Binary function clone detection method for graph disturbance and temperature parameter adjustment

Abstract

The invention relates to a binary function clone detection method for graph disturbance and temperature parameter adjustment, and belongs to the field of artificial intelligence safety. The method comprises the following steps: firstly, constructing a function control flow diagram, and generating an attribute control flow diagram for node additional semantic features; secondly, applying structure and instruction disturbance to the attribute control flow diagram to generate diversified positive samples; then calculating function information amount by using structure and grammar features to adjust a temperature parameter of a loss function, and training a graph encoder by using comparative learning; and finally, generating a graph embedding vector of the function pair to be detected by using a graph encoder, and judging whether the function is a cloned function or not through a cosine distance threshold between the vectors. Aiming at the problem that an existing method is difficult to detect functions with few control branches and high grammar repeatability, the method utilizes function information amount to regulate and control contrast learning temperature parameters to increase function functional area indexing, and detection false alarms are reduced; for the problem that overfitting is easily caused by a fixed training data compiling mode, the sample diversity is increased by applying disturbance, and the detection accuracy is improved.

Description

Technical Field

[0001] This invention relates to a binary function clone detection method for graph perturbation and temperature parameter adjustment, belonging to the field of artificial intelligence security. Background Technology

[0002] With the rapid development of software development, code reuse has become an important means of improving efficiency. However, potential security vulnerabilities in third-party libraries or existing code can also spread to different software platforms through reuse, posing a serious challenge to security protection.

[0003] Binary function clone detection is one of the core foundational technologies in the field of information security. By detecting the similarity between the target function and the vulnerable functions in the library, potential security vulnerabilities can be effectively identified.

[0004] Traditional methods mainly include feature engineering-based methods and graph matching-based methods. Feature engineering-based methods rely on manually designed static features, such as opcode sequences, topological features of the control flow graph (CFG), or constant values ​​within functions. These methods are intuitive and computationally efficient, but their feature extraction process heavily depends on expert knowledge, and manually designed features often have limited representational power, making it difficult to capture deep functional semantics. Furthermore, they are highly sensitive to compilers, optimization options, or simple code obfuscation techniques; once the surface form of the code changes, even if the functionality remains the same, the manually designed features may change significantly, leading to detection failure. Graph matching-based methods treat the function's control flow graph as the core representation, judging by calculating the isomorphism or similarity between graphs. While the control flow graph can reflect the logical structure of a program well, strict graph isomorphism has extremely high computational complexity, making it difficult to apply to large-scale analysis. Approximate graph matching methods often cannot effectively handle situations where structural changes to the control flow graph (such as basic block splitting / merging, redundant block insertion / deletion) occur due to compiler optimization or obfuscation, resulting in insufficient robustness.

[0005] In recent years, deep learning-based methods have overcome the limitations of manual features by learning embedded representations of functions. One effective approach uses graph neural networks to map the function control flow graph into a vector space and then uses vector similarity for judgment. However, this type of graph embedding-based method faces two major problems:

[0006] 1. Training process fails to consider sample diversity: Model training typically employs uniform and fixed learning objectives or loss function parameters, ignoring the significant differences in complexity among different functions, especially those with simple control structures and limited instruction sequence features, resulting in low discriminative power. The control flow graphs extracted from these functions are small in scale and have a limited number of effective nodes, often composed of highly common instruction sequences, limiting the semantic information the model can learn. The uniform learning strategy during model training makes its learning of these functions insufficiently refined, impacting detection accuracy.

[0007] 2. Limited Positive Sample Construction Strategy: Most existing methods rely on constructing positive sample pairs from the same source code function compiled under different compilation configurations and training under fixed compilation conditions. This method of obtaining positive samples is costly and lacks adaptability to basic compilation perturbations (such as changes in topology, node / edge attributes, etc.), resulting in weak generalization ability of the learned feature representations.

