Binary program similarity analysis method and system

Abstract

The application provides a binary program similarity analysis method and system, belonging to the field of network security and software engineering, comprising: extracting multi-level code prints of a target binary program from multiple abstract levels according to an intermediate representation of the target binary program; fusing the multi-level code prints into a unified code print instance of the target binary program; performing multi-modal coding on the unified code print instance to obtain multiple embedding vectors of the unified code print instance; inputting the multiple embedding vectors into an attention fusion module to perform adaptive weighted fusion on the multiple embedding vectors to obtain a final fusion vector of the target binary program; and obtaining a similarity score between the target binary program and other binary programs according to the cosine similarity between the final fusion vector and fusion vectors of the other binary programs. The application realizes high-precision semantic similarity analysis of binary programs by multi-level code print extraction and adaptive weighted fusion of the attention mechanism to construct a robust unified function representation.

Description

Technical Field

[0001] This invention relates to the fields of network security and software engineering, and in particular to a binary program similarity analysis method and system. Background Technology

[0002] Binary program similarity analysis, a core technology in cybersecurity and software engineering, primarily aims to evaluate the semantic similarity between functions directly from compiled binary files without relying on source code. This technology plays a crucial role in scenarios such as vulnerability detection, malware attribution, and code reuse identification. However, the compilation process strips away high-level semantics from the source code, resulting in noisy binary representations. Different compilers, optimization options, or target architectures (such as x86 and ARM) further alter the code structure and instruction sequences, while code obfuscation techniques intentionally increase the difficulty of analysis. These factors collectively constitute the inherent challenges of analysis.

[0003] Existing techniques typically employ graph-based methods, representing functions as control flow graphs (CFGs) with basic blocks as nodes and transition relationships as edges, calculating similarity through graph matching or graph neural networks; or they use instruction sequence-based methods, treating instructions as sentences and using natural language processing models to generate embedding vectors; or they employ feature hashing-based methods, generating fuzzy hash signatures to quickly compare byte sequences. These methods attempt to extract features from specific dimensions to infer semantic similarity.

[0004] However, these technical solutions are often limited to a single modality of information source, leading to the one-sidedness and isolation of semantic capture. Specifically, while graph-based methods can capture macroscopic control flow, they ignore the fine-grained logic within basic blocks; instruction sequence-based methods focus on local semantics but lose global structural dependencies; and feature-based hashing methods are computationally efficient but sensitive to byte layout and cannot cope with transformations that significantly alter representations. This reliance on a single dimension makes it difficult for existing methods to effectively integrate multimodal features when facing compilation diversity and code obfuscation, ultimately resulting in insufficient robustness and accuracy of similarity analysis, and an inability to accurately determine the similarity of binary programs in complex real-world environments. Summary of the Invention

[0005] This invention provides a binary program similarity analysis method, system, electronic device, storage medium, and computer program product to overcome the shortcomings of the one-sidedness and isolation of semantic capture in the prior art, and to achieve high-precision binary program similarity analysis.

[0006] This invention provides a binary program similarity analysis method, comprising the following steps: Based on the intermediate representation of the target binary program, multi-level code patterns of the target binary program are extracted from multiple abstraction levels; The multi-level code patterns are fused into a unified code pattern instance for the target binary program; Multimodal encoding is performed on the unified pattern instance to obtain multiple embedding vectors of the unified pattern instance; The multiple embedding vectors are input into the attention fusion module, and the multiple embedding vectors are adaptively weighted and fused to obtain the final fusion vector of the target binary program; The similarity score between the target binary program and other binary programs is obtained based on the cosine similarity between the final fusion vector and the fusion vector of other binary programs.

[0007] According to a binary program similarity analysis method provided by the present invention, the step of extracting multi-level code patterns of the target binary program from multiple abstraction levels based on the intermediate representation of the target binary program includes: Based on the intermediate representation, the instruction sequences within the plurality of basic blocks are embedded and encoded to obtain the instruction embedding code pattern of the target binary program; Based on the intermediate representation, data flow analysis is performed on the target binary program to identify the definition-usage relationships between the multiple basic blocks according to the register and memory definitions; According to the definition-use relationship, data flow edges are established between the multiple basic blocks to obtain the data flow code pattern of the target binary program; Based on the intermediate representation, the calling instructions in the plurality of basic blocks are scanned to identify the called function pointed to by the calling instruction; By establishing call relationship edges between the multiple basic blocks and the called function, the call relationship pattern of the target binary program is obtained.

[0008] According to a binary program similarity analysis method provided by the present invention, the step of fusing the multi-level code patterns into a unified code pattern instance of the target binary program includes: The unified code instance is obtained by fusing the instruction embedding code, the data stream code, and the call relationship code through an attention mechanism.

[0009] According to a binary program similarity analysis method provided by the present invention, the step of performing multimodal encoding on the uniform pattern instance to obtain multiple embedding vectors of the uniform pattern instance includes: The unified pattern instance is structurally encoded to obtain the structural embedding vector of the unified pattern instance; The unified pattern instance is sequence encoded to obtain the sequence embedding vector of the unified pattern instance; Behavioral encoding is performed on the unified pattern instance to obtain the behavioral embedding vector of the unified pattern instance.

