Cross-architecture binary code similarity detection method based on multi-modal characteristic distillation

Abstract

The invention belongs to the field of binary program analysis, particularly relates to a cross-architecture binary code similarity detection method based on multi-modal characteristic distillation, and aims to efficiently realize binary code similarity detection. The method comprises the following steps: for an input binary code, respectively extracting a structured feature, a semantic feature and a statistical feature of the binary code; and constructing and training a teacher model, mapping the structured features, the semantic features and the statistical features to the same feature space, and performing fusion through a cross-modal attention mechanism to obtain teacher model fusion features. And a lightweight student model is constructed. And converting the two binary codes to be compared into corresponding student feature vectors by utilizing the trained student model, calculating the similarity between the two student feature vectors, and judging the semantic similarity of the two binary codes under the cross-architecture according to the similarity.

Description

Technical Field

[0001] This invention relates to the field of binary program analysis, and more particularly to a cross-architecture binary code similarity detection method based on multimodal feature distillation. Background Technology

[0002] With the large-scale deployment of the power Internet of Things, smart terminals, and embedded devices, binary code similarity detection technology is playing an increasingly crucial role in firmware security analysis, vulnerability reproduction, patch verification, and malicious code tracing. However, real-world applications widely employ various heterogeneous processor instruction set architectures, such as ARM, MIPS, x86, and RISC-V. These different architectures have fundamental differences in instruction syntax, register architecture, addressing modes, and compiler optimization strategies, resulting in highly inconsistent binary representations of the same source code across architectures. This "semantic gap" makes it difficult for traditional similarity detection methods based on fixed byte patterns, local instruction sequences, or single control flow features to reliably capture deep semantic consistency in code under cross-architecture conditions, severely limiting detection accuracy.

[0003] To address these challenges, deep learning-based binary code analysis methods have made significant progress in recent years. Some studies have attempted to learn code representations using methods such as control flow graphs, data flow graphs, or long sequence instruction embeddings. Although these methods can achieve high matching accuracy within specific architectures, they still face inherent limitations when dealing with cross-architecture scenarios: First, different architectures exhibit systematic differences in control flow organization, basic block partitioning, and instruction combination patterns, making it difficult for models based on a single graph structure to learn robust cross-platform representations; second, while the semantics of assembly instructions are equivalent across architectures, their surface syntax and expression are highly fragmented, making it difficult for methods based on instruction sequences or local semantic embeddings to achieve effective cross-architecture semantic alignment; finally, most existing methods rely only on one type of feature modality in structure, semantics, or statistics, lacking the complementarity and synergy of multi-dimensional information, resulting in insufficient robustness of the models to compilation optimization, code obfuscation, and architectural differences.

[0004] To address the issue of single-feature limitations, existing research has begun exploring the fusion of multiple feature classes (such as combining control flow graphs and instruction semantics simultaneously) to more comprehensively characterize binary code. However, current methods typically lack an effective mechanism to unify the feature spaces of different modalities, leading to the potential formation of independent or conflicting feature subspaces during independent training of each modality. On the one hand, different modalities may encode a large amount of redundant information; on the other hand, inconsistencies in abstraction levels and representation granularities between modalities may cause semantic conflicts, impairing the stability and generalization ability of the fusion model. Furthermore, directly constructing complex multimodal fusion models often involves a large number of parameters and high computational costs, making it difficult to meet the urgent needs for detection efficiency and scalability in large-scale, cross-architecture binary analysis tasks. Summary of the Invention

[0005] The purpose of this invention is to provide a cross-architecture binary code similarity detection method based on multimodal feature distillation, which aims to efficiently achieve binary code similarity detection.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: This invention provides a cross-architecture binary code similarity detection method based on multimodal feature distillation, comprising: S1: For the input binary code, extracting structural features, semantic features, and statistical features respectively; the structural features are graph structure representations that integrate control flow information and data flow information; the semantic features include vector representations obtained from the instruction sequence of the binary code and vector representations obtained from the functional description of the binary code; the statistical features are vector representations reflecting the compositional distribution of the binary code; S2: Constructing and training a teacher model, mapping the structural features, semantic features, and statistical features to the same feature space, and fusing them through a cross-modal attention mechanism to obtain the teacher model fused features; simultaneously, utilizing cross-architecture homologous binary... The teacher model is optimized through comparative learning of code pairs, enabling it to achieve high cohesion of fused features for semantically similar binary codes across architectures. S3: A lightweight student model is constructed, with input consisting only of instruction sequence-based vector representations from structured and semantic features. By minimizing the difference between the student model's output feature vector and the teacher model's fused features for the same binary code, the student model learns the teacher model's cross-architecture semantic alignment capability. S4: Using the trained student model, the two binary codes to be compared are converted into corresponding student feature vectors, and the similarity between the two student feature vectors is calculated. The semantic similarity of the two binary codes across architectures is determined based on the similarity.