[0008] In summary, graph embedding-based clone detection methods mainly suffer from the following problems: a uniform learning strategy during model training makes it difficult to detect functions with few control branches and high syntactic repetition; and the fixed compilation mode of training samples easily leads to overfitting. Therefore, this invention proposes a binary function clone detection method based on graph perturbation and temperature parameter adjustment. Summary of the Invention

[0009] This invention aims to address the problems of existing methods' difficulty in detecting functions with few control branches and high syntactic repetition, as well as the overfitting caused by fixed training data compilation patterns. It proposes a binary function clone detection method based on graph perturbation and temperature parameter adjustment.

[0010] The design principle of this invention is as follows: First, the binary function is disassembled to obtain its control flow graph representation. Second, features are extracted from each basic block in the control flow graph, and feature information is added to the nodes to obtain the attributed control flow graph (ACFG). Then, the attributed control flow graph is subjected to structural branching and instruction sequence perturbation to generate multiple perturbation views. During model training, the original view and the perturbation view are fed together as positive sample pairs into the graph encoder to calculate the contrastive loss. Next, the contrastive loss temperature parameter is adjusted according to the function information content, and the parameters of the GNN model are determined by minimizing the contrastive learning loss. Finally, the attributed control flow graphs of the two functions to be detected are input into the GNN model to generate two high-dimensional embedding vectors. The binary function clone detection conclusion is obtained by calculating the cosine similarity of the two high-dimensional vectors.

[0011] The technical solution of the present invention is achieved through the following steps:

[0012] Step 1: Extract the graphical representation of the binary function.

[0013] Step 1.1: Disassemble the target binary file and extract the function control flow graph (CFG).

[0014] Step 1.2: Extract features from the basic blocks of the function and convert the control flow graph into an attribute control flow graph (ACFG).

[0015] Step 2: Construct a perturbation pool and perform random perturbation.

[0016] Step 2.1: Construct the perturbation pool. Perturbation types are divided into structural, semantic, and hybrid types, including six perturbation methods: basic block reordering, redundant block insertion and deletion, conditional branch reversal, instruction substitution perturbation, constant folding perturbation, and irrelevant logic insertion.

[0017] Step 2.2: Six perturbation strategies are used to generate different perturbation views for the original property control flow graph of the function, which are then used for subsequent model training.

[0018] Step 3: Calculate the information content of the function and set the temperature value of the loss function.

[0019] Step 3.1: Calculate the loop complexity of the function, which is used to characterize the complexity of function branches and loop logic.

[0020] Step 3.2: Calculate the average depth of the function, which is used to measure the control structure hierarchy of the function.

[0021] Step 3.3: Calculate the opcode information entropy of the function, which is used to measure the richness of semantic information.

[0022] Step 3.4: Normalize the above three indicators and combine them in a weighted manner to obtain the function information content function I(x).

[0023] Step 3.5: Map the information content I(x) to the loss function temperature value τ(x). For samples with low information content, assign a smaller τ(x) to enable the model to learn finer-grained feature differences and improve the model's discrimination ability on low-information samples; for samples with high information content, assign a larger τ(x) to avoid over-amplifying individual differences and maintain model stability.

[0024] Step 4: Train the parameters in the GNN network by minimizing the objective function.

[0025] Step 4.1: Each time, select the original ACFG and one of the perturbation views to form a positive sample pair, and feed them into the graph encoder to obtain two embedding vectors.

[0026] Step 4.2, calculate the contrastive loss. When calculating the loss for a pair of positive samples, the embedding vectors of all other samples in the batch are used as negative samples for that pair of positive samples to construct the denominator. The learning objective is to minimize the distance between each pair of positive samples and maximize the distance between positive and negative samples.

[0027] Step 4.3, Parameter Update. In each training iteration, the contrastive loss is calculated based on the positive sample pairs, and the views of other functions in the batch are used as negative samples to contribute to the loss. The contrastive losses of all positive sample pairs (which already contain the corresponding negative sample terms) are used together for gradient backpropagation and to update the model parameters. After multiple iterations, the final encoder parameters are obtained.

[0028] Step 5: Calculate function similarity and generate conclusions.