[0010] According to a binary program similarity analysis method provided by the present invention, the step of inputting the multiple embedding vectors into an attention fusion module and adaptively weighting and fusing the multiple embedding vectors to obtain the final fusion vector of the target binary program includes: The structure embedding vector, the sequence embedding vector, and the behavior embedding vector are concatenated to obtain a concatenated vector. The concatenated vector is input into the self-attention layer of the attention fusion module to obtain the weight distribution of the concatenated vector; The concatenated vectors are weighted and summed according to the weight distribution to obtain the final fused vector.

[0011] The binary program similarity analysis method provided by the present invention further includes: The target binary program is disassembled to obtain multiple basic blocks of the target binary program; The multiple basic blocks are extracted into a unified intermediate representation layer to obtain the intermediate representation of the target binary program.

[0012] This invention also provides a binary program similarity analysis system, comprising the following modules: The first processing module is used to extract multi-level code patterns of the target binary program from multiple abstraction levels based on the intermediate representation of the target binary program. The second processing module is used to fuse the multi-level code patterns into a unified code pattern instance of the target binary program; The third processing module is used to perform multimodal encoding on the unified pattern instance to obtain multiple embedding vectors of the unified pattern instance; The fourth processing module is used to input the multiple embedding vectors into the attention fusion module, and to perform adaptive weighted fusion on the multiple embedding vectors to obtain the final fusion vector of the target binary program. The fifth processing module is used to obtain a similarity score between the target binary program and other binary programs based on the cosine similarity between the final fusion vector and the fusion vector of other binary programs.

[0013] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the binary program similarity analysis method described above.

[0014] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the binary program similarity analysis method as described above.

[0015] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the binary program similarity analysis method described above.

[0016] In summary, one or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages: By extracting multi-level code patterns from multiple abstract levels based on the intermediate representation of the target binary program, a more comprehensive and richer program profile than single-dimensional information is constructed, solving the semantic capture bias problem caused by the reliance on a single information source in existing technologies. By fusing multi-level code patterns into a unified code pattern instance of the target binary program, the originally scattered feature information is integrated into an organic whole, providing a high-information-density and structurally complete input for subsequent multimodal encoding, avoiding semantic loss caused by information fragmentation. Multimodal encoding of the unified code pattern instance yields multiple embedding vectors, enabling the extraction of specific and information-condensed embedding vectors from different perspectives such as structure, sequence, and behavior, preserving the uniqueness of different information modalities and providing clean and high-quality feature input for subsequent adaptive fusion. By inputting multiple embedding vectors into the attention fusion module and adaptively weighting and fusing them, the model is endowed with the ability to dynamically adjust the importance of different features according to the specific characteristics of the input program. This intelligently highlights the most discriminative information and suppresses noise, greatly enhancing the robustness and accuracy of the final fused vector in the face of compilation optimization or code obfuscation. By calculating the cosine similarity between the final fusion vector and the fusion vectors of other binary programs, a similarity score is obtained between the target binary program and other binary programs. This provides a comparison method with low computational overhead and large scalability, which can transform abstract semantic similarity into clear and quantifiable numerical results, providing an efficient and reliable decision-making basis for downstream applications such as vulnerability search and code tracing. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0018] Figure 1This is one of the flowcharts of the binary program similarity analysis method provided by the present invention.

[0019] Figure 2 This is the second flowchart of the binary program similarity analysis method provided by the present invention.

[0020] Figure 3 This is the third flowchart of the binary program similarity analysis method provided by the present invention.

[0021] Figure 4 This is the fourth flowchart of the binary program similarity analysis method provided by the present invention.

[0022] Figure 5 This is the fifth flowchart of the binary program similarity analysis method provided by the present invention.

[0023] Figure 6 This is the sixth flowchart of the binary program similarity analysis method provided by this invention.

[0024] Figure 7 This is a schematic diagram of the binary program similarity analysis system provided by the present invention.

[0025] Figure 8 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0027] It should be noted that in the description of this invention, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. The terms "upper," "lower," etc., indicating orientation or positional relationships according to the accompanying drawings, are only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the system or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0028] The terms "first," "second," etc., used in this invention are used to distinguish similar objects, not to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class, without limiting the number of objects; for example, a first object can be one or more. Furthermore, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0029] The following is combined with Figures 1 to 8 This invention describes the binary program similarity analysis method, system, electronic device, storage medium, and computer program product provided by this invention.

[0030] Reference Figure 1 , Figure 1 This is one of the flowcharts illustrating the binary program similarity analysis method provided by this invention, such as... Figure 1 As shown, steps 101 to 105 are included: Step 101: Extract the multi-level code patterns of the target binary program from multiple abstraction levels based on the intermediate representation of the target binary program.

[0031] This step aims to address the limitations of existing technologies in semantic capture. Current analysis methods typically examine binary programs from a single dimension, such as focusing only on control flow structure or instruction sequences. This singular perspective leads to an incomplete understanding of the program's internal logic, significantly reducing the accuracy and robustness of the analysis results when faced with complex code transformations. Therefore, this step employs a novel representation method to fundamentally construct a more comprehensive and in-depth program profile, laying the foundation for high-precision similarity analysis.