[0007] In step S1, structured features are extracted, including: disassembling the binary code to construct a control flow graph of the binary code, with basic blocks as nodes and control transfer relationships as edges; analyzing the instruction sequence obtained from the disassembly to construct an instruction-level data flow graph, and aggregating the data dependencies between instructions to the basic blocks to which the instructions belong, generating a basic block-level data dependency attention matrix; weightedly fusing the adjacency matrix of the control flow graph with the data dependency attention matrix to obtain an enhanced structured graph representation; and using a graph neural network to process the enhanced structured graph representation to generate a vector representation of the structured features.

[0008] In the data dependency attention matrix, the values ​​of the matrix elements are obtained by normalizing the number of all instruction-level data dependency edges connecting the two basic blocks.

[0009] In step S1, semantic features are extracted, including: using a pre-trained natural language processing model to encode each disassembled instruction of the binary code to obtain an instruction-level embedding vector, and performing a pooling operation on all instruction-level embedding vectors to obtain an instruction sequence vector representation; using a large language model to generate natural language text describing the function of the binary code based on the disassembled instruction sequence of the binary code, and encoding the natural language text to obtain a function description vector representation; and fusing the instruction sequence vector representation and the function description vector representation to generate the final semantic feature vector representation.

[0010] Statistical features include vectorized representations of at least one of the following: the distribution of instruction types in binary code, the number of basic blocks contained in binary code, and the degree distribution of nodes in the control flow graph of binary code.

[0011] In step S2, the comparative learning of cross-architecture homogeneous binary code pairs is used, including: taking two binary codes obtained by compiling the same source code under different instruction set architectures as positive sample pairs; during the training process, a comparative learning loss function is constructed, which is used to narrow the distance between the two teacher model fused feature vectors output by the teacher model for the positive sample pairs, while widening the distance between the teacher model fused feature vector and the teacher model fused feature vector output by the negative sample pairs.

[0012] In step S3, the difference between the student feature vector and the teacher model fused features is minimized, specifically by jointly optimizing the following two losses: the first loss is the feature distance loss between the student feature vector and the teacher model fused features; the second loss is the distribution difference loss between the sample similarity distribution calculated based on the student feature vector and the sample similarity distribution calculated based on the teacher model fused features.

[0013] The first loss term uses the mean squared error loss, and the second loss term uses the KL divergence loss.

[0014] In step S4, cosine similarity is used to calculate the similarity between the two student feature vectors.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. This application provides a cross-architecture binary code similarity detection method based on multimodal feature distillation. By constructing a multimodal feature system of structured features, semantic features, and statistical features, it achieves cross-level and multi-dimensional code information capture. Structured features fuse the control flow graph adjacency matrix and the basic block-level data dependency attention matrix, and enhance the discriminative power of structural representation through graph neural networks, effectively offsetting interference caused by differences in control flow composition and instruction partitioning across different architectures. Semantic features adopt a two-layer modeling approach of instruction sequence encoding and functional description encoding, preserving low-level semantic information at the instruction level while supplementing high-level semantics through functional descriptions generated by a large language model, solving the fragmentation problem of large differences in instruction syntax but semantic equivalence across architectures. Statistical features, as an auxiliary modality, further supplement code composition distribution information, reducing the impact of compilation optimization and obfuscation techniques on the detection results. Simultaneously, the teacher model, through comparative learning of cross-architecture source code pairs, forces semantically similar code feature vectors across architectures to maintain high cohesion, significantly improving the accuracy of semantic matching in cross-architecture scenarios and effectively overcoming the bottleneck of limited detection accuracy in traditional single-modal methods.

