Binary patch detection method and system based on retrieval enhancement generation

Abstract

The invention provides a binary patch detection method and system based on retrieval enhancement generation. The method comprises the following steps: collecting a binary file database, preprocessing all vulnerability functions and patch functions in the binary file database, extracting key basic blocks, and generating a plurality of vulnerability-patch pairs by adopting a basic block mapping algorithm based on context awareness, extracting a multi-modal embedding vector of each vulnerability-patch pair based on a hierarchical processing method to construct a vulnerability-patch knowledge base; extracting and preprocessing all target functions in a target file to be tested, extracting multi-modal embedded vectors of all basic blocks in the target functions based on a hierarchical processing method, and retrieving first N groups of vulnerability-patch pairs with relatively high similarity with the basic blocks in the target functions from the vulnerability-patch knowledge base by adopting an RAG search framework, generating patch detection cues based on the first N groups of vulnerability-patch pairs, and performing binary patch detection by a locally deployed large language model to obtain a detection result.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer technology, and particularly relates to a binary patch detection method and system based on retrieval enhancement generation. BACKGROUND

[0002] With the increasing dominance of open source software (OSS) in global software development, its security vulnerabilities have become the core entry of the cyber attack chain. The outbreak of Log4j vulnerability (CVE-2021-44228) in 2021 revealed the vulnerability of the open source ecosystem: although the patch was released quickly after the vulnerability was disclosed, it took an average of 287 days for enterprises to complete the repair, while attackers only needed a few hours to exploit the unpatched targets on a large scale. This contradiction highlights two major challenges of patch management: the concealment of silent patches and the inefficiency of detection technology.

[0003] On the one hand, software manufacturers often release security updates in the form of "silent patches" due to maintenance strategies or business considerations (such as about 23% of security fixes in the Linux kernel are not associated with CVE numbers), which makes it impossible for users to track patches through traditional vulnerability databases (such as NVD), and thus miss the repair window. For example, the "heartbleed" vulnerability (CVE-2014-0160) patch for OpenSSL existed before the vulnerability was disclosed, but it was not applied in time due to the lack of clear labeling, ultimately causing tens of thousands of servers worldwide to be compromised.

[0004] On the other hand, existing patch detection technology faces severe bottlenecks. The current mainstream patch detection technology is respectively aimed at the source code level and the binary level. For example, the source code level patch detection method based on learning models the code semantics through a graph neural network, which performs outstandingly in accuracy, but highly depends on source code accessibility, making it difficult to meet the detection needs of closed-source software or binary dependencies in the supply chain. At the same time, this kind of learning-based method mainly learns from existing patterns, which is not suitable for unknown patterns; and the performance of the model is affected by the distribution of the training data, and it is highly dependent on complete data sets. The binary level patch detection method based on syntax rules is driven by inherent rules and is not affected by data sets, but they cannot handle samples outside the existing rules. At the same time, because the syntax level features (such as register allocation, instruction order, etc.) may change due to compiler optimization: under the O2 / O3 optimization level, the control flow graph (CFG) structure changes by up to 65%, leading to a sharp increase in false positive rate of methods based on syntax features. The binary level patch detection method based on semantic symbolic execution focuses on semantic level features and can capture semantic level differences (such as path constraints generated by symbolic execution, memory access patterns, etc.), but it is difficult to expand due to the path explosion problem, resulting in low efficiency, long processing time for complex single functions, and inability to meet the real-time needs of large-scale firmware detection.

[0005] In addition, the heterogeneity of scenarios such as Internet of Things devices and industrial control systems further exacerbates technical challenges: binary differences across architectures (ARM / x86) and compilers (GCC / Clang) make traditional feature matching ineffective, and dynamic analysis (such as fuzz testing) is difficult to deploy due to limited hardware resources. According to CISA statistics, 72% of patch existence misjudgments in Internet of Things device vulnerabilities in 2023 are due to the insufficient adaptability of tools to optimized code. SUMMARY

[0006] To address the problem that existing binary patch detection methods are difficult to detect cross-version and multi-function patches. The present application proposes a binary patch detection method and system based on retrieval enhancement generation. The method constructs a multi-function vulnerability-patch knowledge base, designs a knowledge-enhanced integrated optimization retrieval method, and selects the Top-N group of vulnerability-patch pairs similar to the target function through two-level screening indexes. Finally, through large model prompt word engineering, it realizes accurate deep analysis of local large language models, and realizes accurate binary patch detection.

[0007] In a first aspect, the present application provides a binary patch detection method based on retrieval enhancement generation, comprising:

[0008] The binary file database is collected, all vulnerability functions and patch functions therein are preprocessed and key basic blocks are extracted, a plurality of vulnerability-patch pairs are generated by using a basic block mapping algorithm based on context awareness, and a multi-modal embedding vector of each vulnerability-patch pair is extracted based on a hierarchical processing method to construct a vulnerability-patch knowledge base; wherein the key basic blocks are basic blocks containing vulnerability or patch codes;

[0009] All target functions in a target file to be tested are extracted and preprocessed, multi-modal embedding vectors of all basic blocks in the target functions are extracted based on a hierarchical processing method, the first N groups of vulnerability-patch pairs with high similarity to the basic blocks in the target functions are retrieved from the vulnerability-patch knowledge base by using an RAG search framework, and patch detection prompt words are generated based on the first N groups of vulnerability-patch pairs, and then binary patch detection is performed by a locally deployed large language model to obtain a detection result.

[0010] Further, the preprocessing includes address normalization, memory access normalization, register normalization, floating point operation instruction normalization and SIMD instruction normalization.

[0011] Further, the generation of the plurality of vulnerability-patch pairs by using the basic block mapping algorithm based on context awareness specifically includes:

[0012] The key basic blocks are inputted, and their addresses, registers, floating point calculations, SIMD instructions and memory operand symbols are symbolized to generate instruction sequences irrelevant to a compiling environment;

[0013] The hash values of the key basic blocks are calculated based on the normalized instructions, and mapping grouping is realized according to the hash values, so that key basic blocks with the same hash values across functions are classified into the same candidate group;

[0014] If the number of key basic blocks in the candidate group = 2, the key basic blocks in the candidate group directly establish a mapping relationship to generate a vulnerability-patch pair;

[0015] If the number of key basic blocks in the candidate group > 2, an iterative greedy matching strategy is used to preferentially select the two key basic blocks with the highest similarity to complete the mapping, and the context relationship of the remaining basic blocks in the candidate group is dynamically updated until the mapping of all basic blocks is completed to generate a vulnerability-patch pair.

[0016] Further, the extraction of the multi-modal embedding vector by using the hierarchical processing method specifically includes: extracting a semantic feature vector from the instruction sequence, extracting a graph feature vector from the control flow graph and the data dependency graph, and forming a multi-modal embedding vector by using a hierarchical multi-modal feature fusion method for the semantic feature vector and the graph feature vector.

[0017] Further, a multi-level hidden state fusion strategy based on the analytic hierarchy process is used to extract the semantic feature vector of the instruction sequence, and the processing flow is as follows:

[0018] First, a dynamic sliding window strategy is used to process the instruction sequence.

[0019] A four-layer decision model is constructed, and the layer contribution weight is determined by an expert evaluation matrix and eigenvalue decomposition. The processed instruction sequence is input, and the four hidden states finally output by the four-layer decision model are linearly combined. The four-layer decision model is the last four encoder layers of the Transformer model. The expert evaluation matrix is constructed by the analytic hierarchy process.

[0020] The merged feature tensor is mean-pooled along the sequence dimension to obtain the semantic feature vector.