[0032] Specifically, in step 101, the target binary program refers to the binary code file or function fragment to be analyzed. The intermediate representation is a unified abstract form of the target binary program. It is independent of specific hardware architecture. Multi-level code patterns refer to a collective term for a set of features. This set consists of multiple independent feature subsets, each used to characterize the characteristics of the target binary program at a specific level of abstraction. These levels of abstraction are carefully designed to characterize the program from different and complementary dimensions, ensuring that the final combined representation covers the most comprehensive semantic information possible.

[0033] In a specific implementation, an intermediate representation of the target binary program is first obtained. Based on this intermediate representation, multiple independent analysis tasks are initiated in parallel. Each analysis task focuses on a specific level of abstraction to extract corresponding features. For example, one analysis task might operate at a fine-grained level to capture the local computational logic of the program, while another might operate at a higher structural level to capture the dependencies and interaction patterns between program units. The outputs of all these independent analysis tasks are then aggregated, and these aggregated features collectively constitute the multi-level code pattern of the target binary program.

[0034] Step 102: Merge the multi-level code patterns into a unified code pattern instance for the target binary program.

[0035] The purpose of this step is to integrate the multiple independent feature sets extracted in the previous step into a structured, unified data entity. Without fusing these scattered code patterns, subsequent analysis modules will struggle to perform a comprehensive evaluation and encoding of the target binary program. Therefore, the objective of this step is to prepare a standardized and complete input for subsequent encoding processing.

[0036] Specifically, in step 102, the unified pattern instance of technical features refers to a comprehensive data structure. This data structure systematically integrates all multi-level pattern information extracted from different levels of abstraction. It is no longer multiple separate feature lists or graphs, but a single entity containing all nodes, edges, and their respective attributes. This instance completely represents a target binary program and can be processed as a whole by the subsequent encoder.

[0037] In one specific implementation, the multi-level patterns generated in the preceding steps are integrated. For example, node features defined in one pattern can be appended to corresponding nodes in the graph structure defined by another pattern. Simultaneously, various types of edge relationships defined by different patterns can all be added to a unified graph. In this way, all scattered feature information is organized into a single, multimodal graph structure. This final structure is the unified pattern instance of the target binary program.

[0038] Step 103: Perform multimodal encoding on the uniform pattern instance to obtain multiple embedding vectors of the uniform pattern instance.

[0039] The purpose of this step is to convert the structured unified pattern instance generated in the previous step into a numerical representation suitable for machine learning processing. The original unified pattern instance is a complex data structure, such as an attribute graph, which cannot be directly used for numerical computation. Therefore, it needs to be mapped to a low-dimensional, dense vector space through an encoding process. Thus, the purpose of step 103 is to extract key, representative feature vectors from the diverse information contained in the instance.

[0040] Specifically, in step 103, multimodal coding refers to the process of using multiple different encoders to extract and encode features from different information modalities or dimensions contained in a uniform pattern instance. The embedding vector is the output of the multimodal coding process. Each embedding vector is a dense numerical vector that represents a semantic summary of the uniform pattern instance under a specific modality or perspective.

[0041] In one specific implementation, the system deploys multiple encoders in parallel. Each encoder processes a specific type of information within the uniform pattern instance. For example, one encoder might focus on processing graph structure information within the instance. Another encoder might focus on processing serialization information contained within the instance. Yet another encoder might focus on processing high-level behavioral information encoded within the instance. These encoders operate in parallel, each outputting an independent embedding vector. These vectors collectively constitute multiple embedding vectors for the uniform pattern instance.

[0042] Step 104: Input multiple embedding vectors into the attention fusion module, perform adaptive weighted fusion on the multiple embedding vectors, and obtain the final fusion vector of the target binary program.

[0043] This step aims to address the static and rigid issues in the feature fusion process. Multiple embedding vectors encoded from different perspectives have been obtained in the previous step. If a simple concatenation or averaging method is used for fusion, it is impossible to dynamically adjust the importance of different features according to the specific characteristics of the target binary program. This static fusion approach lacks flexibility and adaptability when faced with diverse code. Therefore, step 104 introduces an intelligent fusion mechanism to generate a more discriminative and robust final representation.

[0044] Specifically, in step 104, the attention fusion module is a computational module capable of dynamically learning the weight distribution based on the input. This module receives multiple embedding vectors as input and produces a single output vector. Adaptive weighted fusion refers to a dynamic fusion process performed by this module. During this process, the attention fusion module dynamically calculates a weight for each of the multiple input embedding vectors based on their specific content. This weight reflects the relative importance of the corresponding vector in constructing the final program representation. The final fused vector is the product of the adaptive weighted fusion process; it is a single, comprehensive vector representation that condenses the key information from all input vectors and represents the final identity signature of the target binary program.

