A cross-architecture industrial control system binary code unified representation and efficient labeling method

Abstract

The application relates to a cross-architecture industrial control system binary code unified representation and efficient labeling method. The method comprises the following steps: firstly, acquiring binary codes of a cross-architecture industrial control system, and converting the binary codes into a unified intermediate representation containing industrial control specific semantic labels; then, constructing a semantic graph containing industrial control semantic features based on the unified intermediate representation; then, performing representation learning on the semantic graph through a graph Transformer to obtain a unified vector representation of the cross-architecture industrial control binary code; then, pre-labeling an unlabeled industrial control binary code segment based on the unified vector representation; finally, selecting samples from the pre-labeling result according to a preset strategy to perform artificial fine labeling, combining the artificial fine labeling result to construct a quality evaluation system, and forming a closed-loop improvement of labeling quality and model performance. The method solves the problems of inconsistent representation of multi-architecture industrial control binary codes, low efficiency and poor quality of large-scale labeling, realizes cross-architecture semantic unification and efficient and accurate labeling, can provide high-quality data set support for industrial control system vulnerability detection and malicious code tracing, and is suitable for key industry industrial control equipment scenes.

Description

Technical Field

[0001] This application relates to the field of industrial control system security technology, and in particular to a unified representation and efficient annotation method for binary code of cross-architecture industrial control systems. Background Technology

[0002] In the process of digital transformation of industrial control systems, core equipment such as DCS (Distributed Control System) and PLC (Programmable Logic Controller) serve as the nerve center of production control, and the security of their operating logic directly affects the stable operation of critical infrastructure. However, current industrial control equipment generally suffers from a "black box" phenomenon (opaque internal logic) and closed-source firmware, making traditional boundary-based security measures inadequate to cope with increasingly complex attack threats. Attackers can exploit unknown vulnerabilities to tamper with control logic, causing production interruptions or even physical disasters, becoming a key bottleneck restricting the development of the Industrial Internet.

[0003] Binary code analysis is a core method for revealing the underlying logic of devices. By parsing the instruction sequences, control flow structures, and function call relationships of executable files, it can effectively identify security vulnerabilities and malicious logic in closed-source firmware. High-quality labeled datasets are the foundation for the implementation of intelligent analysis algorithms; their completeness and scenario adaptability directly determine the actual effectiveness of vulnerability detection, malicious code identification, and other capabilities.

[0004] Existing general-purpose binary datasets have significant limitations in adapting to industrial control scenarios: on the one hand, they struggle to cover the proprietary instruction sets and architectural differences of devices from multiple brands; on the other hand, they generally lack accurate annotations for security-sensitive operations specific to the industrial control field (such as ladder logic jumps and I / O port read / write), leading to a significant decrease in the detection accuracy of general-purpose algorithms in industrial control scenarios. This insufficient data supply severely restricts the development of intelligent industrial control security technologies.

[0005] Current research on cross-architecture binary analysis has proposed architecture-independent intermediate representations (IRs) and cross-architecture embedding methods based on VEX, LLVM, etc., and there is also research on semantic graph representation based on control flow graphs. However, these works are mostly focused on general software or malicious code scenarios, and lack systematic adaptation to industry characteristics such as "periodic tasks, fieldbus interaction, equipment self-test and interlocking logic" of industrial control firmware, and cannot meet the need for unified representation of industrial control binary code.

[0006] Meanwhile, large-scale industrial control binary code annotation faces dual challenges of efficiency and quality: traditional manual annotation methods, when dealing with engineering-level data scales, suffer from problems such as long training cycles for professionals, high cost per sample annotation, and poor annotation consistency; while automatic annotation methods that rely solely on rule engines or shallow models are difficult to accurately depict the complex control flow structure in industrial control firmware, which is characterized by "intertwined periodic tasks and interrupt handling, and coexistence of real-time scheduling and exception handling", and are prone to systematic omissions or mis-annotations.

[0007] Therefore, there is an urgent need in related technologies for a way to solve the data foundation problem of industrial control binary code analysis that can take into account both unified representation across architectures and efficient and accurate annotation. Summary of the Invention

[0008] Therefore, it is necessary to provide a method for unified representation and efficient annotation of binary code in cross-architecture industrial control systems that can balance unified representation across architectures with efficient and accurate annotation, and solve the data foundation problem of binary code analysis in industrial control systems.

