Software security detection method and system based on deep learning model

Abstract

The invention relates to the technical field of software security detection, in particular to a software security detection method and system based on a deep learning model. The method comprises the following steps: extracting an instruction sequence from a runnable unit of software to be detected, and converting the instruction sequence into a structured input sample; rebuilding a reachable jump path by using the structured input sample, segmenting the reachable jump path into execution fragments, transmitting the execution fragments to a preset deep learning model, and generating a risk judgment result by using the deep learning model; performing confidence coefficient calculation on the risk judgment result, applying disturbance to judge the stability of the risk judgment result, and when the confidence coefficient is higher than a preset threshold value, outputting a safety level according to the formed risk judgment result; according to the method, the reachable jump path is constructed for the software instruction sequence, and deep learning model analysis is combined, so that accurate evaluation and security level judgment of the software operation risk are realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software security detection, and particularly relates to a software security detection method and system based on a deep learning model. BACKGROUND

[0002] The security detection method often has a detection blind area and a high false alarm rate when facing dynamic execution paths and hidden vulnerabilities. In the prior art, most security detection methods mainly rely on static analysis or symbolic execution, and perform vulnerability scanning by analyzing source code or binary instructions, but it is difficult to accurately capture abnormal jumps, logical deviations and security threats that occur in the actual running process of software. The prior art lacks effective path modeling and feature aggregation methods when processing large-scale software instruction sequences, resulting in limitations in overall risk assessment of complex execution flows. Deep learning technology has strong capabilities in pattern recognition and sequence modeling, and provides a new direction for software security detection. A technical scheme for structurally analyzing and aggregating features of software execution paths, while evaluating risk stability and credibility, is implemented to accurately assess the security state of software. SUMMARY

[0003] Therefore, it is necessary to provide a software security detection method and system based on a deep learning model to solve at least one of the above technical problems.

[0004] To achieve the above-mentioned purpose, a software security detection method and system based on a deep learning model includes the following steps: Step S1: extracting an instruction sequence from a runnable unit of software to be detected, and converting the instruction sequence into a structured input sample; Step S2: reconstructing a reachable jump path using the structured input sample, dividing the reachable jump path into execution segments, and transmitting the execution segments to a preset deep learning model to generate a risk judgment result using the deep learning model; Step S3: performing confidence calculation on the risk judgment result, and applying perturbation to judge the stability of the risk judgment result, when the confidence is higher than a preset threshold, outputting a security level according to the formed risk judgment result; Step S4: when the confidence is lower than the preset threshold, marking the structured input sample as a high-risk level and entering an explanation analysis process; in the explanation analysis process, marking a key segment according to the position of the execution segment in the path and the response degree of the deep learning model, and reconstructing a risk path according to the marking order.

[0005] The present application also provides a software security detection system based on a deep learning model for executing the software security detection method based on a deep learning model as described above. The software security detection system based on a deep learning model includes: An instruction sequence extraction module is configured to extract an instruction sequence from a runnable unit of the software to be detected and convert the instruction sequence into a structured input sample; A risk judgment module is configured to reconstruct an accessible jump path using the structured input sample, divide the accessible jump path into execution segments, and transmit the execution segments to a preset deep learning model, and generate a risk judgment result using the deep learning model; A confidence calculation module is configured to perform confidence calculation on the risk judgment result, and apply perturbation to judge the stability of the risk judgment result, and when the confidence is higher than a preset threshold, output a security level according to the formed risk judgment result; A security level output module is configured to, when the confidence is lower than the preset threshold, mark the structured input sample as a high-risk level and enter an explanation and analysis process; in the explanation and analysis process, mark key segments according to the positions of the execution segments in the path and the response degrees of the deep learning model, and reconstruct a risk path according to the marking order.

[0006] The present application has the beneficial effects that: by extracting an instruction sequence from a runnable unit of the software to be detected and converting the instruction sequence into a structured input sample, the fine analysis of the internal execution logic of the software is realized, and the software execution path can be systematically modeled while maintaining the integrity of the instruction sequence and the feature layout. By reconstructing the accessible jump path and dividing the path into execution segments, and combining the deep learning model to perform feature aggregation and risk judgment on each execution segment, the present application can capture potential abnormal control flow behaviors and logical defects in the software, thereby realizing more accurate security evaluation. At the same time, confidence calculation and perturbation analysis are introduced in the risk judgment process to simulate and verify the slight changes of the input features, effectively evaluate the stability of the risk judgment result, and reduce the misjudgment risk caused by the contingency of the single model output. When the confidence is higher than the preset threshold, a reliable security level can be directly output, improving the detection efficiency; when the confidence is lower than the threshold, further enter the explanation and analysis process, mark key segments according to the positions of the execution segments in the path and the model response values, and reconstruct the risk path, providing clear basis for the tracing and positioning of software security events. BRIEF DESCRIPTION OF DRAWINGS

[0007] Fig. 1 FIG. 1 is a schematic flowchart of the steps of a software security detection method based on a deep learning model; Fig. 2 FIG. 3 is a schematic diagram of a feature aggregation process; Fig. 3 FIG. 4 is a schematic flowchart of a confidence evaluation process; The implementation, functional characteristics and advantages of the present application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0008] The technical method of the present application will be described clearly and completely below in conjunction with the drawings. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0009] In addition, the drawings are only schematic illustrations of the present application and are not necessarily drawn to scale. Identical reference numerals in the drawings represent identical or similar parts, and thus repeated descriptions thereof will be omitted. Some of the block diagrams shown in the drawings are functional entities, which do not necessarily have to correspond to physically or logically independent entities. The functional entities can be implemented in the form of software, or in one or more hardware modules or integrated circuits, or in different network and / or processor methods and / or microcontroller methods.