[0021] Further, a heterogeneous perception multi-modal graph embedding model is used to extract the graph feature vector of the control flow graph and the data dependency graph, and the processing flow is as follows:

[0022] The number of nodes of the control flow graph or the data dependency graph is determined. The control flow graph or data dependency graph with a node number less than M is processed in the complete embedding channel. For the control flow graph and data dependency graph with a node number greater than M, a dynamic parameter adjustment mechanism is designed, and a fast embedding channel is used. After graph pruning optimization by the intermediate centrality threshold, it is processed in the complete embedding channel.

[0023] The complete embedding channel uses a double embedding strategy: combining Node2Vec random walk global embedding and GCN deep neural network local embedding. The GCN deep neural network includes four layers of GCN, and each layer of GCN includes convolution and Conv 1d module with a size of 1, batch normalization layer and Leaky ReLU activation function.

[0024] After double embedding feature enhancement is output by the complete embedding channel, multi-dimensional feature splicing and standardization processing are performed to obtain the graph feature vector.

[0025] Further, the hierarchical multi-modal feature fusion method is used to form a multi-modal embedding vector by combining the semantic feature vector and the graph feature vector, which specifically includes: first, a dynamic weight distribution mechanism is constructed, and a bilinear attention model is used to automatically learn the importance weight of the semantic feature vector and the graph feature vector. The initial weight of the semantic feature vector remains dominant, and the contribution proportion of the graph feature vector is dynamically adjusted through the adjacency matrix; then, variance-constrained principal component analysis is used for dimensionality reduction processing to eliminate irrelevant redundant information and retain effective information to generate a compact vector, obtaining a multi-modal embedding vector.

[0026] Further, the RAG search framework is used to retrieve the top N groups of vulnerability-patch pairs with high similarity to the target function from the vulnerability-patch knowledge base, specifically including: a three-level progressive matching mechanism is used, first, a Top-K nearest neighbor search based on the Faiss framework method is performed, where K>N; then, cosine similarity, Euclidean distance and Pearson coefficient three similarity detection methods are used for similarity detection of basic blocks, and the three similarity detection results are fused by weighted average; finally, the similarity score is adjusted based on the structure similarity of the PageRank algorithm, and the final similarity ranking is obtained.

[0027] Further, at the patch detection prompt word design level, a CRISP framework is used to construct system instructions, and the large language model is limited to sequentially perform four analysis processes of assembly instruction analysis, memory operation mode identification, CVE feature matching and patch verification.

[0028] In a second aspect, a binary patch detection system based on retrieval enhancement includes:

[0029] A vulnerability-patch knowledge base generation module is configured to collect a binary file database, pre-process and extract key basic blocks of all vulnerability functions and patch functions in the database, generate a plurality of vulnerability-patch pairs based on a context-aware basic block mapping algorithm, and extract multi-modal embedding vectors of each vulnerability-patch pair based on a hierarchical processing method to construct a vulnerability-patch knowledge base; wherein the key basic blocks are basic blocks containing vulnerability or patch codes.

[0030] A binary patch detection module is configured to extract all target functions in a target file to be tested and pre-process them, extract multi-modal embedding vectors of all basic blocks in the target functions based on a hierarchical processing method, retrieve the top N groups of vulnerability-patch pairs with high similarity to the basic blocks in the target functions from the vulnerability-patch knowledge base using a RAG search framework, and perform binary patch detection by a locally deployed large language model based on patch detection prompt words generated from the top N groups of vulnerability-patch pairs to obtain detection results.

[0031] The present application has the following advantages:

[0032] The method provided by the present application is based on a key basic block signature mapping method, uses patch semantics to reduce irrelevant basic block interference, represents patch features as data flow graphs and control flow graphs with richer semantics, and fuses multi-modal features of assembly instructions, control flow and data flow, generates three-modal feature vectors through a heterogeneous perception embedding model based on multi-modal feature fusion, and uses a dynamic weight fusion strategy to resist compilation interference. Combined with retrieval enhancement generation (RAG) technology and accurate analysis based on a locally deployed large language model, multi-function and cross-version binary patch detection is realized.

[0033] The present application is directed to the core challenges of cross-architecture compilation interference, code obfuscation and semantic drift in binary patch existence detection, and proposes an innovative detection framework based on multi-modal feature fusion and retrieval augmented generation (RAG). By constructing a syntax-semantic collaborative analysis paradigm, the feature stability expression across compilation optimization is realized; a heterogeneous-aware embedding model is designed to fuse multi-modal features of assembly semantics (ASM), control flow graph (CFG) and data flow graph (DFG) to generate multi-dimensional embedding vectors; the RAG technology is innovatively introduced to establish a dynamic knowledge enhancement mechanism, which effectively expands the semantic boundary of traditional feature matching.

[0034] The present application proposes a two-stage linkage analysis mechanism based on context awareness, and constructs a collaborative workflow of syntax feature rapid screening and semantic feature deep verification. The basic block signature mapping algorithm is used to realize accurate positioning of the candidate region, which improves the detection efficiency while ensuring the accuracy of semantic analysis.

[0035] The present application designs a heterogeneous-aware multi-modal embedding model (HDGE), which breaks through the limitations of traditional graph representation learning in binary analysis. Through a dynamic weight fusion strategy, the features of assembly instructions, control flow and data flow are complementarily enhanced.

[0036] The present application establishes an expert enhanced detection paradigm based on RAG, which first combines large language models with binary analysis in depth. Through the CRISP prompt engineering framework, a structured semantic reasoning link is constructed to realize accurate expert analysis. BRIEF DESCRIPTION OF DRAWINGS

[0037] Figure 1 A flowchart of a binary patch detection method based on retrieval augmented generation provided by an embodiment of the present application is provided;

[0038] Figure 2 A flowchart of binary file preprocessing and key basic block extraction provided by an embodiment of the present application is provided;

[0039] Figure 3 A flowchart of a basic block mapping algorithm provided by an embodiment of the present application is provided;

[0040] Figure 4 A flowchart of extracting semantic feature vectors provided by an embodiment of the present application is provided;

[0041] Figure 5 A flowchart of extracting graph feature vectors provided by an embodiment of the present application is provided;

[0042] Figure 6 A structure diagram of a RAG retrieval framework provided by an embodiment of the present application is provided;

[0043] Figure 7Structure diagram two of RAG retrieval framework provided by the embodiment of the present application;

[0044] Figure 8 Structure diagram of a binary patch detection system based on retrieval enhancement generation provided by the embodiment of the present application;

[0045] Figure 9 Thermal diagram of P@10 and F1 performance indicators under different weight combinations provided by the embodiment of the present application;

[0046] Figure 10 Weight-performance curve provided by the embodiment of the present application;

[0047] Figure 11 Contour diagram of parameter sensitivity analysis provided by the embodiment of the present application;

[0048] Figure 12 Statistical diagram of each evaluation indicator provided by the embodiment of the present application;

[0049] Figure 13 Distribution feature diagram of four-dimensional indicator space of different projects provided by the embodiment of the present application;

[0050] Figure 14 Vector similarity distribution result diagram of Top-N=100 provided by the embodiment of the present application;

[0051] Figure 15 Columnar and broken line combined diagram of different performance indicators provided by the embodiment of the present application;

[0052] Figure 16 Data diagram of results of different detection methods provided by the embodiment of the present application. DETAILED DESCRIPTION

[0053] In order to make the objectives, technical solutions and advantages of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0054] As shown in Figure 1 The binary patch detection method based on retrieval enhancement generation provided by the embodiment of the present application comprises:

[0055] S1: Collect a binary file database, preprocess all vulnerability functions and patch functions therein and extract key basic blocks, generate multiple vulnerability-patch pairs based on a context-aware basic block mapping algorithm, and extract multi-modal embedding vectors of each vulnerability-patch pair based on a hierarchical processing method to construct a vulnerability-patch knowledge base; wherein the key basic blocks are basic blocks containing vulnerability or patch codes.