[0029] Step 5.1: For the two functions to be compared, input their attribute control flow graph representations into the encoder trained in Step 4 to obtain embedding vectors. Calculate the cosine similarity between two high-dimensional vectors.

[0030] Step 5.2: Output the binary function clone detection conclusion based on the similarity threshold or sorting result.

[0031] Beneficial effects

[0032] Compared with existing methods, the present invention has the following advantages: (1) Improved detection rate of low information functions: By adjusting the information weighting and loss function temperature parameter, the low recall rate caused by the sparsity of function features is effectively alleviated. (2) Enhanced model robustness: The diversity of samples is increased by simulating compilation perturbation, so that the model can still maintain stable detection performance in the face of slight structural and semantic perturbations. Attached Figure Description

[0033] Figure 1 This is a flowchart of the overall process of the binary function cloning detection method based on graph perturbation and temperature parameter adjustment of the present invention. Detailed Implementation

[0034] To better illustrate the purpose and advantages of the present invention, the implementation methods of the present invention will be further described in detail below with reference to examples.

[0035] This invention uses the Assemblage dataset as the primary source of experimental data. The Assemblage dataset is a large-scale dataset used to evaluate binary function similarity models, containing approximately 890,000 Windows PE binaries and 428,000 Linux ELF files, derived from the automated build results of millions of open-source C / C++ projects. It covers various compiler versions, such as MSVC v140-143, GCC, Clang, etc., and different optimization levels (O1, O2, Ox, O0, etc.), fully reflecting the diversity of compilation environments and optimization strategies.

[0036] Table 1. Experimental data on binary function cloning detection (strips)

[0037]

[0038] The experiment used ROC as the primary evaluation metric. Given a set of function pairs for the samples, the model outputs similarity results. The true positive rate (TPR) and false positive rate (FPR) were calculated for multiple experimental results.

[0039]

[0040] Here, TP represents the number of pairs that are actually similar and are also classified as similar by the model; TN represents the number of pairs that are actually dissimilar and are also classified as dissimilar by the model; FP represents the number of pairs that are actually dissimilar but are incorrectly classified as similar by the model; and FN represents the number of pairs that are actually similar but are incorrectly classified as dissimilar by the model. Finally, the area under the ROC curve (AUC) is used as the quantification metric.

[0041] AUC=∫0 1 TPR(FPR)d(FPR) (3)

[0042] The AUC value ranges from [0,1]. The larger the value, the stronger the model's ability to distinguish between similar and dissimilar function pairs.

[0043] The specific procedure for this experiment is as follows:

[0044] Step 1: Extract the graphical representation of the binary function.

[0045] Step 1.1: Input the binary file of the target function into the disassembler IDA-pro7.0 to obtain the control flow graph of the binary function. The control flow graph is represented by a directed graph G(v,e), where v is a vertex in the control flow graph, each vertex corresponds to a basic block, and each basic block contains one or more binary instructions; e is an edge in the control flow graph, corresponding to the execution flow inside the function.

[0046] Step 1.2 involves extracting features from the basic blocks of the function, including opcode distribution, constant information, and the number of call and jump instructions. The control flow graph is then converted into an attribute control flow graph, denoted as G(V,E), where V is the set of vertices, and each vertex is represented by a feature vector x. V E represents the set of edges, maintaining the control flow relationships of the original control flow graph unchanged.

[0047] Step 2: Construct a perturbation pool and perform random perturbation.

[0048] Step 2.1, Constructing the Perturbation Pool. The perturbation design of this invention can be divided into structural branch perturbation and instruction sequence perturbation. Structural branch perturbation directly affects the topology of the attribute control flow graph, changing the arrangement, number, or connection relationships of vertices and edges, but does not change the actual semantics of the functions. Its purpose is to simulate the differences in control flow structure caused by different compilers, optimization options, or code obfuscation methods, thereby testing the robustness of the model under structural perturbation, including basic block reordering, redundant block insertion and deletion, and irrelevant logic insertion. Instruction sequence perturbation does not change the macroscopic topology of the attribute control flow graph, but modifies the instruction composition and feature vectors within the basic blocks, causing changes in the representation of vertices in the attribute control flow graph. Its logical results remain equivalent, but it will cause changes in opcode distribution, constant usage, and the number of irrelevant logic, used to simulate the differences in instruction sequence generated during compilation optimization or code rewriting. This includes conditional branch reversal, instruction substitution perturbation, irrelevant logic insertion, and constant folding perturbation. Specific classifications can be found in Table 2.