[0010] It should be understood that although the terms "first", "second" and the like can be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another. For example, without departing from the scope of the exemplary embodiments, a first element can be referred to as a second element, and similarly a second element can be referred to as a first element. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0011] To achieve the above-mentioned purpose, please refer to Figs. 1 to 3 A software security detection method based on a deep learning model, comprising the following steps: Step S1: extracting an instruction sequence from a runnable unit of the software to be detected, and converting the instruction sequence into a structured input sample; Step S2: reconstructing an accessible jump path using the structured input sample, cutting the accessible jump path into execution fragments, and transmitting the execution fragments to a preset deep learning model to generate a risk judgment result using the deep learning model; Step S3: performing confidence calculation on the risk judgment result, and applying disturbance to judge the stability of the risk judgment result, when the confidence is higher than a preset threshold, outputting a security level according to the formed risk judgment result; Step S4: when the confidence is lower than the preset threshold, marking the structured input sample as a high-risk level and entering an explanation analysis process; in the explanation analysis process, marking key fragments according to the position of the execution fragments in the path and the response degree of the deep learning model, and reconstructing a risk path according to the marking order.

[0012] In an embodiment, when performing static extraction on the software to be detected, the executable units (such as function bodies, loop blocks, and exception handling blocks) thereof are parsed one by one, and a linear scan is performed on each executable unit to sequentially record instruction operation codes, register read-write fields, and immediate numbers to form an initial instruction sequence. In order to maintain the analyzability of the instructions, instruction position numbers are added during the scanning process, and the control dependency relationship of the instructions is represented in the form of a binary tuple. Subsequently, a preset sequence reconstruction tool is used to construct reachable jump paths according to the jump targets and conditional judgment information among all the instructions. Taking a typical business processing module as an example, the length of the path obtained after reconstruction is about 340 instructions, and according to the actual jump density in the path, the path is divided into execution segments containing 8 to 12 instructions, and a total of 31 execution segments are formed. After each segment is encoded into a vector form according to a predetermined structure, it is written into a model input buffer, input into a deep learning model in batches with a batch size of 16, and a segment-level response value is generated in the forward inference stage of the model. The model output includes a risk label and an original score, and the score range is 0 to 1.

[0013] Subsequently, the preliminary risk result is extracted from the model output, and the confidence is calculated in a Softmax normalization manner. A disturbance amount of ±0.03 is applied to the segments with a relatively concentrated score distribution to recalculate the response value, so as to verify the stability of the risk judgment. When the confidence of a certain segment remains above 0.85 after multiple disturbances, the overall risk level corresponding to the segment is written into a detection result file. For segments with low confidence, the position of the segment in the input sample is explicitly labeled, and the segment enters an explanation and analysis process. In the explanation and analysis, according to the numbering order of the segments in the original path and the activation amplitude of the segments in the feature mapping layer of the model, the segments with an activation amplitude exceeding a threshold value are sorted in size, and the top five segments are taken as key segments. The risk path is spliced again based on the instruction connection relationship between the key segments, so that the reconstructed path can directly reflect the smallest control flow unit triggering the risk judgment.

[0014] When detecting the application, the binary code thereof is disassembled into an intermediate representation form, and about 520 executable instructions are extracted therefrom. The instructions are numbered one by one, and a control flow relationship matrix is constructed in combination with the jump labels thereof. The reachable jump paths are reconstructed using the branch exit records in the matrix, and 7 main paths are obtained, of which the longest one contains 402 instructions. The 40 execution segments are formed by dividing according to a fixed segment length of 10 instructions. Each segment is structured into a structured vector, including opcode embedding, register usage vector, and local jump pattern coding, and the vectors are input into a deep learning model in batches for forward inference. The risk score and the corresponding confidence value of each execution segment are included in the model output. Taking the application as an example, the confidence of most segments falls between 0.65 and 0.92.

[0015] The segments with confidence less than 0.8 are verified by perturbation, and the perturbation is adding no more than random perturbation to the register usage field in the input structured vector, and observing the difference between the risk score after re-inference and the original score. If the score fluctuation still exceeds 0.1 after multiple perturbations, the segment is marked as an unstable region and written into the initial queue of the explanation analysis process. In the explanation analysis, the response peaks of the segments in the intermediate layers (such as the 3rd convolution mapping layer) of the model are calculated, and the segments with the highest peaks are extracted as key segments. Then, the key segments are rearranged according to their original order in the path, and the control instructions between adjacent key segments are supplemented to obtain a reconstructed risk path. The path can accurately indicate the risk judgment trigger chain, such as a combination of three types of key segments including abnormal stack modification, out-of-bound jump, and encryption parameter abnormality.

[0016] It should be noted that, referring to Fig. 3 , the instruction sequence of the software code is extracted and structured, which is converted into analyzable data. Then, the path reconstruction and model analysis stage is entered, the running path is constructed, and the deep learning model is used for feature learning and aggregated analysis of the paths, so as to generate a preliminary risk judgment. The confidence evaluation link is introduced, and the evaluation result directs the process to two branches. If the confidence is high, the safety level is directly output; if the confidence is low, the diagnostic cycle is started, and the explanation analysis, key segment marking and risk path reconstruction are performed in turn to locate the root cause of the uncertain or high-risk judgment, and output the high-risk level and explanation.

