Anti-confusion binary function name recovery method for automatic analysis of malicious software

Abstract

The invention belongs to the technical field of software security, and particularly relates to a malicious software automatic analysis-oriented anti-obfuscation binary function name recovery method, which comprises the following steps of: firstly, constructing a triple data set comprising obfuscation assembly codes, clear assembly codes corresponding to the obfuscation assembly codes and real function names; then utilizing the data set to finely adjust a large-scale language model, so that the large-scale language model has the translation capability of converting obfuscated codes into semantic equivalent clear codes; secondly, mapping the clear assembly code into a semantic feature vector with a fixed dimension by using an anti-confusion graph semantic encoder; and finally, constructing a function name decoder, and carrying out joint training and optimization on coding and decoding parts by minimizing the loss between a prediction function name and a real function name.

Description

Technical Field

[0001] This application belongs to the field of software security technology, specifically relating to a method for recovering anti-obfuscated binary function names for automatic analysis of malware. Background Technology

[0002] In the field of malware analysis, rapid and accurate functional understanding of symbol-stripped binaries is crucial. Function names are abstract summaries of function semantics; accurately recovering function names can significantly improve the analytical efficiency of security analysts and enhance their ability to respond to advanced threats.

[0003] To circumvent analysis, malware commonly employs binary code obfuscation techniques (such as control flow flattening, instruction substitution, and fake control flow). These techniques severely disrupt the structured characteristics of the code, leading to a significant decrease in the performance of traditional binary analysis methods based on control flow graphs or instruction sequences.

[0004] Currently, the recovery of obfuscated binary function names faces two main challenges: 1. Semantic obfuscation: Obfuscation alters the explicit semantics and logical structure of instructions, making it extremely difficult to infer high-level functional intent directly from low-level assembly code. 2. Feature instability: Instruction-flow-based binary code representation methods rely on Natural Language Processing (NLP) techniques to capture the implicit semantics of the code. However, obfuscation techniques, by replacing simple instructions with complex ones, increase the complexity of the context and the length of the tokens, leading to a decrease in the performance of NLP techniques. Graph-based methods heavily rely on stable control flow graph structures, while obfuscation techniques actively disrupt this structure, resulting in feature "distortion." Therefore, existing methods (such as XFL) often assume that they do not support obfuscation scenarios or only support mild obfuscation scenarios, resulting in low accuracy in function name recovery under real-world obfuscation conditions. Summary of the Invention

[0005] To overcome the shortcomings of existing inventions, this invention provides an anti-obfuscated binary function name recovery method for automated malware analysis. The core concept of this invention is to construct a cascaded learning framework of "translation-encoding-decoding," avoiding the direct guessing of function names from obfuscated code by the model. The technical solution is as follows:

[0006] A method for recovering unobfuscated binary function names for automated malware analysis includes the following steps: S1: Training dataset construction: Collect a large amount of triple data from malware {obfuscated assembly code, clean assembly code, real function names}; S2: LLM Translator Fine-tuning: Using the {obfuscated assembly code, clean assembly code} pair from step S1, fine-tune a large language model as code deobfuscator so that it can learn to map obfuscated assembly code to semantically equivalent clean assembly code; S3: Semantic Encoder: Using the clean assembly code from step S1, the dominant augmented semantic graph (DESG) model is converted into a graph structure, and the DESG is mapped into a fixed-dimensional semantic feature vector through a graph neural network encoder (GNN). S4: Joint Training of Function Name Decoder: Construct an end-to-end network whose input is obfuscated assembly code, which passes sequentially through an LLM translator, a DESG builder, and a GNN encoder to obtain a semantic feature vector; input the semantic feature vector into a multilayer perceptron decoder to output a sequence of predicted function name labels; using the {obfuscated assembly code, real function name} data pair from step S1, train and optimize the GNN encoder and function name decoder by minimizing the loss between the predicted and real function names; S5: Automatic recovery function name.

[0007] Preferably, the binary file is obfuscated, specifically with four obfuscation options enabled: fake control flow, control flow flattening, instruction substitution, and basic block splitting. Then, Ghidra is used for disassembly to obtain obfuscated assembly code. The clear assembly code corresponds to the unobfuscated version. The function names are obtained by parsing the unobfuscated binary file and extracting the original function names from the symbol table to obtain the triple data of {obfuscated assembly code, clear assembly code, and real function name}.