[0049] Table 2. Introduction to Disturbance Pool Types

[0050]

[0051]

[0052] The specific implementation of each operation is explained below:

[0053] 1. Basic Block Reordering. If there is no direct control dependency between two basic blocks, their order can be adjusted without changing the function semantics. For example, two basic blocks that only merge to the same successor node through jumps can be swapped, or an unrelated piece of logic can be moved forward / backward. These operations do not affect the program logic, but they will cause changes in the numbering of vertices (basic block feature vectors) or the local topology in the attribute control flow graph, thus testing the robustness of the model to basic block arrangement perturbations.

[0054] 2. Redundant Block Insertion and Deletion. Insertion refers to adding a redundant basic block at a certain location within a function. This block contains instructions that have no impact on the final result, such as NOPs (no-ops), useless assignments to temporary registers, or operations that immediately overwrite after an assignment. Deletion refers to removing redundant logical blocks or dead code blocks from a function, such as uncalled basic blocks or invalid branches in always-true / false branches. These operations do not change the function's functionality but directly affect the structural scale of the attribute control flow graph, changing the number of vertices and edges. This is used to evaluate the model's stability when handling changes in structural scale.

[0055] 3. Conditional Branch Reversal. Reverse the conditional jump statements in the basic block and adjust the edge pointers in the attribute control flow graph to ensure logical equivalence. This perturbation does not change the semantic result of the branch, but it causes changes in the distribution and marking direction of edges in the attribute control flow graph, thus simulating the jump reversal phenomenon caused by compiler optimization or obfuscation in real-world scenarios.

[0056] 4. Instruction Substitution Perturbation. Without altering the function's semantics, certain instructions within a basic block are replaced with equivalent instructions or instruction sequences. For example, the increment operation "x = x + 1" is replaced with the single instruction "INC x", or the multiplication by 2 is replaced with a left shift operation. These operations do not change the function logic but alter the opcode distribution within the basic block, resulting in differences in the feature vectors of vertices in the attribute control flow graph. This is used to test the model's robustness to semantically equivalent code substitution.

[0057] 5. Insertion of irrelevant logic. This involves inserting logical branches into functions that are not actually executed or do not affect the computation result. Examples include branches where the condition is always false or paths that are always skipped. After disassembly, this type of logic generates new basic blocks and adds new vertices and edges to the property control flow graph, thus expanding the graph's size. Although these vertices do not affect the function's output, they introduce "distraction information" into the graph structure, used to test whether the model can still capture the core semantics of the function when faced with dead code or obfuscated logic.

[0058] 6. Constant Folding Perturbation. This involves reverse-expanding constant optimization expressions that the compiler typically performs, or directly folding complex expressions into constants. For example, changing "y = 2 + 2" to "y = 4", or "z = 3 * 5" to "z = 15". This perturbation does not change the final result of function execution, but it alters the composition of instructions and the distribution of opcodes in basic blocks, thereby changing the eigenvectors of the vertices of the attribute control flow graph. This is used to simulate the differences in constant representation under different compilation strategies.

[0059] Step 2.2, control the flow graph g of the primitive properties of a function. origSix different perturbation views were generated using six different perturbation strategies. Used for subsequent model training.

[0060] Step 3: Calculate the information content of the function and set the temperature value of the loss function.

[0061] Step 3.1, Calculate the Cyclomatic Complexity (CC).

[0062] CC=|E|-|V|+2p (4)

[0063] Where |E| is the number of edges in the graph, |V| is the number of vertices in the graph, and p is the number of connected components. Loop complexity describes the complexity of branching and looping logic.