[0017] Preferably, step S2 comprises: constructing a control flow graph from the structured input sample; performing traversal along the control flow graph to reconstruct the reachable jump paths in the connected relationship of the traversal; cutting the reachable jump paths into execution segments, and assigning a unique serial number and corresponding record to each execution segment; inputting all execution segments into the deep learning model in sequence according to the reachable jump paths, performing feature aggregation of the execution segments, and obtaining the feature aggregation result; after the aggregation is completed, the feature aggregation results are fused in a weighted manner, and the overall risk judgment result is output.

[0018] In an embodiment, a control flow graph is constructed according to the instruction opcode, control dependency field and jump target number in the structured input sample. The control flow graph adopts an adjacency list-based representation, each node corresponding to an instruction unit and recording the jump condition and landing point of its outgoing edge. In a typical business logic module, about 360 nodes are parsed in total, including 42 unconditional jump nodes, 57 conditional jump nodes and the rest sequential execution nodes. After the control flow graph is constructed, a depth-first traversal is performed starting from the entry node, recording the connectivity from the current node to the next node in the traversal process to form a path stack. After the traversal is completed, 6 reachable jump paths are reconstructed, the longest path containing about 310 instruction nodes. Subsequently, the paths are divided into execution segments according to a fixed length of 12 instructions, each segment is assigned a sequential number and the corresponding path number and starting position in the path are recorded. To ensure input order consistency, the segments of the same path are sequentially transmitted into the deep learning model according to their sequential numbers. The model internally includes three layers of feature aggregation structures, each layer performing fusion on the local control flow pattern, register pattern and instruction type pattern of the current segment to generate an intermediate aggregated representation. In a specific example, after the aggregation of all segments is completed, the feature aggregation result output by the model has a dimension of 256. These results are matched with the corresponding weighting coefficients according to the segment sequential number, and a segment-by-segment fusion is performed to obtain the overall risk judgment result of the path, which is written into the detection process record file.

[0019] In another embodiment, about 510 instructions in the structured input sample are parsed, and a control flow graph is constructed according to the jump directions thereof. The control flow graph is represented in a matrix form, and a 510x510 Boolean matrix is used to mark the reachability relationship between nodes, while the condition type on the jump edge is recorded. Based on the matrix, starting from the software entry point, all reachable nodes are unfolded in turn using a breadth-first traversal strategy, and the parent node and jump type of the current node are recorded each time during the traversal process, so that the complete reachable jump path can be generated by backtracking. In this example, 9 paths are obtained, and the average path length is about 220 instruction nodes. After obtaining the path set, each path is divided into execution segments according to 10 instructions. Each segment is written into a record containing three items when it is generated: segment number, path number belonging to, and offset in the path. All segments are sent into the deep learning model in path order to perform feature aggregation. The model uses an improved double-channel aggregation structure, which respectively performs aggregation on the local control flow sequence and the operator sequence, and splices at the end of the aggregation layer. In a specific running instance, each segment outputs a 128-dimensional aggregation vector. After all segments are aggregated, the segment aggregation vectors are weighted according to a preset weight table. The weight corresponds to the actual position of the segment in the path, for example, the weight of the segment near the end of the path is slightly higher. After weighted fusion, the risk value of a single path is obtained. The risk value is written into the result cache area and used in the subsequent risk level evaluation process.

[0020] Preferably, constructing a control flow graph for the structured input sample comprises: reading instructions from the structured input sample, and assigning a continuous position identifier to each instruction; using each instruction and position identifier as a graph node, and forming a linear node chain in the order of position identifier; on the linear node chain, sequentially establishing a sequential execution control edge between two adjacent instructions; on the linear node chain, for instructions containing a jump target, parsing the address of the jump target and converting it into a target position identifier, and generating a jump control edge between the current instruction node and the node of the target position identifier; constructing a control flow graph using the sequential execution control edge and the jump control edge.

[0021] In one embodiment, about 430 instruction records are parsed from the structured input sample when performing control flow graph construction on the structured input sample, each record containing an opcode field, a jump flag field, and a corresponding parameter segment. Each instruction is assigned an incremental position number in the parsing order, from 1 to 430, forming a continuous position sequence. Subsequently, each instruction is established as a graph node indexed by the position number and written into a node table, realizing the basic registration of the node. After the node table is established, adjacent nodes are sequentially connected in ascending order of position number. For example, a sequential control relationship is established between node (i) and node (i+1) and written into a sequential control edge table. In this embodiment, a total of 429 sequential control edges are generated to describe the default linear execution path of the sample. Then, the jump flag field of each instruction is parsed, of which 28 instructions carry explicit jump targets. The original addresses of these jump targets are mapped into internal position indexes, for example, jump address 0x004052F0 is mapped to position number 317, and a jump control edge is generated between the current instruction node and the node numbered 317. After the sequential control edges and the jump control edges are generated, the control flow graph is constructed based on the node table, the sequential edge table, and the jump edge table. The control flow graph adopts a hierarchical adjacency list structure, which not only preserves the logical order of the linear execution chain but also explicitly records all jump branches, providing complete control relationship data for subsequent path reconstruction.

