Large Language Model Training and Program Analysis Methods, Devices and Electronic Equipment

Abstract

This invention provides a method, apparatus, and electronic device for training and analyzing large language models, belonging to the field of artificial intelligence technology. The method includes: constructing a training sample set, where each training sample includes task instructions as model input, intermediate representation code sequences, and label information; using the training sample set to perform supervised fine-tuning training on an initial large language model to obtain a target large language model; the intermediate representation code sequences are obtained by converting machine instructions in binary file samples of any processor architecture into semantic operation sequences independent of the processor architecture. This invention innovatively uses platform-independent intermediate representation code as training corpus, unifying the instruction sets of different hardware platforms at the semantic level. This solves the technical problem that existing models cannot be universally applied across platforms due to their dependence on specific architectures, thus achieving the effect of one-time training and universal application across multiple architectures, significantly improving the model's generalization ability and applicability in the field of binary program analysis.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to a method, apparatus, and electronic device for training and analyzing large language models. Background Technology

[0002] With the rapid development of the Internet of Things, mobile computing, and cloud computing, software programs are widely deployed in binary form on hardware platforms covering various heterogeneous processor architectures such as x86, ARM, and MIPS. Therefore, automated and in-depth analysis of these binary programs widely deployed on different hardware platforms to achieve goals such as vulnerability discovery, malware detection, and reverse engineering is of great significance in the fields of software security and system maintenance.

[0003] To meet the above requirements, existing technologies for program analysis using large language models mainly follow two paths. The first is a source code-based analysis method, which pre-trains the large language model on massive amounts of open-source code written in high-level languages ​​(such as C / C++, Java, Python, etc.) to teach it the syntactic structure and high-level semantic logic of the program code. The second is a binary program-oriented analysis method, where some solutions directly train the large language model on assembly instruction datasets of a single processor architecture (such as x-86 architecture) to teach it the underlying machine execution logic.

[0004] However, the aforementioned existing technical solutions have obvious limitations in practical applications. On the one hand, source code-based training methods are not applicable in binary program analysis scenarios where source code is lacking; on the other hand, models that directly learn assembly instructions for a specific platform have a knowledge system that is highly coupled with a particular processor architecture. This results in models trained on one architecture being unable to understand the instruction sets of other architectures, making it difficult to directly transfer and apply them to binary program analysis tasks on other platforms. Summary of the Invention

[0005] This invention provides a method, apparatus, and electronic device for training and analyzing large language models, which solves the technical problems of limited applicability of existing source code-based training methods and the difficulty of cross-platform compatibility of models that directly learn assembly instructions for specific platforms due to their high coupling with specific processor architectures. It enables a target large language model to analyze binary programs under multiple processor architectures with a single training, significantly improving the model's generalization ability and applicability.

[0006] This invention provides a method for training a large language model, comprising: Construct a training sample set, wherein each training sample in the training sample set includes task instructions and intermediate representation code sequences as input to the model, as well as pre-set label information corresponding to the input to the model; The initial large language model is trained under supervised fine-tuning using the training sample set to obtain the target large language model. The intermediate representation code sequence is obtained by converting machine instructions in binary file samples of any processor architecture into semantic operation sequences that are independent of the processor architecture.

[0007] According to a large language model training method provided by the present invention, the binary file samples are constructed in the following manner: Collect source code for multiple high-level languages; Using different versions of compilers and setting different optimization level options, the source code is compiled into binary executables covering multiple instruction set architectures, which serve as samples of the binary files.

[0008] According to a large language model training method provided by the present invention, machine instructions in binary file samples of arbitrary processor architecture are converted into semantic operation sequences independent of the processor architecture, including: The binary file sample is physically segmented at the function granularity to obtain the segmented binary function; The binary function is disassembled by calling a reverse analysis engine to obtain the semantic operation sequence.

[0009] According to a large language model training method provided by the present invention, before constructing the training sample set, the method further includes: Based on the data flow analysis results of the intermediate representation code sequence, redundant instructions in the intermediate representation code sequence are removed to obtain the reduced intermediate representation code sequence.

[0010] According to a large language model training method provided by the present invention, the step of removing redundant instructions from the intermediate representation code sequence based on the data flow analysis results of the intermediate representation code sequence includes: Construct the data flow graph representing the intermediate code sequence; Traverse the data flow graph and delete assignment operation instructions that are not referenced by subsequent instructions; Based on the data flow graph, the definition instructions and usage instructions for temporary variables used only for data transfer are merged.

