Binary vulnerability data set expansion method and system based on cross-modal alignment

Abstract

The invention discloses a binary vulnerability data set expansion method and system based on cross-modal alignment, provides a hierarchical semantic fusion alignment framework, and remarkably improves the precision and expandability of binary vulnerability detection through a heterogeneous modal semantic bridging and transfer learning mechanism. A multi-modal semantic mapping channel is constructed by utilizing natural language interpretation and combining program structured analysis and constant anchor point coding, so that the semantic difference between a binary code and a source code is effectively bridged; a hierarchical attention mechanism enhances the fine-grained perception capability of cross-modal matching; furthermore, a migration framework driven by a vulnerability detection task is provided, binary vulnerability detection is mapped to a source code feature space through cross-modal alignment, a binary vulnerability data set is rapidly expanded by utilizing rich source code vulnerability data, and the data scale bottleneck is broken through.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of vulnerability detection, and in particular to a binary vulnerability dataset expansion method and system based on cross-modal alignment. BACKGROUND

[0002] With the complication of software supply chain and the wide application of open source code, the cross-modal matching technology between binary programs and source codes has become one of the core challenges of software security analysis. Especially in the field of vulnerability detection, how to accurately align binary code fragments with source code vulnerability features directly affects the expansion efficiency of vulnerability knowledge base and the generalization ability of detection tools. Traditional methods rely on manual reverse engineering or feature extraction based on symbolic execution, which is not only time-consuming but also difficult to cope with the semantic gap of large-scale heterogeneous codes. Although existing researches attempt to realize cross-modal matching through neural network embedding, the precision and interpretability are still significant bottlenecks due to the structural ambiguity of binary codes and the scarcity of training data. The scarcity of binary vulnerability dataset is a major obstacle in the field of binary vulnerability detection, which is significantly lagging behind the source code dataset in terms of data acquisition, labeling efficiency, tool support and model generalization. However, binary is irreplaceable in the vulnerability detection of real scenarios (such as Internet of Things devices and closed source software), and how to expand the scale of binary vulnerability data and promote the practical development of binary vulnerability detection is a problem to be solved. SUMMARY

[0003] In view of the semantic gap and vulnerability detection data scarcity in the cross-modal matching between binary and source codes, the application provides a binary vulnerability dataset expansion method and system based on cross-modal alignment. Firstly, a binary-source cross-modal hierarchical semantic fusion alignment framework is proposed, and it is applied to the vulnerability detection task to break through the dilemma of limited scale of binary vulnerability dataset. Then, natural language explanations are generated by the locally deployed DeepSeek-R1-32B large model, combined with program structured analysis and constant anchor coding, a multi-modal semantic bridging channel is constructed, and a hierarchical attention alignment network is designed to enhance the fine-grained perception ability of cross-modal matching. Finally, a vulnerability detection transfer paradigm based on the binary-source cross-modal hierarchical semantic fusion alignment framework is proposed, which can quickly expand the binary vulnerability sample library by using rich source code vulnerability data.

[0004] In order to achieve the above purpose, the application adopts the following technical scheme:

[0005] The application provides a binary vulnerability dataset expansion method based on cross-modal alignment, which comprises the following steps:

[0006] Step 1: Employ a dual-channel parallel processing mechanism to extract multi-level information from the source code and binary code respectively. The multi-level information includes natural language interpretation, structural features, and constant features. Use a pre-trained domain expert network to generate feature embedding vectors for the source code and binary code.

[0007] Step 2: Fuse the feature embedding vectors of the source code and binary code through a hierarchical attention mechanism to obtain the final source code feature embedding vector and binary code feature embedding vector;

[0008] Step 3: Construct interaction features between source code and binary code based on the final source code feature embedding vector and binary code feature embedding vector. Concatenate the original source code feature embedding vector and binary code feature embedding vector with the interaction features to construct a high-dimensional joint representation. Input the high-dimensional joint representation into a multilayer perceptron to model high-order nonlinear relationships. Finally, calculate the alignment probability between source code and binary code using the sigmoid function. Based on the alignment probability, complete the cross-modal function-level alignment of binary and source code.

[0009] Step 4: Map the binary vulnerability detection task to the source code feature space and expand the binary vulnerability dataset using source code vulnerability data.

[0010] Furthermore, in step 1, for source code, the code semantics are parsed using a locally deployed DeepSeek to generate a natural language explanation; for binary code, the disassembled code is obtained based on IDA Pro and then input into a locally deployed DeepSeek to generate a natural language explanation.

[0011] Furthermore, in step 1, the text portion of the natural language interpretation of the source code and binary code is embedded using M3E.

[0012] Furthermore, the hierarchical attention mechanism includes an intramodal fusion layer, a cross-modal feature interaction layer, and a dynamic fusion information layer;

[0013] First, multi-head attention is used in the intra-modal fusion layer to calculate the dependencies between features of the same modality, and then intra-modal feature fusion is performed to obtain the fused intra-modal feature h. self Subsequently based on h self In the cross-modal feature interaction layer, cross-modal feature interaction is performed through cross-attention to obtain cross-modal interaction information h. cross Finally, h is fused at the dynamic fusion information layer through a dynamic gating mechanism. self and h cross This yields the final feature embedding vector.