[0016] 2. To address the issues of existing multimodal fusion methods lacking a unified semantic alignment mechanism and easily generating feature redundancy and conflicts, this invention designs a technical solution combining unified feature space mapping with cross-modal attention fusion. A trainable weight matrix maps features from three modalities to the same feature space, fundamentally eliminating inconsistencies in abstraction levels and representation methods among different modalities. The cross-modal attention mechanism adaptively mines complementary information between modalities, filters effective features, suppresses redundant information, and avoids different modalities repeatedly encoding the same semantics or generating semantic conflicts. Furthermore, this invention achieves a balance between performance and efficiency through a teacher-student distillation framework. The student model retains only structured features and instruction sequence semantic features, discarding the high-cost functional description generation and encoding stages, significantly reducing model parameters and inference time. This meets the deployment requirements of resource-constrained scenarios such as embedded terminals and power IoT devices. The distillation process, through joint optimization of feature distance loss and distribution difference loss, enables the student model to not only approximate the teacher model in terms of individual sample features but also inherit the teacher model's cross-sample semantic relationship cognition ability, ensuring lightweight design without sacrificing detection performance. Attached Figure Description

[0017] Figure 1 This is a flowchart of a cross-architecture binary code similarity detection method based on multimodal feature distillation provided in an embodiment of this application. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0019] For example, such as Figure 1 As shown, this application provides a cross-architecture binary code similarity detection method based on multimodal feature distillation, including: S1: For the input binary code, extract the structural features, semantic features and statistical features of the binary code respectively.

[0020] Among them, the structural features are graph structure representations that integrate control flow information and data flow information; the semantic features include vector representations obtained from instruction sequences based on binary code and vector representations obtained from functional descriptions based on binary code; and the statistical features are vector representations that reflect the distribution of binary code composition.

[0021] In step S1, structured features are extracted, including: disassembling binary code, such as binary files or function fragments, restoring basic block partitioning and control transfer relationships, and constructing a control flow graph (CFG) of the binary code, with basic blocks as nodes and control transfer relationships as edges; subsequently, data dependency analysis is performed on the disassembled instructions, analyzing the instruction sequence obtained from the disassembly, constructing an instruction-level data flow graph (DFG), and aggregating the data dependencies between instructions to the basic blocks to which the instructions belong, generating a basic block-level data dependency attention matrix; the adjacency matrix of the control flow graph and the data dependency attention matrix are weighted and fused to obtain an enhanced structured graph representation; and a graph neural network is used to process the enhanced structured graph representation to generate a vector representation of the structured features.

[0022] For example, in the data dependency attention matrix, the value of the matrix element is obtained by normalizing the number of all instruction-level data dependency edges connecting the two basic blocks.

[0023] More specifically, in step S1, the binary function fragment is first disassembled to identify the set of basic blocks inside the function. And the control transfer relationships between basic blocks, thereby constructing the CFG diagram: in For the set of basic block nodes, To control the transfer edges, nodes in the control flow graph correspond to basic blocks, and edges correspond to control flow transfers between basic blocks. Subsequently, data dependency analysis is performed on the disassembled instruction sequence to identify the definition and usage relationships between instructions regarding operands such as registers and memory addresses, thereby constructing an instruction-level data flow graph (DFG). The instruction-level data flow graph uses instructions as nodes and the definition-usage dependencies between instructions regarding registers or memory variables as edges. in For the set of instruction nodes, edges This section defines registers and memory variables and uses dependencies.

[0024] Next, the dependencies in the instruction-level dataflow graph are aggregated to the basic block level to generate a data dependency attention matrix. Specifically, for each instruction-level data dependency edge connecting two different basic blocks, a dependency count is accumulated between the two associated basic blocks. Subsequently, the dependency count corresponding to each basic block is normalized to obtain the data dependency attention coefficients between that basic block and other basic blocks. All coefficients together constitute the data dependency attention matrix. For example, for each data dependency edge... If its instructions are located in basic blocks and The dependency count at the basic block level is as follows: For example, the normalized data-dependent attention coefficients are shown below: in This is a very small constant to avoid division by zero. The next step is to perform a weighted fusion operation, which will control the adjacency matrix of the flow graph. With data-dependent attention matrix This combination yields an enhanced structured graph representation. This fusion process, while fully preserving the original control flow topology, introduces semantic constraints provided by data dependencies, enabling the enhanced structured graph representation to simultaneously encode both the program's control logic and data logic. The input representation forming the structural features is as follows: Where λ is a regularization parameter used to control the balance between control flow dependencies and data flow dependencies.

[0025] Finally, the enhanced structured graph representation is fed into a graph neural network, such as the Graph Attention Network (GAT), for processing. This graph neural network learns deep features of nodes and edges in the graph and outputs a fixed-dimensional, vectorized structured feature representation. This is used for subsequent multimodal fusion and model training.