[0011] According to a large language model training method provided by the present invention, the construction of the training sample set includes determining the label information based on the type of the task instruction: If the task instruction directs a high-level semantic restoration task, a natural language summary describing the function of the binary file sample is obtained as the tag information; If the task instruction indicates a security and vulnerability analysis task, obtain an analysis report containing at least one of the following: vulnerability type, vulnerability location, and remediation suggestion, as the tag information; If the task instruction indicates a performance behavior analysis task, obtain an analysis report containing algorithm complexity evaluation and / or optimization suggestions as the tag information; If the task instruction indicates a code generation task, the high-level program source code corresponding to the binary file sample is obtained as the tag information; If the task instruction indicates a complex generation task under multiple constraints, the intermediate representation code sequence and / or analysis text that satisfy the specific constraints are obtained as the tag information.

[0012] According to a large language model training method provided by the present invention, the construction of the training sample set further includes: Acquire general natural language text data; The general natural language text data is added to the training sample set according to a preset ratio.

[0013] According to the present invention, a method for training a large language model, wherein the supervised fine-tuning training of an initial large language model using the training sample set includes: All training samples in the training sample set are bucketed according to the length of the intermediate representation code sequence, and the bucket sequence is obtained in ascending order of length; The initial large language model is trained sequentially using training samples from different buckets, according to the order of the bucket sequence.

[0014] According to a large language model training method provided by the present invention, the bucketing sequence sequentially includes a first bucket, a second bucket, and a third bucket. The length of the intermediate representation code sequence of the training samples in the first bucket is less than a first threshold, the length of the intermediate representation code sequence of the training samples in the second bucket is between the first threshold and the second threshold, and the length of the intermediate representation code sequence of the training samples in the third bucket is greater than the second threshold. The step of training the initial large language model sequentially using training samples from different buckets according to the bucket sequence includes: The initial large language model is trained using the training samples in the first bucket to establish the semantic mapping relationship between the intermediate representation code sequence and the label information; The initial large language model is trained to learn context dependencies using the training samples in the second bucket; The global logical features of the learning function of the initial large language model are trained using the training samples in the third bucket.

[0015] The present invention also provides a program analysis method, comprising: Obtain the target binary file to be analyzed; The target function in the target binary file is converted into a semantic operation sequence that is independent of the processor architecture of the target binary file; The user-inputted task instructions and the intermediate representation code sequence are combined to form the model input, which is then input into the target large language model to obtain the analysis result text output by the target large language model. The target large language model is trained based on the large language model training method described in any one of claims 1-9.

[0016] According to the program analysis method provided by the present invention, the step of composing the user-inputted task instructions and the intermediate representation code sequence into a model input includes: The model input is embedded with thought chain prompts, which are used to guide the target large language model to output intermediate reasoning steps and / or logical derivation processes before outputting the analysis result text.

[0017] According to the program analysis method provided by the present invention, after obtaining the analysis result text output by the target large language model, the method further includes: Call a static analysis tool to verify the syntactic correctness or logical consistency of the analysis result text; If the verification fails, the verification error message will be fed back to the target large language model to trigger the target large language model to correct the analysis result text.

[0018] The present invention also provides a large language model training device, comprising: A sample construction module is used to construct a training sample set. Each training sample in the training sample set includes task instructions and intermediate representation code sequences as input to the model, as well as pre-set label information corresponding to the model input. The intermediate representation code sequence is obtained by converting machine instructions in binary file samples of arbitrary processor architecture into semantic operation sequences that are independent of the processor architecture. The model training module is used to perform supervised fine-tuning training of the initial large language model using the training sample set to obtain the target large language model.

[0019] The present invention also provides a program analysis apparatus, comprising: The acquisition module is used to acquire the target binary file to be analyzed; A conversion module is used to convert the target function in the target binary file into a semantic operation sequence that is independent of the processor architecture of the target binary file; The input construction module is used to combine the user-inputted task instructions with the intermediate representation code sequence to form the model input, input it into the target large language model, and obtain the analysis result text output by the target large language model; The target large language model is trained based on any of the large language model training methods described above.

[0020] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement any of the large language model training methods described above.

[0021] The large language model training and program analysis method, device and electronic device provided by the present invention innovatively adopts platform-independent intermediate representation code as training corpus, unifies the instruction sets of different hardware platforms at the semantic level, solves the technical problem that existing models cannot be universally used across platforms due to their dependence on specific architectures, thereby achieving the effect of training once and being universal across multiple architectures, and significantly improving the generalization ability and applicability of the model in the field of binary program analysis. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0023] Figure 1 This is one of the flowcharts illustrating the large language model training method provided by this invention.

[0024] Figure 2 This is the second flowchart of the large language model training method provided by the present invention.

[0025] Figure 3 This is a flowchart illustrating the program analysis method provided by the present invention.