[0022] In another embodiment, about 520 instruction items are extracted from the structured input sample. Each instruction is assigned an independent incremental number in accordance with the appearance order in the sample, and the instruction content (including operation type, immediate number, register operand, and branch flag) is written into a node buffer area. The node buffer area is arranged continuously by number and can be directly used as the index basis for subsequent graph node construction. In order to form the basic execution chain, each node is sequentially connected with the node of the next number. In this embodiment, the number of sequential edges is 519. Subsequently, the nodes with jump information in the node buffer area are scanned, including 19 conditional jumps, 11 unconditional jumps, and 7 function call type jumps. The jump target addresses carried by them are converted into internal numbers according to fixed address mapping rules. For example, jump address 0x080013C4 is mapped to internal number 204, and a jump control edge is written between the current node number 128 and number 204. After the jump edge generation is completed, the control flow graph is constructed in a matrix storage mode. The control flow graph records the connectivity between nodes in a 520x520 sparse matrix, where the sequential control edges are marked as type 1 and the jump control edges are marked as type 2. This matrix can be used as a direct query basis in subsequent execution path search, and whether any two nodes have a control association can be judged in a single query, realizing efficient reachable path calculation.

[0023] Preferably, for the instruction containing the jump target, the address of the jump target is parsed and converted into a target position identifier, and a jump control edge is generated between the current instruction node and the node of the target position identifier, including: scanning the instructions in the linear node chain, and when detecting that the instruction contains a jump target, extracting the target address in the instruction; locating the target position identifier corresponding to the target address, and retrieving the target graph node corresponding to the target position identifier; generating a jump control edge between the current instruction node and the target graph node; when multiple jump targets are contained in the same instruction, querying the target position identifier corresponding to each target address, and generating multiple jump control edges in turn.

[0024] In an embodiment, when performing jump relationship parsing on the linear node chain, all 392 instructions in the node chain are scanned one by one. Among them, there are 33 instructions with explicit jump fields, including conditional jump instructions, unconditional jump instructions, and back jump instructions in loop structures. For any detected jump instruction, the target address is extracted from the operation parameter segment thereof, for example, the target address 0x00406A18. Then, through an internal address mapping table, the target address is converted into the corresponding position number, which is number 247 in this embodiment. The node reference of number 247 is retrieved in the node table, and is taken as the target graph node. A jump control edge is written between the current instruction node and the target graph node, and is recorded in the jump edge table. For some composite jump instructions (for example, conditional jumps carrying true branch and false branch addresses), two target addresses can be parsed, which are mapped into position numbers 152 and 381, respectively. In such cases, two jump control edges are written in accordance with the number order, respectively, and the corresponding branch type is marked in the edge table, so as to distinguish different execution flows in subsequent path traversal. After processing, a total of 41 jump control edges are generated in this embodiment, covering all instruction nodes containing jump targets.

[0025] In another embodiment, the structured input sample is parsed to form a total of 460 consecutive nodes. The jump resolution module is initiated to perform a linear scan of the entire node chain. In the scan, 29 jump instructions are identified, including 17 conditional jumps, 8 unconditional jumps, and 4 table-driven jumps. For each jump instruction, the target address field is read from its parsed structure, such as target address 0x080012F0, and mapped to an internal location number using a uniform address normalization rule. In this embodiment, the address is mapped to location number 189. Upon locating the number 189, the node information corresponding to the number is read from the node index table, and a jump edge is created between the current node and the target node. If a table-driven jump instruction contains multiple jump addresses, such as three branch addresses 0x080010AC, 0x08001120, 0x08001184, they are mapped to numbers 103, 121, 146, respectively, and three jump edges are established in sequence. For each jump edge, the source node, target node, and corresponding jump sequence number are registered in the edge cache to support subsequent reachability search.

[0026] Preferably, the traversal is performed along the control flow graph, and the reachable jump paths are reconstructed from the connected relationships of the traversal, including: starting from an entry node in the control flow graph as the starting point of the traversal, and sequentially visiting adjacent nodes; in the visiting process, when an unvisited node is detected, the location identifier corresponding to the node is recorded in the current path record, and the node is marked as visited in the node attribute; when all adjacent nodes of the current node have completed the visit, the previous node is traced back according to the arrangement order of the nodes in the control flow graph; when the traversal path is traced back from any branch to the entry node, the consecutive location identifier sequence in the current traversal path record is saved as a location identifier sequence set; when all nodes in the control flow graph have completed the traversal, the reachable jump paths are reconstructed according to the saved location identifier sequence set.

[0027] In an embodiment, the entry node in the control flow graph is taken as the starting point of traversal, and all directly connected adjacent nodes thereof are accessed in turn. In the process of access, every time an unvisited node is encountered, the continuous position identifier of the node is read and added to the current path record, and the node attribute is marked as visited. When all adjacent nodes of the current node have completed access, the previous node of the node is traced back, and the adjacent nodes of the previous node that have not been visited are continuously accessed. For the branch structure encountered, each branch is subjected to depth-first traversal according to the above method until the entry node is traced back. Every time the traversal from any branch is traced back to the entry node, the continuous position identifier sequence in the current path record is saved into the position identifier sequence set. After all nodes in the control flow graph have completed traversal, the complete reachable jump path is reconstructed according to the saved multiple position identifier sequence sets, and the path data structure for subsequent execution segment splitting and deep learning model input is formed.