[0045] In one specific implementation, the multiple embedding vectors obtained in the previous step are treated as a whole and input into a pre-trained attention fusion module. The attention fusion module processes the input embedding vectors. Its internal mechanism analyzes the information contained in each vector and assigns a corresponding weight value to each vector. Subsequently, the attention fusion module integrates and refines the multiple embedding vectors based on these dynamically generated weight values. This process ultimately outputs a single vector, which is the final fused vector of the target binary program.

[0046] Step 105: Based on the cosine similarity between the final fusion vector and the fusion vector of other binary programs, obtain the similarity score between the target binary program and other binary programs.

[0047] The purpose of this step is to transform the abstract vector representation generated in the previous steps into a clear and quantifiable analysis result. Step 104 previously generated a final fusion vector for each binary program, which represents the program's semantics in mathematical space. The aim of this step is to calculate the closeness between these vectors using a standardized metric, thereby providing a direct and usable similarity judgment basis for various practical applications.

[0048] Specifically, in step 105, the fusion vectors of other binary programs refer to vector representations generated using the exact same method as the target binary program (i.e., steps 101 to 104). These vectors are typically pre-computed and stored in a code pattern database to represent known programs (e.g., known malware or vulnerable functions). Cosine similarity is a mathematical method used to measure the degree of similarity between two vectors in a direction. The closer the calculated result is to 1, the closer the two vectors are in direction, which means that the binary programs corresponding to the two final fusion vectors are semantically similar. The similarity score is the specific numerical value generated by the cosine similarity calculation, which directly quantifies the degree of similarity between the target binary program and other binary programs.

[0049] In one specific implementation, the final fusion vector of the target binary program is first obtained. Next, the fusion vectors of one or more other binary programs are read from a pre-established database. For each comparison, the final fusion vector of the target binary program and the fusion vector of a selected other binary program are used as a pair of inputs. Then, a cosine similarity calculation formula is applied between these two vectors. The numerical result of this calculation is used as the similarity score between the two programs. This process can be efficiently repeated, enabling rapid comparison of the target program with a massive number of programs in a large-scale database.

[0050] In a preferred embodiment, prior to step 101, the method further includes preprocessing of the binary program. This preprocessing aims to transform the input, hardware-architecture-specific binary program into a standardized, hardware-independent starting point for analysis. This addresses the problem of existing technologies struggling to handle code from different instruction set architectures (e.g., x86, ARM, MIPS). This process provides a unified representation plane for all subsequent analysis steps. Specifically, refer to... Figure 2 , Figure 2 This is the second flowchart of the binary program similarity analysis method provided by the present invention. Before step 101, the method further includes the following steps: Step 201: Disassemble the target binary program to obtain multiple basic blocks of the target binary program.

[0051] Step 202: Extract multiple basic blocks into a unified intermediate representation layer to obtain the intermediate representation of the target binary program.

[0052] The preprocessing process first executes step 201: disassembling the target binary program to obtain multiple basic blocks. In step 201, disassembly refers to using a mature disassembler to convert machine-executable binary code into a human-readable sequence of assembly instructions. Multiple basic blocks are standard structural units of a program. A basic block is a continuous sequence of instructions in which control flow can only enter from the first instruction and exit from the last instruction. In specific implementations, disassemblers such as Ghidra, IDA Pro, or Radare can be used to process the input target binary program file. After obtaining the assembly instruction sequence, the entire instruction sequence is divided into multiple basic blocks according to the position of control flow transfer instructions (such as jump or return instructions).

[0053] Next, the process executes step 202: extracting multiple basic blocks into a unified intermediate representation layer to obtain the intermediate representation of the target binary program. In this step, the unified intermediate representation layer is an abstract representation layer independent of specific hardware architecture. Its purpose is to normalize code from different instruction sets onto a common representation plane. The intermediate representation is the final result obtained after multiple basic blocks are extracted into this layer. In a specific implementation, the assembly instructions within each basic block are processed one by one. It translates these architecture-specific instructions (such as the mov instruction in x8f6 or the LDR instruction in ARM) into a common instruction format defined by the unified intermediate representation layer. After all basic blocks have undergone this translation process, the resulting set is the intermediate representation of the target binary program.

[0054] In a preferred embodiment, refer to Figure 3 , Figure 3 This is the third flowchart of the binary program similarity analysis method provided by the present invention. Step 101 specifically includes the following steps. This process extracts three different levels of code patterns for the target binary program in parallel, thereby solving the problem of insufficient robustness caused by the reliance on a single information source in existing technologies. These three types of code patterns describe the complete semantics of the program from different and complementary dimensions.

[0055] Step 301: Based on the intermediate representation, embedding and encoding the instruction sequences within multiple basic blocks to obtain the instruction embedding code pattern of the target binary program.

[0056] Step 302: Based on the intermediate representation, perform data flow analysis on the target binary program to identify the relationship between multiple basic blocks based on the definition and use of registers and memory.

[0057] Step 303: Establish data flow edges between multiple basic blocks according to the definition-use relationship to obtain the data flow code pattern of the target binary program.

[0058] Step 304: Based on the intermediate representation, scan the calling instructions in multiple basic blocks to identify the called function pointed to by the calling instructions.

