Anti-obfuscation binary function name recovery method for malware automatic analysis

Abstract

The application belongs to the technical field of software security, and particularly relates to an anti-obfuscation binary function name recovery method for automatic analysis of malicious software. First, a triad data set containing obfuscated assembly code, corresponding clear assembly code and real function name is constructed. Then, the data set is used to fine-tune a large language model, so that the large language model has the translation capability of converting obfuscated code into semantically equivalent clear code. Next, the clear assembly code is mapped into a fixed-dimensional semantic feature vector by using an anti-obfuscation graph semantic encoder. Finally, a function name decoder is constructed, and the encoding and decoding parts are jointly trained and optimized by minimizing the loss between the predicted function name and the real function name.

Description

Technical Field

[0001] This application belongs to the field of software security technology, specifically relating to a method for recovering anti-obfuscated binary function names for automatic analysis of malware. Background Technology

[0002] In the field of malware analysis, rapid and accurate functional understanding of symbol-stripped binaries is crucial. Function names are abstract summaries of function semantics; accurately recovering function names can significantly improve the analytical efficiency of security analysts and enhance their ability to respond to advanced threats.

[0003] To circumvent analysis, malware commonly employs binary code obfuscation techniques (such as control flow flattening, instruction substitution, and fake control flow). These techniques severely disrupt the structured characteristics of the code, leading to a significant decrease in the performance of traditional binary analysis methods based on control flow graphs or instruction sequences.

[0004] Currently, the recovery of obfuscated binary function names faces two main challenges: 1. Semantic obfuscation: Obfuscation alters the explicit semantics and logical structure of instructions, making it extremely difficult to infer high-level functional intent directly from low-level assembly code. 2. Feature instability: Instruction-flow-based binary code representation methods rely on Natural Language Processing (NLP) techniques to capture the implicit semantics of the code. However, obfuscation techniques, by replacing simple instructions with complex ones, increase the complexity of the context and the length of the tokens, leading to a decrease in the performance of NLP techniques. Graph-based methods heavily rely on stable control flow graph structures, while obfuscation techniques actively disrupt this structure, resulting in feature "distortion." Therefore, existing methods (such as XFL) often assume that they do not support obfuscation scenarios or only support mild obfuscation scenarios, resulting in low accuracy in function name recovery under real-world obfuscation conditions. Summary of the Invention

[0005] To overcome the shortcomings of existing inventions, this invention provides an anti-obfuscated binary function name recovery method for automated malware analysis. The core concept of this invention is to construct a cascaded learning framework of "translation-encoding-decoding," avoiding the direct guessing of function names from obfuscated code by the model. The technical solution is as follows:

[0006] A method for recovering unobfuscated binary function names for automated malware analysis includes the following steps:

[0007] S1: Training dataset construction: Collect a large amount of triple data from malware {obfuscated assembly code, clean assembly code, real function names};

[0008] S2: LLM Translator Fine-tuning: Using the {obfuscated assembly code, clean assembly code} pair from step S1, fine-tune a large language model as code deobfuscator so that it can learn to map obfuscated assembly code to semantically equivalent clean assembly code;

[0009] S3: Semantic Encoder: Using the clean assembly code from step S1, the dominant augmented semantic graph (DESG) model is used to convert it into a graph structure, and the DESG is mapped into a fixed-dimensional semantic feature vector through a graph neural network encoder (GNN).

[0010] S4: Joint Training of Function Name Decoder: Construct an end-to-end network whose input is obfuscated assembly code, which passes sequentially through an LLM translator, a DESG builder, and a GNN encoder to obtain a semantic feature vector; input the semantic feature vector into a multilayer perceptron decoder to output a sequence of predicted function name labels; using the {obfuscated assembly code, real function name} data pair from step S1, train and optimize the GNN encoder and function name decoder by minimizing the loss between the predicted and real function names;

[0011] S5: Automatic recovery function name.