[0009] Firstly, this application provides a method for unified representation and efficient annotation of binary code across industrial control systems. The method includes: Obtain the binary code of the cross-architecture industrial control system and convert the binary code into a unified intermediate representation containing semantic tags specific to industrial control systems; A semantic graph containing industrial control semantic features is constructed based on the unified intermediate representation; By performing representation learning on the semantic graph using a graph Transformer, a unified vector representation of cross-architecture industrial control binary code is obtained; Pre-annotate unannotated industrial control binary code segments based on the unified vector representation; Based on a preset strategy, samples are selected from the pre-annotated results for manual fine labeling. A quality evaluation system is constructed by combining the results of manual fine labeling, forming a closed-loop improvement of annotation quality and model performance.

[0010] Optionally, in one embodiment of this application, converting the binary code into a unified intermediate representation containing industrial control-specific semantic tags includes: Semantic descriptions are provided for arithmetic logic, memory access, control flow transfer, function calls, and exception handling, and the semantics corresponding to peripheral register access, timer operations, and interrupt vector entry points are marked.

[0011] Optionally, in one embodiment of this application, constructing a semantic graph containing industrial control semantic features based on the unified intermediate representation includes: The basic blocks of the function are divided based on the unified intermediate representation. The basic blocks are used as nodes, and the nodes are attached with industrial control semantic features such as whether they contain I / O register access and whether they are located in the interrupt service routine or the main loop of the periodic task. Using control flow relationships as edges, distinguish the edge types: conditional jump, exception jump, function call, and function return.

[0012] Optionally, in one embodiment of this application, the step of performing representation learning on the semantic graph using a graph Transformer to obtain a unified vector representation of cross-architecture industrial control binary code includes: The basic block nodes are initialized and encoded. The unified intermediate representation instruction sequence within the node is mapped into a vector through an embedding layer and positional encoding, and the industrial control semantic feature encoding of task role and peripheral interaction type is incorporated. The global attention mechanism of the multi-layer graph Transformer module aggregates node information in the graph and combines edge type and graph structure position encoding to model the semantics of the function. The semantic graph is compressed into a function-level unified vector representation through a graph readout mechanism.

[0013] Optionally, in one embodiment of this application, the representation learning of the graph Transformer employs a two-stage training strategy, including: The first stage involves self-supervised pre-training through mask prediction, subgraph reconstruction, and function comparison learning. The second stage combines manually labeled function categories and sensitive operation mode monitoring signals to perform task-driven fine-tuning.

[0014] Optionally, in one embodiment of this application, the step of performing representation learning on the semantic graph using a graph Transformer to obtain a unified vector representation of cross-architecture industrial control binary code further includes: Construct functionally equivalent cross-architecture function positive sample pairs and impose similarity constraints on the unified vector of the positive sample pairs; Construct cross-architecture function negative sample pairs with different functionalities, and impose a difference constraint on the uniform vector of the negative sample pairs.

[0015] Optionally, in one embodiment of this application, the pre-annotation of unannotated industrial control binary code fragments based on the unified vector representation includes: Input the unified vector representation into a multi-label classification model or a Transformer sequence labeling model; For the task of labeling function categories and sensitive operation types, a multi-label classification model is used to output pre-labeled results in the form of probability distribution. For tasks involving function boundary and control flow keypoint annotation, the Transformer sequence annotation model is used to output instruction-level pre-annotation results.

[0016] Optionally, in one embodiment of this application, the step of selecting samples from the pre-labeled results for manual fine labeling according to a preset strategy includes: Based on the probability distribution entropy or class difference measure of model uncertainty using pre-labeled results, representative samples are selected by combining the sample density distribution in the unified vector embedding space, prioritizing samples with high uncertainty and high representativeness.

[0017] Secondly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the steps of the methods described in the various embodiments above.

[0018] Thirdly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the steps of the methods described in the various embodiments above.

