Code embedding method based on semantic embedding vector generation model and related device

Abstract

The invention discloses a code embedding method based on a semantic embedding vector generation model, which belongs to the technical field of computers, and comprises the following steps of: obtaining a binary code block, and performing disassembling processing and code structure analysis based on different granularities to obtain a basic block corresponding to the binary code block and a control flow diagram structure feature; performing assembly instruction linear conversion and cross-instruction-set semantic embedding conversion on the basis of the basic blocks corresponding to the binary code blocks and the structural features of the control flow graph to generate a unified binary code semantic embedding vector space corresponding to a cross-instruction-set architecture; obtaining a known vulnerability sample, and performing semantic vulnerability characterization analysis and candidate vulnerability retrieval positioning to generate a candidate vulnerability code block set; and carrying out dynamic analysis verification on the candidate vulnerability code block set and identifying a corresponding vulnerability repair state so as to output a corresponding binary vulnerability code block detection report. According to the method, high-precision semantic embedding of binary codes can be realized.

Description

Technical Field

[0001] This invention belongs to the field of computer technology and relates to a code embedding method and related apparatus based on a semantic embedding vector generation model. Background Technology

[0002] With the escalating threat of computer security, binary code analysis has become an important research direction in fields such as malware detection, vulnerability analysis, and reverse engineering. Binary code analysis typically relies on static and dynamic analysis techniques. In recent years, with the development of Natural Language Processing (NLP) technology, semantic embedding (SEM) methods have been widely applied to text, speech, and image processing. This method maps objects (such as words, sentences, or images) to a low-dimensional vector space, capturing the semantic information of the objects and making similar objects appear closer together in the vector space. Based on this idea, recent research has attempted to introduce SEM techniques into binary code analysis, extracting its implicit semantic features by converting binary code into embedding vectors. However, existing binary code analysis methods based on SEM mostly rely on manual feature extraction or simple models. While these methods can improve analysis efficiency to some extent, they still struggle to capture high-level semantic information in highly complex and diverse binary code, thus reducing the efficiency of vulnerability detection. Summary of the Invention

[0003] The purpose of this invention is to overcome the shortcomings of the prior art and provide a code embedding method and related apparatus based on a semantic embedding vector generation model. This method and apparatus can capture high-level semantic information of code and reduce the detection efficiency of code vulnerabilities.

[0004] To achieve the above objectives, this invention discloses a code embedding method based on a semantic embedding vector generation model, comprising the following steps:

[0005] Obtain binary code blocks, disassemble the binary code blocks to generate corresponding assembly code representations; perform code structure analysis on the assembly code representations based on different granularities to obtain the basic blocks and control flow graph structure features corresponding to the binary code blocks;

[0006] Based on the basic blocks corresponding to the binary code blocks and the structural features of the control flow graph, the assembly code representation is linearly transformed into assembly instructions to generate a binary assembly linear instruction sequence representation; a semantic embedding vector generation model is constructed based on a pre-trained + fine-tuned architecture and using a neural machine translation model in natural language processing technology; the semantic embedding vector generation model is used to perform cross-instruction set semantic embedding transformation on the binary assembly linear instruction sequence representation to generate a unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture.

[0007] Acquire known vulnerability samples, and perform semantic vulnerability characterization analysis on the known vulnerability samples and the target programs to be tested corresponding to the binary code blocks based on the unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture, so as to generate high-dimensional semantic vulnerability characterization vectors corresponding to each code block; perform candidate vulnerability retrieval and location on the high-dimensional semantic vulnerability characterization vectors corresponding to each code block, so as to generate a set of candidate vulnerability code blocks;

[0008] The candidate vulnerability code block set is dynamically analyzed and verified to generate vulnerability code blocks; the fixed code blocks are obtained, and the static and dynamic features corresponding to the vulnerability code blocks and the fixed code blocks are extracted. At the same time, the corresponding vulnerability fixation status is identified by comparing and analyzing the static and dynamic features corresponding to the vulnerability code blocks and the fixed code blocks.

[0009] The further improvement of the code embedding method based on the semantic embedding vector generation model described in this invention lies in:

[0010] Furthermore, the specific operations of obtaining binary code blocks, disassembling the binary code blocks to generate corresponding assembly code representations, and performing code structure analysis on the assembly code representations based on different granularities to obtain the basic blocks and control flow graph structure features corresponding to the binary code blocks are as follows:

[0011] Obtain the binary code block;

[0012] The binary code block is parsed to generate an intermediate code representation containing the instruction sequence and the corresponding register usage;

[0013] Based on the instruction sequence and registers, the binary code block is disassembled using the corresponding intermediate code representation to generate the corresponding assembly code representation;

[0014] The assembly code representation is subjected to code structure analysis based on different granularities to obtain the basic blocks corresponding to the binary code blocks and the control flow graph structure features.

[0015] Furthermore, the specific operation of performing code structure analysis on the assembly code representation based on different granularities to obtain the basic blocks corresponding to the binary code blocks and the control flow graph structure features is as follows:

[0016] Granular semantic analysis is performed on each instruction in the assembly code representation to generate a granular feature set for each instruction, wherein the granular feature set includes operands and operators corresponding to each instruction;

[0017] Based on the granularity feature set corresponding to each instruction, the assembly code representation is divided into instruction blocks to analyze the dependency relationship between adjacent instructions based on the granularity feature set. The assembly code representation is divided into several basic code blocks with independent semantics. At the same time, based on the dependency relationship between adjacent instructions, the dependency relationship of several basic code blocks with independent semantics is modeled to generate the dependency relationship graph between each basic block.

[0018] Based on the dependency graph between the basic blocks, control flow identification and analysis are performed on the jump instructions and conditional branch instructions in the assembly code representation to obtain the control flow boundary in the assembly code representation.

[0019] Based on the control flow boundaries corresponding to the assembly code representation, dynamic path identification and analysis are performed on several basic code blocks with independent semantic correspondence to obtain the corresponding dynamic control flow paths between each basic block; based on the corresponding dynamic control flow paths between each basic block, a control flow graph is constructed between each basic code block to obtain the corresponding control flow graph between each basic block.

[0020] Code structure feature analysis is performed on each basic code block with independent semantic correspondence and the corresponding control flow graph between each basic block to obtain the basic block and control flow graph structure features corresponding to the binary code block, including the jump relationship between each basic block, the number of executions and the execution time corresponding to each dynamic path.

[0021] Furthermore, the step of performing linear assembly instruction transformation on the assembly code representation based on the basic blocks corresponding to the binary code blocks and the control flow graph structure features to generate a binary assembly linear instruction sequence representation; and the specific operation of constructing a semantic embedding vector generation model based on a pre-trained + fine-tuned architecture and utilizing a neural machine translation model in natural language processing technology, and performing cross-instruction set semantic embedding transformation on the binary assembly linear instruction sequence representation through the semantic embedding vector generation model to generate a unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture, is as follows:

[0022] Based on the basic blocks corresponding to the binary code blocks and the structural features of the control flow graph, the node execution frequency of the corresponding basic code blocks in the assembly code representation is determined. Each basic code block in the assembly code representation is taken as a node, and the execution frequency of each basic code block is determined.

[0023] Based on the execution frequency of each basic code block and combined with the basic blocks corresponding to the binary code blocks and the control flow graph structure features, the branch jump probability of the corresponding basic code blocks in the assembly code representation is evaluated, and the branch jump probability between each basic code block in the assembly code representation is obtained.

[0024] Based on the branch jump probabilities between the basic code blocks in the assembly code representation, a linear representation path mapping is performed on the corresponding basic code blocks in the assembly code representation to generate the linear representation path corresponding to each basic code block in the assembly code representation;

[0025] Based on the linear representation path corresponding to each basic code block within the assembly code representation, the corresponding basic code blocks within the assembly code representation are linearly converted into assembly instructions to generate a binary assembly linear instruction sequence representation;

[0026] Based on a pre-trained and fine-tuned architecture, a semantic embedding vector generation model is constructed using a neural machine translation model in natural language processing. The model then performs cross-instruction set semantic embedding transformation on the binary assembly linear instruction sequence representation to generate a unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture.

[0027] Furthermore, the specific operations for constructing a semantic embedding vector generation model based on a pre-trained + fine-tuned architecture and utilizing a neural machine translation model in natural language processing, and performing cross-instruction set semantic embedding transformation on the binary assembly linear instruction sequence representation to generate a unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture are as follows:

[0028] A semantic embedding vector generation model is constructed based on a pre-trained + fine-tuned architecture and by combining a neural machine translation model in natural language processing technology with binary code block training.

[0029] The original semantic parsing and mapping of instructions of different architectures within the binary assembly linear instruction sequence representation is performed to extract the operands, operators and control flow information corresponding to instructions of different architectures, and to generate semantic representations corresponding to instructions of different architectures.

[0030] The semantic representations corresponding to the different architecture instructions are input into the semantic embedding vector generation model to perform cross-instruction set semantic embedding analysis. The semantic structure embeddings corresponding to the different architecture instructions are automatically captured through unsupervised learning, and binary code semantic embedding vectors corresponding to cross-instruction set architecture are generated.

[0031] Semantic similarity is calculated between the semantic embedding vectors of binary code corresponding to cross instruction set architectures to obtain the semantic embedding similarity between different cross instruction set architectures;

[0032] Based on the semantic embedding similarity between different cross-instruction set architectures, a unified semantic vector space transformation is performed between the binary code semantic embedding vectors corresponding to the cross-instruction set architecture. This is to adjust the specific distribution of the binary code semantic embedding vectors in the space based on the semantic embedding similarity, so as to generate a unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture.

[0033] Furthermore, the specific steps of acquiring known vulnerability samples and performing semantic vulnerability characterization analysis on the known vulnerability samples and the corresponding target programs within the binary code blocks based on the unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture to generate high-dimensional semantic vulnerability characterization vectors for each code block; and performing candidate vulnerability retrieval and localization on the high-dimensional semantic vulnerability characterization vectors for each code block to generate a set of candidate vulnerability code blocks are as follows:

[0034] Obtain samples of known vulnerabilities;

[0035] Binary vulnerability feature analysis is performed on known vulnerability samples to obtain the features of known binary vulnerability samples;

[0036] Based on the characteristics of known binary vulnerability samples, vulnerability pattern mapping analysis is performed on known vulnerability samples to generate a known binary vulnerability pattern mapping table. The known binary vulnerability pattern mapping table includes the binary code vulnerability performance patterns of buffer overflow and format string vulnerabilities under different instruction set architectures.

[0037] Based on the unified binary code semantic embedding vector space corresponding to cross instruction set architecture, semantic vulnerability characterization analysis is performed on the vulnerability feature patterns in the known binary vulnerability pattern mapping table and the corresponding target programs in the binary code blocks to generate high-dimensional semantic vulnerability characterization vectors for each code block.

[0038] Candidate vulnerabilities are retrieved and located from the high-dimensional semantic vulnerability representation vectors corresponding to each code block to generate a set of candidate vulnerability code blocks.

[0039] Furthermore, the specific steps of dynamically analyzing and verifying the candidate vulnerable code block set to generate vulnerable code blocks; obtaining patched code blocks; extracting the static and dynamic features corresponding to the vulnerable code blocks and patched code blocks; and identifying the corresponding vulnerability patching status by comparing and analyzing the static and dynamic features corresponding to the vulnerable code blocks and patched code blocks are as follows:

[0040] Potential vulnerability execution identification and analysis are performed on each candidate vulnerability code block in the candidate vulnerability code block set to obtain the dependency relationship between instruction sequences, jump logic and function call corresponding instruction potential vulnerability execution characteristics of each candidate vulnerability code block.

[0041] Based on the dependencies between instruction sequences, jump logic, and the potential vulnerability execution characteristics of instructions corresponding to function calls within each candidate vulnerability code block, vulnerability activation path mapping is performed on the corresponding candidate vulnerability code blocks to generate code execution vulnerability activation paths corresponding to instruction sequences within each candidate vulnerability code block.

[0042] Based on the code execution vulnerability activation path corresponding to the instruction sequence within each candidate vulnerability code block, a dynamic vulnerability distribution analysis based on the execution time window is performed on each candidate vulnerability code block in the candidate vulnerability code block set to obtain the occurrence frequency, time distribution, and vulnerability existence timing of each candidate vulnerability code block.