[0012] Preferably, the binary file is obfuscated, specifically with four obfuscation options enabled: fake control flow, control flow flattening, instruction substitution, and basic block splitting. Then, Ghidra is used for disassembly to obtain obfuscated assembly code. The clear assembly code corresponds to the unobfuscated version. The function names are obtained by parsing the unobfuscated binary file and extracting the original function names from the symbol table to obtain the triple data of {obfuscated assembly code, clear assembly code, and real function name}.

[0013] Preferably, the LLM translator selects a large language model as the base model and uses the low-rank adaptation LoRA method for fine-tuning. The specific steps are as follows:

[0014] S21.LoRA simulates parameter updates by freezing the original parameters of the pre-trained model and injecting only an additional low-rank matrix next to the original dense layer.

[0015] S22. Design structured prompts to guide the model: The prompt design includes two parts: system prompts and user prompts. System prompts include roles and task descriptions. Roles define the model's position, defining it as an assembly language expert. Task descriptions are instructions for the task, enabling the large language model to understand the work that needs to be done. The task is defined as converting obfuscated code into original, unobfuscated, clear assembly code, and the output format is specified. User prompts consist of pairs of obfuscated assembly code and original, unobfuscated, clear assembly code.

[0016] Preferred training objectives and loss functions for large language models:

[0017] Predicting the output sequence based on the input sequence, i.e., calculating the cross-entropy loss only on the "clean assembly code" of the model output, and minimizing the output sequence, i.e., the clean assembly code. The negative log probability forces the model to focus on reconstructing a clean output from the obfuscated input, which is the key to learning the core deobfuscation capability. To obfuscate the assembly code input sequence, Let be the trainable low-rank parameters introduced through LoRA; the loss function is:

[0018] ;

[0019] Let be the probability.

[0020] Preferably, the DESG construction process includes:

[0021] Step 1: Decompile the clear assembly code to obtain the control flow graph in the original P-Code, and then apply the variable node normalization strategy to generate the control flow graph (CFG) of the normalized P-Code function;

[0022] Step 2: Decompose the instruction sequence in each basic block into independent instructions, where nodes represent independent instructions and edges represent relationships between instructions, thereby obtaining the instruction-based semantic graph (ISG).

[0023] Step 3: Decompose the opcode and operand into tags, refine the relationship between instructions into the relationship between tags, and finally obtain the tag-based semantic graph TSG;

[0024] Step 4: Create virtual basic block nodes for each basic block, and then use domination analysis to introduce domination and post-domination relationships between nodes, thereby constructing a semantic graph BBSG based on basic blocks;

[0025] Step 5: Introduce an inclusion relationship between the opcode marker of the TSG and the virtual base block node of the BBSG. If and only if the instruction corresponding to a certain opcode is included in a specific base block, establish a directed edge from the virtual base block node to the opcode node, and finally obtain the complete DESG.

[0026] Preferably, a gated graph neural network (GGNN) is used to learn the semantic information of the DESG. The message passing process is as follows:

[0027] For each node in the DESG graph, its hidden state is updated by aggregating the hidden states of its neighbors and its own state in the previous layer. Let N be the set of all nodes. Represents a node In the Hidden states and nodes in a multi-layered GGNN The aggregation calculation of the hidden states of neighbors is as follows:

[0028] ;

[0029] in This represents the set of incoming and outgoing edges of node u. Represents a directed edge Edge embedding, Refers to two independent multilayer perceptrons used to process the incoming and outgoing edges respectively. Subsequently, in the... In the layer, the hidden state of node u is calculated using the following formula:

[0030] ;

[0031] GRU uses a gating mechanism to regulate the information flow, filtering out noise while preserving key features;

[0032] Graph pooling: After the message passing layer, the final step is to aggregate all node embeddings into a graph embedding, using Softmax for pooling. The calculation formula is as follows:

[0033] ;

[0034] in The set representing the hidden states of all nodes. It is a parameter known as the inverse temperature.