[0014] Furthermore, in the cross-modal feature interaction layer, each branch of the multi-head attention independently calculates cross-attention and the results are concatenated.

[0015] Furthermore, the dynamic fusion information layer specifically fuses h in the following manner. self and h cross :

[0016] g=σ(W g [h self h cross ]+b g )

[0017] h final =g·h self +(1-g)·h cross

[0018] Where g is a gate vector, W g b g h represents the weight and bias, respectively. final Let σ represent the final feature embedding vector, σ be the Sigmoid function, and || represent the concatenation operation.

[0019] Furthermore, the interaction features include the difference, similarity, and product interaction between the feature vectors of the source code and binary code output by the hierarchical attention mechanism, as shown in the following formula:

[0020] Δ=∣h src_final -h bin_final |

[0021] S = h src_final ·h bin_final

[0022] P = h src_final ⊙h bin_final

[0023] Where Δ, S, and P represent the difference, similarity, and product interaction between the feature vectors of the source code and binary code output by the hierarchical attention mechanism, respectively, and h src_final h bin_final represents the feature vectors of the source code and binary code output by the hierarchical attention mechanism, respectively, and ⊙ represents the Hadamard product.

[0024] Furthermore, in step 4, for a given binary function, the system iteratively determines whether the given binary function has vulnerabilities and the specific vulnerabilities by using a pre-constructed source code vulnerability database.

[0025] Another aspect of this invention proposes a binary vulnerability dataset expansion system based on cross-modal alignment, comprising:

[0026] The multi-granularity feature extraction module is used to extract multi-level information from the source code and binary code respectively using a dual-channel parallel processing mechanism. The multi-level information includes natural language interpretation, structural features and constant features. It generates feature embedding vectors of source code and binary code with the help of a pre-trained domain expert network.

[0027] The hierarchical attention module is used to fuse the feature embedding vectors of source code and binary code through a hierarchical attention mechanism to obtain the final source code feature embedding vector and binary code feature embedding vector.

[0028] The cross-modal alignment module is used to construct interaction features between the source code and binary code based on the final source code feature embedding vector and binary code feature embedding vector. The original source code feature embedding vector and binary code feature embedding vector are concatenated with the interaction features to construct a high-dimensional joint representation. The high-dimensional joint representation is input into a multilayer perceptron to model a high-order nonlinear relationship. Finally, the alignment probability between the source code and binary code is calculated through the sigmoid function, and the cross-modal function-level alignment between binary and source code is completed based on the alignment probability.

[0029] The binary vulnerability dataset extension module is used to map binary vulnerability detection tasks to the source code feature space and expand the binary vulnerability dataset using source code vulnerability data.

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] 1. This invention bridges the semantic gap between heterogeneous modalities by generating natural language interpretations through local deployment of DeepSeek, and significantly improves the accuracy and interpretability of cross-modal matching by combining program structure analysis and constant anchor point encoding.

[0032] 2. A hierarchical attention mechanism is proposed during the alignment process to achieve the step-by-step fusion of multi-granular semantic features.

[0033] 3. To address the scarcity of binary vulnerability datasets, the cross-modal hierarchical semantic fusion alignment framework (steps 1-3) is migrated to vulnerability detection. Leveraging the massive scale of source code vulnerability datasets, the binary vulnerability detection task is mapped to the source code detection domain through alignment, which conveniently and quickly expands the scale of the binary vulnerability dataset.

[0034] 4. Training and testing using publicly available datasets showed that the alignment architecture of this invention achieved an accuracy of 92.3%. Testing on real-world vulnerability datasets demonstrated that the method of this invention can quickly and effectively detect binary vulnerabilities, achieving an accuracy of 78.6% and a false positive rate of only 15.4%. Attached Figure Description

[0035] Figure 1A schematic diagram illustrating the framework of a binary vulnerability dataset expansion method based on cross-modal alignment provided in an embodiment of the present invention;

[0036] Figure 2 This is a schematic diagram of a register state tracking template provided in an embodiment of the present invention;

[0037] Figure 3 This is a schematic diagram of multi-granularity feature extraction provided in an embodiment of the present invention. Detailed Implementation

[0038] For ease of understanding, the following explanations are provided for some of the terms used in the specific embodiments of this invention:

[0039] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments:

[0040] like Figure 1 As shown, a method for expanding a binary vulnerability dataset based on cross-modal alignment includes:

[0041] Step 1: Employ a dual-channel parallel processing mechanism to extract multi-level information from the source code and binary code respectively. The multi-level information includes natural language interpretation, structural features, and constant features. Use a pre-trained domain expert network to generate feature embedding vectors for the source code and binary code.

[0042] Step 2: Fuse the feature embedding vectors of the source code and binary code through a hierarchical attention mechanism to obtain the final source code feature embedding vector and binary code feature embedding vector;

[0043] Step 3: Construct interaction features between source code and binary code based on the final source code feature embedding vector and binary code feature embedding vector. Concatenate the original source code feature embedding vector and binary code feature embedding vector with the interaction features to construct a high-dimensional joint representation. Input the high-dimensional joint representation into a multilayer perceptron to model high-order nonlinear relationships. Finally, calculate the alignment probability between source code and binary code using the sigmoid function. Based on the alignment probability, complete the cross-modal function-level alignment of binary and source code.