[0043] Based on the frequency of occurrence, time distribution, and timing of vulnerability existence of each candidate vulnerability code block, dynamic analysis and verification are performed on each candidate vulnerability code block in the candidate vulnerability code block set to verify whether the vulnerability exists and filter it out to generate vulnerability code blocks.

[0044] The system retrieves the patched code blocks and extracts the static and dynamic features corresponding to the vulnerable code blocks and the patched code blocks. It also identifies the corresponding vulnerability patching status by comparing and analyzing the static and dynamic features of the vulnerable code blocks and the patched code blocks, and outputs the corresponding binary vulnerability code block detection report.

[0045] This invention discloses a code embedding system based on a semantic embedding vector generation model, comprising the following steps:

[0046] The disassembly module is used to obtain binary code blocks, disassemble the binary code blocks to generate corresponding assembly code representations, and perform code structure analysis on the assembly code representations based on different granularities to obtain the basic blocks and control flow graph structure features corresponding to the binary code blocks.

[0047] The generation module is used to perform linear transformation of assembly instructions on the assembly code representation based on the basic blocks corresponding to the binary code blocks and the control flow graph structure features, so as to generate a binary assembly linear instruction sequence representation; and to construct a semantic embedding vector generation model based on a pre-trained + fine-tuned architecture and using a neural machine translation model in natural language processing technology, and to perform cross-instruction set semantic embedding transformation on the binary assembly linear instruction sequence representation through the semantic embedding vector generation model, so as to generate a unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture.

[0048] The analysis module is used to acquire known vulnerability samples and perform semantic vulnerability characterization analysis on the known vulnerability samples and the corresponding target programs within the binary code blocks based on the unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture, so as to generate high-dimensional semantic vulnerability characterization vectors corresponding to each code block; and perform candidate vulnerability retrieval and location on the high-dimensional semantic vulnerability characterization vectors corresponding to each code block to generate a set of candidate vulnerability code blocks.

[0049] The detection module is used to dynamically analyze and verify the candidate set of vulnerable code blocks to generate vulnerable code blocks; obtain the repaired code blocks, and extract the static and dynamic features corresponding to the vulnerable code blocks and the repaired code blocks. At the same time, by comparing and analyzing the static and dynamic features corresponding to the vulnerable code blocks and the repaired code blocks, the corresponding vulnerability repair status is identified.

[0050] The present invention discloses a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the code embedding method based on the semantic embedding vector generation model.

[0051] The present invention discloses a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the code embedding method based on the semantic embedding vector generation model.

[0052] The present invention has the following beneficial effects:

[0053] The code embedding method and related apparatus based on the semantic embedding vector generation model described in this invention, in specific operation, extracts assembly code from the original binary code block and converts the machine code into easily understandable assembly language through a disassembly process. This process is not only a fundamental step in reverse engineering but also the basis for subsequent analysis. The disassembly process first decodes the binary code block into corresponding assembly language instructions, reflecting the program's execution flow and functions. These assembly instructions usually have a very compact and low-level structure, including jump instructions, function calls, data operations, etc. Performing structural analysis on the disassembly results based on different granularities can break down the binary code into smaller basic blocks. Each basic block represents a continuous sequence of instructions and usually has independent control flow characteristics. By further analyzing the interconnections of the basic blocks, a control flow graph (CFG) of the program can be constructed. The control flow graph provides an essential structural foundation for subsequent vulnerability detection, performance optimization, code refactoring, etc., thus identifying the program's potential paths, revealing its complex control structure, and providing a structured basis for vulnerability detection. Secondly, by linearly transforming the assembly code, the program's representation is further simplified, allowing the semantics of the code to be uniformly processed through linear instruction sequences. Converting assembly instruction sequences into linear representations helps reduce code complexity and improves the efficiency of subsequent analysis and processing. Especially when dealing with instruction sets of different architectures, linear transformation provides an architecture-independent analysis platform, avoiding the problems caused by architecture differences and thus better capturing the high-level semantic information of binary code. Building on this, by utilizing Neural Machine Translation (NMT) models in Natural Language Processing, semantic embedding transformation can be performed on binary assembly instruction sequences, mapping them to a unified semantic space. This process is similar to transforming each instruction in a program into a vector with highly abstract semantics, enabling programs from different instruction sets to be compared and analyzed in the same semantic space. With the help of a pre-trained + fine-tuned architecture, a better understanding of cross-instruction sets can be obtained based on large-scale datasets, thereby improving the portability and compatibility of code across different platforms, and ultimately enhancing the accuracy and efficiency of subsequent vulnerability detection. Then, known vulnerability samples are characterized and analyzed using semantic embedding vector space, and compared with the target program under test within binary code blocks. Matching the semantic vectors of the known vulnerability samples with the semantic vectors of the target program identifies potential vulnerabilities in the target program. This process not only improves vulnerability detection accuracy but also uncovers potential security risks related to known vulnerabilities in the program. In this process, semantic vulnerability representation vectors provide a high-dimensional vulnerability representation method, capable of deeply capturing complex semantic relationships in the code and further uncovering potential vulnerability types. This stage of work provides a precise set of candidate vulnerabilities for subsequent dynamic verification and vulnerability remediation, saving significant time and resources for vulnerability localization and remediation.Finally, dynamic analysis and verification of candidate vulnerable code blocks are performed to confirm the existence of actual vulnerabilities. This process, through runtime dynamic monitoring, simulates the program's execution behavior in a real-world environment, enabling a more accurate capture of the vulnerability's actual manifestation. Dynamic analysis not only verifies the authenticity of vulnerabilities but also identifies temporal and environment-related vulnerabilities that static analysis cannot detect. By comparing the static and dynamic characteristics of vulnerable and fixed code blocks, the differences between the fixed code and the original vulnerable code can be identified. These differences involve not only changes in code structure but also changes in program behavior, including changes in memory management and instruction execution. This comparative analysis of static and dynamic characteristics helps developers accurately assess the effectiveness of vulnerability remediation and provides crucial information for subsequent code maintenance. Attached Figure Description

[0054] The accompanying drawings, which form part of this specification, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings:

[0055] Figure 1 This is a flowchart of the method of the present invention;

[0056] Figure 2 for Figure 1 A detailed flowchart of step S1;

[0057] Figure 3 for Figure 2 A detailed flowchart of step S14. Detailed Implementation

[0058] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0059] Example 1

[0060] The code embedding method based on the semantic embedding vector generation model described in this invention includes the following steps:

[0061] Step S1: Obtain the binary code block and disassemble it to generate the corresponding assembly code representation; perform code structure analysis on the assembly code representation based on different granularities to obtain the basic blocks and control flow graph structure features corresponding to the binary code block;

[0062] Step S2: Based on the basic blocks corresponding to the binary code blocks and the structural features of the control flow graph, perform linear transformation of the assembly code representation to generate a binary assembly linear instruction sequence representation; based on the pre-trained + fine-tuned architecture and using the neural machine translation model in natural language processing technology to construct a semantic embedding vector generation model, perform cross-instruction set semantic embedding transformation on the binary assembly linear instruction sequence representation to generate a unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture.

[0063] Step S3: Obtain known vulnerability samples, and perform semantic vulnerability characterization analysis on the known vulnerability samples and the target program to be tested corresponding to the binary code blocks based on the unified binary code semantic embedding vector space corresponding to the cross instruction set architecture, so as to generate high-dimensional semantic vulnerability characterization vectors corresponding to each code block; perform candidate vulnerability retrieval and location on the high-dimensional semantic vulnerability characterization vectors corresponding to each code block to generate a set of candidate vulnerability code blocks;

[0064] Step S4: Perform dynamic analysis and verification on the candidate vulnerability code block set to generate vulnerability code blocks; obtain the fixed code blocks, and extract the static and dynamic features corresponding to the vulnerability code blocks and the fixed code blocks. At the same time, identify the corresponding vulnerability repair status by comparing and analyzing the static and dynamic features corresponding to the vulnerability code blocks and the fixed code blocks, and output the corresponding binary vulnerability code block detection report.

[0065] In the embodiments of this invention, please refer to Figure 1 The diagram illustrates the steps of the code embedding method based on the semantic embedding vector generation model of the present invention. In this example, the code embedding method based on the semantic embedding vector generation model specifically includes the following steps:

[0066] Step S1: Obtain the binary code block and disassemble it to generate the corresponding assembly code representation; perform code structure analysis on the assembly code representation based on different granularities to obtain the basic blocks and control flow graph structure features corresponding to the binary code block;

[0067] In this embodiment of the invention, after obtaining the binary code block, a rule-based disassembly technique is used for processing. For the x86 architecture, an opcode mapping table is constructed, containing 256 opcodes and their corresponding assembly instruction formats. If opcode 8B is encountered, it is parsed as a MOV instruction according to the mapping table, and the operands are further parsed according to the MOV instruction format rules. If the subsequent byte is C0, it is completely parsed as MOV EAX,EAX. For the ARM architecture, a similar instruction template matching method is used. Through opcode prefixes and operand encoding rules, binary data is converted into assembly code. After disassembly, code structure analysis is performed based on different granularities. At the instruction granularity level, a data flow analysis algorithm is used. By constructing a data flow graph (DFG), the read and write operations of each instruction on registers and memory are tracked. For example, MOV... The EAX,[EBX] instruction establishes a data flow edge from memory address [EBX] to register EAX in the DFG. At the basic block granularity level, basic blocks are divided according to control flow jump instructions (such as JMP, CALL). Each basic block satisfies the single entry and single exit characteristic. A control flow graph (CFG) is constructed based on the basic blocks. Nodes are basic blocks, and edges represent the jump relationships between basic blocks. At the same time, the jump conditions of the edges are marked (such as the condition expression corresponding to the JE instruction). Finally, the basic block division and control flow graph structure characteristics corresponding to the binary code block are obtained.

[0068] Step S2: Based on the basic blocks corresponding to the binary code blocks and the structural features of the control flow graph, perform linear transformation of the assembly code representation to generate a binary assembly linear instruction sequence representation; based on the pre-trained + fine-tuned architecture and using the neural machine translation model in natural language processing technology to construct a semantic embedding vector generation model, perform cross-instruction set semantic embedding transformation on the binary assembly linear instruction sequence representation to generate a unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture.

[0069] In this embodiment of the invention, the assembly code is linearly transformed based on the previously obtained basic blocks and control flow graph. A topological sorting algorithm is used to traverse the control flow graph, prioritizing basic blocks without predecessor nodes. The assembly instructions within the basic blocks are then concatenated sequentially. For conditional jump instructions, the absolute jump address is converted to a relative offset based on the position of the jump target basic block after sorting, such as JMP. If the target basic block is 10 positions after the current basic block, it is transformed into JMP+10. When constructing the semantic embedding vector generation model, a neural machine translation model with Transformer architecture is adopted. In the pre-training stage, a binary code corpus containing multiple instruction set architectures such as x86, ARM, and MIPS is used. Through the masking language model task (randomly masking 15% of the instruction tokens) and the next sentence prediction task, it is trained for 100 epochs with a learning rate of 5e-5. In the fine-tuning stage, for the binary assembly linear instruction sequence data, the first 6 layers of the encoder are frozen, the last 6 layers and the decoder are trained, the learning rate is adjusted to 1e-5, and it is trained for 50 epochs. The binary assembly linear instruction sequence is divided into fixed lengths (such as 128 tokens) and input into the model encoder. The instruction semantics are captured through a multi-head attention mechanism. The decoder outputs a 256-dimensional semantic embedding vector. After clustering and dimensionality reduction, a unified binary code semantic embedding vector space across instruction set architectures is finally generated.

[0070] Step S3: Obtain known vulnerability samples, and perform semantic vulnerability characterization analysis on the known vulnerability samples and the target programs to be tested corresponding to the binary code blocks based on the unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture, so as to generate high-dimensional semantic vulnerability characterization vectors corresponding to each code block; perform candidate vulnerability retrieval and location on the high-dimensional semantic vulnerability characterization vectors corresponding to each code block to generate a set of candidate vulnerability code blocks.