[0035] Preferably, Softmax pooling is combined with multi-head attention to form a stacked, multi-layered Softmax structure:

[0036] First, the hidden state is transformed using k linear layers:

[0037] ;

[0038] Subsequently, ReLU activation and normalization are performed, and the calculation formula for each head is as follows:

[0039] ;

[0040] Finally, the outputs of all the heads are concatenated and passed through a linear layer to generate the final graph embedding. The calculation formula is:

[0041] ;

[0042] Where t represents the number of heads;

[0043] Function Name Decoder: A Multilayer Perceptron (MLP) is used as the decoder to embed the graph of function semantics. The function name is predicted using the following formula as input:

[0044] ;

[0045] in , and , All are weighted parameters. For activation function, It is split into individual words after preprocessing. The function name vector is used to update the parameters of the MLP model and GNN encoder, minimizing the following loss function:

[0046] ;

[0047] and These represent actual vocabulary and predicted vocabulary, respectively; Vocabulary is the vocabulary list. This is the cross-entropy loss function.

[0048] Compared with the prior art, the beneficial effects of this application are as follows:

[0049] Modern malware is often obfuscated, requiring analysts to spend considerable time understanding function functionality. Accurate function name prediction can directly reveal function purpose, significantly shortening the analysis cycle. By identifying sensitive function names, the core functional modules of malware can be quickly located, improving threat response speed. Attached Figure Description

[0050] Figure 1 This is a schematic diagram illustrating dataset construction and LLM fine-tuning in an embodiment of the present invention;

[0051] Figure 2 This is a schematic diagram of the encoder and decoder workflow in an embodiment of the present invention;

[0052] Figure 3 This is a flowchart of the application process. Detailed Implementation

[0053] The present invention will be further described below with reference to the accompanying drawings and embodiments. It should be noted that the following detailed description is illustrative and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0054] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0055] Example 1:

[0056] The function name prediction task aims to automatically recover function names from stripped binary code. This process can be formally defined as:

[0057] ;

[0058] in, Let represent the i-th function extracted from the binary file B of project p, and let G represent the prediction model. yes The actual function name. The model's input is a function entity, containing relevant code, data flow, control flow, and other features. The model's output is a sequence of words. Where Vocabulary is the set of words in the vocabulary, and n is the sequence length. The effectiveness of the model is measured by how closely its output matches the real names.

[0059] Sample Source and Compilation: This example constructs a dataset collected from Mirai malware (a type of malware that launches DDoS attacks by infecting consumer devices). The malware is compiled into versions for different computer architectures (x86, x64, ARM, and MIPS) and different optimization levels (O0, O1, O2, O3).

[0060] Adversari obfuscation: The binary file is obfuscated using Hikari, with four obfuscation options enabled: fake control flow, control flow flattening, instruction substitution, and basic block splitting.

[0061] Data extraction and alignment: The obfuscated binary file is disassembled using Ghidra to obtain obfuscated assembly code. The unobfuscated original binary file is then disassembled using Ghidra to extract the corresponding clean assembly code. Function names are obtained by parsing the unobfuscated binary file using Python's pyelftools library, extracting the original function names from the symbol table. Finally, alignment is performed to obtain a triplet of {obfuscated assembly code, clean assembly code, and actual function name}.

[0062] Deduplication is performed. To prevent the model from memorizing generic library function code or repetitive code snippets instead of learning deobfuscation, strict deduplication is carried out. Fuzzy hashing is used at the function level to remove duplicate and highly similar function instances. This ensures the diversity and generalization requirements of the dataset.

[0063] Noise Removal. Drawing on the quality filtering rules of high-quality code datasets such as CodeSearchNet, functions that are too short (<3 instructions) or too long (>256 instructions) are filtered out, as well as samples containing a large number of unreadable characters, file paths, and other noise unrelated to functional semantics.