[0019] Compared with the prior art, the present invention has the following beneficial effects: First, through a three-layer technical approach of "unified intermediate representation + semantic graph + graph Transformer", the differences in instruction encoding and compilation across multiple architectures are shielded while retaining the unique semantics of industrial control (such as periodic tasks and I / O access), thereby achieving a unified semantic mapping of binary code for industrial control across different architectures and supporting joint analysis of firmware from multiple vendors. Second, based on pre-labeling and active learning sample selection using unified vector representation, human effort is focused on "high-value" samples (high uncertainty, high representativeness), significantly reducing the workload of labeling and transforming the labeling mode from "labor-intensive" to "model-driven, expert-verified". Third, through two-stage model training, a multi-dimensional quality evaluation system, and a closed-loop improvement mechanism, the consistency and accuracy of the annotation results are ensured, while continuous iterative optimization of model performance and annotation quality is achieved. Fourth, it can directly support the construction of industrial control binary code datasets, providing a high-quality data foundation for the development of security tools such as vulnerability detection and malicious code tracing, and is suitable for industrial control equipment scenarios in key industries such as oil and gas and power. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating a method for unified representation and efficient annotation of binary code in a cross-architecture industrial control system, as shown in one embodiment. Figure 2 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0022] In one embodiment, such as Figure 1 As shown, a unified representation and efficient annotation method for binary code in cross-architecture industrial control systems is provided, including the following steps: S101: Obtain the binary code of the cross-architecture industrial control system and convert the binary code into a unified intermediate representation containing industrial control-specific semantic tags.

[0023] In this embodiment, binary code of cross-architecture industrial control systems (covering firmware of industrial control equipment from multiple vendors and with multiple CPU architectures) is obtained, and the original machine instructions are converted into a unified intermediate representation (IR) by combining a multi-architecture disassembler engine and a binary enhancement tool.

[0024] In one embodiment of this application, the unified intermediate representation needs to cover core semantic descriptions such as arithmetic logic, memory access, control flow transfer, function calls, and exception handling; additionally mark industrial control-specific semantics, including the semantics corresponding to peripheral register access, timer operations, and interrupt vector entry, while handling special structures such as variable-length instructions, mixed instruction set modes, and delay slots to ensure semantic consistency of instructions across multiple architectures at the IR layer.

[0025] S102: Construct a semantic graph containing industrial control semantic features based on the unified intermediate representation.

[0026] In this embodiment, the basic blocks of functions are divided based on a unified intermediate representation, and the basic blocks are used as semantic graph nodes. Each node is accompanied by industrial control semantic features, including whether it contains I / O register access, whether it is located in an interrupt service routine, and whether it belongs to the main loop of a periodic task. The control flow relationship is used as the edge of the semantic graph, and the edge type is clearly distinguished, including conditional jump edge, exception jump edge, function call edge, and function return edge, so as to fully depict the control flow logic of the industrial control firmware.

[0027] S103: The semantic graph is represented by a graph Transformer to obtain a unified vector representation of cross-architecture industrial control binary code.

[0028] In one embodiment of this application, firstly, the unified intermediate representation instruction sequence within the basic block node is mapped into a vector through an embedding layer and positional encoding. Simultaneously, the industrial control semantic feature encoding of task roles (such as periodic tasks, interrupt handling) and peripheral interaction types (such as I / O access, bus communication) is incorporated to generate an initial node vector. Then, a multi-layer graph Transformer module is stacked, and the information of all relevant nodes in the graph is aggregated using a global attention mechanism. Combined with edge types (such as conditional jumps, function calls) and graph structure positional encoding, the function semantics are modeled from the overall perspective of control flow to capture long-range dependencies. Finally, the entire semantic graph is compressed into a low-dimensional function vector through a graph readout mechanism (such as mean pooling, attention pooling), realizing a unified embedded representation of cross-architecture functions.

[0029] In one embodiment of this application, a "self-supervised pre-training + task-driven fine-tuning" strategy is adopted: Self-supervised pre-training stage: Through mask prediction (masking and predicting some IR instructions or node features), subgraph restoration (scrambling some control flow edges of the semantic graph and restoring them), and function comparison learning (learning similarity between functions with the same function but different architectures), the model learns the control flow structure and instruction semantics. Task-driven fine-tuning phase: By combining a small number of manually labeled function categories (such as control logic functions and communication functions) and sensitive operation modes (such as I / O read and write and permission modification) as supervisory signals, the model's ability to distinguish semantics specific to industrial control is optimized.

[0030] In one embodiment of this application, positive sample pairs of cross-architecture functions with equivalent functions (such as temperature control functions of different brands of PLCs) are constructed, and similarity constraints (such as reducing the cosine distance) are applied to their unified vectors; negative sample pairs of cross-architecture functions with different functions (such as temperature control functions and communication functions) are constructed, and difference constraints (such as increasing the cosine distance) are applied to their unified vectors to achieve cross-architecture semantic alignment.