[0071] In this embodiment of the invention, after acquiring known vulnerability samples, they are converted into semantic vectors in the same format as the target program under test. For the assembly code of each known vulnerability sample, the same semantic embedding vector generation model is used to map it to a unified semantic embedding vector space. Similarly, semantic vectors are generated for each code block of the target program under test. During semantic vulnerability characterization analysis, cosine similarity is used to calculate the similarity between the sample and the code block vectors, with a threshold of 0.8. If the similarity exceeds this threshold, a potential vulnerability association is considered to exist. For example, if the similarity between a known buffer overflow vulnerability sample vector and a code block vector in the target program reaches 0.85, the code block is marked as a potential vulnerability block. The marked code blocks are further analyzed... The neighborhood structure of the vulnerability in the vector space is analyzed, and the K-nearest neighbor algorithm (K=5) is used to find the 5 most similar known vulnerability samples. The semantic representation of the code block is refined by combining the sample features, and a high-dimensional semantic vulnerability representation vector containing information such as vulnerability type and similarity score is generated. Based on the high-dimensional semantic vulnerability representation vector, the density-based DBSCAN clustering algorithm is used to search for and locate candidate vulnerabilities. The neighborhood radius ε=0.2 and the minimum number of samples MinPts=3 are set. The points connected by density in the vector space are divided into clusters, and each cluster corresponds to a potential vulnerability type. The distance between the cluster center and the known vulnerability sample vector is calculated, and clusters with a distance of less than 0.3 are selected. The code blocks in the clusters are included in the candidate vulnerability code block set.

[0072] Step S4: Perform dynamic analysis and verification on the candidate vulnerability code block set to generate vulnerability code blocks; obtain the fixed code blocks, and extract the static and dynamic features corresponding to the vulnerability code blocks and the fixed code blocks. At the same time, identify the corresponding vulnerability repair status by comparing and analyzing the static and dynamic features corresponding to the vulnerability code blocks and the fixed code blocks, and output the corresponding binary vulnerability code block detection report.

[0073] In this embodiment of the invention, dynamic binary instrumentation technology is used to verify the candidate vulnerable code block set. Monitoring code is inserted at the entry point and key instructions of each candidate code block to record information such as register states, memory access addresses and data, and instruction execution order during runtime. The program is simulated to run 1000 times under different input conditions, and the actual execution of the code blocks is statistically analyzed. A verification rule is set: if a code block is executed more than 50 times and exhibits behaviors such as memory out-of-bounds errors or abnormal control flow jumps more than 10 times, it is determined to be a real vulnerable code block. For example, if a candidate code block is executed 60 times and illegal memory writes occur 15 times, it meets the rule and is confirmed as a vulnerable code block. A list of vulnerable code blocks is generated. After obtaining the repaired code blocks, static features (such as instruction sequence hash values ​​and opcode distribution histograms) and dynamic features (such as memory access timing diagrams and CPU utilization curves) are extracted. For the vulnerable code blocks and the repaired code blocks, the difference in static features is calculated using Hamming distance, and the similarity of dynamic features is measured using the Dynamic Time Warping (DTW) algorithm. Thresholds are set: when the static Hamming distance is greater than 20 and the dynamic DTW distance is less than 0.4, the vulnerability is considered to be fixed. The final detection report includes the location of the vulnerable code block, the vulnerability type, static difference comparison, dynamic behavior analysis and remediation suggestions. For example, for buffer overflow vulnerabilities, it is recommended to add boundary check instructions CMP ECX,buffer_size; JLE safe_write after the memory write instruction.

[0074] Furthermore, as an embodiment of the present invention, reference is made to... Figure 2 As shown, Figure 1 A detailed flowchart of step S1 is shown below. In this embodiment, step S1 includes the following steps:

[0075] Step S11: Obtain the binary code block.

[0076] In this embodiment of the invention, binary code blocks are read using a specific storage medium. The storage medium is a non-volatile storage device conforming to the ISO / IEC 10995 standard. The reading process follows the storage device data reading protocol defined by JEDEC, and read operations are performed in fixed block sizes (512 bytes). If the binary code block exceeds the capacity of a single storage block, multiple storage blocks are read sequentially, and the scattered data is concatenated into a complete binary code block according to the logical address mapping relationship of the storage device. During the reading process, the read data is verified using a CRC-32 checksum algorithm. If the verification fails, the corresponding storage block is reread to ensure that the obtained binary code block data is accurate.

[0077] Step S12: Perform binary code parsing on the binary code block to generate an intermediate code representation containing the instruction sequence and the corresponding register usage.

[0078] In this embodiment of the invention, the acquired binary code block is parsed using a finite state machine (FSM)-based parsing method. A state transition table is constructed for the target instruction set architecture (e.g., x86, ARM). The state machine is initially in an "idle" state. Starting from the beginning of the binary code block, data is read byte by byte. When an opcode byte is read, the corresponding transition rule is looked up in the state transition table according to the opcode, and the corresponding operand read state is entered. For example, for the x86 architecture instruction "MOV EAX,[EBX+4]", after reading the opcode "8B", the state machine transitions from the "idle" state to the "MOV instruction operand read" state. According to the instruction format requirements, the target operand "EAX" and the source operand "[EBX+4]" are read sequentially. During the parsing process, a register usage table is maintained to record the read and write operations of registers for each instruction. After parsing, an intermediate code representation containing instruction sequences and register usage information is generated. The instruction sequence is stored in the form of triples (opcode, destination operand, source operand), and the register usage table records the state changes of each register in different instructions.

[0079] Step S13: Disassemble the binary code block based on the instruction sequence and registers using the corresponding intermediate code representation to generate the corresponding assembly code representation.

[0080] In this embodiment of the invention, disassembly processing is performed based on the generated intermediate code representation. A combination of lookup table and syntax analysis is used to establish an opcode-assembly instruction mapping table for the target instruction set architecture. This table contains all legal opcodes and their corresponding assembly instruction formats. The instruction sequences in the intermediate code representation are traversed. For each instruction triplet, the corresponding assembly instruction template is searched in the mapping table based on the opcode. The operands are replaced according to the template format to generate the assembly instruction. For example, for the instruction triplet ("MOV", "EAX", "[EBX+4]"), the template "MOV destination,source" corresponding to the opcode "MOV" is found in the mapping table. "EAX" is replaced with "destination", and "[EBX+4]" is replaced with "source", resulting in the assembly instruction "MOV EAX,[EBX+4]". During processing, for complex instructions (such as those with prefix bytes), a syntax analyzer performs structural parsing to ensure that the generated assembly code accurately reflects the function of the binary code block. Finally, all assembly instructions are combined sequentially to form a complete assembly code representation.

[0081] Step S14: Perform code structure analysis on the assembly code representation based on different granularities to obtain the basic blocks corresponding to the binary code blocks and the control flow graph structure features.

[0082] In this embodiment of the invention, by performing code structure analysis on the assembly code representation at different granularities, basic block partitioning is first performed. Using data dependency and control dependency analysis methods, starting from the first instruction of the assembly code, data dependencies (such as write-after-read, read-after-write, write-after-write) and control dependencies (such as the impact of jump instructions on the execution of subsequent instructions) between instructions are identified. When a jump instruction (such as "JMP", "JE", etc.) is encountered or a data dependency interruption exists between instructions, a new basic block is partitioned. Each basic block satisfies the single entry and single exit condition, i.e., there is only one entry point and one exit point. For example, in a code segment containing the instructions "CMP EAX,EBX" and "JE label", "CMP EAX,EBX" and "JE label" constitute one basic block, and the instructions after "label" constitute another basic block. After completing the basic block partitioning, a control flow graph is constructed. Using basic blocks as nodes, if the last instruction of one basic block can directly jump to the first instruction of another basic block, a directed edge is added between the two nodes. For conditional jump instructions, two directed edges are added to different target basic blocks depending on whether the condition is true or false. The structural features of the control flow graph are analyzed, including the jump relationship between basic blocks, the in-degree and out-degree of each basic block, and the connectivity of the control flow graph. Finally, the basic blocks corresponding to the binary code blocks and the structural features of the control flow graph are obtained, which provides a foundation for subsequent code embedding based on the semantic embedding vector generation model.

[0083] Furthermore, as an embodiment of the present invention, reference is made to... Figure 3 As shown, Figure 2 A detailed flowchart of step S14 is shown in this embodiment. Step S14 includes the following steps:

[0084] Step S141: Perform granular semantic analysis on each instruction in the assembly code representation to generate a granular feature set for each instruction, including the operands and operators for each instruction.

[0085] In this embodiment of the invention, granular semantic analysis is performed on each instruction in the assembly code representation, and regular expression matching technology is used to identify the instruction format. For x86 architecture assembly instructions, pattern matching rules are set. For example, for instructions with the format OPERATOR OPERAND1, OPERAND2, the operators and operands are extracted using the regular expression ^(\w+)\s+([^,]+),\s*(.+)$. For each instruction, its operators (such as MOV, ADD, JMP, etc.) and operands (such as register EAX, memory address [EBX+4], immediate value 0x10, etc.) are extracted. At the same time, the operand type (register, memory, immediate value) and addressing mode (direct addressing, indirect addressing, etc.) are analyzed. For example, the instruction MOV EAX,[EBX+4] is parsed into the operator MOV, operands EAX (register type) and [EBX+4] (memory type, base address register EBX, offset 4). The semantic vector representation of each instruction is calculated. A pre-trained Word2Vec model is used to vectorize the operators and operands. The operator vector has a dimension of 32, and the operand vector has a dimension of 64. The operator vector and operand vector are concatenated to form a 128-dimensional granular feature vector corresponding to each instruction. A feature set containing all instruction granular features is constructed to provide a data foundation for subsequent instruction block partitioning.

[0086] Step S142: Based on the granularity feature set corresponding to each instruction, divide each instruction in the assembly code representation into instruction blocks to analyze the dependency relationship between adjacent instructions based on the granularity feature set, and divide the assembly code representation into several basic code blocks with independent semantics. At the same time, based on the dependency relationship between adjacent instructions, perform dependency relationship modeling on several basic code blocks with independent semantics to generate a dependency relationship graph between each basic block.

[0087] In this embodiment of the invention, the assembly code is divided into instruction blocks based on a previously generated granular feature set. A data dependency analysis method is used to analyze the data dependencies between adjacent instructions, including true dependencies (write-after-read), anti-dependencies (read-after-write), and output dependencies (write-after-write). For example, the instruction sequence MOV EAX,5 → ADD EBX,EAX has a true dependency because the second instruction reads the value written by the first instruction. Control dependency analysis is used to determine the control relationships between instructions, identifying the impact of jump instructions and conditional branch instructions on the execution of subsequent instructions. Based on these dependencies, the assembly code is divided into several basic code blocks. Each basic block satisfies the condition of a single entry point and a single exit point. A dependency graph between basic blocks is constructed, represented by a directed graph. Nodes represent basic blocks, and edges represent dependencies between basic blocks. The edge weight is calculated based on the dependency strength, which is determined by the number of data dependencies and the frequency of control dependencies. The formula is: Dependency Strength = 0.6 × Number of Data Dependencies + 0.4 × Frequency of Control Dependencies, forming a complete dependency graph of basic blocks.

[0088] Step S143: Based on the dependency graph between each basic block, perform control flow identification and analysis on the corresponding jump instructions and conditional branch instructions in the assembly code representation to obtain the corresponding control flow boundary in the assembly code representation.

[0089] In this embodiment of the invention, control flow identification and analysis are performed on jump instructions and conditional branch instructions in assembly code based on a basic block dependency graph. A static analysis method is used to track the target address of each jump instruction and conditional branch instruction, determining the possible direction of control flow. For unconditional jump instructions (JMP), the jump target address is directly determined. For conditional jump instructions (JE, JNE, etc.), the jump targets when the condition is true and false are analyzed respectively. A control flow boundary identification algorithm is used to determine the control flow boundary of each basic block. This algorithm starts from the program entry point, traverses each basic block according to the dependency graph, and records the execution context and target address of each jump instruction and conditional branch instruction. When encountering indirect jump instructions whose target address cannot be directly determined, an inter-procedural analysis method is used, combining the call context and register state for inference. Finally, a control flow boundary set is constructed, clarifying the start and end positions of each basic block and the control transfer relationships between basic blocks, providing a foundation for subsequent dynamic path identification.

[0090] Step S144: Based on the control flow boundaries corresponding in the assembly code representation, perform dynamic path identification and analysis on several basic code blocks with independent semantic correspondence to obtain the corresponding control flow dynamic paths between each basic block; construct a control flow graph between each basic code block according to the corresponding control flow dynamic paths between each basic block to generate the corresponding control flow graph between each basic block.