[0064] LLM Translator: The existing open-source model Deepseek-Coder-33B-Base is selected as the base model. To avoid the high computational cost and memory overhead of full fine-tuning, Low-Rank Adaptation (LoRA) is used for efficient fine-tuning. LoRA simulates parameter updates by freezing the original parameters of the pre-trained model and injecting additional low-rank matrices only alongside the original dense layers. Specifically, all original parameters of the base model are frozen, and a set of trainable low-rank decomposition matrices are injected in parallel onto the linear transformation matrices of the query, key, value, and output projection layers in the attention layer. Structured prompts are designed to guide the model. The prompt design includes system prompts and user prompts. System prompts include roles, task descriptions, and output formats. Roles define the model's positioning; here, we define it as an assembly language expert. Defining roles for the model helps improve response quality. Task descriptions explain the task, enabling the large model to understand the work to be done. Here, we define the task as "converting obfuscated code into original, unobfuscated, clear assembly code" and specify the output format. User suggestions consist of pairs of obfuscated assembly code and the original, unobfuscated, clean assembly code. Training objective and loss function: This stage employs sequence-to-sequence loss, aiming to predict the output sequence based on the input sequence. Specifically, it calculates the cross-entropy loss only for the "clean assembly code" portion of the model's output, minimizing the output sequence, i.e., the clean assembly code. The negative log probability forces the model to focus on reconstructing a clean output from obfuscated inputs, which is key to learning the core deobfuscation capabilities. To obfuscate the assembly code input sequence. These are trainable low-rank parameters introduced through LoRA.

[0065] (2).

[0066] DESG builder: Utilizing the dominance-enhanced semantic graph representation method proposed by Wang et al., it captures the comprehensive and stable semantics of obfuscated binary functions. The DESG construction process consists of five steps:

[0067] Step 1: First, decompile the binary function to obtain the control flow graph in the original P-Code. Then, apply the variable node normalization strategy to generate the control flow graph (CFG) of the normalized P-Code function.

[0068] Step 2: Decompose the instruction sequence in each basic block into independent instructions, where nodes represent independent instructions and edges represent relationships between instructions (i.e., data relationships or influence relationships), thereby obtaining an instruction-based semantic graph (ISG).

[0069] Step 3: Decompose the opcode and operands into tags, and refine the relationships between instructions into relationships between tags. For example, in the instruction x86_r_0 = INT_SUB x86_r_0, c_0, the tags x86_r_0 and c_0 are the first and second operands of the opcode tag INT_SUB, respectively, and correspondingly, there is a data relationship between them. Finally, a tag-based semantic graph (TSG) is obtained.

[0070] Step 4: First, create virtual basic block nodes for each basic block. Then, use domination analysis to introduce domination and post-domination relationships between nodes, thereby constructing a semantic graph based on basic blocks (BBSG).

[0071] Step 5: Introduce an inclusion relationship between the opcode markers of the TSG and the virtual base block nodes of the BBSG. A directed edge is established from the virtual base block node to the opcode node if and only if the instruction corresponding to a certain opcode is contained within a specific base block. This ultimately yields the complete DESG.

[0072] The GNN encoder uses a gated graph neural network (GGNN) to learn the semantic information of the DESG. The message passing process is as follows: a node updates its hidden state by aggregating the hidden states of its neighbors and its own state in the previous layer. Let N be the set of all nodes. Represents a node In the Hidden states in a multi-layered GGNN. Nodes The aggregation calculation of the hidden state of the neighbor is shown in formula (3):

[0073] (3);

[0074] in This represents the set of incoming and outgoing edges of node u. Represents a directed edge ( Edge embedding, This refers to two independent multilayer perceptrons used to process the incoming and outgoing edges, respectively. Subsequently, in the (...) In layer 1, the hidden state of node u is calculated according to formula (4):

[0075] (4);

[0076] GRU regulates the information flow through a gating mechanism, filtering noise while preserving key features. Graph pooling: After the message passing layer, the final step is to aggregate all node embeddings into a graph embedding. Softmax is used for pooling, and the calculation formula is shown in formula (5):

[0077] (5);

[0078] in The set representing the hidden states of all nodes. This is a parameter called inverse temperature. Multi-head attention is a core technology of the Transformer architecture, allowing each head to learn a different attention distribution. Softmax pooling is combined with multi-head attention to form a stacked, multi-layered Softmax structure. First, k linear layers are used to transform the hidden state. Then ReLU activation and normalization are performed. The calculation formula for each head is shown in formula (6):

[0079] (6);

[0080] Where k represents the index of the head. Finally, the outputs of all heads are concatenated and passed through a linear layer to generate the final graph embedding. The calculation formula is: , where t represents the number of heads.