[0056] Wherein, after collecting a public database and compiling the database into binary file data through a compiler, an IDA plug-in is designed to batch process large-scale binary files and automatically extract vulnerability functions and patch functions in all files.

[0057] S2: Extract all target functions in a target file to be tested and preprocess them, extract multi-modal embedding vectors of all basic blocks in the target functions based on a hierarchical processing method, retrieve the top N groups of vulnerability-patch pairs with high similarity to the basic blocks in the target functions from the vulnerability-patch knowledge base using a RAG search framework, generate patch detection prompt words based on the top N groups of vulnerability-patch pairs, and perform binary patch detection by a locally deployed large language model to obtain a detection result.

[0058] Wherein, an IDA plug-in is designed to batch process large-scale binary files and automatically extract target functions to be tested in the input target file to be tested.

[0059] The embodiment of the application is based on a key basic block signature mapping method, reduces irrelevant basic block interference using patch semantics, represents patch features as data flow graphs and control flow graphs with richer semantics, and fuses multi-modal features of assembly instructions, control flow and data flow, generates three-modal feature vectors through a heterogeneous perception embedding model based on multi-modal feature fusion, and uses a dynamic weight fusion strategy to resist compilation interference. Combined with retrieval augmentation generation (RAG) technology and accurate analysis based on a locally deployed large language model, multi-function and cross-version binary patch detection is realized.

[0060] On the basis of the above-mentioned embodiments, as Figure 2As shown, the embodiment provides a specific method of preprocessing. In view of the characteristics of the binary function category and the cross-architecture, a binary instruction standardization method is studied, and different compilers are used to compile into binary files. Due to the differences in the compilation settings such as the compilation optimization options, the register assignment, and the address displacement, the compiled binary files of two similar or identical source functions may be quite different, and the present application generates a feature signature based on the difference of the key basic blocks between the vulnerability-patch function pair, so it is very important to eliminate the changes introduced by the compiler. In order to eliminate the bias caused by the compilation process, in view of the problem that the retrieval accuracy is low due to the differences in the assembly code caused by the compiler optimization, the register allocation and the address offset, a binary standardization method is studied, and the address, memory, register, operation instruction and SIMD instruction are standardized in multiple dimensions.

[0061] The preprocessing includes address normalization, memory access normalization, register normalization, floating point operation instruction normalization and SIMD instruction normalization. Among them,

[0062] ① Address normalization: replace specific memory addresses with symbolic placeholders to eliminate differences caused by address displacement

[0063] Eg: call 0x80488094—>call address;

[0064] ② Memory access normalization: replace indirect memory access instructions with symbolic memory operations to reduce differences caused by different memory layouts.

[0065] Eg: mov[ebp],edx—>mov mem,edx;

[0066] ③ Register normalization: replace specific register names with general placeholders to reduce the impact of register allocation differences.

[0067] Eg: mov ebp,esp—>mov reg,reg;

[0068] ④ Floating point operation instruction normalization: for the characteristics of floating point operation instruction, introduce a general register placeholder "reg" to replace specific floating point registers, and shield the interference caused by register allocation and data format differences.

[0069] Eg: addss xmm0,xmm1—>fp_add reg,reg;

[0070] mulsd xmm2,xmm3—>fp_mul reg,reg

[0071] ⑤SIMD instruction normalization: for SIMD instructions, a fine-grained normalization strategy is proposed to reduce the impact of instruction changes caused by architecture differences and compiler optimizations on the analysis process.

[0072] Eg: movaps xmm0, xmm1 -> simd_mov reg, reg

[0073] addps xmm2, xmm3 -> simd_add reg, reg

[0074] Based on the above multi-dimensional normalization, the semantics of the instructions are preserved, and the differences caused by non-semantic changes in the compilation process are eliminated, so that the subsequent analysis is more focused on the actual logic and behavior of the code.

[0075] The embodiment of the application extracts the target function (TF) by preprocessing and IDA-based batch processing, and fuses the syntax features (mnemonic-operation code sequence, function call) and the structure attributes (basic block, branch) together to construct a multi-dimensional detection signature.

[0076] Existing binary difference analysis tools (such as Bindiff and Diaphora) achieve basic block alignment through hash matching, but face the problem of hash collision in the many-to-many scenario. For example, when there are multiple basic blocks with the same syntax but different control flow contexts in a function, the traditional method may cause false matching due to the same hash value, resulting in invalid patch feature extraction. To solve this problem, the embodiment provides a context-aware basic block mapping algorithm, the core process of which is as shown in Figure 3 , including:

[0077] Input the key basic block, and symbolize its address, register, floating point calculation, SIMD instruction and memory operand to generate an instruction sequence independent of the compilation environment.

[0078] Calculate the hash value of the key basic block based on the normalized instruction, and realize mapping grouping according to the hash value, so that the key basic blocks with the same hash value across functions are classified into the same candidate group;

[0079] For the injective matching scenario (there is only a unique pair of cross-function basic blocks in the candidate group, and the number of basic blocks = 2), the key basic blocks in the candidate group directly establish a mapping relationship to generate a vulnerability-patch pair;

[0080] For the case of many-to-many matching conflict (i.e. different basic blocks have the same hash value, the number of key basic blocks in the candidate group > 2), a structure similarity scoring mechanism is introduced to realize accurate matching by quantifying the context relationship of adjacent key basic blocks, and the candidate group is obtained. Specifically, an iterative greedy matching strategy is adopted to preferentially select the two key basic blocks with the highest similarity to complete the mapping, and the context relationship of the remaining basic blocks in the candidate group is dynamically updated until the mapping of all basic blocks is completed, and the vulnerability-patch pair is generated.

[0081] Specifically, the algorithm calculates the edit distance of the expected predecessor and successor block instructions of the key basic blocks in the candidate group, generates a comprehensive similarity matrix combined with the control flow weight (the normalized contribution of in-degree and out-degree), and solves the remaining matching conflicts by taking the adjacency relationship of the matched blocks as new constraints through a context propagation mechanism. Finally, the basic block mapping table is output, and the matched VF-PF key basic block pair is generated.

[0082] The application studies the feature signature generation method based on vulnerability-patch pair after the first step of preprocessing and reducing the search range to screen the TF range similar to VF. The feature signature of each VF assembly code and the corresponding PF assembly code is generated, and the difference basic block between them is marked as the vulnerability-patch pair signature. These signatures will be used for subsequent patch existence detection, and the process of signature generation includes target binary preprocessing and context-aware basic block mapping algorithm.

[0083] On the basis of the above embodiment, the vulnerability-patch pair contains instruction sequences, control flow graphs and data dependency graphs. Among them, in order to solve the problem that the extraction of control flow and data flow features in traditional binary analysis is sensitive to compiler optimization and lacks semantic information, a context-sensitive double-flow graph semantic modeling method is proposed, which realizes accurate capture of patch semantic features by jointly constructing cross-version control flow graph (CFG) and data flow graph (DFG), and breaks through the limitation of traditional isolated graph analysis.

[0084] The embodiment studies the anti-optimization graph construction technology, designs the instruction standardization-dominance tree reconstruction joint algorithm, eliminates the interference of compiler optimization on the graph structure, restores the implicit control dependency between basic blocks after optimization based on value set analysis (VSA), and solves the problem of loop unrolling edge loss caused by optimization options.

[0085] Table 1 Dominance tree modified control flow edge

[0086]

[0087] Finally, the CFG and DFG structure features of the key function are extracted, the basic block number, in-degree and out-degree distribution and other information are obtained, and finally the integration of syntax and semantic double information is realized, which provides basic information for multi-modal feature fusion.