[0026] Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0028] It should be noted that, in the description of this invention, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. Those skilled in the art will understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0029] The terms "first," "second," etc., used in this invention are used to distinguish similar objects, not to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class, without limiting the number of objects; for example, a first object can be one or more. Furthermore, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0030] Before describing in detail the large language model training and program analysis method, apparatus, and electronic device provided by this invention, we will briefly define some abbreviations and terms in the field that may appear in the subsequent embodiments: (1) Binary code refers to the instruction set that a computer's central processing unit (CPU) can directly interpret and execute. It consists of a series of binary numbers composed of "0" and "1" and is the final and lowest-level representation of a software program. The binary code of a specific CPU architecture (such as x86, ARM) can only run on processors of that architecture or compatible processors.

[0031] (2) Assembly language is a low-level programming language that uses human-readable mnemonics (such as MOV and ADD) to represent machine instructions (binary code) of computer hardware. It is closely related to a specific processor architecture. The assembler converts these mnemonics into machine code so that the computer can execute them directly.

[0032] (3) Intermediate Representation (IR) is an abstract code form that lies between high-level source code (such as C / C++) and low-level code (binary code and assembly language) during the program compilation process. It is used for program analysis and optimization.

[0033] (4) Platform-independent code (P-Code) refers to a specific type of intermediate representation defined by the Ghidra decompilation tool, which can uniformly convert machine instructions from different computing platforms into semantically equivalent intermediate operation sequences.

[0034] (5) Reduced P-Code is a preprocessed form of P-Code proposed in this invention. It removes redundant information (such as temporary variables and dead code) generated by decompilation tools and unrelated to the core program logic in the original P-Code through data flow analysis, and has higher semantic density.

[0035] (6) Large Language Model (LLM) refers to a deep learning model trained on large-scale text data, which has powerful natural language understanding and generation capabilities.

[0036] (7) Supervised fine-tuning (SFT) is the process of training a pre-trained large language model using data with “instruction-response” labels to adapt it to a specific task or follow a specific instruction format.

[0037] In the fields of software security, reverse engineering, and vulnerability discovery, static analysis of binary executable files is fundamental to understanding program behavior and identifying security vulnerabilities. Due to the lack of source code, analysts rely heavily on disassemblers or decompiles, whose core function is to convert machine code into a representation that is easier for both humans and machines to understand.

[0038] Intermediate representation (IR) plays a crucial role in this process, acting as a bridge to shield the complexity and differences of the underlying hardware (such as different CPU architectures like x86, ARM, and MIPS). P-Code, the standard IR adopted by Ghidra, a leading reverse engineering platform, is widely used for cross-architecture program analysis due to its platform independence and structured expressive capabilities.

[0039] In recent years, Large Language Models (LLMs) have achieved remarkable success in understanding, generating, and completing tasks in high-level programming languages ​​such as Python and Java. However, transferring the capabilities of these models to low-level, platform-independent information retrieval (IR) layers (such as P-Code) faces a series of fundamental challenges.

[0040] Existing large-scale code models primarily learn programming paradigms from massive amounts of source code. They can mimic programmers' coding styles, but lack a deep understanding of the actual machine-level form of programs after compilation and optimization. This results in a lack of low-level binary semantic understanding when dealing with representations like P-Code that directly reflect binary execution logic. They are unable to accurately model complex binary-level behaviors such as compiler optimizations (e.g., instruction reordering, function inlining), memory layout (e.g., stack frame structure, memory alignment), register allocation and reuse, for example: The pre-trained models based on source code, commonly used in current technologies, employ the principle of pre-training on massive amounts of open-source high-level language code (such as Python, Java, and C++) and their associated natural language text (such as comments and documentation), allowing the large language model to learn the syntax, code structure, and programming logic of high-level languages. This type of model (such as CodeBERT) relies entirely on source code and its comments for training. However, source code loses a significant amount of information (such as variable names and high-level structures) during compilation and introduces compiler-specific optimizations (such as instruction reordering and register allocation). Because the underlying code after symbols have never been seen, the resulting large language model cannot establish a semantic mapping between the source code logic and the binary execution state (such as register changes, stack frame layout, and memory flags). This results in its inability to understand the actual program behavior running on the machine when performing reverse engineering tasks.