[0059] Step 305: Establish call relationship edges between multiple basic blocks and the called functions to obtain the call relationship code pattern of the target binary program.

[0060] The process first executes step 301: based on the intermediate representation, the instruction sequences within multiple basic blocks are embedded and encoded to obtain the instruction embedding pattern of the target binary program. Here, the instruction embedding pattern is one or a set of feature vectors, representing the fine-grained computational logic within multiple basic blocks. In a more detailed implementation, the instruction sequence within each basic block is first normalized. This process generalizes or removes volatile components, such as replacing specific register names (eax) with general symbols (e.g., REG), immediate values ​​(e.g., 0x42) with IMM, and memory addresses with MEM, retaining only the opcode and instruction structure. Then, these normalized instruction sequences are input into a pre-trained sequence encoder model, such as a Transformer-based model. This model has learned general semantic relationships between instructions on a large code corpus. For each basic block, its normalized instruction sequence is input into the encoder, which then compresses the semantics of the entire sequence into a fixed, high-dimensional, dense numerical vector. The set of feature vectors generated by all basic blocks together constitutes the instruction embedding pattern of the target binary program.

[0061] Simultaneously, the process executes step 302: based on the intermediate representation, data flow analysis is performed on the target binary program to identify the definition-use relationships between multiple basic blocks according to registers and memory. Next, the process executes step 303: based on the definition-use relationships, data flow edges are established between the multiple basic blocks to obtain the data flow pattern of the target binary program. Here, the data flow pattern is a graph structure that reveals the flow path of data between different basic blocks. In a more detailed implementation, static data flow analysis is performed at the function level. This analysis tracks the values ​​of each register and key memory location. When an instruction writes a value to a register or memory location in a basic block, this is recorded as a "definition." When a subsequent instruction reads the value from that register or memory location in another basic block, this is recorded as a "use." If a "definition" point can be reached uninterruptedly from a "use" point, a directed data flow edge is established between the multiple basic blocks containing these two points. The type of this edge can be labeled EDGE_DATA_FLOW. The set of all data flow edges established in this way constitutes the data flow pattern.

[0062] Furthermore, the process also executes step 304: based on the intermediate representation, scanning the call instructions in multiple basic blocks to identify the called function pointed to by the call instructions. Subsequently, the process executes step 305: establishing call relationship edges between multiple basic blocks and the called functions to obtain the call relationship pattern of the target binary program. The call relationship pattern is also a graph structure that describes the program's external interaction behavior. In a more detailed implementation, all instructions within a function are traversed, specifically identifying call instructions, such as the `call` instruction in the x86 architecture. For each call instruction, its operands are parsed to determine the address or name of the called function. This called function may be another function within the program, or it may be an external library function or a system API. A unique node is created for this called function in the graph (if it does not already exist), and then a directed call relationship edge is established between the basic block node containing the call instruction and the node representing the called function. The type of this edge can be labeled `EDGE_CALL`. The set of all call relationship edges established in this way constitutes the call relationship pattern.

[0063] By extracting three complementary code patterns, the program's intrinsic information is captured comprehensively from three dimensions. Instruction embedding code patterns focus on local computational logic, data flow code patterns focus on internal data dependencies, and call relationship code patterns focus on high-level behavioral interactions. The richness of this representation far surpasses any single-modal method. It enables the model to learn more fundamental and less mutable functional characteristics, thus establishing a more reliable similarity metric even when faced with compiler optimizations and code obfuscation that can alter the control flow structure or instruction sequence.

[0064] In a preferred embodiment, refer to Figure 4 , Figure 4 This is the fourth flowchart of the binary program similarity analysis method provided by the present invention. Step 102 specifically includes the following steps: Step 401: The instruction embedding pattern, data stream pattern, and call relationship pattern are fused together using an attention mechanism to obtain a unified pattern instance.

[0065] Specifically, this step aims to address the semantic gaps that may arise when simply merging three independent code patterns in a structured manner. Simply statically stacking the information from the three code patterns fails to effectively represent the deep interactions between different information dimensions. For example, the internal computational logic of a basic block (represented by instruction embedding code patterns) directly affects its external data dependencies (represented by data flow code patterns). Therefore, this step introduces an attention mechanism. Its purpose is to fuse instruction embedding code patterns, data flow code patterns, and call relationship code patterns from different sources during the construction of the unified code pattern instance, generating a unified code pattern instance with tighter information coupling. The attention mechanism is used to dynamically evaluate and integrate the information provided by different code patterns during the fusion process.

[0066] In more detail, an initial multi-relationship graph is first constructed. The nodes in this initial graph represent basic blocks, and their initial features are defined by the corresponding instruction embedding patterns (i.e., the feature vectors of each basic block). The edges in the graph include data flow edges defined by data flow patterns and call relationship edges defined by call relationship patterns. At this point, although the structure is aggregated, the relationship between node features and the graph structure is separate. Next, this initial multi-relationship graph is input into a module based on a Graph Attention Network (GAT). This module is the specific implementation of the attention mechanism in this step. For each node in the graph, the GAT module calculates the attention coefficients between it and all its neighboring nodes. The calculation of these coefficients considers not only the node's own features but also the features of its neighboring nodes, and even further considers the type of connecting edges (whether they are data flow edges or call relationship edges). Then, based on these attention coefficients, the module performs a weighted summation of the features of all neighboring nodes, thereby updating the node's feature vector. After this process, the feature vector of each node incorporates the data flow and call relationship information within its neighborhood. This graph, after being processed by the GAT module and having its node features updated, is the final unified pattern instance.