[0091] In this embodiment of the invention, dynamic path identification analysis is performed on basic code blocks based on control flow boundaries. Symbolic execution technology is used to generate a symbolic execution tree for each basic block, simulating the execution path of the program under different input conditions. For conditional branch instructions, different path constraints are generated according to the conditional expression. For example, for the conditional jump instruction CMP EAX,5; JE label, path constraints EAX=5 and EAX≠5 are generated, corresponding to the jump and no jump cases, respectively. Through a path traversal algorithm, the reachability and execution probability of each basic block in different execution paths are calculated. This algorithm starts from the program entry point, traverses all possible paths along the control flow graph, records the access count and execution conditions of each basic block, and combines historical execution data and program input distribution to statistically analyze the execution frequency and probability of each dynamic path, constructing a control flow graph (CFG) between basic blocks. Nodes represent basic blocks, edges represent control transfer relationships between basic blocks, and the weight of the edges is set to the execution probability of the corresponding path. For example, if the execution probability of the path from basic block A to basic block B is 0.7, then the weight of the edge A→B is 0.7. In this way, a complete basic block control flow graph is generated, which intuitively shows the execution flow and path distribution of the program.

[0092] Step S145: Perform code structure feature analysis on several basic code blocks with independent semantic correspondence and the corresponding control flow graphs between each basic block to obtain the basic block and control flow graph structure features corresponding to the binary code block, including the jump relationship between each basic block, the number of executions and the execution time corresponding to each dynamic path.

[0093] In this embodiment of the invention, structural feature analysis is performed on basic code blocks and the control flow graph to extract jump relationships between basic blocks, including direct jumps, indirect jumps, conditional jumps, etc. The number and distribution of each jump type are statistically analyzed, and the in-degree and out-degree of each basic block are calculated. The in-degree indicates how many basic blocks can jump to this basic block, and the out-degree indicates how many other basic blocks this basic block can jump to. The execution count and execution time of each dynamic path are analyzed. Performance counter technology is used to record the execution count and execution time of each basic block during program execution. For loop structures, the number of iterations of the loop body and the average execution time are calculated to analyze the impact of loop structures on the overall program performance. Topological features of the control flow graph are extracted, including the graph diameter, average path length, and clustering coefficient. The graph diameter represents the longest and shortest path length between any two nodes in the control flow graph, reflecting the maximum possible number of steps in program execution; the average path length represents the average shortest path length between all node pairs, reflecting the average complexity of program execution; and the clustering coefficient represents the degree of tight connection between nodes, reflecting the modularity of the program structure. Through these structural features, the control flow characteristics of binary code blocks are comprehensively described.

[0094] Furthermore, step S2 includes the following steps:

[0095] Step S21: Based on the basic blocks corresponding to the binary code blocks and the structural features of the control flow graph, determine the node execution frequency of the corresponding basic code blocks in the assembly code representation, so as to take each basic code block in the assembly code representation as a node and determine the execution frequency of each basic code block.

[0096] In this embodiment of the invention, the execution frequency of basic code blocks within the assembly code representation is determined based on a pre-constructed control flow graph (CFG). A combination of static analysis and dynamic simulation is employed. First, loop structures are identified using program slicing technology. Initial execution frequency coefficients are set for loop body basic blocks (e.g., 10 for for loops, 5 for while loops). For conditional branch basic blocks, initial weights are assigned based on the complexity of the conditional expressions (e.g., 0.8 for simple comparisons, 0.5 for complex logical operations). Symbolic execution technology is used to simulate the program execution path, recording the access count of each basic block. During the simulation, a boundary value testing strategy is used for loop structures, executing them 1, 10, 100 times, etc., to calculate the average access frequency. For example, if a for loop basic block is accessed 1000 times in 100 simulations, its average execution frequency is 10 times / simulation. Combined with the program's input space distribution, the execution paths under different input conditions are weighted statistically. Finally, each basic code block is treated as a node, and its execution frequency value is used as the node weight, forming a weighted control flow graph.

[0097] Step S22: Based on the execution frequency of each basic code block and combined with the basic blocks corresponding to the binary code blocks and the control flow graph structure features, evaluate the branch jump probability of the corresponding basic code blocks in the assembly code representation to obtain the branch jump probability between each basic code block in the assembly code representation.

[0098] In this embodiment of the invention, the branch jump probability of basic code blocks is evaluated based on the previously obtained node execution frequency and control flow graph structure characteristics. For conditional jump edges in the control flow graph, the jump probability is calculated using a probabilistic context-free grammar (PCFG) model. First, the operand types and value ranges of the conditional expression are analyzed, and the syntax tree of the conditional expression is constructed. For example, for the conditional expression (a>5)&&(b<10), by analyzing the value distribution of variables a and b and combining historical execution data statistics, the probability of the condition being true is determined to be 0.6. For unconditional jump edges, the jump probability is set to 1.0. The node execution frequency and edge jump probability information are integrated using a Bayesian network model. For the jump from basic block A to basic block B, the jump probability calculation formula is: P(A→B)=F(A)×C(A→B), where F(A) is the execution frequency of basic block A, and C(A→B) is the conditional jump probability of edge A→B. Finally, the branch jump probability matrix between each basic code block in the assembly code representation is obtained.

[0099] Step S23: Based on the branch jump probabilities between the basic code blocks in the assembly code representation, perform linear representation path mapping on the corresponding basic code blocks in the assembly code representation to generate linear representation paths corresponding to the basic code blocks in the assembly code representation.

[0100] In this embodiment of the invention, a linear representation path mapping is performed on basic code blocks based on a branch jump probability matrix. A Markov Chain Monte Carlo (MCMC) algorithm is employed, starting from the entry basic block and generating multiple execution paths through random walks based on jump probabilities. A path length threshold of 20 basic blocks is set, and 1000 samples are generated for each path. The sampling results are statistically analyzed to calculate the co-occurrence frequency of each basic block pair appearing in the same path. For example, if basic blocks A and B appear simultaneously in 500 paths, their co-occurrence frequency is 0.5. A co-occurrence frequency matrix is ​​constructed, and a hierarchical clustering algorithm is used to group the basic blocks. Linear representation paths are generated according to the clustering results and jump probabilities, prioritizing basic block sequences with high jump probabilities and high co-occurrence frequencies to ensure the representativeness of the generated paths. Finally, a corresponding linear representation path is generated for each basic code block, and each node in the path contains a basic block identifier and jump probability information.

[0101] Step S24: Based on the linear representation path corresponding to each basic code block in the assembly code representation, perform linear conversion of the corresponding basic code block in the assembly code representation to generate a binary assembly linear instruction sequence representation.

[0102] In this embodiment of the invention, the basic code blocks are linearly converted into assembly instructions based on linear representation paths. Each linear representation path is traversed, and the assembly instructions within each basic block are sequentially connected according to the order of the basic blocks in the path. For jump instructions in the path, the jump instruction is replaced with a relative position marker based on the position of the target basic block in the path. For example, the JMP label instruction in the original assembly code is replaced with JMP+5 if the target basic block is located 5 positions after the current basic block in the path; if it is located 3 positions before the current basic block, it is replaced with JMP-3. For conditional jump instructions, relative position replacement is also performed, while retaining the condition judgment logic. When processing loop structures, the loop body basic block sequence is copied multiple times, the number of times being the previously determined execution frequency. For example, if the execution frequency of a certain loop basic block is 10 times, the loop body instruction sequence is copied 10 times. Finally, a continuous binary assembly linear instruction sequence representation without jump instructions is generated. Each instruction in the sequence contains an opcode, operands, and relative position marker information.

[0103] Step S25: Based on the pre-trained + fine-tuned architecture and using the neural machine translation model in natural language processing technology, a semantic embedding vector generation model is constructed to perform cross-instruction set semantic embedding transformation on the binary assembly linear instruction sequence representation, so as to generate a unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture.

[0104] In this embodiment of the invention, a neural machine translation model is constructed based on a pre-training + fine-tuning architecture to perform cross-instruction set semantic embedding transformation on the representation of linear instruction sequences in binary assembly. In the pre-training stage, a large-scale multi-architecture binary code corpus is used, and a Transformer architecture is adopted. The encoder and decoder each contain 12 layers, and each layer has 8 attention heads. The pre-training tasks include masked language model (MLM) and next-sentence prediction (NSP). In the fine-tuning stage, parameters are adjusted for binary code samples in specific domains, and a contrastive learning strategy is used to optimize the model. The linear instruction sequence is divided into a fixed-length token sequence, where each token represents an instruction or operand. The semantic features of the instruction sequence are extracted by the encoder to generate an embedding vector. To address the differences between instruction set architectures, an architecture embedding layer is introduced into the model, assigning an independent embedding vector to each instruction set architecture. During the decoding stage, an attention mechanism is used to align the semantic representations of different architectures, ultimately generating a unified 256-dimensional binary code semantic embedding vector space. Semantically similar instructions from different architectures are close in distance within this space. Verification using cosine similarity calculation shows that the distance between ADD EAX, EBX of the x86 architecture and ADD R0, R1, R2 of the ARM architecture in the embedding space is 0.12, indicating a high degree of semantic similarity.

[0105] Furthermore, step S22 includes the following steps:

[0106] The execution activity of the corresponding basic code blocks in the assembly code representation is statistically analyzed based on the execution frequency of each basic code block to obtain the program execution activity of each basic code block.

[0107] In this embodiment of the invention, based on the pre-defined basic code blocks, the execution frequency of each basic code block within the assembly code representation is statistically analyzed. Instrumentation is employed to insert counter code at the entry point of each basic code block, with the initial counter value set to 0. During program simulation execution, the counter for each basic code block is automatically incremented by 1 upon entry. The simulation execution process follows the jump relationships defined in the control flow graph, ensuring that the execution path covers all possible scenarios. After the simulation execution is completed, the final count values ​​of all counters are collected. For example, for basic code blocks containing loop structures, the counter value will increase accordingly due to multiple loop iterations; while basic blocks executed only under specific conditions may have lower counter values. The program execution activity corresponding to each basic code block is calculated using the formula "Program execution activity = Number of basic code block executions / Total number of simulation executions". Assuming a total number of simulation executions is 1000, and the final counter value of a certain basic code block is 200, its program execution activity is 0.2. The execution activity of all basic code blocks is sorted and recorded to provide a quantitative basis for subsequent analysis.

[0108] Preferably, the execution path branch identification of the corresponding code basic blocks in the assembly code representation is performed based on the basic blocks corresponding to the binary code blocks and the jump relationship between each basic block in the control flow graph structure features, so as to obtain each possible branch path corresponding to each code basic block in the program execution process.

[0109] In this embodiment of the invention, the execution path branches of the basic blocks in the assembly code representation are identified based on the basic blocks corresponding to the binary code blocks and the structural features of the control flow graph. Starting from the initial basic block of the control flow graph, the graph structure is traversed using a depth-first search (DFS) algorithm. For each basic block, its outgoing edges are checked: if there is an outgoing edge corresponding to an unconditional jump instruction, the basic block pointed to by the outgoing edge is the only subsequent execution path; if there are two outgoing edges corresponding to a conditional jump instruction, they represent two branch paths when the condition is true and false, respectively. Taking the basic block containing the conditional judgment instruction "CMP EAX,EBX; JE label" as an example, by analyzing the control flow graph, it is identified that when "EAX = EBX", the program jumps along the edge pointing to the basic block marked "label", which is one branch path; when "EAX ≠ EBX", the program jumps along the other edge to other basic blocks, forming another branch path. During the search process, all possible branch paths of each basic block are recorded and stored in a tree structure. Nodes represent basic blocks and edges represent path jump relationships. Finally, each possible branch path corresponding to each basic code block during program execution is obtained, clearly showing the multiple possibilities of program execution.

[0110] Preferably, the branch jump probability between the corresponding code basic blocks in the assembly code representation is evaluated based on the program execution activity corresponding to each code basic block and in combination with each possible branch path corresponding to each code basic block in the program execution process, so as to obtain the branch jump probability between each code basic block in the assembly code representation.