[0044] Step 4: Map the binary vulnerability detection task to the source code feature space and expand the binary vulnerability dataset using source code vulnerability data.

[0045] The method specifically includes:

[0046] 1 Overall Framework

[0047] This invention proposes a binary-source code cross-modal hierarchical semantic fusion alignment framework, which achieves deep semantic matching between source code and binary programs through heterogeneous feature decoupling and hierarchical semantic fusion. Figure 1The paper demonstrates the overall framework of this method, which adopts a two-stream cross-modal alignment architecture, including the construction of multi-granularity feature extractors and the implementation of hierarchical alignment networks.

[0048] This framework employs a dual-channel parallel processing mechanism to extract semantic information (natural language interpretation), structural features (Abstract Syntax Tree (AST) and data flow on the source code side, and Control Flow Graph (CFG) on the binary side) and constant semantics (integers and strings) from both the source code and binary modalities. Modality-specific embedding vectors are generated using a pre-trained domain expert network, thus completing the construction of the multi-granularity feature extractor. To address the heterogeneity of cross-modal feature spaces, a hierarchical attention alignment mechanism is designed. This mechanism dynamically captures deep correlation patterns between the source code and binary data through a three-stage progressive fusion strategy: local feature weighted concatenation, cross-domain gating interaction, and global semantic aggregation. Finally, a robust cross-modal matching classifier is constructed by jointly measuring the similarity of the representation spaces, effectively improving the semantic alignment accuracy of heterogeneous code representations while avoiding early feature confusion. Through multi-granularity feature extraction and hierarchical alignment networks, function-level alignment between the source code and binary data is ultimately achieved.

[0049] 2. Problem Definition

[0050] 2.1 Similarity

[0051] This invention is based on the theory of program semantic equivalence, establishing cross-modal similarity relationships between source code and binary code at the function granularity. Following the definition of a function in a binary program as defined by jTrans (a framework for binary program analysis), we consider a source code function and the ordered set of binary instructions (functions) compiled from it to be equivalent, i.e., similar.

[0052] For a set of functions F, a similarity relation is defined as follows: if functions f_s∈S and f_b∈B are generated by the same high-level language function through compilation, then they constitute a positive sample pair (f_s,f_b)∈P, and otherwise they constitute a negative sample pair (f_s,f_b)∈N.

[0053] 2.2 Alignment

[0054] Given the source code function S = {s1,...,sn} and its compiled binary function B = {b1,...,bm}, we define the alignment task as finding the mapping function F:(S,B)→[0,1] such that:

[0055]

[0056] The output probability is the cross-modal alignment confidence score, where: φ: S∪B→R d For a shared feature encoder, [·; ·] denotes vector concatenation operation, σ(·) is the sigmoid activation function, and w∈R2d , b∈R are the classification layer parameters.

[0057] 3 Feature Selection Mechanism

[0058] In cross-modal code alignment tasks, the quality of feature representation directly affects the model's ability to capture semantic consistency between heterogeneous modalities. Traditional methods often fall into the "modal gap" dilemma, mainly manifested in: (1) heterogeneity of syntactic structures leading to topological feature mismatch; (2) semantic noise introduced by compiler optimization destroying constant consistency; and (3) differences in abstraction levels causing breaks in intent representation. To overcome this limitation, this invention proposes a triple joint representation system: First, a high-level semantic bridge is constructed through dual-channel natural language interpretation to overcome the semantic fragmentation caused by syntactic differences; second, a hierarchical structure mapping based on control flow topology is used to realize cross-modal equivalent transformation of program logic; finally, a constant-aware anchor-assisted alignment mechanism is designed to enhance the model's robustness to compiler perturbations. These three feature dimensions complement each other at the spatial topology, semantic abstraction, and data entity levels, jointly constituting a complete solution space for cross-modal alignment.

[0059] 3.1 Natural Language Interpretation

[0060] To address the cross-modal semantic gap problem, this invention innovatively utilizes a locally deployed large model to construct a dual-channel natural language interpretation system, establishing a semantic bridge through natural language information to achieve cross-modal interpretability alignment.

[0061] Existing research, such as CLAP, attempts to bridge the gap between source code and binary code using natural language interpretation. However, it uses the GPT4 API for initial data accumulation and then trains and fine-tunes LLAMA on the existing data to obtain a GPT4 shadow model. Furthermore, it only performs source code interpretation generation; the binary code side is embedded into the natural language space by fine-tuning the encoder. Deepseek's open-source nature facilitates this work. We utilize DeepseekR1-32B to build a localized code understanding engine for natural language interpretation, significantly improving cost-effectiveness compared to CEBin's method of training a shadow model using a cloud API.

[0062] To address the one-way limitation of the CLAP method, which only processes source code, we also used IDA to process the binary code for assembly enhancement. Then, we specifically performed natural language interpretation and generation for the assembly code. By using a bidirectional interpretation system, we bridged the semantic gap between modalities and greatly satisfied the need for cross-modal alignment accuracy.