[0031] S104: Pre-annotate the unannotated industrial control binary code segments based on the unified vector representation.

[0032] In one embodiment of this application, for labeling tasks such as function categories and sensitive operation types, a multi-label classification model is used to output the pre-labeling results in the form of probability distribution of the labels corresponding to each function / segment (e.g., "temperature control function: 0.92, includes I / O access: 0.88"). For annotation tasks such as function boundaries and key control flow points (e.g., interrupt entry points, loop start points), a Transformer-based sequence annotation model is adopted to output instruction-level pre-annotation results for instruction sequences with unified intermediate representations (e.g., "Instructions 1-5: function start segment, instruction 8: loop entry point").

[0033] S105: Select samples from the pre-labeled results according to the preset strategy for manual fine labeling, and construct a quality evaluation system based on the results of manual fine labeling to form a closed-loop improvement of labeling quality and model performance.

[0034] In one embodiment of this application, the probability distribution entropy (a higher entropy value indicates higher model uncertainty) or class difference (such as the difference between the most probable label and the second most probable label) of the pre-labeled results is calculated to identify high uncertainty samples; the sample density distribution in the unified vector embedding space is analyzed, and representative samples of the density center (typical samples) or density boundary (boundary samples) are selected; samples with "high uncertainty + high representativeness" are selected first to form a manual labeling task package.

[0035] In one embodiment of this application, a "model suggestion + expert decision" annotation interface is designed. Annotation experts can view the pre-annotation results and confidence information, and confirm, correct, or supplement the labels (such as supplementing process section information or equipment category information). The refined annotation results are stored in a high-quality annotation library. An evaluation system is constructed from two dimensions: model and data. Model dimension: The performance of the annotation model in different label categories is monitored through accuracy (number of correctly pre-annotated samples / total number of pre-annotated samples), precision (number of correctly annotated positive samples / total number of samples annotated as positive), recall (number of correctly annotated positive samples / total number of actual positive samples), and F1 score (2 × precision × recall / (precision + recall)). Data dimension: The quality of the annotation results is evaluated through sampling review (randomly selecting 10%-20% of refined annotation samples for re-review), cross-annotation (multiple experts independently annotate the same sample, and calculate the Kappa coefficient to measure consistency), and logical consistency check (verifying the integrity of control flow and the closure of call relationships through static analysis and graph structure analysis).

[0036] In one embodiment of this application, the quality assessment results are subjected to structured analysis to distinguish between rule-level (e.g., fuzzy annotation specifications), model-level (e.g., insufficient model adaptation to specific architectures), and data-level (e.g., missing samples of a certain type of device) problems: rule-level problems: revising annotation specifications and rule engine logic; model-level problems: adjusting the graph Transformer or annotation model structure, optimizing the loss function, and supplementing training samples; data-level problems: collecting missing scene samples and cleaning noisy samples; iteratively executing the "pre-annotation - sample selection - manual fine-labeling - quality assessment - model / rule optimization" process to achieve continuous improvement in annotation quality and model performance.

[0037] The aforementioned method for unified representation and efficient annotation of binary code in cross-architecture industrial control systems involves several steps. First, the binary code of the cross-architecture industrial control system is obtained and converted into a unified intermediate representation containing industrial control-specific semantic markers. Next, a semantic graph containing industrial control semantic features is constructed based on the unified intermediate representation. Then, representation learning is performed on the semantic graph using a graph Transformer to obtain a unified vector representation of the cross-architecture industrial control binary code. Following this, unannotated industrial control binary code fragments are pre-annotated based on the unified vector representation. Finally, samples are selected from the pre-annotation results for manual fine-labeling according to a preset strategy. A quality evaluation system is then constructed based on the manual fine-labeling results, forming a closed-loop improvement mechanism for annotation quality and model performance. This method solves the problems of inconsistent representation of binary code in multi-architecture industrial control systems and low efficiency and poor quality in large-scale annotation. It achieves unified semantic representation and efficient, accurate annotation across architectures, providing high-quality dataset support for industrial control system vulnerability detection and malicious code tracing, and is suitable for key industry industrial control equipment scenarios.