[0064] Step 3.2, Calculate the average depth (AD).

[0065]

[0066] Where L represents all leaf nodes, and d(entry,l) is the shortest path length from the entry node to the farthest leaf node. The average depth is used to measure the hierarchy of the function's control structure.

[0067] Step 3.3: Calculate the opcode entropy (OE).

[0068]

[0069] Where K is the total number of instruction types, p i It represents the frequency of the i-th type of opcode in the function. Opcode information entropy is used to measure the richness of semantic information.

[0070] Step 3.4: Normalize the above three indicators and synthesize them using a weighted method to obtain the function information content:

[0071] I(x)=w1·norm(CC)+w2·norm(AD)+w3·norm(OE) (7)

[0072] Where norm(.) represents the normalization function, which maps three indicators with different dimensions and numerical ranges to a unified scale, avoiding the dominance of a single feature in the overall information content calculation due to excessively large dimensions or numerical ranges, thereby ensuring the balance and robustness of feature fusion; w1, w2, w3 are weight parameters, which can adaptively adjust the relative contributions of the three types of information to the overall information content according to specific application scenarios, increasing the transferability of this method.

[0073] Step 3.5: In the InfoNCE loss calculation formula, the temperature parameter τ determines the degree of amplification of similarity after exponential operation. For functions of samples with low information content, setting a smaller τ(x) makes the gradient of exp(sim / τ(x)) steeper, thereby amplifying the originally weak similarity difference between positive and negative samples and improving the model's ability to distinguish between samples with low information content. For samples with high information content, their embedding space itself has strong separability. Assigning a larger τ(x) can make the similarity distribution smoother, avoiding over-amplification of already obvious differences, thus maintaining the stability of the training process. The specific mapping method follows the formula below:

[0074] τ(x)=τ min +(τ max -τ min )·norm(I(x)) (8)

[0075] Initial setting τ min =0.35,τ max =0.95, I(x) is the function information value calculated in step 3.4, norm(.) represents the normalization function, and normalization of the information value achieves smooth interpolation, ensuring that the temperature parameter can be continuously and monotonically adjusted with the change of information. By implementing a differentiated learning strategy for different information functions, the model can enhance its discrimination ability on low information samples, while maintaining stable convergence on high information samples.

[0076] Step 4: Train the parameters in the GNN network by minimizing the objective function.

[0077] Step 4.1: Each time, select the original ACFG and one of the perturbation views to form a positive sample pair. The input to the graph encoder yields two embedding vectors h. orig =f θ (g orig ), Where f θ It is a parameter-shared graph encoder, using the same set of parameters throughout the training process.

[0078] Step 4.2, calculate the contrastive loss. During optimization, the model focuses on two key objectives: maximizing the semantic consistency between the original view and the perturbation view (i.e., narrowing the distance between positive sample pairs), and strengthening the discriminative boundary between the original sample and all negative samples in the batch (i.e., widening the distance between negative samples). In the InfoNCE loss calculation, all other functional views (including the original view and the perturbation view) in the batch, except for the current positive sample pair, are treated as negative samples, and their embedding vectors collectively constitute the denominator. The loss for a single positive sample pair is:

[0079]

[0080] Among them, h orig The embedding generated for the original view in step 1, h is the embedding generated from the perturbation view in step 2. j This indicates all data except h in the same training batch. orig and The embeddings outside of this are used as negative samples for comparison, and τ is the adaptive temperature set in step 3;

[0081] Since each original view will form a positive sample pair with multiple perturbed views, this will occur multiple times within an epoch. Pairing is used, and the loss calculated each time is added to the total batch loss:

[0082]

[0083] Step 4.3, Parameter Update. The positive sample terms from the above loss function, along with the negative sample terms automatically generated from other samples within the batch, participate in gradient backpropagation to update the encoder parameters θ. After multiple iterations, the final model parameters are obtained.

[0084] Step 5: Calculate function similarity.