[0063] For both source code and binary code analysis, we implemented specific prompts to maximize the domain understanding capabilities of the large model. In the ARM reverse engineering channel, a register state tracing template was used to standardize the semantic annotation of input / output registers. A "first-then-final" instruction flow deconstruction paradigm guided the large model to accurately parse assembly-level control transfer patterns. In the C language source code analysis channel, a function signature derivation template was designed to force the model to follow the parsing path of "parameter type-return type-function summary," and a mechanism was established to constrain the preservation of the original English terms for technical terminology. Templates are as follows: Figure 2 As shown.

[0064] 3.2 Core Structure Topology

[0065] A program's structural characteristics reflect how the code is organized and its execution flow, serving as a crucial bridge between source code and binary code. Although the compilation process introduces many changes, the program's basic control flow and key structural relationships are usually preserved.

[0066] The core logic of the program—including branch decisions in control flow, nested relationships in loop iterations, and hierarchical structures of function calls—is still explicitly represented in the binary code as basic block divisions and jump instructions. For example, conditional branch statements (such as if-else) in the source code may be refactored into indirect jumps or conditional flag checks after compilation optimization, but the mutual exclusion of their branch paths and the execution order can still be accurately mapped through the topological relationships of the control flow graph. Furthermore, while code obfuscation techniques (such as fake branch injection) can interfere with the readability of symbol tables or variable names, they are unlikely to completely destroy the distribution patterns of inbound and outbound edges of key nodes (such as loop entries and exception handling entries) in the original control flow graph. This robustness to syntactic interference makes the structural topology a stable semantic carrier connecting the source code and the binary code. Although the source code functions and the compiled binary code differ significantly in form, their high-level logical features, such as function call trees and loop nesting depths, still exhibit cross-modal consistency, thus providing an abstract semantic framework decoupled from implementation details for the matching task.

[0067] 3.3 Transmodal constant anchor points

[0068] In cross-modal code representation alignment tasks, constants (such as hard-coded integers and string literals) are chosen as anchors for cross-modal alignment due to their compile-time invariance and semantic stability. Although constants are coarse-grained features (CodeCMR, 2022), they exhibit unique perturbation resistance during compilation.

[0069] Constants provide a highly reliable correlation between source code and binary representation. For example, the magic number in an encryption algorithm (such as the initial constant 0x6A09E667 in SHA-256) will always appear with the same value in binary. Similarly, constant values ​​in source code (such as #define BUFFER_SIZE 256) are directly mapped to literal operations in binary (such as the x86 instruction mov eax,256 or the ARM instruction LDR R0,=256), and do not become invalid with changes in compiler optimization levels (-O0 / -O3) or instruction set architecture. This stability stems from the logical immutability of constants; even when obfuscation techniques such as control flow flattening (OLLVM) or function inlining are applied, constant values ​​are still preserved as underlying operands.

[0070] 4. Multi-granularity feature extractor (e.g.) Figure 3 (As shown)

[0071] 4.1 Data Preprocessing

[0072] Function segmentation: We consider the source code and the binary files compiled from it to be similar. Based on the source code projects and corresponding compiled binary projects provided by the BinKit open-source dataset, we segmented them at the function level. Source code and binary functions with the same name in the same project are considered similar pairs. We then uniformly named the segmented source code and binary functions according to the project and function names.

[0073] Multi-dimensional information extraction: On the source code side, DeepSeek is deployed locally to parse the code semantics and generate natural language interpretations. Joern is used to extract AST and data flow structure features, and regular expressions and Clang are used to accurately extract constant strings and integers. On the binary side, IDAPro is used to obtain disassembled code, which is then input into a large model to generate interpretations. Angr is used to extract control flow features such as CFG / CG, and hard-coded constants are statically extracted using FLOSS and Capstone engines. Finally, the six-dimensional cross-modal features are normalized and stored, and function names are used as discriminant labels. This lays a multi-dimensional data foundation for the alignment task.

[0074] 4.2 Feature Embedding

[0075] Domain expert networks are used for embedding, the text portion of the natural language interpretation on the source code and binary side is embedded using M3E, the AST and data stream of the source code are embedded using GraphCodeBert, the CFG of the binary side is embedded using GAT, and the integers and strings on the source code and binary side are embedded using bidirectional LSTM.

[0076] Natural Language Interpretation Embedding: Natural language interpretation text from both the source code and binary sides is uniformly encoded into 768-dimensional semantic vectors directly using the M3E model. Each text segment is independently input into the model, and [CLS] tag vectors are extracted as the final representation. M3E is a text embedding model trained on a dataset of tens of millions (22 million+) Chinese sentences, surpassing the openai-ada-002 model (ChatGPT's official model) in both text classification and text retrieval tasks.

[0077] Structural Feature Embedding: Source Code Abstract Syntax Tree: After converting the AST into a graph structure based on sibling nodes and parent-child relationships, GraphCodeBERT is used for embedding. This model uses a Transformer architecture with data flow edge enhancement to perform mask prediction tasks on the node traversal path, and finally generates a 256-dimensional syntax feature vector through graph pooling layers. Binary Control Flow Graph: A three-layer graph attention network (GAT) is designed to address the graph topology characteristics of the CFG. Each basic block node contains a feature initialization vector (including opcode distribution, register state transitions, etc.), and neighbor node information is aggregated through a multi-head attention mechanism (8 heads). Finally, a node importance ranking algorithm is used to extract a 256-dimensional subgraph-level representation.