[0026] In step S1, semantic features are extracted, including: using a pre-trained natural language processing model to encode each disassembled instruction of the binary code to obtain an instruction-level embedding vector, and performing a pooling operation on all instruction-level embedding vectors to obtain an instruction sequence vector representation; using a large language model to generate natural language text describing the function of the binary code based on the disassembled instruction sequence of the binary code, and encoding the natural language text to obtain a function description vector representation; and fusing the instruction sequence vector representation and the function description vector representation to generate the final semantic feature vector representation.

[0027] More specifically, for semantic feature extraction, the first step is to perform semantic encoding of the instruction sequence. This involves using a pre-trained natural language processing model, such as the DistilBERT model, to encode each instruction obtained after disassembling the binary function. It is transformed into a fixed-dimensional vector representation, called an instruction-level embedding vector.

[0028] For example, each instruction The result can be represented as a fixed-dimensional vector as follows: in, This represents the dimension of the vector space. It is the first Vector representation of instructions.

[0029] Subsequently, by performing pooling operations, such as average pooling, on the instruction-level embedding vectors of all instructions within the function, the overall vector representation of the instruction sequence is obtained, which is simply called the instruction sequence vector representation. The instruction sequence vector representation comprehensively reflects the low-level semantic information of the function at the instruction level.

[0030] For example, the formula is as follows: Where Pool represents pooling operation. It is a vector representation of all instructions in the function.

[0031] Next, the disassembled instruction sequence of the binary function is used as input, and a natural language text describing the overall functionality of the function is generated using a Large Language Model (LLM). This natural language text is then encoded using a natural language processing model, transforming it into a vector representation called the Function Description Vector Representation. The Function Description Vector Representation characterizes the semantics of the program at a high-level functional abstraction level.

[0032] Taking Arduino code snippets as an example, the model can generate program function description text such as "This function computes checksum...". The DistilBERT model encodes the text to generate corresponding function description vector representations. Where T represents the text described in natural language.

[0033] Finally, a semantic feature fusion operation is performed to represent the overall vector of the instruction sequence obtained above. Functional description vector representation The fusion can be performed, for example, through vector concatenation operations and a learnable weighting matrix. The fused features are integrated and their dimensionality reduced to generate a final, unified semantic feature vector representation. This semantic feature vector simultaneously encapsulates the underlying instruction semantics and the upper-level behavioral functional descriptions of the program, constituting the semantic modality in a multimodal feature system. For example, in, This represents a vector concatenation operation. It is a learned weighted matrix used to combine instruction features and natural language features.

[0034] As one possible implementation, the statistical features in step S1 include a vectorized representation of at least one of the following information: the instruction type distribution of the binary code, the number of basic blocks contained in the binary code, and the degree distribution of nodes in the control flow graph of the binary code.

[0035] The instruction type distribution of binary code refers to the distribution of different types of instructions (such as arithmetic, logical, and jump instructions) in a program. The number of basic blocks in binary code refers to the number of basic blocks in a program, reflecting the control flow complexity. The degree distribution of nodes in the control flow graph of binary code refers to analyzing the CFG graph and calculating the in-degree and out-degree distribution of each basic block.

[0036] By processing the above statistical characteristics, the final statistical characteristic representation is obtained: in, For the input statistics, This is a function used to generate statistical feature representations.

[0037] S2: Construct and train a teacher model, map structured features, semantic features and statistical features to the same feature space, and fuse them through a cross-modal attention mechanism to obtain teacher model fused features; at the same time, optimize the teacher model by using comparative learning of cross-architecture homologous binary code pairs, so that the teacher model fused features have high cohesion for cross-architecture semantically similar binary codes.

[0038] For example, structured features, semantic features, and statistical features can be mapped to the same feature space using a learnable weight matrix: in, , , is a trainable weight matrix.

[0039] This application embodiment employs a cross-modal attention mechanism for fusion. Through a multi-head attention mechanism, combined with structured features, semantic features, and statistical features, the output representation of the teacher layer is obtained, which is the teacher model fusion feature: For example, in step S2, the comparative learning of cross-architecture homogeneous binary code pairs includes: using two binary codes compiled from the same source code under different instruction set architectures as positive sample pairs; during the training process, constructing a comparative learning loss function, which is used to narrow the distance between the two teacher model fused feature vectors output by the teacher model for the positive sample pairs, while widening the distance between the teacher model fused feature vector and the teacher model fused feature vector output by the negative sample pairs.

[0040] For example, the formula for the contrastive learning loss function is as follows: in, It is the representation of the current function in architecture A. It is the representation of homologous functions in architecture B. For negative samples, For temperature coefficient, For vector similarity, Used to calculate two vectors The similarity between them.