[0085] Step 5.1: For the two functions to be compared, input their graphical representations into the encoder to obtain high-dimensional embedding vectors. Calculate the cosine similarity between two high-dimensional vectors:

[0086]

[0087] Step 5.2: Based on the similarity threshold or ranking result, output the clone detection conclusion of the binary function.

[0088] The above detailed description further illustrates the purpose, technical solution, and beneficial effects of the invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A binary function cloning detection method for graph perturbation and temperature parameter adjustment, characterized in that... The method includes the following steps: Step 1: Extract the graph representation of the binary function. First, disassemble the target binary file and extract the function's control flow graph (CFG). Second, extract features from the basic blocks of the function, add feature information to the control flow graph nodes, and convert the control flow graph into an attribute control flow graph (ACFG). Step 2: Construct a perturbation pool and perform random perturbation. First, construct the perturbation pool; then, use six perturbation strategies to generate different perturbation views for the original property control flow graph of the function, which will be used for subsequent model training. Step 3: Calculate the information content of the function and set the temperature value of the loss function. First, calculate the loop complexity, average depth, and opcode information entropy of the function respectively. Then, normalize the above three indicators and combine them in a weighted manner to obtain the information content function I(x). Then, map the information content I(x) to the temperature value τ(x) of the loss function. Step 4: Train the parameters in the GNN network by minimizing the contrastive loss function. First, each time, select the original ACFG and one of the perturbation views to form a positive sample pair, and feed them into the graph encoder to obtain two embedding vectors. Then, calculate the contrastive loss, in which the temperature value τ(x) is calculated in step 3. Next, update the parameters. In each training iteration, the contrastive loss of all positive sample pairs (which already contains the corresponding negative sample terms) is used together for gradient backpropagation and to update the model parameters. After multiple iterations, the final encoder parameters are obtained. Step 5, Function Similarity Calculation and Conclusion Generation; First, for the two functions to be compared, their attribute control flow graph representations are input into the encoder trained in Step 4 to obtain embedding vectors. Next, the cosine similarity between the two high-dimensional vectors is calculated; then, based on the similarity threshold or ranking result, the binary function clone detection conclusion is output.

2. The binary function cloning detection method for graph perturbation and temperature parameter adjustment according to claim 1, characterized in that: In step 2, a multi-dimensional and multi-level graph perturbation strategy pool is constructed. By introducing various perturbation methods, semantically equivalent but differently implemented function variants generated in real compilation optimization and obfuscation scenarios are simulated. Specifically, the perturbation pool mainly includes the following two core strategies: The first is structural branch perturbation. This type of perturbation starts from the overall structure of the control flow graph. Specific implementation methods include: changing the code layout without affecting the execution logic by reordering basic blocks; simulating code redundancy characteristics under different compiler optimization strategies by inserting and deleting redundant blocks; constructing logically equivalent but different control flow branch structures by reversing conditional branches; and simulating code bloating techniques commonly used in anti-debugging or code obfuscation by inserting harmless conditional branches or basic blocks that do not contribute effective logic but change the execution path length in the control flow. The second type is instruction sequence perturbation. This type of perturbation performs semantically preserved transformations on the instruction-level implementation sequence while maintaining the overall functionality of the function. Specifically, this includes: generating equivalent but different instruction combinations of code sequences by instruction substitution perturbation; simulating the compiler's optimization behavior for constant expressions by constant folding perturbation; and increasing semantic analysis noise by interspersing instructions that do not affect the final state (such as operations on volatile registers, no-operations, redundant calculations, and rollbacks) in the instruction sequence to simulate useless instruction fragments in real code. By combining multiple levels of perturbations from control flow structure to instruction sequence, multiple functionally equivalent views covering structural layout and instruction implementation are generated. This allows the model to focus on the core functional features of functions during training, rather than memorizing specific code implementations, thereby improving the robustness and generalization performance of the subsequent clone detection model in identifying diverse compilation variants and obfuscation adversaries.