[0038] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0039] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 2As shown, the computer device includes a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When executed by the processor, the computer program implements a unified binary code representation and efficient annotation method for cross-architecture industrial control systems. The display screen can be an LCD screen or an e-ink display screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0040] Those skilled in the art will understand that Figure 2 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0041] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0042] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0043] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0044] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0045] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0046] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A unified representation and efficient annotation method for binary code in cross-architecture industrial control systems, characterized in that, The method includes: Obtain the binary code of the cross-architecture industrial control system and convert the binary code into a unified intermediate representation containing semantic tags specific to industrial control systems; A semantic graph containing industrial control semantic features is constructed based on the unified intermediate representation; By performing representation learning on the semantic graph using a graph Transformer, a unified vector representation of cross-architecture industrial control binary code is obtained; Pre-annotate unannotated industrial control binary code segments based on the unified vector representation; Based on a preset strategy, samples are selected from the pre-annotated results for manual fine labeling. A quality evaluation system is constructed by combining the results of manual fine labeling, forming a closed-loop improvement of annotation quality and model performance.

2. The method for unified representation and efficient annotation of binary code in cross-architecture industrial control systems according to claim 1, characterized in that, The process of converting the binary code into a unified intermediate representation containing industrial control-specific semantic tags includes: Semantic descriptions are provided for arithmetic logic, memory access, control flow transfer, function calls, and exception handling, and the semantics corresponding to peripheral register access, timer operations, and interrupt vector entry points are marked.

3. The method for unified representation and efficient annotation of binary code in cross-architecture industrial control systems according to claim 1, characterized in that, The construction of a semantic graph containing industrial control semantic features based on the unified intermediate representation includes: The basic blocks of the function are divided based on the unified intermediate representation. The basic blocks are used as nodes, and the nodes are attached with industrial control semantic features such as whether they contain I / O register access and whether they are located in the interrupt service routine or the main loop of the periodic task. Using control flow relationships as edges, distinguish the edge types: conditional jump, exception jump, function call, and function return.

4. The method for unified representation and efficient annotation of binary code in cross-architecture industrial control systems according to claim 1, characterized in that, The step of learning the representation of the semantic graph through a graph Transformer to obtain a unified vector representation of cross-architecture industrial control binary code includes: The basic block nodes are initialized and encoded. The unified intermediate representation instruction sequence within the node is mapped into a vector through an embedding layer and positional encoding, and the industrial control semantic feature encoding of task role and peripheral interaction type is incorporated. The global attention mechanism of the multi-layer graph Transformer module aggregates node information in the graph and combines edge type and graph structure position encoding to model the semantics of the function. The semantic graph is compressed into a function-level unified vector representation through a graph readout mechanism.

5. The method for unified representation and efficient annotation of binary code in cross-architecture industrial control systems according to claim 4, characterized in that, The representation learning of the graph Transformer employs a two-stage training strategy, including: The first stage involves self-supervised pre-training through mask prediction, subgraph reconstruction, and function comparison learning. The second stage combines manually labeled function categories and sensitive operation mode monitoring signals to perform task-driven fine-tuning.

6. The method for unified representation and efficient annotation of binary code in cross-architecture industrial control systems according to claim 5, characterized in that, The step of learning the representation of the semantic graph through a graph Transformer to obtain a unified vector representation of cross-architecture industrial control binary code further includes: Construct functionally equivalent cross-architecture function positive sample pairs and impose similarity constraints on the unified vector of the positive sample pairs; Construct cross-architecture function negative sample pairs with different functionalities, and impose a difference constraint on the uniform vector of the negative sample pairs.

7. The method for unified representation and efficient annotation of binary code in cross-architecture industrial control systems according to claim 1, characterized in that, The pre-annotation of unannotated industrial control binary code segments based on the unified vector representation includes: Input the unified vector representation into a multi-label classification model or a Transformer sequence labeling model; For the task of labeling function categories and sensitive operation types, a multi-label classification model is used to output pre-labeled results in the form of probability distribution. For tasks involving function boundary and control flow keypoint annotation, the Transformer sequence annotation model is used to output instruction-level pre-annotation results.

8. The method for unified representation and efficient annotation of binary code in cross-architecture industrial control systems according to claim 1, characterized in that, The step of selecting samples from the pre-labeled results for manual fine labeling according to a preset strategy includes: Based on the probability distribution entropy or class difference measure of model uncertainty using pre-labeled results, representative samples are selected by combining the sample density distribution in the unified vector embedding space, prioritizing samples with high uncertainty and high representativeness.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

Images