[0078] Constant Feature Embedding: For cross-architecture numerical constants (such as magic numbers and error codes) and string literals, a bidirectional LSTM encoder is constructed for context-sensitive embedding. The input sequence is encoded at the byte level. The forward LSTM captures grammatical constraint patterns, and the backward LSTM models the context dependencies. A compact 64-dimensional representation is generated through time-dimension max pooling. In particular, a sliding window (4-bit window, stride 2) is used to handle the discretization problem for hexadecimal values. Finally, integers and strings are embedded into a 128-dimensional vector.

[0079] 5-level alignment network

[0080] 5.1 Hierarchical attention mechanism:

[0081] Considering the heterogeneous gap between the source code and binary representations in terms of syntactic information, control flow structure, and underlying representation, we propose a hierarchical attention mechanism to fuse the embedding vectors of the source code and binary representations. Through multi-granularity cross-modal alignment, we achieve adaptive fusion of the source code and binary embedding vectors.

[0082] The three-dimensional features obtained from both the source code and binary sides through a multi-granularity feature extractor enter a hierarchical attention mechanism. This mechanism uses a third-order gated attention network, which first calculates the dependencies between features through multi-head attention (8 heads) to achieve intra-modal feature fusion. Figure 1 ①), and then cross-modal feature interaction is achieved through cross-attention ( Figure 1(②) Ultimately, multi-source information is fused through a dynamic gating mechanism. Figure 1 (① and ② in the text).

[0083] The first intramodal fusion layer (formula below) fuses multi-granularity features:

[0084] h self =Mean(MultiHead([h text ,h struct ,h str ]))

[0085] Where h self This represents the modality's own characteristics.

[0086] Thus, the fused source code feature embedding vector h is obtained. src and the fused binary code feature embedding vector h bin .

[0087] The second layer is a cross-modal (source code-binary code) feature interaction layer, which introduces cross-modal features into the unimodal vector. The source code is used as the query, and the binary features are used as the key / value (and vice versa). The output is the feature representation after cross-attention:

[0088] C src→bin =MultiHead(h src ,h bin ,h bin )

[0089] C bin→src =MultiHead(h bin ,h src ,h src )

[0090] Multi-head attention enhances feature diversity by independently calculating cross-attention and concatenating the results.

[0091] MultiHead(Q,K,V)=Concat(head1,…,head h W O

[0092]

[0093] This leads to the acquisition of cross-modal interaction information h. cross .

[0094] The third layer is a dynamic information fusion layer, which adaptively balances its own features with cross-modal interaction information:

[0095] g=σ(W g [hself h cross ]+b g )

[0096] h final =g·h self +(1-g)·h cross

[0097] Here, g is a gating vector with a value ranging from [0,1], used to dynamically balance the contributions of modal features and cross-modal interaction information. In the fusion formula: when g is close to 1, it indicates a greater reliance on modal features; when g is close to 0, it indicates a greater reliance on cross-modal interaction information. W g b g Let h represent the weights and biases, respectively. σ is the Sigmoid function, and || represents the concatenation operation. cross It is a general term for "cross-modal interactive information." For the source code modality: h cross Corresponding to C src→bin In other words, when processing source code, h cross It is C src→bin This represents the features resulting from the interaction of source code features with binary code features. For binary modality: h cross Corresponding to C bin→src In other words, when processing binary code, h cross It is C bin→src This indicates the features resulting from the interaction between binary code features and source code features.

[0098] The final source code feature embedding vector h is obtained. src_final and binary code feature embedding vector h bin_final .

[0099] The deep similarity network receives the final source code feature embedding vector and binary feature embedding vector output by the hierarchical attention mechanism. It calculates cross-modal alignment scores through multi-dimensional interactive modeling and nonlinear semantic fusion, designs three basic interaction operators for interactive feature construction, and calculates difference, similarity, and product interactions to capture complementary relationships between features.

[0100] Difference:Δ=∣h src_final -h bin_final |,

[0101] Similarity:S=h src_final ·h bin_final ,

[0102] Product:P=h src_final ⊙h bin_final ,

[0103] Where Δ, S, and P represent the difference, similarity, and product interaction between the feature vectors of the source code and binary code output by the hierarchical attention mechanism, respectively, and ⊙ represents the Hadamard Product. Then, the original features and the interaction features are concatenated to construct a high-dimensional joint representation:

[0104] h joint =[h src ||h bin ||Δ||P]∈R 4d ,

[0105] This design preserves both the interpretability of the original features and the discriminative power of the interactive features. It models high-order nonlinear relationships using a multilayer perceptron (MLP) and finally calculates the alignment probability between the source code and the binary code, i.e., the similarity score (0-1), using the sigmoid function.

[0106] It is worth noting that the output of similarity S is a scalar used to directly calculate the alignment score, and is not involved in feature concatenation. joint The construction focuses on preserving the original features (h src and h bin The system uses both vector-based interaction features (Δ and P) to balance interpretability and discriminativeness. Δ and P, as vectors, better capture local interaction information, while S, as a global similarity measure, is more suitable for high-level score calculation.