[0088] On the basis of the above-mentioned embodiments, a method of assembly code representation learning based on multi-modal feature fusion is researched, a unified vectorization representation framework is constructed by jointly analyzing the semantic features and structural features of the binary program, and a specific implementation process of the multi-modal embedding vector provided by the hierarchical processing method is provided, which specifically includes: extracting a semantic feature vector from the instruction sequence of the vulnerability-patch pair, extracting a graph feature vector from the control flow graph of the vulnerability-patch pair and the data dependency graph of the vulnerability-patch pair, and forming a multi-modal embedding vector by using a hierarchical multi-modal feature fusion method on the semantic feature vector and the graph feature vector. Further, as shown in Figure 4 As shown in the figure, the semantic feature vector of the instruction sequence is extracted by using a multi-level hidden state fusion strategy based on the analytic hierarchy process, and the processing flow is as follows:

[0089] First, the instruction sequence is processed by using a dynamic sliding window strategy; in order to improve the robustness of the long code segment, the dynamic sliding window strategy processes the long instruction sequence. In order to improve the task adaptability, the static weight is dynamically optimized, and the adjustment amplitude is linearly related to the gradient of the objective function.

[0090] Then, a four-layer decision model is constructed, the layer contribution weight is determined by an expert evaluation matrix and eigenvalue decomposition, the processed instruction sequence is input, and the four hidden states finally output by the four-layer decision model are linearly combined; wherein the four-layer decision model is the last four encoder layers (i.e. the layers close to the output) of the Transformer model (CodeBERT architecture). Specifically, the four-layer decision model uses the last four layers of the Transformer model: Layer N-3, Layer N-2, Layer N-1 and Layer N, and then an expert evaluation matrix is constructed by using the analytic hierarchy process (AHP) to evaluate the contribution of each layer in the following dimensions: semantic representation quality, syntax feature coverage, context dependency and anti-interference. In this embodiment, the maximum weight configuration is [0.15, 0.26, 0.33, 0.26].

[0091] Finally, the merged feature tensor is mean-pooled along the sequence dimension to obtain a semantic feature vector. The merged feature tensor is mean-pooled along the sequence dimension to produce a 768-dimensional semantic vector. This method can not only preserve expert knowledge, but also adaptively capture cross-layer context dependencies, improving the robustness to compilation interference.

[0092] Further, as shown in Figure 5 As shown in the figure, the graph feature vector of the control flow graph and the data dependency graph is extracted by using a heterogeneous perception multi-modal graph embedding model, and the processing flow is as follows:

[0093] The number of nodes of the control flow graph or the data dependency graph is determined, and the control flow graph or the data dependency graph with a node number less than M enters a complete embedding channel processing; for the control flow graph and the data dependency graph with a node number greater than M, a dynamic parameter adjustment mechanism is designed, a fast embedding channel is adopted, and after graph pruning optimization is performed through the betweenness centrality threshold (0.01), the complete embedding channel processing is entered again for processing;

[0094] The complete embedding channel adopts a dual embedding strategy: combining Node2Vec random walk global embedding and GCN deep neural network local embedding; the GCN deep neural network includes four layers of GCN, and each layer of GCN includes a convolution and a Conv1d module with a size of 1, a batch normalization layer and a Leaky ReLU activation function.

[0095] After the dual embedding feature enhancement output by the complete embedding channel, multi-dimensional feature splicing is performed and standardized processing is performed, and a graph feature vector is obtained.

[0096] The multi-dimensional feature splicing adopts a feature enhancement module: by splicing traditional graph theory features such as node degree, clustering coefficient and PageRank value with deep learning embedding vectors (two vectors obtained by combining Node2Vec random walk global embedding and GCN deep neural network local embedding), 128-dimensional composite graph features are formed after standardization processing.

[0097] The existing graph representation learning method has significant limitations in assembly code analysis: the traditional graph convolution network (GCN) based method is limited by the local neighborhood aggregation mechanism, resulting in weak global topology feature capturing ability, and the embedding vector of the key node (such as the loop control block) in the sparse control flow graph is easily overwhelmed by noise, resulting in a high false positive rate; while the method that simply relies on Node2Vec can capture global structure patterns through random walk, but ignores instruction-level semantic association, resulting in lower accuracy of cross-architecture similar function retrieval, and the problem of explosive computational complexity (time complexity up to O(N1.5)) on large-scale data dependency graphs (DFG). Both of them lack dynamic adaptation ability to heterogeneous graph structures (control flow graph and data dependency graph), and it is difficult to balance semantic fidelity and topological integrity. In view of the limitations of traditional graph representation methods, a heterogeneous-aware dual-modal graph embedding model (HDGE) is proposed, which breaks through the above limitations through a multi-level collaborative mechanism.

[0098] Further, the semantic feature vector and the graph feature vector are fused by a hierarchical multi-modal feature fusion method to form a multi-modal embedding vector, specifically including: first, a dynamic weight distribution mechanism is constructed, and a bilinear attention model is used to automatically learn the importance weight of the semantic feature vector and the graph feature vector, wherein the initial weight of the semantic feature vector remains dominant, and the graph feature vector adjusts the contribution proportion through the adjacency matrix propagation; then, principal component analysis with variance constraint is used for dimension reduction processing, irrelevant redundant information is removed, effective information amount is retained to generate a compact vector, and a multi-modal embedding vector is obtained.

[0099] On the basis of the above-mentioned embodiments, in view of the problem that the similarity calculation false positive rate is significantly high due to the high similarity between the versions before and after patch repair in binary software vulnerability detection, a heuristic similarity matching method based on an integrated algorithm is proposed, a multi-modal calculation model combining structure, semantics and cross-source features is studied, and a feature retrieval method based on context perception is designed, the application uses a cross-architecture and anti-obfuscation precise similarity detection algorithm to realize fast matching of vulnerability-patch library feature signatures, complete efficient screening of large-scale target to be tested, and accurately extract Top-N level matching targets in similarity ranking. As shown in Figure 6 The embodiment provides the steps of retrieving the first N groups of vulnerability-patch pairs with high similarity to the basic blocks in the target function from the vulnerability-patch knowledge base by using the RAG search framework, specifically including: adopting a three-level progressive matching mechanism, first, performing Top-K nearest neighbor search based on the Faiss framework method, wherein K>N;Then, cosine similarity, Euclidean distance and Pearson coefficient are used for similarity detection of the basic blocks, and the three similarity detection results are fused by weighted average;Finally, the similarity score is adjusted based on the structure similarity of the PageRank algorithm, and the final similarity ranking is obtained.

[0100] Specifically, the retrieval process adopts a three-level progressive matching mechanism:

[0101] 1. Syntax level coarse screening: performing Top-K nearest neighbor search based on the Faiss framework method, wherein the value of K is dynamically determined by heuristic rules, L2 regularization and inner product similarity calculation are used, and the Top-n parameter is dynamically adjusted:

[0102] Wherein, alpha represents the architecture adaptive coefficient, and M is the size of the knowledge base.

[0103] Wherein, theta represents the retrieval similarity, and mu represents the threshold value, which is dynamically calculated through the length distribution of the training data.

