are as follows:

[0081] S3.1: Vectorize the basic block opcode sequence, control flow graph features, cross-basic block data dependency graph features, and ordered sequence features of all system call instructions in the basic block of step S2, and concatenate the four vector features into the feature vector q of the basic block.

[0082] S3.2: Obtain the set of feature vectors v of known vulnerability basic blocks from the vulnerability database, and generate k random projection vectors r1, r2…r from the known vulnerability feature vectors. k Each r j It is a unit vector with the same dimension as v, for each vulnerability feature vector v i Calculate the hash value to generate the signature h j (v i The vulnerability feature vectors are placed into a hash table according to their signatures (vectors with the same signature are placed in the same bucket) to build an LSH index.

[0083]

[0084] S3.3: Perform a hash calculation signature on the extracted basic block feature vector q. Search the LSH index for the bucket with the same signature as the basic block feature vector q. All vulnerability feature vectors in this bucket constitute the candidate set C. Calculate the similarity between the basic block feature vector q and each vector in C. Set a similarity threshold of 0.85 and filter out candidate sets with similarity values ​​greater than the threshold.

[0085]

[0086] Furthermore, the specific operation steps in step S4 above are as follows:

[0087] S4.1: Vectorize the basic block opcodes, cross-basic block data dependency graphs, and system call sequences of basic block calls in the LSH fast filtering candidate set to generate vector features h. op (opcode feature vector), h DDG (Feature vector of cross-block data dependency graph), h syscall (System call sequence feature vector of basic block calls)

[0088] S4.2: Take each basic block in the set of basic blocks output in step S2 as a node in the graph. The node features are obtained by fusing the opcode feature vector and the system call vector. The edges are determined by the dependency relationship of the cross-basic block data dependency graph to construct the graph structure.

[0089] S4.3: Use the message passing mechanism of GGNN to iteratively update node representations in multiple rounds, and take the final representation of all nodes. GGNN updates nodes using the neighborhood aggregation mechanism of GRU (Gated Circular Unit):

[0090]

[0091] S4.4: Output the vulnerability probability of each node through a fully connected layer. Set the fine-grained matching threshold of GNN to 0.92. If the feature vector detection result is greater than 0.92, it is judged as a vulnerability.

[0092]

[0093] Example 2

[0094] like Figure 5 As shown, the present invention provides a vulnerability detection system based on code block features, comprising:

[0095] The file acquisition and parsing unit is used to acquire the binary file to be detected, parse the binary file, and use a hybrid disassembler engine to parse machine instructions.

[0096] The basic block segmentation unit is used to segment basic blocks according to instructions, perform static linear scanning on the extracted binary file instructions, construct a control flow graph, divide basic blocks, generate basic block opcode features, construct a cross-basic block data dependency graph, and construct a system call sequence of basic block calls;

[0097] The vulnerability detection unit is used for fast LSH filtering. It compares the similarity of basic block features with features from the vulnerability feature library using the LSH algorithm, and coarsely filters the candidate set. The candidate set includes: basic block opcode sequences, cross-basic block data dependency graphs, and basic block call system call sequences. The basic block opcode sequences, cross-basic block data dependency graphs, and basic block call system call sequence features in the candidate set are fused. The fused features are then matched with GNN for fine-grained vulnerability detection.

[0098] In this embodiment, the basic block segmentation in the basic block segmentation unit includes:

[0099] The binary file parsing process yields the binary file parsing structure, file architecture information, and all function information.

[0100] Static linear scan: Based on parsing the binary file to obtain all data sections in the binary file structure information, use Capstone disassembly, check whether it is a function start, branch instruction or branch target as a block boundary, create basic blocks, process branch instructions, and output the file basic block set;

[0101] Constructing the control flow graph: Based on all basic blocks collected from the static linear scan results, obtain the predecessor and successor blocks of each basic block, and connect the predecessor and successor blocks to form the control flow graph.

[0102] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered illustrative and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the scope of the invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

[0103] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can be appropriately combined to form other embodiments that can be understood by those skilled in the art. The above content is only for illustrating the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. Any modifications made based on the technical concept proposed in this invention shall fall within the scope of protection of the claims of this invention.

Claims

1. A vulnerability detection method based on code block features, characterized in that, include: Obtain the binary file to be tested, parse the binary file, and use a hybrid disassembler engine to parse the machine instructions; Based on the instructions, the basic block segmentation is performed. The extracted binary file instructions are subjected to static linear scanning, control flow graph is constructed, basic blocks are divided, basic block opcode features are generated, cross-basic block data dependency graph is constructed, and system call sequence of basic block calls is constructed. LSH fast filtering uses the LSH algorithm and vulnerability feature library features to compare the similarity of basic block features, and coarsely filters the candidate set, which includes: basic block opcode sequences, cross-basic block data dependency graphs, and basic block call system call sequences. The basic block opcode sequences, cross-basic block data dependency graphs, and basic block call system call sequence features in the candidate set are fused, and the fused features are matched with GNN fine-grained features for vulnerability detection.