[0107] 6. Vulnerability Detection Migration

[0108] To address the issue of scarce datasets in binary vulnerability detection tasks, we creatively utilize the alignment of source code and binary data to map binary vulnerabilities to source code vulnerabilities. Simply put, given a binary function, we use a pre-constructed source code vulnerability database and our alignment model to iteratively determine whether the given binary function has a vulnerability, and which / some vulnerabilities it is (if a corresponding source code vulnerability function outputs an item, then the corresponding vulnerability exists).

[0109] We collected publicly disclosed CVE vulnerabilities and their associated vulnerability types (CWE-IDs) from different versions of eight projects: ffmpeg, libav, libtiff, linux, openssl, qemu, tcpdump, and xen. After removing duplicate vulnerabilities based on CVE-ID and function name and performing data cleaning, we obtained a total of 400 vulnerable functions and related information.

[0110] Taking the OpenSSL project as an example, we collected the source code and binaries of 60 CVE vulnerabilities from 2006 to 2021 for four versions: 0.9.8, 1.0.1, 1.1.0, and 1.1.1 (we only pre-built the source code vulnerability library; the binary vulnerabilities will be verified in subsequent experiments). Table 1 is a partial vulnerability list example for the four versions of the OpenSSL project.

[0111] Table 1. Examples of partial vulnerability lists for four versions of the OpenSSL project.

[0112]

[0113]

[0114] The source code function is embedded using a multi-granularity feature extractor to obtain three feature vectors for the source code vulnerability function. Then, by freezing the weights of the hierarchical attention mechanism, the first weighted concatenation layer (i.e., ...) is called. Figure 1 ①) Obtain the feature embedding vector of the source code vulnerability. Build an efficient index using FAISS or Milvus to support large-scale vector similarity searches. Utilize MySQL to store the mapping relationship between CVE metadata (ID, description, patch link) and embedding vectors, using CVE-ID as the core association item to build a scalable vulnerability knowledge base.

[0115] To verify the effectiveness of this invention, the following experiments were conducted:

[0116] 7.1 Experimental Setup

[0117] 7.1.1 Environment and Hardware Configuration

[0118] Our experimental environment is Ubuntu 22.04, with an Intel(R) Xeon(R) Platinum 8558P CPU and an NVIDIA A100-SXM4-80GB*8 graphics card.

[0119] 7.1.2 Dataset

[0120] Based on the BinKit 2.0 public dataset, we partitioned functions by project name plus function name to determine <source code, binary> matching pairs. Positive examples are function pairs with the same name within the same project, while negative examples are function pairs with different names within the same project and function pairs across projects. The positive and negative examples were constructed in a 1:3 ratio. During model training, the training, validation, and test sets were divided into training, validation, and test sets at 70%, 15%, and 15% respectively. The final training set contained 49,016 function pairs, the validation set contained 9,992 function pairs, and the test set contained 9,784 function pairs.

[0121] The vulnerability detection dataset constructed in this invention consists of binary functions extracted from real-world software vulnerabilities, covering 52 vulnerability types (including buffer overflows, integer overflows, and use-after-free) discovered in publicly disclosed CVE vulnerabilities. The dataset contains 400 binary function samples with known vulnerabilities, each labeled with CVE-ID, vulnerable function name, CWE-ID, etc., compiled in arm-gcc 4.8.0-00 (the table below shows some examples of the vulnerability test dataset). To enhance data diversity, we generated 4,672 derived test samples through code obfuscation (control flow flattening, instruction substitution), as shown in Table 2.

[0122] Table 2 Partial Test Samples

[0123]

[0124]

[0125] 7.1.3 Baseline Model

[0126] This invention selects the following two cutting-edge methods as baseline models for comparative experiments:

[0127] CodeCMR: This research pioneers a dual-encoder architecture for function-level binary-source code matching. The method employs a Deep Pyramid Convolutional Network (DPCNN) to extract character-level source code features, combined with a Graph Neural Network (GNN) based on HBMP node embeddings to model the binary control flow graph (CFG). It innovatively integrates code literals (strings / integers) using LSTM and proposes a norm-weighted sampling strategy to optimize the triplet loss. Experiments on the GCC / Clang compilation dataset demonstrate a Recall@1 of 90.2%, overcoming the limitations of traditional literal matching through semantic-aware representation learning.

[0128] CLAP: A contrastive learning-based framework that aligns assembly code semantics through natural language interpretation. It employs a jump-aware Transformer encoder and WordPiece word segmentation, utilizing 195 million automatically generated code-interpretation pairs for transfer representation learning. This model achieves a zero-shot Recall@1 of 83.3% in the Binary Code Similarity Detection (BCSD) task, demonstrating excellent cross-task generalization ability by mapping assembly code and text prompts to a unified semantic space. Combined with LLM-driven data augmentation, it effectively overcomes the data scarcity problem in low-resource scenarios.

[0129] 7.2 Experiment

[0130] To systematically verify the effectiveness and innovation of our model, this invention designs a multi-dimensional experimental system based on mainstream academic benchmarks for binary cross-modal detection. The experiments cover: the contribution of ablation to the deconstruction model's key components; comparative experiments for horizontal performance comparison; and vulnerability detection experiments to verify the alignment model's effectiveness in vulnerability detection tasks. All experiments are reproduced three times under the same hardware configuration and software environment, and the average is taken to ensure reproducibility.