[0067] This step achieves deep fusion of three types of code patterns through an attention mechanism, resulting in significant technical improvements. Compared to simple feature concatenation or structure merging, the unified code pattern instance generated in this step has higher information quality, enabling the entire model to better understand the complex relationships between computation, structure, and behavior in the program, thus laying the foundation for the final generation of a high-quality fusion vector.

[0068] In a preferred embodiment, refer to Figure 5 , Figure 5 This is the fifth flowchart of the binary program similarity analysis method provided by the present invention. Step 103 specifically includes the following steps. This process encodes the uniform code pattern instance in parallel from multiple angles, aiming to decompose and refine this complex multimodal data structure into multiple highly condensed numerical vectors. Since a single encoder cannot simultaneously capture all the structural, sequence, and behavioral information contained in the uniform code pattern instance, this step employs multiple parallel encoders to ensure that each core feature of the program can be fully and accurately extracted. Step 501: Perform structural encoding on the uniform pattern instance to obtain the structural embedding vector of the uniform pattern instance.

[0069] Step 502: Perform sequence encoding on the uniform pattern instance to obtain the sequence embedding vector of the uniform pattern instance.

[0070] Step 503: Perform behavior encoding on the uniform pattern instance to obtain the behavior embedding vector of the uniform pattern instance.

[0071] The process first executes step 501: structural encoding of the uniform pattern instance to obtain the structural embedding vector of the uniform pattern instance. Here, the structural embedding vector is a dense vector summarizing the topological information of the entire program graph structure. It reflects the complex control flow, data flow, and call relationships between basic blocks. In a more detailed implementation, structural encoding is performed by a graph neural network (GNN). The entire uniform pattern instance (an attribute graph containing various node and edge types) is provided as input to the GNN. The GNN operates through a multi-layered message-passing mechanism. In each layer, each node aggregates information from its neighbors to update its own representation. After several iterations, the representation of each node incorporates its local and global context information in the graph. Finally, a graph-level readout function, such as graph pooling, is applied to all node representations to generate a single, fixed-dimensional structural embedding vector.

[0072] Simultaneously, step 502 is executed: sequence encoding is performed on the unified pattern instance to obtain the sequence embedding vector of the unified pattern instance. Here, the sequence embedding vector is a dense vector summarizing the overall computational logic of the program. It originates from the internal instruction semantics of all basic blocks constituting the program. In a more detailed implementation, the initial feature vectors of all basic block nodes (i.e., the instruction embeddings generated in step 301) are first extracted from the unified pattern instance. These vectors are then arranged into a vector sequence according to the address order of the basic blocks in memory. This vector sequence is then input into a Transformer-based sequence model. This model utilizes its self-attention mechanism to capture the long-distance dependencies between the various basic blocks in the sequence. Finally, the model outputs a single vector that summarizes the overall semantics of the entire sequence; this vector is the sequence embedding vector.

[0073] Furthermore, the process also performs step 503: behavioral encoding of the unified pattern instance to obtain the behavioral embedding vector of the unified pattern instance. The behavioral embedding vector is a dense vector summarizing the high-level external interaction patterns of the program. It primarily focuses on the call relationships between the program and other functions or system services. In a more detailed implementation, all call relationship information is first extracted from the unified pattern instance. A sparse feature vector is constructed, where each dimension of the vector corresponds to a known library function or API. If the program calls an API, the corresponding dimension in the vector is activated. This high-dimensional, sparse vector is then fed into a relatively simple multilayer perceptron (MLP). The MLP maps it to a low-dimensional, dense embedding space, and the resulting vector is the behavioral embedding vector.

[0074] In a preferred embodiment, refer to Figure 6 , Figure 6 This is the sixth flowchart of the binary program similarity analysis method provided by the present invention. Step 104 specifically includes the following steps. This process aims to fuse multiple independent embedding vectors encoded from different perspectives in the previous step into a single, comprehensive final representation. This solves the problem that static fusion methods cannot adjust feature importance according to the specific characteristics of the input program. By introducing an adaptive fusion mechanism, the robustness and discriminative power of the final program representation are significantly improved.

[0075] Step 601: Concatenate the structure embedding vector, sequence embedding vector, and behavior embedding vector to obtain the concatenated vector.

[0076] Step 602: Input the concatenated vector into the self-attention layer of the attention fusion module to obtain the weight distribution of the concatenated vector.

[0077] Step 603: Perform a weighted summation on the spliced ​​vectors according to the weight distribution to obtain the final fused vector.