[0041] S3: Construct a lightweight student model whose input consists only of instruction sequence-based vector representations of structured and semantic features; by minimizing the difference between the student feature vectors output by the student model and the teacher model's fused features output by the teacher model for the same binary code, the student model learns the teacher model's cross-architecture semantic alignment capability.

[0042] In step S3, the difference between the student feature vector and the teacher model fused features is minimized, specifically by jointly optimizing the following two losses: the first loss is the feature distance loss between the student feature vector and the teacher model fused features; the second loss is the distribution difference loss between the sample similarity distribution calculated based on the student feature vector and the sample similarity distribution calculated based on the teacher model fused features.

[0043] The first loss term uses the mean squared error loss, and the second loss term uses the KL divergence loss.

[0044] For example, the output of the student model is The output of the teacher model is To make the student model as close as possible to the feature representation of the teacher model, thereby minimizing the difference between the student feature vector and the fused features of the teacher model, the feature distillation loss is defined as the square of the Euclidean distance between the student model features and the teacher model features, which is also the first loss term: To further convey the knowledge of the teacher model's global similarity distribution, this application employs a soft-label distillation method. Specifically, it first calculates the similarity distribution of the teacher model. Similarity distribution between the student model and the model : in The temperature coefficient is used to adjust the smoothness of the distribution; the similarity distribution of the student model. for: The difference between the two methods is measured by the Kullback–Leibler (KL) divergence: This loss ensures that the student model not only approximates the teacher model in terms of individual sample features, but also maintains the relative semantic relationships across samples, thereby enhancing cross-architecture consistency. The embodiments of this application combine feature distillation loss, semantic preservation loss, and contrastive learning loss. The integration forms the final training objective: in, , , The weighting coefficients for different loss terms can be adjusted according to the actual task requirements. By optimizing this objective function, the student model can learn the cross-architecture semantic knowledge of the teacher model while maintaining efficient inference, achieving a balance between lightweight design and high performance.

[0045] S4: Using the trained student model, convert the two binary codes to be compared into corresponding student feature vectors, calculate the similarity between the two student feature vectors, and judge the semantic similarity of the two binary codes across architectures based on the similarity.

[0046] As one possible implementation, in step S4, cosine similarity is used to calculate the similarity between the two student feature vectors.

[0047] After completing the distillation training process for the teacher and student models, the cross-architecture similarity detection phase begins. This phase utilizes a fully trained lightweight student model to achieve efficient and accurate binary code semantic similarity comparison.

[0048] During the inference phase, for any input binary code to be detected, its structural features and instruction sequence semantic features (i.e., the instruction sequence-based vector representation of the semantic features) are first extracted. Then, these two types of features are input into the student model, which outputs a low-dimensional student feature vector. This vector comprehensively represents the core information of the input code at both the structural and semantic levels. Furthermore, because it has learned the cross-architecture alignment capability of the teacher model through distillation training, it provides a consistent representation of the same function across different instruction set architectures.

[0049] When it is necessary to determine the similarity between two binary codes, such as two function fragments, the above vectorization process is performed on both to obtain their respective student feature vectors. Next, the cosine similarity between these two vectors is calculated. Cosine similarity assesses similarity by measuring the cosine of the angle between two vectors in a given direction. It is insensitive to the absolute scale of the vectors, thus more effectively capturing the semantic consistency hidden behind implementation differences caused by different architectures and compilation strategies. Therefore, it is particularly suitable for the cross-architecture similarity measurement scenario provided in this application.

[0050] Based on the calculated similarity score, the final detection result can be output according to a preset judgment threshold or sorting rule. In one embodiment, if the similarity score of two codes exceeds the threshold, they are determined to be highly similar at the semantic level. In another embodiment, for example in multi-candidate matching scenarios such as vulnerability code search or malicious code family clustering, all candidate codes can be sorted in descending order according to the similarity score, and the top-ranked results can be selected as output, thereby achieving efficient semantic retrieval in large-scale binary code libraries.

[0051] Through the complete process described above, the method provided in this application embodiment can achieve stable and robust binary code semantic similarity detection between heterogeneous processor instruction set architectures (such as ARM, x86, MIPS, RISC-V, etc.), providing effective technical support for key tasks such as firmware security analysis, vulnerability impact scope definition, malicious code homology determination, and software supply chain component analysis.

[0052] In the description of this specification, specific features, structures, materials, or characteristics may be combined in any suitable manner in one or more embodiments or examples.