[0131] RQ1: Validity test of model components

[0132] To verify the effectiveness of multimodal feature fusion and hierarchical attention mechanisms, we designed the following ablation experiments: 1) Feature ablation: Semantic, structural, and constant features were removed sequentially. 2) Structural ablation: The hierarchical attention mechanism was removed, and direct concatenation was used instead. The experimental results are shown in Table 3.

[0133] Table 3 Ablation Experiment Results

[0134]

[0135] Experimental results show that the complete model exhibits the best overall performance in the cross-modal alignment task. Its accuracy (0.9433), recall (0.9305) and F1 score (0.8913) are significantly better than those of each ablation condition, verifying the effectiveness of the multi-component collaborative design.

[0136] Specifically: (1) The absence of large models leads to a sharp drop in performance (F1 score drops by 19.54%). Its deep semantic understanding ability is crucial for suppressing false positives (precision drops by 29.09%), which shows that natural language interpretation, as a semantic bridge, plays an irreplaceable role in the implicit alignment task of heterogeneous features; (2) The removal of structural features causes a 9.52% drop in recall, indicating that the control flow graph (CFG) and abstract syntax tree (AST) play a key role in capturing the potential execution paths of binary and source code. Structural matching is an indispensable part of the alignment task; (3) The exclusion of constant information reduces precision by 5.99%, proving that semantic analysis of hard-coded values ​​(such as buffer size and loop boundaries) can effectively reduce false positives on benign code; (4) The reduction of attention mechanism causes a 10.27% drop in recall, proving its effectiveness in dynamically focusing on key alignment regions (such as source code for loops and binary jmp instruction sequences) through a three-layer attention mechanism.

[0137] The complete model achieves complementary representation between binary and source code at multiple levels, including semantics, structure, and constants, through heterogeneous feature fusion and dynamic weight allocation, ultimately achieving a balanced optimization of precision (0.8553) and recall (0.9305).

[0138] RQ2: Cross-modal matching performance comparison

[0139] For easier and more intuitive comparison, this model modified the evaluation metrics to Recall@1, Recall@10, and MRR in this experiment. The CLAP model was reproduced with the evaluation metric modified to Recall@10 to unify the evaluation metrics. As shown in Table 4, this model significantly outperforms the baseline in cross-architecture scenarios.

[0140] Table 4 Comparison of Cross-Modal Matching Performance Results

[0141] Recall@1 Recall@10 CodeCMR 87.3 97.5 CLAP(Zero shot) 83.6 92.9 This model 90.3 98.3

[0142] Compared to CodeCMR, this model improves Recall@1 by 3.0%, because the hierarchical attention introduced effectively alleviates the semantic shift caused by optimization perturbation. Compared to CLAP's Recall@1, it improves by 6.7% (since CLAP is more difficult to evaluate with zero samples, the improvement results are only for reference). This shows that explicit cross-modal alignment strategy is more suitable for fine-grained function matching than implicit language supervision.

[0143] RQ3. Vulnerability Detection Experiment

[0144] The results of the vulnerability detection experiment are shown in Table 5.

[0145] Table 5. Results of the vulnerability detection experiment

[0146]

[0147] This invention addresses the challenge of cross-modal semantic matching between binary and source code, proposing a cross-modal hierarchical semantic fusion alignment framework. It innovatively applies this framework to vulnerability detection tasks, solving the dual problems of scarce binary vulnerability data and insufficient detection accuracy. By combining large-model-driven natural language interpretation, program structure analysis, and a hierarchical attention mechanism, this method achieves accurate cross-modal semantic alignment and enhanced interpretability. Experiments demonstrate that the framework achieves a matching accuracy of 92.3% on public datasets and a detection accuracy of 78.6% in real-world binary vulnerability scenarios, significantly improving upon existing methods.

[0148] Based on the above embodiments, the present invention also proposes a binary vulnerability dataset expansion system based on cross-modal alignment, comprising:

[0149] The multi-granularity feature extraction module is used to extract multi-level information from the source code and binary code respectively using a dual-channel parallel processing mechanism. The multi-level information includes natural language interpretation, structural features and constant features. It generates feature embedding vectors of source code and binary code with the help of a pre-trained domain expert network.

[0150] The hierarchical attention module is used to fuse the feature embedding vectors of source code and binary code through a hierarchical attention mechanism to obtain the final source code feature embedding vector and binary code feature embedding vector.

[0151] The cross-modal alignment module is used to construct interaction features between the source code and binary code based on the final source code feature embedding vector and binary code feature embedding vector. The original source code feature embedding vector and binary code feature embedding vector are concatenated with the interaction features to construct a high-dimensional joint representation. The high-dimensional joint representation is input into a multilayer perceptron to model a high-order nonlinear relationship. Finally, the alignment probability between the source code and binary code is calculated through the sigmoid function, and the cross-modal function-level alignment between binary and source code is completed based on the alignment probability.

[0152] The binary vulnerability dataset extension module is used to map binary vulnerability detection tasks to the source code feature space and expand the binary vulnerability dataset using source code vulnerability data.