[0104] 2. Semantic-level fine screening: To solve the problem of low accuracy of single algorithm in similarity search, an ensemble method is used to integrate multiple similarity algorithms and construct a dynamic weight distribution model based on ensemble learning. The advantages and disadvantages of the current mainstream similarity detection methods in binary patch existence detection are as follows:

[0105] Table 2 Similarity calculation method advantage and disadvantage table

[0106]

[0107] Based on the advantages of each method in binary detection, the present application adopts an integrated method of multi-modal feature complementation, which fuses three core indicators by weighted average, as follows:

[0108] scores=(cos-sim+euc-sim+pearson-sim) / 3

[0109] The similarity algorithm automatically learns the weight combination through the logistic regression meta-classifier, the cosine similarity dominates the global semantic matching, the Euclidean distance strengthens the local feature difference perception, and the Pearson coefficient captures the potential linear correlation, improving the accuracy of detection for different compilers and optimization options. (Cosine weight 0.42, DTW weight 0.35, Pearson weight 0.23). At the same time, the systematic errors of each method are offset in the integration process, the "long tail effect" of cosine similarity is corrected by the local sensitivity of Euclidean distance; the linear deviation of Pearson coefficient is compensated by the nonlinear alignment ability of DTW, realizing the complementation of different algorithms.

[0110] 3. Context verification: Based on the control flow feature, a structure similarity correction model based on PageRank algorithm is designed. The model extracts the CFG adjacency matrix feature of the matching function, calculates the node centrality weight (in-degree weight 0.6, out-degree weight 0.4), and adjusts the initial similarity score by weighting.

[0111] It can be understood that the retrieval augmented generation (RAG) technology realizes the external expansion and context perception optimization of the model knowledge boundary by fusing the dynamic retrieval mechanism and the deep learning model. The core idea is to retrieve the semantic fragments related to the current task from the structured knowledge base to guide the model to generate more discriminative and robust feature representation. Compared with traditional generation models, RAG can effectively alleviate the feature drift problem caused by data sparsity and enhance the modeling ability of the model for long-tail distribution by explicitly introducing domain prior knowledge. In the field of binary code analysis, the introduction of RAG provides a new technical path to solve the challenges of cross-compiler optimization and instruction set heterogeneity. The key lies in constructing an endogenous knowledge base highly adapted to the task and designing an efficient retrieval-fusion mechanism.

[0112] Based on the joint vector space generated by multi-modal feature fusion, an improved IVF-Flat multi-thread index strategy is adopted. A hierarchical progressive index architecture is designed to realize efficient similarity retrieval. The improved composite index mechanism is adopted to decompose the 1104-dimensional fusion vector into a semantic subspace (768-dimensional) and a structure subspace (336-dimensional), and an inverted index (IVF) based on OPQ (Optimized Product Quantization) optimization is constructed respectively, and the PCA dimension reduction module is used to effectively solve the feature space sparsity problem.

[0113] For cross-architecture retrieval requirements, an adaptive quantization strategy is introduced to realize heterogeneous measurement indexing. By calculating the KL divergence of the feature vector, the PQ (Product Quantization) codebook allocation is dynamically adjusted, so that the codebook center point has higher discrimination in the area with large difference in distribution of different architecture vectors. At the same time, a multi-measure hybrid calculation mode is used, and a multi-codebook index structure based on product quantization is designed. Each codebook corresponds to a specific similarity calculation space, and the index update module uses an incremental learning method. When a new vulnerability-patch pair is added, only the affected subspace index needs to be updated locally, avoiding the computational overhead caused by full reconstruction.

[0114] In view of the problem that the feature retrieval is time-consuming and the accuracy is low due to the too large matching range in the binary patch existence check, a knowledge base feature retrieval method based on context perception is researched, and an efficient vector retrieval technology is used to retrieve the most similar document or paragraph in the vector space.

[0115] For the target binary file, the complete assembly function code TF is automatically extracted by using the ida script, the multi-dimensional normalization is completed through the preprocessing stage to extract the normalized instruction sequence, global retrieval is implemented for all position functions extracted from the binary file, and it is judged whether the effective feature function is contained, the effective feature function graph structure feature is extracted by the heterogeneous perception embedding model based on multi-modal feature fusion, and the target vector TF-Vectors is generated by multi-modal feature fusion.

[0116] The real-time retrieval based on the RAG framework internal knowledge base is performed on the target function TF, the query vector TF-Vectors is generated after the input binary file is preprocessed and embedded with feature vectors, after receiving the query vector, the similarity calculation strategy is dynamically adjusted based on the index structure, and the most similar N similar vectors are selected as the preselected group based on the similarity threshold.

[0117] The embodiment of the application combines the retrieval of key features in the local knowledge base with the generation of context-sensitive semantic analysis, and realizes efficient and accurate binary patch detection based on the heuristic similarity retrieval engine and the local large language model analysis.

[0118] On the basis of the above-mentioned embodiment, the present embodiment proposes a binary patch existence detection framework based on fine-tuning large language model, as shown in Figure 7 The core is to construct a prompt word engineering system for assembly code analysis. The embodiment of the application adopts a hierarchical progressive prompt strategy, and integrates three key links of vulnerability feature matching, control flow difference analysis and patch instruction verification into the large model reasoning process. First, the Top-N most similar code fragments are retrieved from the triplets of the target function TF, the candidate vulnerability function VF and the patch function PF by using the RGA (Retrieval-Augmented Generation) algorithm, and a multi-modal analysis context is established.

[0119] Embodiments of the present application combine mixed similarity metrics to screen candidate vulnerability-patch functions. Through the Retrieval Augmented Generation (RAG) technique, based on two-stage screening, first, the VF and PF with a similarity greater than the preset similarity threshold in the vulnerability-patch library are retrieved with the target function TF, and then the integrated algorithm is used to accurately retrieve the Top-N internal knowledge base vectors with the highest similarity. Top-N candidates are generated N triples (TF, PF, VF) with the target function, and input into the locally deployed Llama-3-32B model to realize expert accurate verification, prompting engineering to clearly analyze data flow anomalies, control flow divergence points and other key features.

[0120] At the prompt word design level, the CRISP (Contextualized Role Instruction with Structured Process) framework is used to build system instructions. The system prompt word clearly defines the four-step analysis process that the large model needs to perform in sequence: assembly instruction analysis, memory operation mode recognition, CVE feature matching, and patch verification. The role definition module enhances the model's understanding of the semantics of assembly instruction sequences, the task decomposition module converts complex analysis processes into verifiable atomic operations, and the output format constraint ensures the structured nature of the generated results. This design effectively overcomes the false positive problem caused by excessive freedom of traditional methods.

[0121] The locally deployed 32B deepseek-R1 parameter expert model uses hierarchical prompting and collaborative reasoning mechanisms (Hierarchical Prompting). It performs double-path verification, and its system instruction template algorithm is shown in Table 3:

[0122] Table 3 Instruction Template

[0123]

[0124]

[0125] Hierarchical analysis architecture: retain the three-stage verification process of control flow analysis, vulnerability matching, and patch verification

[0126] Defensive constraints: mandatory CVE number reference mechanism and prohibition of unverified speculation to prevent large models from generating false CVE information.

[0127] Structured output: hybrid format of Markdown table + assembly-level patch suggestions.

[0128] Context binding: encode the retrieved Top-K triples into <TF, VF, PF> pair sequences, and inject relative patch distance information through position encoding

[0129] To address the problem of high false positives in different vulnerability instruction retrieval analysis, a vulnerability-patch detection mechanism based on dynamic temperature regulation of large language expert models is studied, and the generation parameters are automatically adjusted according to high-risk instruction patterns such as "rep movsb", "free", etc. When a buffer overflow feature is detected, the temperature parameter is reduced to 0.3 to improve the analysis certainty; if no obvious vulnerability pattern is found, the exploratory temperature value of 0.7 is maintained. At the same time, the context-aware truncation algorithm (_truncate_with_context method) is used to compress the input length while preserving key instruction sequences (such as function entry points and memory operation instruction clusters), balancing model processing efficiency and key information integrity.