[0081] Function Name Decoder: A Multilayer Perceptron (MLP) is used as the decoder to embed the graph of function semantics. The function name is predicted using the following formula as input:

[0082] (7);

[0083] in , and , For weight parameters, For activation function, It is split into individual words after preprocessing. The function name vector. To update the parameters of the MLP model and GNN encoder, minimize the following loss function:

[0084] (8);

[0085] in and These represent actual vocabulary and predicted vocabulary, respectively; Vocabulary is the vocabulary list. This is the cross-entropy loss function.

[0086] Implementation: (1) Fine-tuning of the LLM translator. Based on the LLaMa-Factory framework, the parameter optimization is performed using the low-rank adaptation method. The relevant hyperparameters are configured as follows: rank dimension is 8, scaling factor is 32, and dropout rate is set to 0.05. (2) Based on the Ghidra platform and scripts, the binary file and DESG dominance augmented semantic graph are constructed. The GNN graph encoder and function name decoder are constructed using the PyTorch framework. (3) The dataset is divided into training set, validation set and test set in an 8:1:1 ratio.

[0087] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for recovering unobfuscated binary function names for automatic malware analysis, characterized in that, Includes the following steps: S1: Training dataset construction: Collect a large amount of triple data from malware {obfuscated assembly code, clean assembly code, real function names}; S2: LLM Translator Fine-tuning: Using the {obfuscated assembly code, clean assembly code} pair from step S1, fine-tune a large language model as code deobfuscator so that it can learn to map obfuscated assembly code to semantically equivalent clean assembly code; S3: Semantic Encoder: Using the clean assembly code from step S1, the dominant augmented semantic graph (DESG) model is converted into a graph structure, and the DESG is mapped into a fixed-dimensional semantic feature vector through a graph neural network encoder (GNN). S4: Joint Training of Function Name Decoder: Construct an end-to-end network whose input is obfuscated assembly code, which is then passed sequentially through an LLM translator, a DESG builder, and a GNN encoder to obtain semantic feature vectors; The semantic feature vector is input into a multilayer perceptron decoder, which outputs a sequence of predicted function name tags. Using the {obfuscated assembly code, real function name} data pair from step S1, the GNN encoder and function name decoder are trained and optimized by minimizing the loss between the predicted function name and the real function name. S5: Automatic recovery function name.

2. The method for recovering anti-obfuscated binary function names for automatic malware analysis according to claim 1, characterized in that, The binary file is obfuscated using four obfuscation options: fake control flow, control flow flattening, instruction substitution, and basic block splitting. Ghidra is then used for disassembly to obtain obfuscated assembly code. The clean assembly code corresponds to the unobfuscated version. Function names are obtained by parsing the unobfuscated binary file and extracting the original function names from the symbol table to obtain a triplet of {obfuscated assembly code, clean assembly code, real function name}.

3. The method for recovering anti-obfuscated binary function names for automatic malware analysis according to claim 1, characterized in that, The LLM translator selects a large language model as its base model and uses the low-rank adaptation LoRA method for fine-tuning. The specific steps are as follows: S21.LoRA simulates parameter updates by freezing the original parameters of the pre-trained model and injecting only an additional low-rank matrix next to the original dense layer. S22. Design structured prompts to guide the model: The prompt design includes two parts: system prompts and user prompts. System prompts include roles and task descriptions. Roles define the model's position, defining it as an assembly language expert. Task descriptions are instructions for the task, enabling the large language model to understand the work that needs to be done. The task is defined as converting obfuscated code into original, unobfuscated, clear assembly code, and the output format is specified. User prompts consist of pairs of obfuscated assembly code and original, unobfuscated, clear assembly code.