[0078] The process first executes step 601: concatenating the structure embedding vector, sequence embedding vector, and behavior embedding vector to obtain a concatenated vector. In this step, the concatenated vector is a newly generated one-dimensional long vector. It is formed by concatenating the three aforementioned independent vectors end-to-end. In a more detailed implementation, three inputs are received from the parallel encoder: a structure embedding vector representing the program topology, a sequence embedding vector representing the program's local computational logic, and a behavior embedding vector representing the program's high-level external interactions. These are concatenated along the vector dimension in a predetermined order, such as [structure embedding vector, sequence embedding vector, behavior embedding vector]. If each input vector has a dimension of d, the resulting concatenated vector will have a dimension of 3d.

[0079] Next, the process executes step 602: the concatenated vector is input to the self-attention layer of the attention fusion module to obtain the weight distribution of the concatenated vector. Here, the self-attention layer is a neural network layer that analyzes the relationships between different parts within an input vector. The weight distribution is the output of the self-attention layer; it is a set of values, typically summed to 1, with each value corresponding to a part of the concatenated vector, representing the relative importance of that part. In a more detailed implementation, the self-attention layer receives the concatenated vector as input. This layer evaluates, through internal computation (e.g., using a Query-Key-Value mechanism), the contribution of each part of the concatenated vector corresponding to the original three embedding vectors to the final identity recognition. The layer ultimately outputs a weight distribution containing three values, such as [w_struct, w_lexical, w_behavioral], which are the importance scores dynamically calculated for the structural embedding vector, sequence embedding vector, and behavioral embedding vector.

[0080] Finally, the process executes step 603: weighted summation of the concatenated vectors according to the weight distribution to obtain the final fused vector. Weighted summation is a mathematical operation that multiplies each original embedding vector by its corresponding weight and then sums the results. In a more detailed implementation, the weight distribution obtained in the previous step is used to modulate the three original embedding vectors. The specific calculation formula is: Final fused vector = w_struct × structural embedding vector + w_lexical × sequence embedding vector + w_behavioral × behavioral embedding vector. The result of this calculation is a single vector with the same dimension as the original embedding vectors (dimension d), which is the final fused vector representing the target binary program.

[0081] Reference Figure 7 , Figure 7 This is a schematic diagram of the binary program similarity analysis system provided by the present invention. The system includes: The first processing module is used to extract multi-level code patterns of the target binary program from multiple abstraction levels based on the intermediate representation of the target binary program. The second processing module is used to fuse multi-level code patterns into a unified code pattern instance for the target binary program; The third processing module is used to perform multimodal encoding on the uniform pattern instance to obtain multiple embedding vectors of the uniform pattern instance; The fourth processing module is used to input multiple embedding vectors into the attention fusion module, and to perform adaptive weighted fusion of the multiple embedding vectors to obtain the final fusion vector of the target binary program. The fifth processing module is used to obtain the similarity score between the target binary program and other binary programs based on the cosine similarity between the final fusion vector and the fusion vector of other binary programs.

[0082] In one possible implementation, the first processing module is further configured to: Based on the intermediate representation, the instruction sequences within multiple basic blocks are embedded and encoded to obtain the instruction embedding code pattern of the target binary program. Based on the intermediate representation, data flow analysis is performed on the target binary program to identify the relationship between multiple basic blocks based on the definition and use of registers and memory; Based on the definition and usage relationship, data flow edges are established between multiple basic blocks to obtain the data flow code pattern of the target binary program; Based on the intermediate representation, the call instructions in multiple basic blocks are scanned to identify the called function pointed to by the call instruction; By establishing call relationship edges between multiple basic blocks and the called functions, the call relationship code pattern of the target binary program is obtained.

[0083] In one possible implementation, the second processing module is further configured to: fuse the instruction embedding code pattern, the data stream code pattern, and the call relationship code pattern through an attention mechanism to obtain a unified code pattern instance.

[0084] In one possible implementation, the third processing module is further configured to: Structural encoding is performed on the uniform pattern instance to obtain the structural embedding vector of the uniform pattern instance; Sequence encoding is performed on the uniform pattern instance to obtain the sequence embedding vector of the uniform pattern instance; Behavioral encoding is performed on the uniform pattern instance to obtain the behavioral embedding vector of the uniform pattern instance.

[0085] In one possible implementation, the fourth processing module is further configured to: The structure embedding vector, sequence embedding vector, and behavior embedding vector are concatenated to obtain the concatenated vector; The concatenated vector is input into the self-attention layer of the attention fusion module to obtain the weight distribution of the concatenated vector; The concatenated vectors are weighted and summed according to the weight distribution to obtain the final fused vector.

[0086] In one possible implementation, the first processing module is further configured to: The target binary program is disassembled to obtain its multiple basic blocks; Multiple basic blocks are extracted into a unified intermediate representation layer to obtain the intermediate representation of the target binary program.

[0087] It should be noted that the binary program similarity analysis system provided by the present invention can execute the binary program similarity analysis method of any of the above embodiments during specific operation, which will not be elaborated in this embodiment.