[0130] As Figure 8 shown, the embodiment of the application also provides a binary patch detection system based on retrieval enhancement generation, comprising:

[0131] A vulnerability-patch knowledge base generation module is used to collect a binary file database, preprocess all vulnerability functions and patch functions therein, and extract key basic blocks. A context-aware basic block mapping algorithm is used to generate multiple vulnerability-patch pairs, and a hierarchical processing method is used to extract multi-modal embedding vectors of each vulnerability-patch pair to construct a vulnerability-patch knowledge base. The key basic blocks are basic blocks containing vulnerability or patch code.

[0132] A binary patch detection module is used to extract all target functions in a target file to be tested and preprocess them, extract multi-modal embedding vectors of all basic blocks in the target functions based on a hierarchical processing method, use a RAG search framework to retrieve the top N groups of vulnerability-patch pairs with high similarity to the basic blocks in the target functions from the vulnerability-patch knowledge base, and generate patch detection prompt words based on the top N groups of vulnerability-patch pairs, then use a locally deployed large language model to perform binary patch detection, and obtain a detection result.

[0133] To verify the effectiveness of the application, experiments are conducted in this embodiment: by comparing the influence of different multi-modal information weights of three types of features, assembly code (ASM), control flow graph (CFG) and data flow graph (DFG), on the results, the accuracy of patch detection, the efficiency of patch detection, and the comparison with other patch detection methods, the effectiveness of the application is verified in these aspects.

[0134] A. Research Settings

[0135] 1. Experimental data set:

[0136] The embodiment constructs a multi-dimensional evaluation benchmark to comprehensively evaluate the effectiveness of the binary patch detection method. The experimental data covers 400 CVE public vulnerabilities of vulnerability-patch function pairs (VF-PF). To further verify the cross-compiler environment adaptability and noise robustness of the method, the embodiment constructs an enhanced data set: based on 4 high-activity open source projects such as OpenSSL and Linux kernel, multiple version binary samples are generated by combining different compilers and optimization levels, and 30% irrelevant functions are injected to simulate real software complexity. The construction of the data set strictly follows the following principles:

[0137] ① Version alignment: For each CVE, the last vulnerable version (VF) and the first fixed version (PF) are accurately recorded to ensure the timing accuracy of the vulnerability-patch pair.

[0138] ② Function sampling: 20% of the functions in each binary file are randomly selected as detection targets, covering core modules, toolchain code and edge functions.

[0139] ③ Noise control: Irrelevant functions with no explicit call relationship with the target function are generated through instrumentation to ensure the independence of noise injection.

[0140] The final data set contains 13,960 cross-version, cross-compiler, and cross-architecture functions, covering multiple historical versions (VF / PF version pairs). This design balances the breadth of vulnerability coverage, the diversity of compilation environment and the intensity of noise interference, providing a reliable benchmark for evaluating patch existence detection, cross-platform robustness and anti-noise capability.

[0141] 2. Evaluation indicators:

[0142] The experimental evaluation uses four indicators to measure the performance of the invention, namely Precision (P), Recall (R), F-Measure (F1) and Accuracy (A). These indicators are defined in Table II. The values of these four indicators range from 0 to 1, where the higher the value, the better the consistency between the test results and the true results. The definitions are shown in Table 4:

[0143] Table 4 Experimental indicator definition table

[0144]

[0145]

[0146] B. Multi-modal weight evaluation

[0147] Parameter configuration: In the experiment, two sets of parameter configurations need to be assigned values, which are feature fusion weight and vulnerability matching system feature parameters respectively. In order to explore the optimal weight configuration of multi-modal feature fusion, a series of control experiments are designed for the heterogeneous features of code representation (assembly semantics, control flow graph, data flow graph). Based on the information entropy theory, it is assumed that the contribution of different features to the accuracy of vulnerability-patch vector retrieval in the RAG framework is significantly different. By adjusting the weights dynamically with different values and conducting control experiments, the relative importance of assembly code (ASM), control flow graph (CFG), and data flow graph (DFG) in the vulnerability matching task is evaluated, and the optimal weight allocation ratio is determined through experiments, while satisfying the formula: ∑W ASM +W CFG +W DFG =1

[0148] The evaluation strategy adopts a two-stage strategy combining grid search (Grid Search) and Bayesian optimization (Bayesian Optimization):

[0149] 1. Coarse-grained search: W ASM ∈[0.5,0.9], W CFG ∈[0.05,0.3], W DFG ∈[0.05,0.3] are iterated in the range of 0.1.

[0150] 2. Fine-grained optimization: Based on the coarse-grained results, Bayesian optimization is used to further search in the optimal area.

[0151] The core indicators are Top-K accuracy (P@K): the proportion of the first K correct matches; and weighted F1 value: F1 = 2*(P*R) / (P+R), where P is the precision and R is the recall.

[0152] Experimental results:

[0153] Figure 9 The heat map shows the P@10 and F1 performance indicators under different weight combinations. Figure 9 (a) shows the distribution of P@10 accuracy under different W ASM and W CFG combinations. The darker the color, the higher the P@10 accuracy, indicating better performance of the model under that weight combination. Figure 9 (b) shows the distribution of F1 score, with darker colors representing higher F1 scores. The x-axis of the heat map represents W ASM , and the y-axis represents W CFG . From the figure, it can be seen that when W ASM is about 0.7 and W CFG is about 0.15, the performance indicators reach the best.

[0154] Figure 10 The weight-performance curve shows the performance at a fixed W. CFG In this case, the P@10 and F1 indices follow W ASM The trend of change. Select three single-feature baselines, let W CFG The values ​​are set to 0.1, 0.15, and 0.2. Figure 10 It contains three curves, each corresponding to W. CFG For values ​​of 0.1, 0.15, and 0.2. The solid line represents the performance change of P@10, and the dashed line represents the performance change of F1. From Figure 10 It can be observed that, with W ASM With the increase of W, the performance index first rises and then falls. ASM Below 0.6, accuracy drops significantly, indicating that the lack of assembly semantic features leads to severe performance loss; W ASM After W > 0.7, the performance tends to saturate (deep blue region), and the marginal gain decreases (gradient becomes gentler), indicating that redundant features under high weights may introduce noise, and excessive bias towards a single feature will compromise the system's robustness. CFG and W DFG When the value is <0.10, the performance contribution is negligible (P@10<0.75), and it needs to be considered in conjunction with W. ASM Improved effect. Heatmap analysis revealed that in W... ASM Around 0.7, W CFG and W DFG When ∈[0.15,0.20], with W ASM The synergistic effect is significant (in the steep gradient region), and the structural features enhance their ability to represent complex functions, reaching a peak. This indicates that the model at this point... ASM W CFG and W DFG It performs best in balance, with too much or too little emphasis on W. ASM Both will lead to a decrease in performance.

[0155] Figure 11 This is a contour plot of the parameter sensitivity analysis, further illustrating the P@10 performance under different baseline weight combinations. The contour lines in the plot connect points with the same P@10 value; the denser the contour lines, the more drastic the performance change. Figure 11 The text also includes areas filled with different colors, with darker colors indicating higher P@10 values. A red dashed line marks W. ASM The value is 0.7, which is the region where performance peaks. From Figure 11 It can be seen from this that when W ASM The model's P@10 performance is most stable and high when the CFG weights are around 0.7 and around 0.15.

[0156] Meanwhile, ablation experiments were conducted on the present invention, and the removal of any type of feature led to a decrease in performance: ① Removal of ASM: P@10 decreased by 32.7% (p<0.001); ② Removal of CFG / DFG: F1 across projects decreased by 9.1% (p<0.01).