3. The binary function cloning detection method for graph perturbation and temperature parameter adjustment according to claim 1, characterized in that: Step 3 introduces a multi-dimensional quantitative evaluation mechanism, proposing a comprehensive measurement model for the function information content I(x). This model jointly characterizes the function from three key dimensions: structural complexity, control level, and semantic density, constructing a composite information content index that simultaneously reflects both structural and semantic features. The calculation of the function information content I(x) is given by the following formula: I(x)=w1·norm(CC)+w2·norm(AD)+w3·norm(OE) Here, CC represents loop complexity, used to accurately quantify the path complexity introduced by the internal branches and loop logic of a function; AD represents average depth, characterizing the nesting depth and execution path length of a function from the perspective of the hierarchical structure of the control flow; OE represents opcode information entropy, breaking through the limitations of traditional structural metrics by introducing the concept of entropy from information theory to quantitatively evaluate the semantic uncertainty and richness of the opcode sequence in a function; norm(.) represents the normalization function, mapping three indicators with different dimensions and numerical ranges to a unified scale, avoiding a single feature from dominating the overall information content calculation due to excessively large dimensions or numerical ranges, thus ensuring the balance and robustness of feature fusion; w1, w2, and w3 are weight parameters, which can adaptively adjust the relative contribution of the three types of information to the overall information content according to specific application scenarios, increasing the transferability of this method.

4. The binary function cloning detection method for graph perturbation and temperature parameter adjustment according to claim 1, characterized in that: In step 3, an information-aware adaptive temperature adjustment mechanism is introduced. By establishing a dynamic mapping relationship between the information content I(x) of the function and the training loss function τ(x), a differentiated feature learning strategy for samples with different information content is realized, solving the problem that the temperature parameter is fixed in traditional methods and it is difficult to adapt to sample heterogeneity. Specifically, for samples with low information content, their internal features are sparse and have weak discriminative power, and the model is prone to ignoring subtle differences. By allocating a smaller τ(x), a steeper gradient response is constructed during training, forcing the model to focus on subtle differences in finite features, thereby improving the fine-grained discrimination ability for low-information function variants. For samples with high information content, an excessively small temperature parameter will cause the model to overfit individual specificity and weaken generalization. By allocating a larger τ(x), the high-dimensional feature space is moderately smoothed, suppressing the interference of outliers on model training, avoiding excessive amplification of individual differences, and maintaining model stability. The mapping method of adaptive temperature τ(x) is as follows: τ(x)=τ min +(t max -t min )·norm(I(x)) Where, τ max , τ min As a preset constant, I(x) is the function information value calculated in step 3. Normalizing the information value achieves smooth interpolation, ensuring that the temperature parameter can be continuously and monotonically adjusted with the change of information. This design not only gives the model the ability to autonomously adjust the degree of learning focus according to the characteristics of the samples, but also constructs a dynamic and balanced training environment as a whole, which significantly improves the model's adaptability and discrimination accuracy on samples of functions with different complexity.

5. The binary function cloning detection method for graph perturbation and temperature parameter adjustment according to claim 1, characterized in that: The contrast loss function in step 4 adopts InfoNCE loss, combined with the graph perturbation strategy in step 2 and the temperature parameter adjustment strategy in step 3, to construct a structured discrimination task in the multi-view embedding space and achieve efficient learning of function semantic representation. Its formula is defined as: Among them, h orig The embedding generated for the original view in step 1, h is the embedding generated from the perturbation view in step 2. j This indicates all data except h in the same training batch. orig and The embeddings outside of this are used as negative samples for comparison, and τ is the adaptive temperature set in step 3; During the optimization process, the model focuses on two key objectives: maximizing the semantic consistency between the original view and the perturbation view, i.e., narrowing the distance between positive sample pairs, and strengthening the discriminative boundary between the original sample and all negative samples in the batch, i.e., widening the distance between negative samples. In addition, the adaptive temperature parameter τ set in step 3 is introduced into the calculation formula to dynamically adjust the gradient update intensity according to the amount of sample information, ensuring that the model remains stable on complex samples and achieves fine discrimination on simple samples. This enables the contrastive learning process to adapt to the characteristics of samples with different complexity functions, significantly improving the efficiency and quality of learning.

Images