[0153] The above description is only a preferred embodiment of the present invention. It should be noted that those skilled in the art can make several improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for expanding a binary vulnerability dataset based on cross-modal alignment, characterized in that, include: Step 1: Employ a dual-channel parallel processing mechanism to extract multi-level information from the source code and binary code respectively. The multi-level information includes natural language interpretation, structural features, and constant features. Use a pre-trained domain expert network to generate feature embedding vectors for the source code and binary code. Step 2: Fuse the feature embedding vectors of the source code and binary code through a hierarchical attention mechanism to obtain the final source code feature embedding vector and binary code feature embedding vector; Step 3: Construct interaction features between source code and binary code based on the final source code feature embedding vector and binary code feature embedding vector. Concatenate the original source code feature embedding vector and binary code feature embedding vector with the interaction features to construct a high-dimensional joint representation. Input the high-dimensional joint representation into a multilayer perceptron to model high-order nonlinear relationships. Finally, calculate the alignment probability between source code and binary code using the sigmoid function. Based on the alignment probability, complete the cross-modal function-level alignment of binary and source code. Step 4: Map the binary vulnerability detection task to the source code feature space and expand the binary vulnerability dataset using source code vulnerability data.

2. The binary vulnerability dataset expansion method based on cross-modal alignment according to claim 1, characterized in that, In step 1, for source code, the code semantics are parsed using a locally deployed DeepSeek to generate a natural language interpretation; for binary code, the disassembled code is obtained based on IDAPro and then input into a locally deployed DeepSeek to generate a natural language interpretation.

3. The binary vulnerability dataset expansion method based on cross-modal alignment according to claim 1, characterized in that, In step 1, the text portion of the natural language interpretation of the source code and binary code is embedded using M3E.

4. The binary vulnerability dataset expansion method based on cross-modal alignment according to claim 1, characterized in that, The hierarchical attention mechanism includes an intramodal fusion layer, a cross-modal feature interaction layer, and a dynamic fusion information layer; First, multi-head attention is used in the intra-modal fusion layer to calculate the dependencies between features of the same modality, and then intra-modal feature fusion is performed to obtain the fused intra-modal feature h. self Subsequently based on h self In the cross-modal feature interaction layer, cross-modal feature interaction is performed through cross-attention to obtain cross-modal interaction information h. cross Finally, h is fused at the dynamic fusion information layer through a dynamic gating mechanism. self and h cross This yields the final feature embedding vector.

5. The binary vulnerability dataset expansion method based on cross-modal alignment according to claim 4, characterized in that, In the cross-modal feature interaction layer, each branch of the multi-head attention independently calculates cross-attention and the results are concatenated.

6. The binary vulnerability dataset expansion method based on cross-modal alignment according to claim 4, characterized in that, The dynamic fusion information layer specifically fuses h in the following manner. self and h cross : g=σ(W g [h self ‖h cross ]+b g ) h final =g·h self +(1-g)·h cross Where g is a gate vector, W g b g h represents the weight and bias, respectively. final Let σ represent the final feature embedding vector, σ be the Sigmoid function, and || represent the concatenation operation.

7. The binary vulnerability dataset expansion method based on cross-modal alignment according to claim 1, characterized in that, The interaction features include the difference, similarity, and product interaction between the feature vectors of the source code and binary code output by the hierarchical attention mechanism, as shown in the following formula: Δ=∣h src_final -h bin_final ∣ S=h src_final ·h bin_final P=h src_final ⊙h bin_final Where Δ, S, and P represent the difference, similarity, and product interaction between the feature vectors of the source code and binary code output by the hierarchical attention mechanism, respectively, and h src_final h bin_final represents the feature vectors of the source code and binary code output by the hierarchical attention mechanism, respectively, and ⊙ represents the Hadamard product.

8. The binary vulnerability dataset expansion method based on cross-modal alignment according to claim 1, characterized in that, In step 4, for a given binary function, the system iteratively determines whether the given binary function has vulnerabilities and the specific vulnerabilities by using a pre-constructed source code vulnerability database.

9. A binary vulnerability dataset expansion system based on cross-modal alignment, characterized in that, include: The multi-granularity feature extraction module is used to extract multi-level information from the source code and binary code respectively using a dual-channel parallel processing mechanism. The multi-level information includes natural language interpretation, structural features and constant features. It generates feature embedding vectors of source code and binary code with the help of a pre-trained domain expert network. The hierarchical attention module is used to fuse the feature embedding vectors of source code and binary code through a hierarchical attention mechanism to obtain the final source code feature embedding vector and binary code feature embedding vector. The cross-modal alignment module is used to construct interaction features between the source code and binary code based on the final source code feature embedding vector and binary code feature embedding vector. The original source code feature embedding vector and binary code feature embedding vector are concatenated with the interaction features to construct a high-dimensional joint representation. The high-dimensional joint representation is input into a multilayer perceptron to model a high-order nonlinear relationship. Finally, the alignment probability between the source code and binary code is calculated through the sigmoid function, and the cross-modal function-level alignment between binary and source code is completed based on the alignment probability. The binary vulnerability dataset extension module is used to map binary vulnerability detection tasks to the source code feature space and expand the binary vulnerability dataset using source code vulnerability data.

Images