[0111] In this embodiment of the invention, based on the previously obtained program execution activity corresponding to each basic code block, and combined with each identified possible branch path, the branch jump probability between basic code blocks in the assembly code representation is evaluated. For two adjacent basic blocks A and B in the control flow graph (i.e., there is a directed edge from A to B), let the program execution activity of basic block A be A. actice The number of executions required to jump from basic block A to basic block B via this directed edge is N. AB The total number of outgoing edges executed for basic block A is N. A-total Then use the formula Calculate the branch jump probability from basic block A to basic block B. For example, if the execution activity of basic block A is 0.3, the number of executions from basic block A to basic block B is 30, and the total number of outgoing edges from basic block A is 100, then the branch jump probability from A to B is... The above calculation is performed on all pairs of basic blocks connected by directed edges in the control flow graph to obtain the branch jump probabilities between each basic code block in the assembly code representation. These probability values ​​are stored in matrix form, where matrix element P... ij This represents the branch jump probability from basic block i to basic block j, providing crucial data support for optimizing code layout and predicting execution behavior during subsequent binary code embedding.

[0112] Furthermore, step S25 includes the following steps:

[0113] Step S251: Based on the pre-trained + fine-tuned architecture, and using the neural machine translation model in natural language processing technology combined with binary code block training, construct the corresponding semantic embedding vector generation model.

[0114] In this embodiment of the invention, a semantic embedding vector generation model is constructed based on a pre-training + fine-tuning architecture. A neural machine translation model with a Transformer architecture is employed. During the pre-training phase, a large-scale multi-architecture binary code corpus is used, including binary code samples from instruction set architectures such as x86, ARM, and MIPS. The model includes an encoder and a decoder. The encoder consists of a 12-layer self-attention mechanism and a feedforward neural network. The decoder also has a 12-layer structure, with each layer containing self-attention, encoder-decoder attention, and a feedforward neural network. During pre-training, a masked language model (MLM) task is used, randomly masking 15% of the instruction tokens to allow the model to... The model predicts the masked content and simultaneously uses the Next Sentence Prediction (NSP) task to determine whether two consecutive code blocks are semantically continuous. The pre-training process lasts for 100 epochs with a learning rate of 5e-5 and a batch size of 64. In the fine-tuning phase, domain-specific binary code samples are used to adjust the model parameters to adapt to the target task. A two-stage training strategy is adopted during fine-tuning. In the first stage, the first 6 layers of the encoder are frozen, and only the last 6 layers and the decoder are trained with a learning rate of 1e-5. In the second stage, all layers are unfrozen, the learning rate is reduced to 5e-6, and training continues for 50 epochs. Finally, a semantic embedding vector generation model that can handle binary code with different architectures is obtained.

[0115] Step S252: Perform original semantic parsing mapping on instructions of different architectures within the binary assembly linear instruction sequence representation to extract operands, operators, and control flow information corresponding to instructions of different architectures, and map them to generate semantic representations corresponding to instructions of different architectures.

[0116] In this embodiment of the invention, the instructions of different architectures within the binary assembly linear instruction sequence representation are parsed and mapped using original semantics. For x86 architecture instructions, regular expression matching technology is used to identify the instruction format. For example, MOVEAX,[EBX+4] is parsed as the operator MOV, the target operand EAX (register type), and the source operand [EBX+4] (memory addressing type). For ARM architecture instructions ADD R0, R1, R2, they are parsed as the operator ADD, the target operand R0, and the source operands R1 and R2. The attributes of each operand are extracted, including register number, memory address offset, and immediate value. At the same time, the control flow information between instructions is analyzed to identify jump instructions (such as JMP, B) and conditional branch instructions (such as JE, BNE). The jump target address and conditional expression are recorded, and the extracted operands, operators, and control flow information are mapped to a unified semantic representation space. One-hot encodings are created for each operator and operand type, such as MOV encoded as [0,0,1,…,0] and register EAX encoded as [1,0,0,…,0]. For complex operands, such as memory addressing [EBX+4], the encoding is broken down into a combination of the base address register EBX, offset 4, and addressing mode, ultimately generating fixed-dimensional semantic representation vectors corresponding to instructions of different architectures.

[0117] Step S253: Input the semantic representations corresponding to different architecture instructions into the semantic embedding vector generation model to perform cross-instruction set semantic embedding analysis, so as to automatically capture the semantic structure embeddings corresponding to different architecture instructions through unsupervised learning and generate binary code semantic embedding vectors corresponding to cross-instruction set architectures.

[0118] In this embodiment of the invention, cross-instruction set semantic embedding analysis is performed by inputting the semantic representations corresponding to instructions of different architectures into a semantic embedding vector generation model. An unsupervised learning approach is adopted. The model encoder processes the input semantic representations and captures long-distance dependencies between instructions through a self-attention mechanism. For example, for the x86 instruction sequence MOVEAX,5; ADD EBX,EAX and the ARM instruction sequence MOV R0,#5; ADD R1,R1,R0, the model calculates the correlation between different instruction tokens using an attention weight matrix, learning the semantic correspondence between EAX and R0, and between EBX and R1. The decoder generates embedding vectors corresponding to the input semantic representations, with a vector dimension of 256. During training, a contrastive learning strategy is used to shorten the distance between semantically similar instruction pairs (such as the implementation of the same function under different architectures) and widen the distance between semantically unrelated instruction pairs. The InfoNCE loss function is adopted, with the formula: L=-log(exp(sim(z_i,z_j) / τ) / Σ_k). exp(sim(z_i,z_k) / τ)), where z_i and z_j are the embedding vectors of positive sample pairs, z_k is the embedding vector of negative sample pairs, sim is the cosine similarity function, and τ is the temperature parameter (set to 0.1). Through this training method, the model automatically captures the semantic structure embeddings corresponding to instructions of different architectures, and finally generates binary code semantic embedding vectors corresponding to cross instruction set architectures.

[0119] Step S254: Perform semantic similarity calculation between the semantic embedding vectors of binary code corresponding to cross instruction set architectures to obtain the semantic embedding similarity between different cross instruction set architectures.

[0120] In this embodiment of the invention, semantic similarity is calculated between the semantic embedding vectors of binary code corresponding to cross instruction set architectures. The cosine similarity metric is used. For embedding vectors v1 and v2 generated by two different architecture instructions, the calculation formula is: cosine_sim(v1,v2)=(v1·v2) / (||v1||·||v2||), where v1·v2 is the vector dot product, and ||v1|| and ||v2|| are the L2 norms of the vectors, respectively. For example, calculating the x86 instruction ADD... The embedding vector similarity of EAX, EBX and ARM instructions ADDR0, R1, R2 is calculated using the formula above. If v1 = [0.2, 0.3, ..., 0.1] and v2 = [0.15, 0.32, ..., 0.09], the similarity value is 0.92, indicating that the two instructions are highly similar semantically. To improve computational efficiency, vector indexing technology is used to construct a KD-tree structure for the embedding vectors. For a given query vector, the K nearest neighbor vector is quickly found through the KD-tree, reducing the computational overhead of traversing all vectors. The similarity between all instruction pairs is calculated to form a similarity matrix, where the matrix element S[i,j] represents the semantic similarity between the i-th instruction and the j-th instruction.

[0121] Step S255: Based on the semantic embedding similarity between different cross-instruction set architectures, perform a unified semantic vector space transformation between the binary code semantic embedding vectors corresponding to the cross-instruction set architectures, so as to adjust the specific distribution of the binary code semantic embedding vectors in the space based on the semantic embedding similarity, so as to generate a unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture.

[0122] In this embodiment of the invention, based on the semantic embedding similarity between different cross-instruction set architectures, a unified semantic vector space transformation is performed on the binary code semantic embedding vectors. Using the Procrustes analysis method, an orthogonal transformation matrix R is found such that the vectors in the source vector space (e.g., x86 architecture) are semantically closer to the vectors in the target vector space (e.g., ARM architecture) after transformation. The optimization objective function is: Where A is the source vector matrix and B is the target vector matrix. To find the optimal transformation matrix R using the Frobenius norm and singular value decomposition (SVD), the specific steps are: calculate the covariance matrix C = A. T ·B, perform SVD decomposition on C: C = U·Σ·V T Then the optimal transformation matrix R = U·V TThe transformation matrix R is used to multiply all vectors in the source vector space to obtain the transformed vectors. For example, for the x86 architecture embedding vector v_x86, the transformed vector is v_x86' = v_x86·R. The distribution of the vector space is adjusted so that semantically similar instructions are closer together in the new space, and semantically unrelated instructions are farther apart. Finally, a unified binary code semantic embedding vector space corresponding to cross instruction set architecture is generated. Instructions of different architectures have a consistent semantic representation in this space, which provides a foundation for subsequent code analysis, vulnerability detection and other applications.

[0123] Furthermore, step S3 includes the following steps:

[0124] Step S31: Obtain known vulnerability samples.

[0125] In this embodiment of the invention, known vulnerability samples are acquired through a multi-channel collection strategy. Confirmed vulnerability samples are extracted from public vulnerability databases such as NVD (National Vulnerability Database) and CVE (Common Vulnerability Disclosure). These samples cover different industries and application scenarios. At the same time, newly discovered zero-day vulnerabilities and high-risk vulnerabilities are collected from reports published by security research institutions. For specific fields, such as IoT devices and industrial control systems, dedicated vulnerability samples are obtained from security bulletins of relevant manufacturers. The collected vulnerability samples are classified and organized, and indexes are established according to dimensions such as vulnerability type (e.g., buffer overflow, format string vulnerability), instruction set architecture (e.g., x86, ARM, MIPS), and application scenario (e.g., web applications, embedded systems). Each vulnerability sample contains information such as original binary code, vulnerability description, exploitation method, and remediation suggestions. The samples are uniquely identified by a hash algorithm to ensure the accuracy and traceability of the samples.

[0126] Step S32: Perform binary vulnerability feature analysis on the known vulnerability samples to obtain the features of the known binary vulnerability samples.

[0127] In this embodiment of the invention, binary vulnerability feature analysis is performed on known vulnerability samples using a combination of static and dynamic analysis. In the static analysis phase, disassemblers are used to convert binary code into assembly instruction sequences, extracting features such as instruction patterns, register usage habits, and memory access patterns. For example, for buffer overflow vulnerabilities, the focus is on analyzing the relationship between memory write instructions (such as MOV and STOS) and array boundary checking instructions (such as CMP and JLE). In the dynamic analysis phase, symbolic execution technology is used to simulate program execution, recording program state changes and data flow. During the simulation, specially designed test inputs are injected to trigger vulnerability behavior, observing phenomena such as abnormal memory access and control flow hijacking. Combined with taint analysis technology, the propagation path of data from the input source to the vulnerability point is traced to determine the vulnerability triggering conditions. The features obtained from static and dynamic analysis are integrated to construct vulnerability feature vectors. Each feature vector contains information on dimensions such as instruction sequence patterns, memory access patterns, data flow relationships, and control flow characteristics, forming a structured representation of the features of known binary vulnerability samples.

[0128] Step S33: Perform vulnerability pattern mapping analysis on known vulnerability samples based on the characteristics of known binary vulnerability samples to generate a known binary vulnerability pattern mapping table, which includes the binary code vulnerability performance patterns of buffer overflow and format string vulnerabilities under different instruction set architectures.

[0129] In this embodiment of the invention, vulnerability pattern mapping analysis is performed on known vulnerability samples based on their characteristics. A clustering algorithm from machine learning is used to group vulnerability samples of the same type according to their instruction set architecture. For example, all buffer overflow vulnerability samples are divided into x86 architecture group, ARM architecture group, MIPS architecture group, etc. For samples within each architecture group, a sequence alignment algorithm is used to analyze the similarity of instruction sequences and extract common pattern features. For example, in x86 architecture buffer overflow vulnerabilities, a common pattern is the lack of boundary checks after consecutive memory write instructions. These common patterns are abstracted into binary code vulnerability manifestation patterns, forming a vulnerability pattern library. A mapping relationship is established between vulnerability types and manifestation patterns under different architectures, generating a known binary vulnerability pattern mapping table. Each entry in the mapping table contains information such as vulnerability type, instruction set architecture, corresponding binary code vulnerability manifestation pattern, and pattern matching threshold. For example, for format string vulnerabilities, the manifestation pattern under ARM architecture might be frequent use of PRINTF series functions with a lack of parameter validation; the corresponding matching threshold is set to 0.85.

[0130] Step S34: Based on the unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture, perform semantic vulnerability characterization analysis on the vulnerability feature patterns in the known binary vulnerability pattern mapping table and the corresponding target program in the binary code block to generate high-dimensional semantic vulnerability characterization vectors for each code block.