[0008] Preferably, the LLM translator selects a large language model as the base model and uses the low-rank adaptation LoRA method for fine-tuning. The specific steps are as follows: S21.LoRA simulates parameter updates by freezing the original parameters of the pre-trained model and injecting only an additional low-rank matrix next to the original dense layer. S22. Design structured prompts to guide the model: The prompt design includes two parts: system prompts and user prompts. System prompts include roles and task descriptions. Roles define the model's position, defining it as an assembly language expert. Task descriptions are instructions for the task, enabling the large language model to understand the work that needs to be done. The task is defined as converting obfuscated code into original, unobfuscated, clear assembly code, and the output format is specified. User prompts consist of pairs of obfuscated assembly code and original, unobfuscated, clear assembly code.

[0009] Preferred training objectives and loss functions for large language models: Predicting the output sequence based on the input sequence, i.e., calculating the cross-entropy loss only on the "clean assembly code" of the model output, and minimizing the output sequence, i.e., the clean assembly code. The negative log probability forces the model to focus on reconstructing a clean output from the obfuscated input, which is the key to learning the core deobfuscation capability. To obfuscate the assembly code input sequence, Let be the trainable low-rank parameters introduced through LoRA; the loss function is: ; Let be the probability.

[0010] Preferably, the DESG construction process includes: Step 1: Decompile the clear assembly code to obtain the control flow graph in the original P-Code, and then apply the variable node normalization strategy to generate the control flow graph (CFG) of the normalized P-Code function; Step 2: Decompose the instruction sequence in each basic block into independent instructions, where nodes represent independent instructions and edges represent relationships between instructions, thereby obtaining the instruction-based semantic graph (ISG). Step 3: Decompose the opcode and operand into tags, refine the relationship between instructions into the relationship between tags, and finally obtain the tag-based semantic graph TSG; Step 4: Create virtual basic block nodes for each basic block, and then use domination analysis to introduce domination and post-domination relationships between nodes, thereby constructing a semantic graph BBSG based on basic blocks; Step 5: Introduce an inclusion relationship between the opcode marker of the TSG and the virtual base block node of the BBSG. If and only if the instruction corresponding to a certain opcode is included in a specific base block, establish a directed edge from the virtual base block node to the opcode node, and finally obtain the complete DESG.

[0011] Preferably, a gated graph neural network (GGNN) is used to learn the semantic information of the DESG. The message passing process is as follows: For each node in the DESG graph, its hidden state is updated by aggregating the hidden states of its neighbors and its own state in the previous layer. Let N be the set of all nodes. Represents a node In the Hidden states and nodes in a multi-layered GGNN The aggregation calculation of the hidden states of neighbors is as follows: ; in This represents the set of incoming and outgoing edges of node u. Represents a directed edge Edge embedding, Refers to two independent multilayer perceptrons used to process the incoming and outgoing edges respectively. Subsequently, in the... In the layer, the hidden state of node u is calculated using the following formula: ; GRU uses a gating mechanism to regulate the information flow, filtering out noise while preserving key features; Graph pooling: After the message passing layer, the final step is to aggregate all node embeddings into a graph embedding, using Softmax for pooling. The calculation formula is as follows: ; in The set representing the hidden states of all nodes. It is a parameter known as the inverse temperature.

[0012] Preferably, Softmax pooling is combined with multi-head attention to form a stacked, multi-layered Softmax structure: First, the hidden state is transformed using k linear layers: ; Subsequently, ReLU activation and normalization are performed, and the calculation formula for each head is as follows: ; Finally, the outputs of all the heads are concatenated and passed through a linear layer to generate the final graph embedding. The calculation formula is: ; Where t represents the number of heads; Function Name Decoder: A Multilayer Perceptron (MLP) is used as the decoder to embed the graph of function semantics. The function name is predicted using the following formula as input: ; in , and , All are weighted parameters. For activation function, It is split into individual words after preprocessing. The function name vector is used to update the parameters of the MLP model and GNN encoder, minimizing the following loss function: ; and These represent actual vocabulary and predicted vocabulary, respectively; Vocabulary is the vocabulary list. This is the cross-entropy loss function.