[0028] In another embodiment, the entry node in the control flow graph is numbered, and all adjacent nodes of the node are accessed in order. In the process of access, for each node, if the node attribute is marked as “unvisited”, the position identifier thereof is appended to the current path record, and the node attribute is marked as visited. In the process of traversal, a backtracking strategy is adopted: when all adjacent nodes of the node have been accessed, the previous node is rolled back according to the order of definition of the nodes in the graph, and the untraversed adjacent nodes thereof are continuously accessed. For the case of multiple branches, independent path records are executed for each branch, and the path is saved as a position identifier sequence set after completion. After all nodes in the control flow graph have completed traversal, all position identifier sequence sets are integrated to generate a reachable jump path set, and each path in the set includes a continuous position identifier sequence, which provides complete path information for subsequent execution segment splitting and model input.

[0029] Preferably, all execution segments are sequentially input into the deep learning model according to the reachable jump path, and the execution segment features are aggregated to obtain a feature aggregation result, which includes: According to the reachable jump path, the input sequence position of each execution segment in the path is determined, and an input index is established according to the input sequence position; Each execution segment is sequentially transmitted to the input end of the deep learning model according to the input index; In the deep learning model, the instruction features in a single execution segment are aggregated to generate a corresponding segment-level feature representation; After the segment-level feature is generated, inter-segment feature aggregation is performed according to the input sequence position, and the segment-level features of adjacent execution segments are sequentially fused in order; When the execution segment completes the feature aggregation, the feature aggregation result obtained by sequentially fusing the segment-level features is output.

[0030] In an embodiment, the order position of each execution segment in the path is determined according to the reconstructed reachable jump path, and a unique input index is assigned to each execution segment. Then, the instruction sequence of each execution segment and the corresponding position index are sequentially transmitted to the input end of the deep learning model. Inside the model, the opcode, register operation, and jump information of each instruction in a single execution segment are extracted as features, and weighted summation and normalization processing are performed within the segment to generate a segment-level feature representation. After the completion of segment-level feature generation, the segment-level features of adjacent execution segments are sequentially fused in the order of the reachable jump path to form a segment-level feature aggregation sequence. After all execution segments are aggregated, the feature aggregation result formed by the sequential fusion of segment-level features is output, which contains the instruction feature distribution information on the entire reachable jump path and can be used for subsequent risk judgment analysis.

[0031] In another embodiment, based on the reconstructed jump path, the execution segments on the path are numbered as E1…Em, and an input index table is established to ensure that each segment enters the deep learning model in order. For each execution segment, the instruction operation type, target address, operand length, and jump relationship are first encoded to generate an instruction feature matrix within the segment. After inputting the instruction feature matrix into the model, the segment-level feature vector is calculated through intra-segment convolution and pooling operations. Then, according to the input index table, the segment-level feature vectors are gradually fused in the order of the path, with the fusion method being weighted summation and normalization processing to ensure that the inter-segment features maintain the relevance of the path order during aggregation. After all segments complete feature aggregation, the model outputs a vector containing the fusion result of all segment features on the entire jump path, which can be directly used for subsequent risk judgment or confidence analysis.

[0032] It should be noted that, referring to Fig. 2 , the segment-level feature representation (dashed line) representing the information of a single segment is low in intensity and constant, while the inter-segment feature aggregation result (solid line) obtained by sequentially fusing adjacent segment features according to the path order is significantly higher in intensity and stable. The feature aggregation method successfully integrates scattered segment information to form a whole path feature representation.

[0033] Preferably, after aggregation is completed, the feature aggregation result is fused in a weighted manner, and the overall risk judgment result is output, including: For the set of segment-level features contained in the feature aggregation result, a bottom-up hierarchy is established according to the layer-by-layer calculation order of the deep learning model; Control coefficients are established in the aggregation structure for step-by-step transmission, and the weight distribution coefficients within each layer are determined according to the control coefficients; The independent weighting coefficients corresponding to the fusion of segment-level features of each segment within the same layer; After completing the single-layer fusion, the fusion result of the layer and the cross-layer weight corresponding to the control coefficient are matched as the input weight of the next layer; According to the input weight, each layer is driven to perform fusion, and after the fusion of the highest layer is completed, the fusion result of the highest layer is used to generate the overall risk judgment result.

[0034] In an embodiment, after completing feature aggregation, a weighted fusion manner is used to generate the overall risk judgment result. Specifically, for the segment-level feature set obtained after feature aggregation, a corresponding hierarchical sequence is established from bottom to top according to the layer-by-layer calculation relationship of the deep learning model, so that the segment-level features can participate in subsequent weight distribution and fusion processing according to the established structure order. Subsequently, in the established hierarchical structure, control coefficients for cross-layer transmission are set for each layer, and the weight distribution within each layer is determined based on the control coefficients, so that the segments in the same layer correspond to independent weighting coefficients respectively when performing fusion. After completing the fusion processing of a single layer, the fusion result of the layer and the cross-layer weight corresponding to the control coefficient are matched, so as to be used as the input weight of the next layer for guiding the fusion order and fusion strength of the subsequent hierarchical layers. According to the above input weight, each layer is driven to perform fusion operation in turn, and after the fusion of the highest layer is completed, the fusion result of the highest layer is used as the basis of the overall risk judgment result.