[0131] In this embodiment of the invention, based on a unified binary code semantic embedding vector space corresponding to a cross-instruction set architecture, semantic vulnerability representation analysis is performed on vulnerability feature patterns in a known binary vulnerability pattern mapping table and the target program under test. The vulnerability feature patterns and the binary code of the program under test are converted into semantic vectors in the unified vector space. A cosine similarity calculation method is used to compare the similarity between the vulnerability feature pattern vector and the vectors of each code block in the program under test. A similarity threshold of 0.7 is set. When the similarity between a code block vector and a vulnerability feature pattern vector exceeds the threshold, the code block is considered to have a potential vulnerability. For the identified potentially vulnerable code blocks, their neighborhood structure in the vector space is further analyzed. Using the K-nearest neighbor algorithm, the K most similar known vulnerability sample vectors to the code block are found, and their common features and differences are analyzed. Combined with information such as instruction sequences and data flow relationships in the vulnerability feature patterns, feature enhancement is performed on the potentially vulnerable code blocks, ultimately generating a high-dimensional semantic vulnerability representation vector containing multi-dimensional feature information.

[0132] Step S35: Perform candidate vulnerability retrieval and location on the high-dimensional semantic vulnerability representation vector corresponding to each code block to generate a set of candidate vulnerability code blocks.

[0133] In this embodiment of the invention, candidate vulnerabilities are located by performing candidate vulnerability retrieval on the high-dimensional semantic vulnerability representation vectors corresponding to each code block. A density-based spatial clustering algorithm (DBSCAN) is used to cluster the high-dimensional semantic vulnerability representation vectors. The neighborhood radius parameter ε is set to 0.3, and the minimum sample size parameter MinPts is set to 5. Points with density connections in the vector space are divided into the same cluster, with each cluster representing a potential vulnerability type. The distance between the cluster center and the known vulnerability pattern vector is calculated to determine the vulnerability type corresponding to the cluster. For each vector in a cluster, its distance to the cluster center is calculated; the closer the distance, the more likely the code block is to be a vulnerability point. A distance threshold of 0.2 is set, and code blocks with a distance less than the cluster center are selected as candidate vulnerability code blocks. The candidate vulnerability code blocks are sorted, with priority given to code blocks matching high-risk vulnerability patterns. Finally, a set of candidate vulnerability code blocks containing parameters such as location information, vulnerability type, and confidence level is generated, providing a clear target for subsequent vulnerability verification and remediation.

[0134] Furthermore, step S34 includes the following steps:

[0135] Binary semantic analysis is performed on the target program under test corresponding to the binary code block to obtain the binary semantic representation of the target program under test.

[0136] In this embodiment of the invention, binary semantic analysis is performed on the target program under test within the binary code block. A method combining instruction-level semantic extraction and data flow analysis is adopted. First, the target program under test is decomposed into a sequence of machine instructions. Semantic parsing is performed on each instruction. For x86 architecture instructions, such as MOV EAX,[EBX+4], the operator MOV is identified through the opcode mapping table. The target operand EAX is determined to be a general-purpose register using register encoding rules. Based on the memory addressing mode, the source operand [EBX+4] is parsed to represent the memory address access of the base address register EBX plus offset 4. A data flow analysis graph is constructed, with instructions as nodes and data flow directions as edges. When instructions perform read or write operations on registers or memory, connections are established between nodes. For example, between the instructions MOV EAX,5 and ADD EBX,EAX, since the ADD instruction reads the value of EAX, a directed edge is established in the data flow graph from the MOV instruction node to the ADD instruction node. At the same time, control flow information during instruction execution is recorded, jump instructions and conditional branch instructions are identified, and the transfer of program execution path is determined. Instruction semantics, data flow, and control flow information are integrated, and a binary semantic representation of the target program under test is generated according to a fixed format. Each semantic representation unit contains information such as instruction opcode, operand type and value, data flow dependency, and control flow jump target, and is stored in a structured form to provide basic data for subsequent vulnerability analysis.

[0137] Preferably, based on the unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture, semantic vulnerability association mapping is performed on the vulnerability feature patterns in the known binary vulnerability pattern mapping table and the binary semantic representation of the target program under test, so as to analyze the vulnerability association between the binary semantic representation and vulnerability feature patterns in the target program under test, and map them to the corresponding unified binary code semantic embedding vector space to obtain the high-dimensional semantic vulnerability representation of each code block.

[0138] In this embodiment of the invention, based on a unified binary code semantic embedding vector space corresponding to a cross-instruction set architecture, vulnerability feature patterns in a known binary vulnerability pattern mapping table are associated and mapped with the binary semantic representation of the target program under test. The known binary vulnerability pattern mapping table stores feature patterns of common vulnerabilities such as buffer overflow and integer overflow. Each feature pattern consists of a series of instruction semantic fragments and data operation relationships. Using the cosine similarity calculation method, the vulnerability feature patterns and binary semantic representations are converted into embedding vectors respectively, and then similarity calculation is performed. For a sequence of instructions in the buffer overflow vulnerability feature pattern, MOV ESI,[EBP-40]; MOV EAX,[ESI]; MOV[EDI],EAX, convert it to an embedding vector V1; perform the same conversion on similar instruction sequences in the target program to obtain vector V2. Calculate the similarity between the two using the formula cosine_sim(V1,V2)=(V1·V2) / (||V1||×||V2||). If the similarity exceeds a set threshold (e.g., 0.8), a vulnerability association is identified. Map this part of the binary semantic representation to a unified binary code semantic embedding vector space. During the mapping process, the instruction operation information and data flow relationship in the original semantic representation are preserved, and their specific positions are determined according to the coordinate rules of the vector space. Generate a high-dimensional semantic vulnerability representation corresponding to each code block, intuitively showing the distribution of vulnerability features in the semantic space.

[0139] Preferably, the high-dimensional semantic vulnerability representation corresponding to each code block is optimized by performing vulnerability representation based on semantic difference analysis, so as to identify potential vulnerability differences and corresponding mismatches by using semantic difference analysis, and to refine and optimize the high-dimensional semantic vulnerability representation to generate a high-dimensional semantic vulnerability representation vector corresponding to each code block.

[0140] In this embodiment of the invention, vulnerability representation optimization based on semantic difference analysis is performed on the high-dimensional semantic vulnerability representations corresponding to each code block. The Locality Sensitive Hash (LSH) algorithm is used to hash-bin the high-dimensional semantic vulnerability representation vectors, quickly identifying semantically similar vulnerability representations. For vectors within each bin, the semantic difference between each pair is calculated. The semantic difference calculation combines the Euclidean distance and semantic information entropy, with the formula Diff = α × d + (1 - α) × H, where d is the Euclidean distance, H is the semantic information entropy, and α is 0.6. Through semantic difference analysis, potential vulnerability differences and mismatches are identified. For example, if two high-dimensional semantic vulnerability representation vectors are close in Euclidean distance but have a large difference in semantic information entropy, it indicates a possible mismatch, requiring further analysis. For the identified problems, the high-dimensional semantic vulnerability representation is refined and optimized. For mismatched vectors, their original semantic representation is re-examined, the parameters in the embedding vector generation process are adjusted, and they are remapped to the vector space. For vulnerabilities with discrepancies, missing semantic information is supplemented by combining historical vulnerability data and expert experience. This includes adding data flow constraints or control flow jump logic, ultimately generating a high-dimensional semantic vulnerability representation vector for each code block. This vector accurately reflects the vulnerability characteristics and provides a reliable basis for subsequent vulnerability detection and remediation.

[0141] Furthermore, step S35 includes the following steps:

[0142] Step S351: Evaluate the vulnerability logic error repair for the high-dimensional semantic vulnerability representation vector corresponding to each code block to obtain the probability distribution of semantic vulnerability logic error repair for each code block.

[0143] In this embodiment of the invention, vulnerability logic error repair assessment is performed on the high-dimensional semantic vulnerability representation vectors corresponding to each code block. An assessment model is constructed using a Bayesian network. First, assessment factors are determined, including the type of instruction involved in the vulnerability, the complexity of the data flow, the number of control flow jumps, etc. Taking a buffer overflow vulnerability as an example, if the vulnerability representation vector shows that a large number of memory write operations are involved and there are abnormal jumps in the control flow, these factors are used as nodes of the Bayesian network. A conditional probability table is set for each node, and the probability value is determined by training with historical vulnerability repair data. For example, if historical data shows that the probability of successful repair is 0.3 when a vulnerability involves more than 5 consecutive memory write operations, this probability is recorded in the conditional probability table of the corresponding node. Using Bayes' theorem P(A|B)=P(B|A)P(A) / P(B), and combining the dependencies between various factors, the probability of repairing the semantic vulnerability logic error corresponding to each code block is calculated. After performing the above calculation on all code blocks, the probability distribution of the semantic vulnerability logic error repair for each code block is obtained. The repair probability is divided into five levels: very low (0-0.2), low (0.2-0.4), medium (0.4-0.6), high (0.6-0.8), and very high (0.8-1). The probability density function is used to visually represent the likelihood of each code block being at different repair probability levels.

[0144] Step S352: Obtain the vulnerability case library corresponding to the binary code block.

[0145] In this embodiment of the invention, a vulnerability case library corresponding to binary code blocks is obtained. This library stores historical vulnerability cases under different instruction set architectures. The vulnerability case library is stored using a relational database structure. Each case includes fields such as vulnerability type (e.g., buffer overflow, integer overflow), involved instruction sequence, data flow direction, control flow characteristics, and remediation scheme. The construction of the case library is based on long-term vulnerability research and collection. Representative vulnerability cases are extracted through analysis of public vulnerability reports, security research literature, and actual security incidents. Simultaneously, each case is standardized, converting the instruction sequence into a unified semantic representation to ensure comparability between cases. For example, vulnerability cases implementing the same function under x86 and ARM architectures are all converted into a representation based on a unified semantic embedding vector space, facilitating subsequent matching calculations.

[0146] Step S353: Based on the probability distribution of semantic vulnerability logic error repair for each code block, perform vulnerability semantic matching calculation between the high-dimensional semantic vulnerability representation vector corresponding to each code block and each vulnerability case in the vulnerability case library to obtain the semantic matching index between each code block and each vulnerability case.

[0147] In this embodiment of the invention, based on the probability distribution of semantic vulnerability logic error repair for each code block, the high-dimensional semantic vulnerability representation vector corresponding to each code block is matched with each vulnerability case in the vulnerability case library. A weighted fusion matching algorithm is used, with a repair probability weight of 0.4 and a semantic similarity weight of 0.6. The semantic similarity calculation uses an improved edit distance algorithm, which decomposes the semantic representation of the high-dimensional semantic vulnerability representation vector and the vulnerability case into sub-elements such as instruction operations, data flow relationships, and control flow patterns, and calculates the edit distance between sub-elements. For example, for the semantic tables of two buffer overflow vulnerabilities... As shown, if their memory write operation instruction sequences are similar but their control flow jump patterns are different, this difference is quantified by edit distance. Combined with the repair probability, the semantic similarity is weighted and adjusted. If the repair probability of a certain code block is 0.8 (high repair probability level), and its semantic similarity calculation value with a certain vulnerability case is 0.7, then the final semantic matching index is calculated by the formula MatchIndex = 0.4 × 0.8 + 0.6 × 0.7 = 0.74. This calculation is performed on each code block and all cases in the vulnerability case library to finally obtain the semantic matching index between each code block and each vulnerability case.

[0148] Step S354: Based on the semantic matching index between each code block and each vulnerability case, perform candidate vulnerability retrieval and location on the corresponding code blocks to generate a set of candidate vulnerability code blocks.

[0149] In this embodiment of the invention, candidate vulnerabilities are retrieved and located for corresponding code blocks based on the semantic matching index between each code block and each vulnerability case. The semantic matching index threshold is set to 0.7. All code blocks and their corresponding semantic matching indices are traversed. When the semantic matching index between a code block and a vulnerability case is greater than or equal to 0.7, the code block is marked as a candidate vulnerability code block. Clustering analysis is used to cluster the candidate vulnerability code blocks according to the semantic matching index and vulnerability type. For example, all candidate code blocks with high matching indices with buffer overflow vulnerability cases are clustered into one category, and those with high matching indices with integer overflow vulnerability cases are clustered into another category. Each clustering result is sorted, and code blocks with high semantic matching indices and low repair probabilities are preferentially selected to be added to the candidate vulnerability code block set. The final candidate vulnerability code block set contains the code blocks most likely to have vulnerabilities. Each code block is accompanied by detailed information such as its corresponding vulnerability type, the matching index with the most similar case in the case library, and the probability of repairing semantic vulnerability logic errors, providing clear targets and references for subsequent vulnerability verification and repair.