[0013] Compared with the prior art, the beneficial effects of this application are as follows: Modern malware is often obfuscated, requiring analysts to spend considerable time understanding function functionality. Accurate function name prediction can directly reveal function purpose, significantly shortening the analysis cycle. By identifying sensitive function names, the core functional modules of malware can be quickly located, improving threat response speed. Attached Figure Description

[0014] Figure 1 This is a schematic diagram illustrating dataset construction and LLM fine-tuning in an embodiment of the present invention; Figure 2 This is a schematic diagram of the encoder and decoder workflow in an embodiment of the present invention; Figure 3 This is a flowchart of the application process. Detailed Implementation

[0015] The present invention will be further described below with reference to the accompanying drawings and embodiments. It should be noted that the following detailed description is illustrative and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0016] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0017] Example 1: The function name prediction task aims to automatically recover function names from stripped binary code. This process can be formally defined as: ; in, Let G represent the i-th function extracted from the binary file B of project p, and let G represent the prediction model. yes The actual function name. The model's input is a function entity, containing relevant code, data flow, control flow, and other features. The model's output is a sequence of words. Where Vocabulary is the set of words in the vocabulary, and n is the sequence length. The effectiveness of the model is measured by how closely its output matches the real names.

[0018] Sample Source and Compilation: This example constructs a dataset collected from Mirai malware (a type of malware that launches DDoS attacks by infecting consumer devices). The malware is compiled into versions for different computer architectures (x86, x64, ARM, and MIPS) and different optimization levels (O0, O1, O2, O3).

[0019] Adversari obfuscation: The binary file is obfuscated using Hikari, with four obfuscation options enabled: fake control flow, control flow flattening, instruction substitution, and basic block splitting.

[0020] Data extraction and alignment: The obfuscated binary file is disassembled using Ghidra to obtain obfuscated assembly code. The unobfuscated original binary file is then disassembled using Ghidra to extract the corresponding clean assembly code. Function names are obtained by parsing the unobfuscated binary file using Python's pyelftools library, extracting the original function names from the symbol table. Finally, alignment is performed to obtain a triplet of {obfuscated assembly code, clean assembly code, and actual function name}.

[0021] Deduplication is performed. To prevent the model from memorizing generic library function code or repetitive code snippets instead of learning deobfuscation, strict deduplication is carried out. Fuzzy hashing is used at the function level to remove duplicate and highly similar function instances. This ensures the diversity and generalization requirements of the dataset.

[0022] Noise Removal. Drawing on the quality filtering rules of high-quality code datasets such as CodeSearchNet, functions that are too short (<3 instructions) or too long (>256 instructions) are filtered out, as well as samples containing a large number of unreadable characters, file paths, and other noise unrelated to functional semantics.

[0023] LLM Translator: The existing open-source model Deepseek-Coder-33B-Base is selected as the base model. To avoid the high computational cost and memory overhead of full fine-tuning, Low-Rank Adaptation (LoRA) is used for efficient fine-tuning. LoRA simulates parameter updates by freezing the original parameters of the pre-trained model and injecting additional low-rank matrices only alongside the original dense layers. Specifically, all original parameters of the base model are frozen, and a set of trainable low-rank decomposition matrices are injected in parallel onto the linear transformation matrices of the query, key, value, and output projection layers in the attention layer. Structured prompts are designed to guide the model. The prompt design includes system prompts and user prompts. System prompts include roles, task descriptions, and output formats. Roles define the model's positioning; here, we define it as an assembly language expert. Defining roles for the model helps improve response quality. Task descriptions explain the task, enabling the large model to understand the work to be done. Here, we define the task as "converting obfuscated code into original, unobfuscated, clear assembly code" and specify the output format. User suggestions consist of pairs of obfuscated assembly code and the original, unobfuscated, clean assembly code. Training objective and loss function: This stage employs sequence-to-sequence loss, aiming to predict the output sequence based on the input sequence. Specifically, it calculates the cross-entropy loss only for the "clean assembly code" portion of the model's output, minimizing the output sequence, i.e., the clean assembly code. The negative log probability forces the model to focus on reconstructing a clean output from obfuscated inputs, which is key to learning the core deobfuscation capabilities. To obfuscate the assembly code input sequence. These are trainable low-rank parameters introduced through LoRA.

[0024] (2).

[0025] DESG builder: Utilizing the dominance-enhanced semantic graph representation method proposed by Wang et al., it captures the comprehensive and stable semantics of obfuscated binary functions. The DESG construction process consists of five steps: Step 1: First, decompile the binary function to obtain the control flow graph in the original P-Code. Then, apply the variable node normalization strategy to generate the control flow graph (CFG) of the normalized P-Code function.

[0026] Step 2: Decompose the instruction sequence in each basic block into independent instructions, where nodes represent independent instructions and edges represent relationships between instructions (i.e., data relationships or influence relationships), thereby obtaining an instruction-based semantic graph (ISG).

[0027] Step 3: Decompose the opcode and operands into tags, and refine the relationships between instructions into relationships between tags. For example, in the instruction x86_r_0 = INT_SUB x86_r_0, c_0, the tags x86_r_0 and c_0 are the first and second operands of the opcode tag INT_SUB, respectively, and correspondingly, there is a data relationship between them. Finally, a tag-based semantic graph (TSG) is obtained.