[0035] In another embodiment, for the segment-level feature set after feature aggregation, weighted fusion processing can be realized through another hierarchical mapping manner. Specifically, when establishing the hierarchical sequence, the segment-level features can be divided into preset structure layers according to their time sequence association or semantic association, so that the sequence relationship from near to far is formed between the structure layers. Based on the sequence relationship, cross-layer control factors are configured for each structure layer, and the weight difference between features is determined within the structure layer through the control factors, so that the segment features in the same structure layer use the weighting coefficient matched with their association degree when performing fusion. During the fusion process, the weighted merging can be performed within the structure layer first to obtain the summary features of the structure layer. Subsequently, the summary features and the cross-layer weight corresponding to the control factor are combined, so as to be used as the input basis of the upper structure. After the weighted fusion of each layer is completed in turn, the fusion output of the uppermost structure is used as the overall risk judgment result, realizing the hierarchical mapping of the aggregated features to the judgment result.

[0036] Preferably, step S3 comprises: After obtaining the risk judgment result output by the deep learning model, the corresponding confidence is calculated according to the output layer response value of the deep learning model; In the state of keeping the input sample structure unchanged, limited disturbance is applied to the feature value to obtain the risk judgment result after disturbance; The risk judgment results before and after disturbance are compared to calculate the difference ratio to represent the stability of the judgment result; When the confidence is higher than a preset threshold, a security level is output according to the formed risk judgment result.

[0037] In an embodiment, after the deep learning model completes the execution of the segment feature aggregation and outputs the risk judgment result, the response value of the output layer is read and normalized into a confidence value according to the probability. Subsequently, while keeping the instruction sequence and structure of the input sample unchanged, the opcode feature and jump information of each instruction are selected as the perturbation object, and a ±5% amplitude change is applied to the value to simulate the slight fluctuation of the input feature. The perturbed input sample is re-input into the deep learning model to obtain the risk judgment result after perturbation. Then, the risk judgment results before and after perturbation are compared element by element, the difference ratio is calculated, and the ratio is compared with the preset stability reference threshold to represent the judgment stability of the model under the current input. When the confidence is higher than the preset threshold 0.8 and the difference ratio is lower than the reference range, the security level of the software is output according to the formed risk judgment result.

[0038] In another embodiment, the output vector of the entire reachable jump path of the deep learning model is read, and the confidence value is calculated based on the maximum activation value of the output vector. While keeping the input sample structure unchanged, a Gaussian perturbation with limited amplitude (mean value 0, standard deviation 0.02) is applied to the feature vector of each execution segment to simulate slight feature drift. The perturbed execution segment sequence is input into the model again to obtain the risk judgment result after perturbation, and the cosine similarity or absolute difference of the output vectors before and after perturbation is calculated to quantify the stability of the judgment result. By comparing the confidence value and the stability index, if the confidence exceeds the set threshold 0.85 and the stability index is within the allowed range, the risk level judged by the model is directly output, otherwise the subsequent explanation and analysis process is entered.

[0039] Preferably, while keeping the input sample structure unchanged, limited perturbation is applied to the feature value to obtain the risk judgment result after perturbation, including: The input feature value is selected as the perturbation object while keeping the overall instruction sequence and feature layout of the input sample unchanged; The selected feature value is subjected to a limited amplitude change, and the input fluctuation is simulated; The perturbed input sample is re-input into the deep learning model for inference to obtain the corresponding risk judgment result; The correspondence between the perturbation type, perturbation amplitude and corresponding risk judgment result is recorded.

[0040] In an embodiment, the opcode vector and the jump target offset of each instruction are selected as the perturbation objects while keeping the input sample's instruction sequence and structure layout unchanged. Linear changes with an amplitude limit of ±5% are applied to the selected feature values to simulate slight fluctuations in instruction features. The perturbed instruction sequence is re-input into the input end of the deep learning model for inference to generate the corresponding risk judgment result. Subsequently, the perturbation type (linear offset), perturbation amplitude (percentage change), and the corresponding risk judgment result are recorded in a log file for subsequent analysis of the sensitivity and stability of the judgment result.

[0041] In another embodiment, the reachable jump paths and execution segment sequences of the input sample are kept unchanged, and for the feature vector of each execution segment, Gaussian noise with a mean of 0 and a standard deviation of 0.02 is used for perturbation to simulate slight fluctuations at the input end. The perturbed execution segment sequence is sequentially input into the deep learning model to obtain the perturbed risk judgment output. The perturbation type (Gaussian noise), amplitude (standard deviation value), and the corresponding risk judgment result after perturbation are recorded for subsequent confidence and stability analysis to determine the model's response to slight changes in input features.

[0042] Especially important is to compare the risk judgment results before and after perturbation, calculate the difference ratio to represent the stability of the judgment result, including: The risk judgment results before and after perturbation of the same input sample are read and output; The difference ratio is calculated according to the numerical difference between the two results; The difference ratio is compared with the preset stability reference range to determine the stability of the judgment result; When the difference ratio approaches or exceeds the reference range, the stability state information corresponding to the input sample is recorded.

[0043] In an embodiment, for the same input sample, the risk judgment result output value generated before perturbation and the risk judgment result output value generated after perturbation are read. The difference ratio is calculated by dividing the absolute difference of the output values by the output value before perturbation. The difference ratios of all execution segments are summarized and compared with the pre-set stability reference range (such as 0-10%). When the difference ratio of a certain input sample approaches or exceeds the reference range, its stability state is marked as "high sensitivity" in the sample record for subsequent further analysis or processing of the input sample.