[0150] Furthermore, step S4 includes the following steps:

[0151] Step S41: Perform potential vulnerability execution identification analysis on each candidate vulnerability code block in the candidate vulnerability code block set to obtain the dependency relationship between instruction sequences, jump logic and function call corresponding instruction potential vulnerability execution characteristics in each candidate vulnerability code block.

[0152] In this embodiment of the invention, potential vulnerability execution identification analysis is performed on each candidate vulnerable code block within the candidate vulnerable code block set. A joint data flow and control flow analysis method is employed. First, a data flow graph (DFG) is constructed for each candidate vulnerable code block to trace data dependencies between instructions. For example, in a buffer overflow candidate code block, the memory write dependency between the MOV EDI,[EBP-40] instruction and the subsequent STOSDWORD PTR[EDI] instruction is analyzed to determine the data flow path from registers to memory. Simultaneously, a control flow graph (CFG) is constructed to parse instruction jump logic. For conditional jump instructions CMPEAX,100; JL label, the execution path differences when the condition is true and false are analyzed. Symbolic execution technology is used to simulate program execution, generating symbolic expressions for each variable and recording the constraints during instruction execution. For function call instructions, such as CALL strlen, the function parameter passing method and return value processing logic are extracted. By analyzing the stack frame structure, the parameter pushing order and stack balancing operation are determined. By integrating data flow dependencies, control flow jump logic, and function call characteristics, a vector containing 128 dimensions is formed. The first 32 dimensions represent the strength of data dependencies, the middle 64 dimensions describe the complexity of control flow, and the last 32 dimensions record the function call pattern, thereby obtaining the execution characteristics of potential instruction vulnerabilities.

[0153] Step S42: Based on the dependencies between instruction sequences, jump logic, and the potential vulnerability execution characteristics of instruction calls within each candidate vulnerability code block, perform vulnerability activation path mapping on the corresponding candidate vulnerability code blocks to generate code execution vulnerability activation paths corresponding to instruction sequences within each candidate vulnerability code block.

[0154] In this embodiment of the invention, vulnerability activation path mapping is performed based on the instruction dependencies and jump logic of candidate vulnerable code blocks. A depth-first search (DFS) algorithm is used to traverse the control flow graph, generating multiple execution paths from the entry instruction based on different branches of conditional jumps. For example, in a code block containing an IF-ELSE structure, two paths are generated: one where the condition is true and one where it is false. For each execution path, the vulnerability activation condition is analyzed in conjunction with data flow dependencies. In a buffer overflow scenario, the path must satisfy the condition that "memory write length exceeds buffer size." Symbolic execution is used to generate constraint expressions for each path, such as write length > buffer size, and the satisfiability of these constraint expressions is solved. A path weight algorithm is used to evaluate the vulnerability activation probability of each path, with the weight determined by the frequency of occurrence of key instructions in the path. For example, the weight of a path missing a memory boundary check instruction is increased by 20%. Finally, 3-5 high-probability vulnerability activation paths are generated for each candidate vulnerable code block, with each path containing information such as instruction sequence, constraint conditions, and activation probability.

[0155] Step S43: Based on the code execution vulnerability activation path corresponding to the instruction sequence within each candidate vulnerability code block, perform dynamic vulnerability distribution analysis on each candidate vulnerability code block in the candidate vulnerability code block set based on the execution time window, so as to obtain the occurrence frequency, time distribution and vulnerability existence timing of each candidate vulnerability code block.

[0156] In this embodiment of the invention, a time series analysis model is constructed by performing dynamic distribution analysis of vulnerabilities based on the execution time window of the vulnerability activation path. The execution window is divided into 100ns units. Using dynamic binary instrumentation, timers are inserted at key instructions in each activation path to record the timestamps of instruction execution. The number of executions of each candidate vulnerability code block within different time windows is counted, and the frequency of occurrence is calculated. For example, a buffer overflow vulnerability has the highest execution frequency (0.7 times / ms) within the 500-1000ms time window after program startup. When analyzing the time distribution characteristics, periodic execution patterns are identified, such as vulnerability triggering paths that repeat execution every 100ms. When determining the timing of vulnerability existence, the system event log is combined to analyze the time correlation between vulnerability activation and external input. For example, if the probability of a vulnerability code block being activated exceeds 90% within 300ms after receiving a network data packet of a specific format, the frequency, time distribution, and timing of existence data are stored in a three-dimensional matrix with dimensions of (time window, execution path, vulnerability type).

[0157] Step S44: Based on the occurrence frequency, time distribution and vulnerability timing of each candidate vulnerability code block, perform dynamic analysis and verification on each candidate vulnerability code block set to verify whether the vulnerability exists and filter it out to generate vulnerability code blocks.

[0158] In this embodiment of the invention, candidate vulnerable code blocks are verified and screened based on dynamic distribution characteristics. A frequency threshold of 0.5 times / ms and a time window coverage threshold of 60% are set. A comprehensive verification score is calculated for each candidate code block: Score = 0.4 × frequency normalized value + 0.3 × time coverage normalized value + 0.3 × timing correlation. When the Score > 0.7, a vulnerability is determined to exist. For example, if a candidate code block has a frequency normalized value of 0.8, a time coverage normalized value of 0.65, and a timing correlation of 0.9, the comprehensive score is 0.8 × 0.4 + 0.65 × 0.3 + 0.9 × 0.3 = 0.785. If the score exceeds the threshold, it is confirmed as a vulnerable code block. For multi-path vulnerabilities, a voting mechanism is adopted: when more than 50% of the activation paths meet the verification score, the code block is determined to have a vulnerability. All code blocks that meet the Score are screened out, and finally a list of vulnerable code blocks containing vulnerability type, activation conditions, and verification score is generated.

[0159] Step S45: Obtain the patched code block and extract the static and dynamic features corresponding to the vulnerable code block and the patched code block. At the same time, identify the corresponding vulnerability patching status by comparing and analyzing the static and dynamic features corresponding to the vulnerable code block and the patched code block, so as to output the corresponding binary vulnerability code block detection report.

[0160] In this embodiment of the invention, by acquiring the repaired code block, comparing the differences between the versions of the vulnerable code block before and after using a version control system, static features are extracted, including instruction sequence hash values, opcode frequency distribution, and function call graph topology; dynamic features include execution time series, memory access patterns, and CPU utilization curves. A feature comparison matrix is ​​constructed. The difference between static features is calculated using Hamming distance, and the similarity between dynamic features is calculated using the Dynamic Time Warping (DTW) algorithm. For example, the Hamming distance between the instruction sequence of the vulnerable code block and the repaired code block is 15, and the DTW distance between the memory access patterns is 8.7. A repair status identification rule is designed: if the difference between static features > 10 and the similarity between dynamic features < 0.6, it is determined to be repaired. The final generated detection report includes the location of the vulnerable code block, vulnerability type, static difference analysis, dynamic behavior comparison, and repair suggestions. The repair suggestions are generated based on the modification pattern of the repaired code block, such as adding boundary checks CMPECX,100; JLE safe after the memory write instruction.

[0161] Example 2

[0162] The code embedding system based on a semantic embedding vector generation model described in this invention includes the following steps:

[0163] The disassembly module is used to obtain binary code blocks, disassemble the binary code blocks to generate corresponding assembly code representations, and perform code structure analysis on the assembly code representations based on different granularities to obtain the basic blocks and control flow graph structure features corresponding to the binary code blocks.

[0164] The generation module is used to perform linear transformation of assembly instructions on the assembly code representation based on the basic blocks corresponding to the binary code blocks and the control flow graph structure features, so as to generate a binary assembly linear instruction sequence representation; and to construct a semantic embedding vector generation model based on a pre-trained + fine-tuned architecture and using a neural machine translation model in natural language processing technology, and to perform cross-instruction set semantic embedding transformation on the binary assembly linear instruction sequence representation through the semantic embedding vector generation model, so as to generate a unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture.

[0165] The analysis module is used to acquire known vulnerability samples and perform semantic vulnerability characterization analysis on the known vulnerability samples and the corresponding target programs within the binary code blocks based on the unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture, so as to generate high-dimensional semantic vulnerability characterization vectors corresponding to each code block; and perform candidate vulnerability retrieval and location on the high-dimensional semantic vulnerability characterization vectors corresponding to each code block to generate a set of candidate vulnerability code blocks.

[0166] The detection module is used to dynamically analyze and verify the candidate set of vulnerable code blocks to generate vulnerable code blocks; obtain the repaired code blocks, and extract the static and dynamic features corresponding to the vulnerable code blocks and the repaired code blocks. At the same time, by comparing and analyzing the static and dynamic features corresponding to the vulnerable code blocks and the repaired code blocks, the corresponding vulnerability repair status is identified.

[0167] Example 3

[0168] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the code embedding method based on a semantic embedding vector generation model. For example, the method includes: acquiring binary code blocks; disassembling the binary code blocks to generate corresponding assembly code representations; performing code structure analysis on the assembly code representations at different granularities to obtain basic blocks and control flow graph structure features corresponding to the binary code blocks; performing linear conversion of the assembly code representations based on the basic blocks and control flow graph structure features to generate a binary assembly linear instruction sequence representation; constructing a semantic embedding vector generation model based on a pre-trained + fine-tuned architecture and utilizing a neural machine translation model from natural language processing technology; and using the semantic embedding vector generation model... A cross-instruction set semantic embedding transformation is performed on the binary assembly linear instruction sequence representation to generate a unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture. Known vulnerability samples are acquired, and semantic vulnerability characterization analysis is performed on the known vulnerability samples and the corresponding target programs within the binary code blocks based on the unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture to generate high-dimensional semantic vulnerability characterization vectors for each code block. Candidate vulnerability retrieval and localization are performed on the high-dimensional semantic vulnerability characterization vectors corresponding to each code block to generate a set of candidate vulnerable code blocks. Dynamic analysis and verification are performed on the set of candidate vulnerable code blocks to generate vulnerable code blocks. Repaired code blocks are acquired, and static and dynamic features corresponding to vulnerable code blocks and repaired code blocks are extracted. Simultaneously, the corresponding vulnerability repair status is identified by comparing and analyzing the static and dynamic features corresponding to vulnerable code blocks and repaired code blocks.

[0169] Example 4

[0170] A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of the code embedding method based on a semantic embedding vector generation model, for example including: obtaining binary code blocks; disassembling the binary code blocks to generate corresponding assembly code representations; performing code structure analysis on the assembly code representations based on different granularities to obtain basic blocks and control flow graph structure features corresponding to the binary code blocks; performing linear conversion of assembly instructions on the assembly code representations based on the basic blocks and control flow graph structure features corresponding to the binary code blocks to generate binary assembly linear instruction sequence representations; constructing a semantic embedding vector generation model based on a pre-trained + fine-tuned architecture and utilizing a neural machine translation model in natural language processing technology; and using the semantic embedding vector generation model to perform linear conversion of binary assembly instructions. The method involves performing cross-instruction set semantic embedding transformation on the instruction sequence representation to generate a unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture; acquiring known vulnerability samples and performing semantic vulnerability characterization analysis on the known vulnerability samples and the corresponding target programs within the binary code blocks based on the unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture to generate high-dimensional semantic vulnerability characterization vectors for each code block; performing candidate vulnerability retrieval and location on the high-dimensional semantic vulnerability characterization vectors corresponding to each code block to generate a set of candidate vulnerable code blocks; performing dynamic analysis and verification on the set of candidate vulnerable code blocks to generate vulnerable code blocks; acquiring repaired code blocks and extracting the static and dynamic features corresponding to the vulnerable code blocks and the repaired code blocks, while identifying the corresponding vulnerability repair status by comparing and analyzing the static and dynamic features corresponding to the vulnerable code blocks and the repaired code blocks.