[0157] In summary, these charts collectively reveal a significant trend in model performance under different weight allocations. They also demonstrate the core role of assembly semantics, contributing 72% to function-level matching. Assembly semantic information forms the foundation of performance, but needs to be optimized in conjunction with structural features. Based on the experimental results, the optimal solution is selected: W. ASM It is 0.7, W CFG / W DFG At a value of 0.15, the model exhibits excellent performance on both P@10 and F1 metrics, achieving a balance between accuracy and generalization. These findings are significant for understanding the model's sensitivity to different features and provide strong support for optimizing the model's parameters.

[0158] C. Accuracy Assessment

[0159] In this experiment, the framework of this invention was run on a constructed dataset and compared with real labeled information to evaluate whether the invention can efficiently and accurately perform binary patch existence detection. First, the effectiveness of the invention was evaluated; the experimental results are shown in the table below:

[0160] Table 5 Accuracy Assessment Table

[0161]

[0162]

[0163] To evaluate the accuracy of this invention in detecting binary file patches, a multi-dimensional evaluation was conducted on eight typical binary analysis projects (Binutils, D-Link, FFmpeg, expat, OpenSSL, vmlinux, TP-Link, and libpng). Experimental results show that the accuracy of this invention is consistently above 80%, and the binary detection large language model can accurately identify patch information present in files, such as... Figure 12As shown, each evaluation metric (Precision, Recall, F1, Accuracy) presents significant inter-project differences (ANOVA p<0.01). Among them, the Precision metric reaches a peak of 0.953 (95% CI: 0.942-0.964) in the libpng project, while the lowest performance is observed in the vmlinux kernel project (0.821±0.017), reflecting the systematic impact of kernel code peculiarities (e.g., 12.7% inline assembly, 34% symbol loss due to LTO optimization) on detection accuracy. By designing a two-axis coordinate system (left axis: performance score, right axis: sample size), this embodiment reveals the non-linear relationship between sample size and detection stability. For example, Figure 12 As shown by the gray columns, the OpenSSL project with the largest sample size (N=200) achieves an Accuracy of 0.929 (±0.011), but its standard deviation is significantly higher than that of the expat project with a smaller sample size (N=45, σ=0.007). Further calculations show that when the sample size exceeds 150, the variance of the performance metric increases with the sample size (β=0.13, p=0.022), which is consistent with the exponential growth of code variability in complex projects. In particular, in the D-Link (N=85) and TP-Link (N=72) firmware projects, the function confusion rate caused by private compression formats reaches 85%, resulting in Recall values of 0.814 and 0.825, respectively, which are significantly lower than those of other projects (t-test p<0.001).

[0164] Figure 12 The combined bar chart shows the distribution characteristics of each project in the four-dimensional index space. The FFmpeg project maintains high levels of Precision (0.942±0.009) and Recall (0.927±0.012), with an F1 value (0.934) close to the theoretical optimal level. Error bar analysis shows that sample size has a significant impact on the confidence of the results: the error interval (±0.5) of the OpenSSL project is 5.26 times that of the libpng project (±0.095), which is related to the long-tailed distribution characteristics in large sample scenarios. The statistical table shows that the global average Precision is 0.892 (σ=0.042) and the Recall is 0.871 (σ=0.051), indicating that the generalization ability of existing methods for complex control flow patterns still needs to be improved.

[0165] Based on the above experimental results and analysis, three improvement measures are proposed:

[0166] 1. Adversarial training: To address firmware obfuscation, a training set containing 85,000 adversarial samples is constructed to enhance model robustness;

[0167] 2. Symbol recovery module: design LTO symbol speculation algorithm based on Monte Carlo tree search, recall is improved by 14.2% in vmlinux evaluation;

[0168] 3. Heterogeneous feature fusion: adopt attention weighted multi-modal fusion strategy, make the F1 value of OpenSSL project from 0.920 to 0.941.

[0169] D. Performance evaluation

[0170] The traditional binary patch existence method based on syntax semantics has the problems of fast detection speed but low accuracy; and the current patch detection method based on large language model has the problems of single processing target, input text length limitation, poor context correlation effect of multi-target analysis, and low efficiency of large-scale patch detection, a retrieval method based on vulnerability-patch knowledge enhancement is proposed, the invention is screened through two stages of vector retrieval-expert analysis, through double analysis of vector similarity preliminary screening and expert large language model verification, the accuracy and performance of patch existence detection are greatly improved. When the TOP-N value is set to 50, the performance evaluation results of the patch existence detection of eight projects of the invention are as follows, which are divided into three processing stages, namely function preprocessing, vector retrieval and large model analysis time:

[0171] Table 6: Processing time table of each stage

[0172]

[0173] According to the time ratio calculation efficiency table as follows:

[0174] Stage ratio=stage time / total time×100

[0175] Table 7: Time table of each stage ratio

[0176]

[0177]

[0178] According to table 6 and table 7, it can be found that due to the large language model assisted analysis based on heuristic thinking of the invention, the large model analysis stage accounts for 84.3%-99.7% (average 93.1%) of the total time, which becomes the performance bottleneck of the system. Among them: the FFmpeg project reaches the highest ratio of 99.7%, because it contains a large number of SIMD instruction functions, which increases the complexity of model reasoning; the D-Link project has very irregular control flow due to firmware obfuscation (85% of irregular jump instructions are detected), which increases the calculation amount of model attention mechanism by 32%.

[0179] It is worth noting that if only vector retrieval analysis is performed, the Top-N=100 vector similarity distribution result is as followsFigure 13 As shown in the figure, it can be found that most of the results are distributed between 0-0.4, and there are vectors with high similarity, so it is shown that only similarity retrieval has less time but lower accuracy, so two-stage large language model accurate analysis is needed.

[0180] E.Comparison of Related Works

[0181] In order to evaluate the comparison of the effect of the present application and other most advanced tools, the well-known rule-based patch detection methods BinXray and PatchDiscovery, the semantic-based patch detection method PS3 and the source code-based patch detection method GraphSPD in binary patch existence detection are selected for comparative experiments. Among them, BinXray and PatchDiscovery are detection methods based on accurate analysis of binary level to extract function syntax features; PS3 is a detection method based on semantic level symbolic signature, which extracts stable signature by symbolic simulation and matches in semantic level. GraphSPD uses the semantic features of source code before and after the patch to develop PatchCPG graph representation, and uses the graph learning model PatchGNN to detect security patches. In order to compare these methods positively, we run MR-Match, PatchDiscovery and BinXray on the binary dataset using the same experimental configuration. The evaluation results of GraphSPD are calculated according to the test results reported in its paper, and the comparison results are shown in Table 8:

[0182] Table 8 Comparison results of each model

[0183]

[0184] Comparison on four key performance indicators: precision (Precision), recall (Recall), F1 score (F1 Score) and accuracy (Accuracy). As Figure 14 The combination of column chart and line chart is used to comprehensively evaluate the detection performance of each method.

[0185] According to the experimental results, the embodiment is compared with the mainstream binary patch detection method in five core indicators (precision P, recall R, F1 value, accuracy A, and total time consumption). The experimental data shows that the application performs well in precision (0.911) and F1 score (0.897), indicating that it can effectively identify the correct patch version and existing vulnerabilities while maintaining a low false positive rate. This advantage is due to the innovative multi-modal hierarchical indexing architecture, which integrates code syntax, control flow, and data flow features, effectively alleviating the limitations of single-modal feature representation. At the same time, due to the application of large language model technology, the success rate of detection is significantly improved, and the robustness to compiler optimization is enhanced.

[0186] The PS3 method is significantly higher than other methods in recall rate (0.970), but its precision (0.820) and accuracy (0.855) are relatively low, indicating that it may produce more false positives. The GraphSPD method is significantly lower than other tools in recall rate (0.435) and F1 score (0.557), mainly due to source code detection.