[0028] Step 4: First, create virtual basic block nodes for each basic block. Then, use domination analysis to introduce domination and post-domination relationships between nodes, thereby constructing a semantic graph based on basic blocks (BBSG).

[0029] Step 5: Introduce an inclusion relationship between the opcode markers of the TSG and the virtual base block nodes of the BBSG. A directed edge is established from the virtual base block node to the opcode node if and only if the instruction corresponding to a certain opcode is contained within a specific base block. This ultimately yields the complete DESG.

[0030] The GNN encoder uses a gated graph neural network (GGNN) to learn the semantic information of the DESG. The message passing process is as follows: a node updates its hidden state by aggregating the hidden states of its neighbors and its own state in the previous layer. Let N be the set of all nodes. Represents a node In the Hidden states in a multi-layered GGNN. Nodes The aggregation calculation of the hidden state of the neighbor is shown in formula (3): (3);

[0031] in This represents the set of incoming and outgoing edges of node u. Represents a directed edge ( Edge embedding, This refers to two independent multilayer perceptrons used to process the incoming and outgoing edges, respectively. Subsequently, in the (...) In layer 1, the hidden state of node u is calculated according to formula (4): (4); GRU regulates the information flow through a gating mechanism, filtering noise while preserving key features. Graph pooling: After the message passing layer, the final step is to aggregate all node embeddings into a graph embedding. Softmax is used for pooling, and the calculation formula is shown in formula (5): (5); in The set representing the hidden states of all nodes. This is a parameter called inverse temperature. Multi-head attention is a core technology of the Transformer architecture, allowing each head to learn a different attention distribution. Softmax pooling is combined with multi-head attention to form a stacked, multi-layered Softmax structure. First, k linear layers are used to transform the hidden state. Then ReLU activation and normalization are performed. The calculation formula for each head is shown in formula (6): (6); Where k represents the index of the head. Finally, the outputs of all heads are concatenated and passed through a linear layer to generate the final graph embedding. The calculation formula is: , where t represents the number of heads.

[0032] Function Name Decoder: A Multilayer Perceptron (MLP) is used as the decoder to embed the graph of function semantics. The function name is predicted using the following formula as input: (7); in , and , For weight parameters, For activation function, It is split into individual words after preprocessing. The function name vector. To update the parameters of the MLP model and GNN encoder, minimize the following loss function: (8); in and These represent actual vocabulary and predicted vocabulary, respectively; Vocabulary is the vocabulary list. This is the cross-entropy loss function.

[0033] Implementation: (1) Fine-tuning of the LLM translator. Based on the LLaMa-Factory framework, the parameter optimization is performed using the low-rank adaptation method. The relevant hyperparameters are configured as follows: rank dimension is 8, scaling factor is 32, and dropout rate is set to 0.05. (2) Based on the Ghidra platform and scripts, the binary file and DESG dominance augmented semantic graph are constructed. The GNN graph encoder and function name decoder are constructed using the PyTorch framework. (3) The dataset is divided into training set, validation set and test set in an 8:1:1 ratio.

[0034] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for anti-obfuscated binary function name recovery for malware automatic analysis, characterized in that, Comprising the following steps: S1: training dataset construction: a large number of triple data {obfuscated assembly code, clear assembly code, real function name} are collected from malware; S2: LLM translator fine-tuning: using the {obfuscated assembly code, clear assembly code} pair in step S1, fine-tune a large language model as a code deobfuscation translator, so that it can learn to map obfuscated assembly code to semantically equivalent clear assembly code; S3: semantic encoder: using the clear assembly code in step S1, convert it into a graph structure using the dominance enhanced semantic graph DESG model, and map the DESG to a fixed-dimensional semantic feature vector through a graph neural network encoder GNN; S4: function name decoder joint training: build an end-to-end network, whose input is obfuscated assembly code, which is sequentially passed through the LLM translator and the DESG builder and GNN encoder to obtain a semantic feature vector; input the semantic feature vector into a multi-layer perceptron decoder to output the predicted function name label sequence, and use the {obfuscated assembly code, real function name} data pair in step S1 to minimize the loss between the predicted function name and the real function name. Train and optimize the GNN encoder and function name decoder; S5: automatically restore function name. The binary file is obfuscated, specifically four obfuscation options are enabled: false control flow, control flow flattening, instruction replacement and basic block splitting, and then disassembled using Ghidra to obtain obfuscated assembly code; the clear assembly code corresponds to the unobfuscated version; the function name is obtained by parsing the unobfuscated binary file to extract the original function name from the symbol table to obtain the {obfuscated assembly code, clear assembly code, real function name} triple data.