2. The method according to claim 1, characterized in that, The basic block segmentation includes: The binary file parsing process yields the binary file parsing structure, file architecture information, and all function information. Static linear scan: Based on parsing the binary file to obtain all data sections in the binary file structure information, use Capstone disassembly, check whether it is a function start, branch instruction or branch target as a block boundary, create basic blocks, process branch instructions, and output the file basic block set; Constructing the control flow graph: Based on all basic blocks collected from the static linear scan results, obtain the predecessor and successor blocks of each basic block, and connect the predecessor and successor blocks to form the control flow graph.

3. The method according to claim 1, characterized in that, The basic block includes: Basic block address, block size, number of instructions, predecessor block address, successor block address, and opcode sequence information.

4. The method according to claim 1, characterized in that, The construction of the cross-basic block data dependency graph includes: The formula for constructing a cross-block data dependency graph is: Represents basic block B i The set of output registers; I mem This is a memory dependency indicator function; it takes the value 1 if a memory dependency exists, and 0 otherwise. α is the memory weighting coefficient, set to 0.

3.

5. The method according to claim 1, characterized in that, The system call sequence for constructing the basic block includes: Based on the basic block information obtained from the static linear scan results, for all instructions in each basic block, the instruction set is precisely matched according to the architecture information of the binary file structure information, and a normalization function that converts case and removes leading and trailing spaces is used, along with a prefix matching function, to output an ordered sequence of all system call instructions in the basic block.

6. The method according to claim 1, characterized in that, LSH fast filtering includes: The opcode sequence, control flow graph, cross-block data dependency graph, and system call sequence of basic block are extracted and vectorized into features. The four vector features are then concatenated into a basic block feature vector q. Obtain the set v of feature vectors of known vulnerability basic blocks from the vulnerability database, and generate k random projection vectors r1, r2…r from the known vulnerability feature vectors. k Each r j It is a unit vector with the same dimension as v, for each vulnerability feature vector v i Calculate the hash value to generate the signature h j (v i The vulnerability feature vectors are placed into a hash table according to their signatures to build an LSH index; Formula for constructing an LSH index: The extracted basic block feature vector q is hashed to calculate its signature. The LSH index is then searched for a bucket with the same signature as the basic block feature vector q. All vulnerability feature vectors in this bucket constitute the candidate set C. The basic block feature vector q and each feature vector v in C are then calculated. i The similarity is set to a similarity threshold of 0.85, and candidate sets with similarity values ​​greater than the threshold are filtered out. Similarity calculation:

7. The method according to claim 1, characterized in that, The GNN fine-grained matching includes: The basic block opcode sequences, cross-basic block data dependency graphs, and basic block call system call sequences in the candidate set obtained by LSH fast filtering are vectorized into opcode feature vectors h. op , cross-block data dependency graph feature vector h DDG and the system call sequence feature vector h of basic block calls. syscall ; Each basic block is used as a node in the graph. The node features are obtained by fusing the opcode feature vector and the system call vector. The edges are determined by the dependency relationships in the cross-basic block data dependency graph to construct the graph structure. Given an input graph structure, the node representation is updated iteratively in multiple rounds using the message passing mechanism of GGNN. The final representation of all nodes is then taken and the vulnerability probability of each node is output through a fully connected layer. Vulnerability determination is performed on the feature vectors. The fine-grained matching threshold of GNN is set to 0.

92. If the feature vector detection result is greater than 0.92, it is judged as a vulnerability.

8. The method according to claim 7, characterized in that, The calculation process for vulnerability determination: P vul =σ(W p ·[h op ;h DDG ·h syscall ]) p vul The calculated vulnerability probability result; σ is the Sigmoid activation function, which "compresses" any real value of the calculation result within the parentheses into the (0,1) interval, making it a valid probability value; W p Weight matrix When p vul A value greater than 0.92 is considered a vulnerability.

9. A vulnerability detection system based on code block features, characterized in that, include: The file acquisition and parsing unit is used to acquire the binary file to be detected, parse the binary file, and use a hybrid disassembler engine to parse machine instructions. The basic block segmentation unit is used to segment basic blocks according to instructions, perform static linear scanning on the extracted binary file instructions, construct a control flow graph, divide basic blocks, generate basic block opcode features, construct a cross-basic block data dependency graph, and construct a system call sequence of basic block calls; The vulnerability detection unit is used for fast LSH filtering. It compares the similarity of basic block features with features from the vulnerability feature library using the LSH algorithm, and coarsely filters the candidate set. The candidate set includes: basic block opcode sequences, cross-basic block data dependency graphs, and basic block call system call sequences. The basic block opcode sequences, cross-basic block data dependency graphs, and basic block call system call sequence features in the candidate set are fused. The fused features are then matched with GNN for fine-grained vulnerability detection.

10. A vulnerability detection system based on code block features according to claim 9, characterized in that, The basic block segmentation in the basic block segmentation unit includes: The binary file parsing process yields the binary file parsing structure, file architecture information, and all function information. Static linear scan: Based on parsing the binary file to obtain all data sections in the binary file structure information, use Capstone disassembly, check whether it is a function start, branch instruction or branch target as a block boundary, create basic blocks, process branch instructions, and output the file basic block set; Constructing the control flow graph: Based on all basic blocks collected from the static linear scan results, obtain the predecessor and successor blocks of each basic block, and connect the predecessor and successor blocks to form the control flow graph.

Images