[0044] In another embodiment, the risk judgment results before and after the disturbance are read independently for each execution segment, the numerical difference proportion is calculated segment by segment, and the average difference proportion of the entire reachable jump path is generated. The average difference proportion is compared with a preset threshold value (such as 15%), and the stability degree of the overall path risk judgment is judged. If the average difference proportion exceeds the threshold value, the stability state information corresponding to the input sample is recorded as “unstable”, and the difference proportion, the execution segment number involved and the corresponding risk judgment result are saved in the log for subsequent explanation and analysis and risk path reconstruction.

[0045] Especially important is that step S4 comprises: When the confidence is lower than the preset threshold value or the stability exceeds the limited range, the structured input sample is determined as a high risk level; The input sample determined as the high risk level is input into an explanation and analysis process; In the explanation and analysis process, the model response values corresponding to each execution segment are obtained according to the positions of the execution segments in the reachable jump path; The influence order of the execution segments in the risk judgment is determined according to the sizes of the model response values; The reachable jump path is reconstructed according to the influence order of the execution segments, and a risk path of the risk propagation relationship is formed.

[0046] In an embodiment, when the confidence of the input sample is lower than the preset threshold value or the difference proportion before and after the disturbance exceeds the limited range, the structured input sample is marked as a high risk level. Subsequently, the high risk level sample is transmitted into an explanation and analysis process. In the explanation and analysis process, the corresponding deep learning model output response values are read according to the serial order of each execution segment in the reachable jump path. According to the response value size, the execution segments are sorted from high to low according to the contribution to the overall risk judgment, and a segment influence order table is generated. Then, according to the order, each execution segment in the reachable jump path is connected in turn to form a risk propagation path, and the flow direction and key nodes of the risk in the software execution path are clarified.

[0047] In another embodiment, it is assumed that the high risk sample to be analyzed contains 50 execution segments, the model response values are obtained according to the position indexes of each execution segment in the path, and the response values are normalized. Then, the response values are arranged from large to small, and the top 20% of the segments are marked as key segments. When reconstructing the risk path, the key segments are connected in the original path order in turn, and the remaining segments are attached in the path order to form a complete risk path structure. In the path structure, the serial number, the original response value and the normalized response value of each segment are recorded at the same time for subsequent analysis and risk propagation visualization.

[0048] The application further provides a software security detection system based on a deep learning model, which is used for executing the software security detection method based on the deep learning model. An instruction sequence extraction module is configured to extract an instruction sequence from a runnable unit of the software to be detected and convert the instruction sequence into a structured input sample; A risk judgment module is configured to reconstruct an accessible jump path by using the structured input sample, cut the accessible jump path into execution segments, and transmit the execution segments to a preset deep learning model, and generate a risk judgment result by using the deep learning model; A confidence calculation module is configured to perform confidence calculation on the risk judgment result, and apply a disturbance to judge the stability of the risk judgment result, and when the confidence is higher than a preset threshold, output a security level according to the formed risk judgment result; A security level output module is configured to, when the confidence is lower than the preset threshold, mark the structured input sample as a high-risk level and enter an explanation analysis process; in the explanation analysis process, mark a key segment according to the position of the execution segment in the path and the response degree of the deep learning model, and reconstruct a risk path according to the marking order.

[0049] The above is only a specific embodiment of the application, which enables those skilled in the art to understand or implement the application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the application. Therefore, the application will not be limited to these embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A software security detection method based on a deep learning model, characterized in that, Includes the following steps: Step S1: Extract instruction sequences from the executable units of the software to be tested, and convert the instruction sequences into structured input samples; Step S2: Reconstruct reachable jump paths using structured input samples, segment the reachable jump paths into execution segments, and transmit the execution segments to a preset deep learning model to generate risk assessment results using the deep learning model; Step S3: Calculate the confidence level of the risk assessment result and apply a perturbation to assess the stability of the risk assessment result. When the confidence level is higher than the preset threshold, output the safety level based on the formed risk assessment result. Step S4: When the confidence level is lower than the preset threshold, the structured input sample is marked as high-risk and enters the interpretation and analysis process; In the interpretation and analysis process, key segments are marked according to their position in the path and the response level of the deep learning model, and the risk path is reconstructed according to the marking order.

2. The software security detection method based on a deep learning model according to claim 1, characterized in that, Step S2 includes: Construct a control flow graph from structured input samples; Perform a traversal along the control flow graph and reconstruct reachable jump paths based on the connectivity relationships of the traversal; The reachable jump path is divided into execution segments, and each execution segment is assigned a unique sequence number and corresponding record; All execution fragments are sequentially input into the deep learning model according to the reachable jump path, and the execution fragment features are aggregated to obtain the feature aggregation result; After aggregation is completed, the feature aggregation results are combined in a weighted manner, and the overall risk assessment result is output.

3. The software security detection method based on a deep learning model according to claim 2, characterized in that, Constructing a control flow graph from structured input samples includes: Read instructions from structured input samples and assign consecutive positional identifiers to each instruction; Each instruction and its location identifier is used as a graph node, and a linear chain of nodes is formed in the order of the location identifiers. On a linear node chain, sequential execution control edges are established between two adjacent instructions. On a linear node chain, for instructions containing a jump target, the address of the jump target is parsed and converted into a target location identifier, and a jump control edge is generated between the current instruction node and the node with the target location identifier. Construct a control flow graph using sequential execution control edges and jump control edges.