2. The method of claim 1, wherein, The LLM translator selects a large language model as the base model and uses the LoRA method for fine-tuning, the specific steps are:

3. The method of claim 1, wherein, S21. LoRA updates the original parameters of the pre-trained model by freezing the original parameters and injecting additional low-rank matrices into the original dense layer to simulate parameter updates; S22. Design structured prompts to guide the model: the prompt design includes system prompts and user prompts, the system prompts include roles and task descriptions; the role defines the orientation of the model, which is defined as an assembly language expert; the task description is an explanation of the task, so that the large language model understands the work to be done, defines the task as converting obfuscated code to original unobfuscated clear assembly code, and specifies the output format; the user prompt is composed of an obfuscated assembly code and an original unobfuscated clear assembly code pair. The training target and loss function of the large language model are:

4. The method of claim 1, wherein, The loss function is: According to the input sequence to predict the output sequence, that is, only the cross-entropy loss of the model output part "clear assembly code" is calculated, and the output sequence, that is, the clear assembly code is minimized The negative logarithmic probability of the clear assembly code forces the model to focus on reconstructing the clean output from the confused input, which is the key to learning the anti-confusion core ability. For the confused assembly code input sequence, For the trainable low-rank parameters introduced by LoRA; The construction process of DESG includes: ； is the probability.

5. The method of claim 1, wherein, Step 1: decompile the clear assembly code to obtain the control flow graph in the original P-Code, then apply the variable node normalization strategy to generate the control flow graph CFG of the normalized P-Code function; Step 2: split the instruction sequence in each basic block into independent instructions, where the node represents an independent instruction and the edge represents the relationship between instructions, thus obtaining an instruction-based semantic graph ISG; ​ Step 3: The operation code and the operation number are split into tokens, and the relationship between instructions is refined into the relationship between tokens, and finally the semantic graph TSG based on tokens is obtained; Step 4: A virtual basic block node is created for each basic block, and then the dominance and post-dominance relationships between nodes are introduced by using dominance analysis, thereby constructing the semantic graph BBSG based on basic blocks; Step 5: The inclusion relationship between the operation code token of TSG and the virtual basic block node of BBSG is introduced, and a directed edge is established from the virtual basic block node to the operation code node only when the instruction corresponding to the operation code is included in the specific basic block, and finally the complete DESG is obtained.

6. The method of claim 5, wherein the method further comprises: The semantic information of DESG is learned using the gated graph neural network GGNN, and the message passing process is as follows: The hidden state of each node of the DESG graph is updated by aggregating the hidden states of its neighbor nodes and its own state at the previous layer, denoted as N, the set of all nodes, representing nodes In the first layer GGNN, the hidden state of a node is computed as follows: ； in This represents the set of incoming and outgoing edges of node u. Represents a directed edge Edge embedding, Refers to two independent multilayer perceptrons used to process the incoming and outgoing edges respectively, and then, in the ( In layer 1, the hidden state of node u is calculated using the following formula: ； Where GRU adjusts the information flow through the gating mechanism, filtering noise while retaining key features; Graph pooling: After the message passing layer, the last step is to gather all node embeddings into a graph embedding, and the Softmax is used for pooling operation, and the calculation formula is as follows: ； wherein a set of all node hidden states, is a parameter called inverse temperature.

7. The method of claim 6, wherein the method further comprises: determining whether the function name is in the list of function names; and if the function name is not in the list of function names, then determining whether the function name is in the list of function names of the malware. The Softmax pooling is combined with the multi-head attention to form a stacked multi-layer Softmax structure: First, use k linear layers to transform the hidden state: ； Then, ReLU activation and normalization are performed, and the calculation formula of each head is as follows: ； Finally, the outputs of all heads are concatenated and passed through a linear layer to generate the final graph embedding The calculation formula is: ； Where t represents the number of heads; Function name decoder: Using a multi-layer perceptron (MLP) as a decoder to predict the function name from the graph embedding of the function semantics As input, the function name is predicted by the following equation: ； wherein , and , are weight parameters, is an activation function, is a function name vector split into individual words after preprocessing are the parameters of the updated MLP model, GNN encoder, minimizing the following loss function: ; and represent the true and predicted vocabulary, respectively, Vocab is the vocabulary, is the cross-entropy loss function.

Images