[0053] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A cross-architecture binary code similarity detection method based on multimodal feature distillation, characterized in that, include: S1: For the input binary code, extract the structural features, semantic features, and statistical features of the binary code respectively; The structured features are graph structure representations that integrate control flow information and data flow information; the semantic features include vector representations obtained from instruction sequences based on binary code and vector representations obtained from functional descriptions based on binary code; the statistical features are vector representations reflecting the distribution of binary code composition; S2: Construct and train a teacher model, map the structured features, semantic features, and statistical features to the same feature space, and fuse them through a cross-modal attention mechanism to obtain teacher model fused features; simultaneously, optimize the teacher model by using comparative learning of cross-architecture homogeneous binary code pairs, so that the teacher model fused features are compatible with cross-architecture semantically similar binary codes. The code exhibits high cohesion; S3: Construct a lightweight student model, whose input only includes the structured features and the instruction sequence-based vector representation of the semantic features; by minimizing the difference between the student feature vector output by the student model and the teacher model's fused features output by the teacher model for the same binary code, the student model learns the teacher model's cross-architecture semantic alignment capability; S4: Using the trained student model, convert the two binary codes to be compared into corresponding student feature vectors, calculate the similarity between the two student feature vectors, and determine the semantic similarity of the two binary codes across architectures based on the similarity.

2. The cross-architecture binary code similarity detection method based on multimodal feature distillation according to claim 1, characterized in that, In step S1, extracting the structured features includes: disassembling the binary code to construct a control flow graph of the binary code, wherein the control flow graph has basic blocks as nodes and control transfer relationships as edges; analyzing the instruction sequence obtained from the disassembly to construct an instruction-level data flow graph, and aggregating the data dependencies between instructions to the basic blocks to which the instructions belong, generating a basic block-level data dependency attention matrix; weightedly fusing the adjacency matrix of the control flow graph with the data dependency attention matrix to obtain an enhanced structured graph representation; and processing the enhanced structured graph representation using a graph neural network to generate a vector representation of the structured features.

3. The cross-architecture binary code similarity detection method based on multimodal feature distillation according to claim 2, characterized in that: In the data dependency attention matrix, the values ​​of the matrix elements are obtained by normalizing the number of all instruction-level data dependency edges connecting the two basic blocks.

4. The cross-architecture binary code similarity detection method based on multimodal feature distillation according to claim 1, characterized in that, In step S1, the semantic features are extracted, including: using a pre-trained natural language processing model to encode each disassembled instruction of the binary code to obtain an instruction-level embedding vector, and performing a pooling operation on all instruction-level embedding vectors to obtain an instruction sequence vector representation; using a large language model to generate natural language text describing the function of the binary code based on the disassembled instruction sequence of the binary code, and encoding the natural language text to obtain a function description vector representation; and fusing the instruction sequence vector representation and the function description vector representation to generate the final semantic feature vector representation.

5. The cross-architecture binary code similarity detection method based on multimodal feature distillation according to claim 1, characterized in that: The statistical features include a vectorized representation of at least one of the following information: the instruction type distribution of the binary code, the number of basic blocks contained in the binary code, and the degree distribution of nodes in the control flow graph of the binary code.

6. The cross-architecture binary code similarity detection method based on multimodal feature distillation according to claim 1, characterized in that: In step S2, the comparative learning using cross-architecture homogeneous binary code pairs includes: using two binary codes compiled from the same source code under different instruction set architectures as positive sample pairs; during training, constructing a comparative learning loss function, which is used to narrow the distance between the two teacher model fusion feature vectors output by the teacher model for the positive sample pairs, while widening the distance between the teacher model fusion feature vector and the teacher model fusion feature vector output by the negative sample pairs.

7. The cross-architecture binary code similarity detection method based on multimodal feature distillation according to claim 1, characterized in that, In step S3, minimizing the difference between the student feature vector and the teacher model fused features is specifically achieved by jointly optimizing the following two losses: the first loss is the feature distance loss between the student feature vector and the teacher model fused features; the second loss is the distribution difference loss between the sample similarity distribution calculated based on the student feature vector and the sample similarity distribution calculated based on the teacher model fused features.

8. The cross-architecture binary code similarity detection method based on multimodal feature distillation according to claim 7, characterized in that: The first loss term uses the mean squared error loss, and the second loss term uses the KL divergence loss.

9. The cross-architecture binary code similarity detection method based on multimodal feature distillation according to claim 1, characterized in that, In step S4, cosine similarity is used to calculate the similarity between the two student feature vectors.

Images