4. The software security detection method based on a deep learning model according to claim 3, characterized in that, On a linear node chain, for instructions containing a jump target, the address of the jump target is parsed and converted into a target location identifier. A jump control edge is generated between the current instruction node and the node containing the target location identifier, including: Scan the instructions in the linear node chain, and when an instruction is found to contain a jump target, extract the target address from the instruction; Locate the target location identifier corresponding to the target address, and retrieve the target graph node corresponding to the target location identifier; Generate a jump control edge between the current instruction node and the target graph node; When the same instruction contains multiple jump targets, query the target location identifier corresponding to each target address and generate multiple jump control edges in sequence.

5. The software security detection method based on a deep learning model according to claim 2, characterized in that, Perform a traversal along the control flow graph and reconstruct reachable jump paths based on the connectivity relationships of the traversal, including: Starting from the entry node in the control flow graph, visit adjacent nodes in sequence. During the access process, when an unvisited node is detected, the location identifier corresponding to the node is recorded in the current path record, and the node is marked as visited in the node attributes. If all adjacent nodes of the current node have been visited, backtrack to the previous node according to the order of the nodes in the control flow graph; When the traversal path backtracks from any branch to the entry node, the continuous sequence of position identifiers in the current traversal path record is saved as a set of position identifier sequences; Once all nodes in the control flow graph have been traversed, the reachable jump path is reconstructed based on the saved set of position identifier sequences.

6. The software security detection method based on a deep learning model according to claim 2, characterized in that, All execution fragments are sequentially input into the deep learning model according to the reachable jump path, and the execution fragment features are aggregated to obtain... Feature aggregation results include: Based on the reachable jump path, determine the position of the input sequence in the path for each execution segment, and build an input index according to the position of the input sequence; Each execution segment is sequentially transmitted to the input end of the deep learning model according to its input index; Within a deep learning model, instruction features in a single execution segment are aggregated to generate corresponding segment-level feature representations. After the fragment-level features are generated, feature aggregation between fragments is performed based on the position of the input sequence, and the fragment-level features of adjacent execution fragments are fused sequentially. After the fragment completes feature aggregation, the output is the feature aggregation result of the fragment-level features fused sequentially.

7. The software security detection method based on a deep learning model according to claim 2, characterized in that, After aggregation, the feature aggregation results are combined in a weighted manner, and the overall risk assessment result is output, including: For the fragment-level feature set contained in the feature aggregation result, a bottom-up hierarchy is established according to the layer-by-layer calculation order of the deep learning model; Establish control coefficients that are passed down level by level in the aggregate structure, and determine the weight distribution coefficients within each layer based on the control coefficients; The independent weighting coefficients corresponding to the fragment-level features of each fragment within the same layer during fusion; After completing the single-layer fusion, the fusion result of that layer and the cross-layer weights corresponding to the control coefficients are matched and used as the input weights for the next layer. The fusion process is driven by the input weights of each layer. After the fusion of the highest layer is completed, the overall risk assessment result is generated based on the fusion result of the highest layer.

8. The software security detection method based on a deep learning model according to claim 1, characterized in that, Step S3 includes: After obtaining the risk assessment results output by the deep learning model, the corresponding confidence level is calculated based on the response value of the output layer of the deep learning model; While keeping the input sample structure unchanged, a finite perturbation is applied to the feature values ​​to obtain the perturbation risk assessment result; The risk assessment results before and after the disturbance are compared, and the difference ratio is calculated to characterize the stability of the assessment results; When the confidence level is higher than the preset threshold, the safety level is output based on the risk assessment result.

9. The software security detection method based on a deep learning model according to claim 8, characterized in that, While keeping the input sample structure unchanged, applying a finite perturbation to the feature values ​​yields the following risk assessment results after perturbation: While keeping the overall instruction sequence and feature layout of the input sample unchanged, the input feature value is selected as the perturbation object; Apply a limited variation to the selected feature value and simulate fluctuations at the input. The perturbated input samples are re-input into the deep learning model for inference to obtain the corresponding risk assessment results. Record the correspondence between the type and magnitude of disturbances and the corresponding risk assessment results.

10. A software security detection system based on a deep learning model, characterized in that, For performing the software security detection method based on a deep learning model as described in claim 1, the software security detection system based on a deep learning model includes: The instruction sequence extraction module is used to extract instruction sequences from the executable units of the software to be tested and convert the instruction sequences into structured input samples. The risk assessment module is used to reconstruct reachable jump paths using structured input samples, divide the reachable jump paths into execution segments, and transmit the execution segments to a preset deep learning model to generate risk assessment results. The confidence calculation module is used to calculate the confidence level of the risk assessment result and apply perturbation to assess the stability of the risk assessment result. When the confidence level is higher than the preset threshold, the security level is output based on the formed risk assessment result. The security level output module is used to mark structured input samples as high-risk and enter the interpretation and analysis process when the confidence level is lower than a preset threshold. In the interpretation and analysis process, key segments are marked according to the position of the execution segment in the path and the response degree of the deep learning model, and the risk path is reconstructed according to the marking order.

Images