4. The method for recovering anti-obfuscated binary function names for automatic malware analysis according to claim 1, characterized in that, Training objectives and loss functions for large language models: Predicting the output sequence based on the input sequence, i.e., calculating the cross-entropy loss only on the "clean assembly code" of the model output, and minimizing the output sequence, i.e., the clean assembly code. The negative log probability forces the model to focus on reconstructing a clean output from the obfuscated input, which is the key to learning the core deobfuscation capability. To obfuscate the assembly code input sequence, These are trainable low-rank parameters introduced through LoRA; The loss function is: ； Let be the probability.

5. The method for recovering anti-obfuscated binary function names for automatic malware analysis according to claim 1, characterized in that, The DESG construction process includes: Step 1: Decompile the clear assembly code to obtain the control flow graph in the original P-Code, and then apply the variable node normalization strategy to generate the control flow graph (CFG) of the normalized P-Code function; Step 2: Decompose the instruction sequence in each basic block into independent instructions, where nodes represent independent instructions and edges represent relationships between instructions, thereby obtaining the instruction-based semantic graph (ISG). Step 3: Decompose the opcode and operand into tags, refine the relationship between instructions into the relationship between tags, and finally obtain the tag-based semantic graph TSG; Step 4: Create virtual basic block nodes for each basic block, and then use domination analysis to introduce domination and post-domination relationships between nodes, thereby constructing a semantic graph BBSG based on basic blocks; Step 5: Introduce an inclusion relationship between the opcode marker of the TSG and the virtual base block node of the BBSG. If and only if the instruction corresponding to a certain opcode is included in a specific base block, establish a directed edge from the virtual base block node to the opcode node, and finally obtain the complete DESG.

6. The method for recovering anti-obfuscated binary function names for automatic malware analysis according to claim 5, characterized in that, The semantic information of DESG is learned using a gated graph neural network (GGNN). The message passing process is as follows: For each node in the DESG graph, its hidden state is updated by aggregating the hidden states of its neighbors and its own state in the previous layer. Let N be the set of all nodes. Represents a node In the Hidden states and nodes in a multi-layered GGNN The aggregation calculation of the hidden states of neighbors is as follows: ； in This represents the set of incoming and outgoing edges of node u. Represents a directed edge Edge embedding, Refers to two independent multilayer perceptrons used to process the incoming and outgoing edges respectively, and then, in the ( In layer 1, the hidden state of node u is calculated using the following formula: ； GRU uses a gating mechanism to regulate the information flow, filtering out noise while preserving key features; Graph pooling: After the message passing layer, the final step is to aggregate all node embeddings into a graph embedding, using Softmax for pooling. The calculation formula is as follows: ； in The set representing the hidden states of all nodes. It is a parameter known as the inverse temperature.

7. The method for recovering anti-obfuscated binary function names for automatic malware analysis according to claim 6, characterized in that, By combining Softmax pooling with multi-head attention, a stacked, multi-layered Softmax structure is formed: First, the hidden state is transformed using k linear layers: ； Subsequently, ReLU activation and normalization are performed, and the calculation formula for each head is as follows: ； Finally, the outputs of all the heads are concatenated and passed through a linear layer to generate the final graph embedding. The calculation formula is: ； Where t represents the number of heads; Function Name Decoder: A Multilayer Perceptron (MLP) is used as the decoder to embed the graph of function semantics. The function name is predicted using the following formula as input: ； in , and , All are weighted parameters. For activation function, It is split into individual words after preprocessing. The function name vector is used to update the parameters of the MLP model and GNN encoder, minimizing the following loss function: ; and These represent actual vocabulary and predicted vocabulary, respectively; Vocabulary is the vocabulary list. This is the cross-entropy loss function.

Images