[0088] Figure 8 This is a schematic diagram of the structure of the electronic device provided by the present invention, such as... Figure 8 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830, and a communication bus 840, wherein the processor 810, the communication interface 820, and the memory 830 communicate with each other through the communication bus 840. The processor 810 can call logical instructions in the memory 830 to execute a binary program similarity analysis method, which includes: extracting multi-level code patterns of the target binary program from multiple abstraction levels based on the intermediate representation of the target binary program; fusing the multi-level code patterns into a unified code pattern instance of the target binary program; performing multimodal encoding on the unified code pattern instance to obtain multiple embedding vectors of the unified code pattern instance; inputting the multiple embedding vectors into an attention fusion module, and performing adaptive weighted fusion on the multiple embedding vectors to obtain the final fusion vector of the target binary program; and obtaining a similarity score between the target binary program and other binary programs based on the cosine similarity between the final fusion vector and the fusion vectors of other binary programs.

[0089] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0090] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, and when the program instructions are executed by a computer, the computer is able to execute the binary program similarity analysis method provided in the above embodiments.

[0091] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the binary program similarity analysis method provided in the above embodiments.

[0092] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0093] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0094] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A binary program similarity analysis method, characterized in that, include: Based on the intermediate representation of the target binary program, multi-level code patterns of the target binary program are extracted from multiple abstraction levels; The multi-level code patterns are fused into a unified code pattern instance for the target binary program; Multimodal encoding is performed on the unified pattern instance to obtain multiple embedding vectors of the unified pattern instance, including: structural encoding of the unified pattern instance to obtain a structural embedding vector of the unified pattern instance; sequence encoding of the unified pattern instance to obtain a sequence embedding vector of the unified pattern instance; and behavioral encoding of the unified pattern instance to obtain a behavioral embedding vector of the unified pattern instance. The multiple embedding vectors are input into the attention fusion module, and the multiple embedding vectors are adaptively weighted and fused to obtain the final fusion vector of the target binary program; The similarity score between the target binary program and other binary programs is obtained based on the cosine similarity between the final fusion vector and the fusion vector of other binary programs.

2. The binary program similarity analysis method according to claim 1, characterized in that, The step of extracting multi-level code patterns of the target binary program from multiple abstraction levels based on the intermediate representation of the target binary program includes: Based on the intermediate representation, the instruction sequences within multiple basic blocks are embedded and encoded to obtain the instruction embedding code pattern of the target binary program; Based on the intermediate representation, data flow analysis is performed on the target binary program to identify the definition-usage relationships between the multiple basic blocks according to the register and memory definitions; According to the definition-use relationship, data flow edges are established between the multiple basic blocks to obtain the data flow code pattern of the target binary program; Based on the intermediate representation, the calling instructions in the plurality of basic blocks are scanned to identify the called function pointed to by the calling instruction; By establishing call relationship edges between the multiple basic blocks and the called function, the call relationship pattern of the target binary program is obtained.

3. The binary program similarity analysis method according to claim 2, characterized in that, The process of fusing the multi-level code patterns into a unified code pattern instance for the target binary program includes: The unified code instance is obtained by fusing the instruction embedding code, the data stream code, and the call relationship code through an attention mechanism.

4. The binary program similarity analysis method according to claim 1, characterized in that, The step of inputting the multiple embedding vectors into the attention fusion module and adaptively weighting and fusing the multiple embedding vectors to obtain the final fusion vector of the target binary program includes: The structure embedding vector, the sequence embedding vector, and the behavior embedding vector are concatenated to obtain a concatenated vector. The concatenated vector is input into the self-attention layer of the attention fusion module to obtain the weight distribution of the concatenated vector; The concatenated vectors are weighted and summed according to the weight distribution to obtain the final fused vector.

5. The binary program similarity analysis method according to claim 1, characterized in that, Also includes: The target binary program is disassembled to obtain multiple basic blocks of the target binary program; The multiple basic blocks are extracted into a unified intermediate representation layer to obtain the intermediate representation of the target binary program.

6. A binary program similarity analysis system, characterized in that, include: The first processing module is used to extract multi-level code patterns of the target binary program from multiple abstraction levels based on the intermediate representation of the target binary program. The second processing module is used to fuse the multi-level code patterns into a unified code pattern instance of the target binary program; The third processing module is used to perform multimodal encoding on the unified pattern instance to obtain multiple embedding vectors of the unified pattern instance, including: performing structural encoding on the unified pattern instance to obtain the structural embedding vector of the unified pattern instance; performing sequence encoding on the unified pattern instance to obtain the sequence embedding vector of the unified pattern instance; and performing behavioral encoding on the unified pattern instance to obtain the behavioral embedding vector of the unified pattern instance. The fourth processing module is used to input the multiple embedding vectors into the attention fusion module, and to perform adaptive weighted fusion on the multiple embedding vectors to obtain the final fusion vector of the target binary program. The fifth processing module is used to obtain a similarity score between the target binary program and other binary programs based on the cosine similarity between the final fusion vector and the fusion vector of other binary programs.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the binary program similarity analysis method as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the binary program similarity analysis method as described in any one of claims 1 to 5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the binary program similarity analysis method as described in any one of claims 1 to 5.

Images