[0171] The above description is merely a preferred embodiment of the present invention and does not constitute any limitation on the present invention. Any simple modifications, alterations, or equivalent structural changes made to the above embodiments based on the technical essence of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A code embedding method based on a semantic embedding vector generation model, characterized in that, Includes the following steps: Obtain binary code blocks, disassemble the binary code blocks to generate corresponding assembly code representations; perform code structure analysis on the assembly code representations based on different granularities to obtain the basic blocks and control flow graph structure features corresponding to the binary code blocks; Based on the basic blocks corresponding to the binary code blocks and the structural features of the control flow graph, the assembly code representation is linearly transformed into assembly instructions to generate a binary assembly linear instruction sequence representation; a semantic embedding vector generation model is constructed based on a pre-trained + fine-tuned architecture and using a neural machine translation model in natural language processing technology; the semantic embedding vector generation model is used to perform cross-instruction set semantic embedding transformation on the binary assembly linear instruction sequence representation to generate a unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture. Acquire known vulnerability samples, and perform semantic vulnerability characterization analysis on the known vulnerability samples and the target programs to be tested corresponding to the binary code blocks based on the unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture, so as to generate high-dimensional semantic vulnerability characterization vectors corresponding to each code block; perform candidate vulnerability retrieval and location on the high-dimensional semantic vulnerability characterization vectors corresponding to each code block, so as to generate a set of candidate vulnerability code blocks; Dynamically analyze and verify the set of candidate vulnerable code blocks to generate vulnerable code blocks; Obtain the patched code block and extract the static and dynamic features corresponding to the vulnerable code block and the patched code block. At the same time, identify the corresponding vulnerability patching status by comparing and analyzing the static and dynamic features corresponding to the vulnerable code block and the patched code block.

2. The code embedding method based on the semantic embedding vector generation model according to claim 1, characterized in that, The specific operations for obtaining binary code blocks, disassembling the binary code blocks to generate corresponding assembly code representations, and performing code structure analysis on the assembly code representations based on different granularities to obtain the basic blocks and control flow graph structure features corresponding to the binary code blocks are as follows: Obtain the binary code block; The binary code block is parsed to generate an intermediate code representation containing the instruction sequence and the corresponding register usage; Based on the instruction sequence and registers, the binary code block is disassembled using the corresponding intermediate code representation to generate the corresponding assembly code representation; The assembly code representation is subjected to code structure analysis based on different granularities to obtain the basic blocks corresponding to the binary code blocks and the control flow graph structure features.

3. The code embedding method based on the semantic embedding vector generation model according to claim 2, characterized in that, The specific operation of performing code structure analysis based on different granularities on the assembly code representation to obtain the basic blocks corresponding to the binary code blocks and the control flow graph structure features is as follows: Granular semantic analysis is performed on each instruction in the assembly code representation to generate a granular feature set for each instruction, wherein the granular feature set includes operands and operators corresponding to each instruction; Based on the granularity feature set corresponding to each instruction, the assembly code representation is divided into instruction blocks to analyze the dependency relationship between adjacent instructions based on the granularity feature set. The assembly code representation is divided into several basic code blocks with independent semantics. At the same time, based on the dependency relationship between adjacent instructions, the dependency relationship of several basic code blocks with independent semantics is modeled to generate the dependency relationship graph between each basic block. Based on the dependency graph between the basic blocks, control flow identification and analysis are performed on the jump instructions and conditional branch instructions in the assembly code representation to obtain the control flow boundary in the assembly code representation. Based on the control flow boundaries corresponding to the assembly code representation, dynamic path identification and analysis are performed on several basic code blocks with independent semantic correspondence to obtain the corresponding dynamic control flow paths between each basic block; based on the corresponding dynamic control flow paths between each basic block, a control flow graph is constructed between each basic code block to obtain the corresponding control flow graph between each basic block. Code structure feature analysis is performed on each basic code block with independent semantic correspondence and the corresponding control flow graph between each basic block to obtain the basic block and control flow graph structure features corresponding to the binary code block, including the jump relationship between each basic block, the number of executions and the execution time corresponding to each dynamic path.

4. The code embedding method based on the semantic embedding vector generation model according to claim 1, characterized in that, The specific operations of performing linear assembly instruction transformation on the assembly code representation based on the basic blocks corresponding to the binary code blocks and the control flow graph structure features to generate a binary assembly linear instruction sequence representation; constructing a semantic embedding vector generation model based on a pre-trained + fine-tuned architecture and utilizing a neural machine translation model in natural language processing technology; and performing cross-instruction set semantic embedding transformation on the binary assembly linear instruction sequence representation through the semantic embedding vector generation model to generate a unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture are as follows: Based on the basic blocks corresponding to the binary code blocks and the structural features of the control flow graph, the node execution frequency of the corresponding basic code blocks in the assembly code representation is determined. Each basic code block in the assembly code representation is taken as a node, and the execution frequency of each basic code block is determined. Based on the execution frequency of each basic code block and combined with the basic blocks corresponding to the binary code blocks and the control flow graph structure features, the branch jump probability of the corresponding basic code blocks in the assembly code representation is evaluated, and the branch jump probability between each basic code block in the assembly code representation is obtained. Based on the branch jump probabilities between the basic code blocks in the assembly code representation, a linear representation path mapping is performed on the corresponding basic code blocks in the assembly code representation to generate the linear representation path corresponding to each basic code block in the assembly code representation; Based on the linear representation path corresponding to each basic code block within the assembly code representation, the corresponding basic code blocks within the assembly code representation are linearly converted into assembly instructions to generate a binary assembly linear instruction sequence representation; Based on a pre-trained and fine-tuned architecture, a semantic embedding vector generation model is constructed using a neural machine translation model in natural language processing. The model then performs cross-instruction set semantic embedding transformation on the binary assembly linear instruction sequence representation to generate a unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture.

5. The code embedding method based on the semantic embedding vector generation model according to claim 4, characterized in that, The specific operations for constructing a semantic embedding vector generation model based on a pre-trained + fine-tuned architecture and utilizing a neural machine translation model in natural language processing, and performing cross-instruction set semantic embedding transformation on the binary assembly linear instruction sequence representation to generate a unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture are as follows: A semantic embedding vector generation model is constructed based on a pre-trained + fine-tuned architecture and by combining a neural machine translation model in natural language processing technology with binary code block training. The original semantic parsing and mapping of instructions of different architectures within the binary assembly linear instruction sequence representation is performed to extract the operands, operators and control flow information corresponding to instructions of different architectures, and to generate semantic representations corresponding to instructions of different architectures. The semantic representations corresponding to the different architecture instructions are input into the semantic embedding vector generation model to perform cross-instruction set semantic embedding analysis. The semantic structure embeddings corresponding to the different architecture instructions are automatically captured through unsupervised learning, and binary code semantic embedding vectors corresponding to cross-instruction set architecture are generated. Semantic similarity is calculated between the semantic embedding vectors of binary code corresponding to cross instruction set architectures to obtain the semantic embedding similarity between different cross instruction set architectures; Based on the semantic embedding similarity between different cross-instruction set architectures, a unified semantic vector space transformation is performed between the binary code semantic embedding vectors corresponding to the cross-instruction set architecture. This is to adjust the specific distribution of the binary code semantic embedding vectors in the space based on the semantic embedding similarity, so as to generate a unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture.

6. The code embedding method based on the semantic embedding vector generation model according to claim 1, characterized in that, The specific steps of acquiring known vulnerability samples and performing semantic vulnerability characterization analysis on the known vulnerability samples and the corresponding target programs within binary code blocks based on the unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture to generate high-dimensional semantic vulnerability characterization vectors for each code block, and performing candidate vulnerability retrieval and localization on the high-dimensional semantic vulnerability characterization vectors for each code block to generate a set of candidate vulnerability code blocks are as follows: Obtain samples of known vulnerabilities; Binary vulnerability feature analysis is performed on known vulnerability samples to obtain the features of known binary vulnerability samples; Based on the characteristics of known binary vulnerability samples, vulnerability pattern mapping analysis is performed on known vulnerability samples to generate a known binary vulnerability pattern mapping table. The known binary vulnerability pattern mapping table includes the binary code vulnerability performance patterns of buffer overflow and format string vulnerabilities under different instruction set architectures. Based on the unified binary code semantic embedding vector space corresponding to cross instruction set architecture, semantic vulnerability characterization analysis is performed on the vulnerability feature patterns in the known binary vulnerability pattern mapping table and the corresponding target programs in the binary code blocks to generate high-dimensional semantic vulnerability characterization vectors for each code block. Candidate vulnerabilities are retrieved and located from the high-dimensional semantic vulnerability representation vectors corresponding to each code block to generate a set of candidate vulnerability code blocks.

7. The code embedding method based on the semantic embedding vector generation model according to claim 1, characterized in that, The candidate vulnerability code block set is dynamically analyzed and verified to generate vulnerability code blocks; The specific steps for obtaining the patched code block, extracting the static and dynamic features corresponding to the vulnerable code block and the patched code block, and identifying the corresponding vulnerability patching status by comparing and analyzing the static and dynamic features of the vulnerable code block and the patched code block are as follows: Potential vulnerability execution identification and analysis are performed on each candidate vulnerability code block in the candidate vulnerability code block set to obtain the dependency relationship between instruction sequences, jump logic and function call corresponding instruction potential vulnerability execution characteristics of each candidate vulnerability code block. Based on the dependencies between instruction sequences, jump logic, and the potential vulnerability execution characteristics of instructions corresponding to function calls within each candidate vulnerability code block, vulnerability activation path mapping is performed on the corresponding candidate vulnerability code blocks to generate code execution vulnerability activation paths corresponding to instruction sequences within each candidate vulnerability code block. Based on the code execution vulnerability activation path corresponding to the instruction sequence within each candidate vulnerability code block, a dynamic vulnerability distribution analysis based on the execution time window is performed on each candidate vulnerability code block in the candidate vulnerability code block set to obtain the occurrence frequency, time distribution, and vulnerability existence timing of each candidate vulnerability code block. Based on the frequency of occurrence, time distribution, and timing of vulnerability existence of each candidate vulnerability code block, dynamic analysis and verification are performed on each candidate vulnerability code block in the candidate vulnerability code block set to verify whether the vulnerability exists and filter it out to generate vulnerability code blocks. The system retrieves the patched code blocks and extracts the static and dynamic features corresponding to the vulnerable code blocks and the patched code blocks. It also identifies the corresponding vulnerability patching status by comparing and analyzing the static and dynamic features of the vulnerable code blocks and the patched code blocks, and outputs the corresponding binary vulnerability code block detection report.

8. A code embedding system based on a semantic embedding vector generation model, characterized in that, Includes the following steps: The disassembly module is used to obtain binary code blocks, disassemble the binary code blocks to generate corresponding assembly code representations, and perform code structure analysis on the assembly code representations based on different granularities to obtain the basic blocks and control flow graph structure features corresponding to the binary code blocks. The generation module is used to perform linear transformation of assembly instructions on the assembly code representation based on the basic blocks corresponding to the binary code blocks and the control flow graph structure features, so as to generate a binary assembly linear instruction sequence representation; and to construct a semantic embedding vector generation model based on a pre-trained + fine-tuned architecture and using a neural machine translation model in natural language processing technology, and to perform cross-instruction set semantic embedding transformation on the binary assembly linear instruction sequence representation through the semantic embedding vector generation model, so as to generate a unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture. The analysis module is used to acquire known vulnerability samples and perform semantic vulnerability characterization analysis on the known vulnerability samples and the corresponding target programs within the binary code blocks based on the unified binary code semantic embedding vector space corresponding to the cross-instruction set architecture, so as to generate high-dimensional semantic vulnerability characterization vectors corresponding to each code block; and perform candidate vulnerability retrieval and location on the high-dimensional semantic vulnerability characterization vectors corresponding to each code block to generate a set of candidate vulnerability code blocks. The detection module is used to dynamically analyze and verify the set of candidate vulnerable code blocks in order to generate vulnerable code blocks; Obtain the patched code block and extract the static and dynamic features corresponding to the vulnerable code block and the patched code block. At the same time, identify the corresponding vulnerability patching status by comparing and analyzing the static and dynamic features corresponding to the vulnerable code block and the patched code block.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the code embedding method based on the semantic embedding vector generation model as described in any one of claims 1-7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the code embedding method based on the semantic embedding vector generation model as described in any one of claims 1-7.

Images