[0187] At the same time, the application maintains high detection accuracy while showing good time efficiency. As shown in Table 2, the total time consumption (4,102 seconds) is greatly reduced, which benefits from the fast vector retrieval technology based on RAG, efficient retrieval based on vulnerability-patch library, and significantly improves the speed of matching analysis of the target to be tested. Figure 15

[0188] Overall, the application method leads in precision and F1 score, indicating that it has high detection capability while maintaining a low false positive rate. BinXray and PatchDiscovery methods perform relatively balanced in various indicators. Therefore, the application achieves excellent performance in accuracy and efficiency, effectively solving the problem of large data volume and high accuracy requirement in current binary patch existence detection.

[0189] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the application, and not to limit them; although the application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can modify the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some technical features; and these modifications or substitutions do not make the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the application.​

Claims

1. A binary patch detection method based on retrieval enhancement generation, characterized in that, include: A binary file database is collected, and all vulnerable functions and patch functions are preprocessed to extract key basic blocks. A context-aware basic block mapping algorithm is used to generate multiple vulnerability-patch pairs. A hierarchical processing method is used to extract the multimodal embedding vector of each vulnerability-patch pair to construct a vulnerability-patch knowledge base. The key basic blocks are basic blocks containing vulnerability or patch code. All target functions in the target file to be tested are extracted and preprocessed. Multimodal embedding vectors of all basic blocks in the target functions are extracted based on a hierarchical processing method. The top N vulnerability-patch pairs with high similarity to the basic blocks in the target functions are retrieved from the vulnerability-patch knowledge base using the RAG search framework. Patch detection prompts are generated based on the top N vulnerability-patch pairs and then binary patch detection is performed by a locally deployed large language model to obtain the detection results.

2. The binary patch detection method based on retrieval enhancement generation according to claim 1, characterized in that, The preprocessing includes address normalization, memory access normalization, register normalization, floating-point instruction normalization, and SIMD instruction normalization.

3. The binary patch detection method based on retrieval enhancement generation according to claim 1, characterized in that, The aforementioned method of generating multiple vulnerability-patch pairs using a context-aware basic block mapping algorithm specifically includes: Input the key basic block and symbolize its address, register, floating-point calculation, SIMD instructions and memory operands to generate an instruction sequence that is independent of the compilation environment; The hash value of the key basic block is calculated based on the normalized instructions, and the mapping group is implemented according to the hash value, so that the key basic blocks with the same hash value across functions are classified into the same candidate group. If the number of critical basic blocks in the candidate group is 2, the critical basic blocks in the candidate group are directly mapped to generate vulnerability-patch pairs. If the number of critical basic blocks in the candidate group is greater than 2, an iterative greedy matching strategy is adopted to select the two basic blocks with the highest similarity to complete the mapping, and the context relationship of the remaining basic blocks in the candidate group is dynamically updated until the mapping of all critical basic blocks is completed, generating vulnerability-patch pairs.

4. The binary patch detection method based on retrieval enhancement generation according to claim 1, characterized in that, The method of extracting multimodal embedding vectors using a hierarchical processing approach specifically includes: extracting semantic feature vectors from the instruction sequence of the vulnerability-patch pair; extracting graph feature vectors from the control flow graph and data dependency graph of the vulnerability-patch pair; and forming multimodal embedding vectors by using a hierarchical multimodal feature fusion method with the semantic feature vectors and the graph feature vectors.

5. The binary patch detection method based on retrieval enhancement generation according to claim 4, characterized in that, A multi-level implicit state fusion strategy based on the analytic hierarchy process (AHP) is used to extract semantic feature vectors from instruction sequences. The processing flow is as follows: A dynamically adjusted sliding window strategy is used to process instruction sequences; A four-layer decision model is constructed, and the layer contribution weights are determined by the expert evaluation matrix and eigenvalue decomposition. The processed instruction sequence is input, and the four hidden states output by the four-layer decision model are linearly combined. The four-layer decision model refers to the last four encoder layers of the Transformer model; the expert evaluation matrix is ​​constructed using the analytic hierarchy process (AHP). The merged feature tensor is averaged along the sequence dimension to obtain the semantic feature vector.

6. The binary patch detection method based on retrieval enhancement generation according to claim 4, characterized in that, A heterogeneous sensing multimodal graph embedding model is used to extract graph feature vectors from the control flow graph and data dependency graph. The processing flow is as follows: The number of nodes in the control flow graph or the data dependency graph is determined. For control flow graphs or data dependency graphs with fewer than M nodes, they are processed through the full embedding channel. For control flow graphs and data dependency graphs with more than M nodes, a dynamic parameter adjustment mechanism is designed. A fast embedding channel is used, and graph pruning optimization is performed through betweenness centrality threshold before the graph is processed through the full embedding channel. The complete embedding channel employs a dual embedding strategy: combining Node2Vec random walk global embedding and GCN deep neural network local embedding; the GCN deep neural network consists of four GCN layers, each containing convolutions and a Conv 1d module of size 1, a batch normalization layer, and a Leaky ReLU activation function; The dual-embedded feature enhancement is obtained through the output of the complete embedding channel. After multi-dimensional feature concatenation and standardization, a graph feature vector is obtained.

7. The binary patch detection method based on retrieval enhancement generation according to claim 4, characterized in that, The method of forming a multimodal embedding vector by using a hierarchical multimodal feature fusion method for the semantic feature vector and the graph feature vector specifically includes: firstly, constructing a dynamic weight allocation mechanism, using a bilinear attention model to automatically learn the importance weights of the semantic feature vector and the graph feature vector, wherein the initial weight of the semantic feature vector remains dominant, and the contribution ratio of the graph feature vector is dynamically adjusted through adjacency matrix propagation; then, using variance-constrained principal component analysis for dimensionality reduction, eliminating irrelevant and redundant information, retaining effective information to generate a compact vector, thus obtaining the multimodal embedding vector.

8. The binary patch detection method based on retrieval enhancement generation according to claim 1, characterized in that, The method of retrieving the top N vulnerability-patch pairs with high similarity to the basic blocks in the objective function from the vulnerability-patch knowledge base using the RAG search framework includes: employing a three-level progressive matching mechanism; firstly, performing a Top-K nearest neighbor search based on the Faiss framework method, where K>N; then, using three similarity detection methods—cosine similarity, Euclidean distance, and Pearson coefficient—to detect the similarity of the basic blocks, and fusing the three similarity detection results by weighted average; finally, adjusting the similarity score based on the structural similarity of the PageRank algorithm to obtain the final similarity ranking.

9. The binary patch detection method based on retrieval enhancement generation according to claim 1, characterized in that, At the design level of patch detection prompts, the CRISP framework is used to construct system instructions, which are then used to execute a four-step analysis process sequentially on a large language model: assembly instruction analysis, memory operation pattern recognition, CVE feature matching, and patch verification.

10. A binary patch detection system based on retrieval enhancement, characterized in that, include: The vulnerability-pattern knowledge base generation module collects a binary file database, preprocesses all vulnerable functions and patch functions, extracts key basic blocks, generates multiple vulnerability-pattern pairs using a context-aware basic block mapping algorithm, and extracts the multimodal embedding vector of each vulnerability-pattern pair based on a hierarchical processing method to construct the vulnerability-pattern knowledge base; wherein the key basic blocks are basic blocks containing vulnerability or patch code; The binary patch detection module is used to extract all target functions in the target file to be tested and preprocess them. Based on the hierarchical processing method, it extracts the multimodal embedding vectors of all basic blocks in the target functions. Using the RAG search framework, it retrieves the top N vulnerability-patch pairs with high similarity to the basic blocks in the target functions from the vulnerability-patch knowledge base. Based on the top N vulnerability-patch pairs, it generates patch detection prompt words and then performs binary patch detection using a locally deployed large language model to obtain the detection results.

Images