[0041] Furthermore, current binary function embedding models based on representation learning treat the binary code similarity search problem as a representation learning problem. The core idea is to design a neural network model that embeds a variable-length binary function (usually its assembly instruction sequence and control flow graph) into a fixed-dimensional vector embedding, making functionally similar functions closer together in the vector space. However, these models lack the ability to generate and interact with underlying machine code. This is mainly because these models (such as Asm2Vec) are discriminative models rather than generative models. While they can calculate similarity by compressing functions into fixed vectors, they completely lose the ability to recover or generate code, limiting them to tasks like binary code similarity detection and known vulnerability feature matching. This results in models that cannot explain the function's functionality in natural language or translate assembly code back into a high-level language. Moreover, they are closed mathematical models, unable to interact with analysts through natural language commands like large language models. Their application scenarios are limited to "known sample search," unable to handle unknown analytical tasks requiring logical reasoning.

[0042] Existing technologies also include end-to-end assembly-to-source code translation based on large language model fine-tuning. This method takes assembly code text of a specific CPU architecture as input and the corresponding high-level language (such as C) source code text as output. Then, it uses a large language model (LLM) for end-to-end training. The goal is to enable the LLM to directly learn the mapping relationship between low-level, platform-dependent assembly instructions and high-level, human-readable source code.

[0043] Because assembly language is tightly coupled with CPU architecture, models trained on x86 assembly cannot understand code from other architectures such as ARM or MIPS. To support multiple architectures, a separate model must be trained for each architecture, which is extremely costly and difficult to maintain.

[0044] In addition, this plan is tested Figure 1 This approach attempts to bridge the significant semantic gap between assembly and high-level C code. The complex many-to-many mapping between assembly and high-level languages ​​(compiler optimizations can transform a single line of C code into multiple lines of assembly, or vice versa) makes models highly susceptible to generating syntactically correct but logically flawed code. Experimental results from LLM4Decompile, a representative example, confirm this: even its best model only achieves 21% semantic accuracy, indicating a significant bottleneck in ensuring functional equivalence.

[0045] Furthermore, this approach typically uses raw assembly or decompiled intermediate code as input. This raw code is riddled with tool-generated temporary variables, dead code, and other artifacts. Training directly with this noisy data not only wastes valuable context windows but also forces the model to learn a large amount of meaningless information, reducing the model's efficiency in learning core program logic.

[0046] In view of the many shortcomings of the existing solutions, the present invention provides a method, apparatus and electronic device for training and analyzing large language models with platform-independent intermediate representation code, which mainly aims to solve the following key technical problems: (1) Solve the problem that existing large language models have difficulty mastering the underlying semantics after compilation. This invention constructs training data with intermediate representation code (P-Code) as the core and designs corresponding pre-training tasks, so that the model can directly learn the actual execution logic, register state and memory behavior of the program after compilation during the training process, thereby bridging the semantic difference between high-level source code and low-level binary.

[0047] (2) This invention addresses the problem that existing binary representation learning schemes are limited in function and lack the ability to generate and interact with natural language. During the training process, this invention adopts a strategy of training with a mixture of platform-independent code (P-Code), high-level language code, and general natural language corpus. By aligning the semantic spaces of the code modality and the natural language modality, the invention endows the model with the ability to understand user instructions, interpret the meaning of code, and generate code.

[0048] (3) This invention addresses the problems of poor versatility and high training costs associated with existing architecture-specific fine-tuning schemes and multi-architecture migration. It utilizes the platform-independent nature of P-Code (P-Code) to construct a unified intermediate representation training space, shielding the differences in underlying instruction sets. This allows the model to simultaneously acquire the ability to analyze and understand the P-Code converted from various hardware architectures such as x86, ARM, and MIPS, requiring only a single training process.

[0049] (4) Solve the problem of model convergence difficulty and "logical illusion" caused by the high difficulty of semantic mapping in end-to-end decompilation training. This invention uses the strong structure and explicit semantics of platform-independent code P-Code as a "bridge" during training, which reduces the difficulty for large language models to learn the mapping relationship from low-level language to high-level language, establishes a more stable semantic correspondence, thereby effectively suppressing illusion and improving the logical accuracy of model understanding and code generation.

[0050] As a further alternative, this invention can also address the problems of low signal-to-noise ratio and low learning efficiency for long sequences caused by the large amount of redundancy in the original input data in existing training schemes. This invention designs a specific platform-independent code P-Code reduction algorithm as a preprocessing step before training. While preserving the core semantics of the program, it significantly shortens the sequence length of training samples. This not only improves the effective information density (signal-to-noise ratio) of the training data but also significantly enhances the ability of large language models to capture long functional context dependencies and improves training efficiency.

[0051] The following is combined with Figures 1-4 This invention describes the large language model training and program analysis method, apparatus, and electronic device provided by the present invention.

[0052] Figure 1 This is one of the flowcharts illustrating the large language model training method provided by this invention, such as... Figure 1 As shown, including but not limited to the following steps: Step 11, construct a training sample set, wherein each training sample in the training sample set includes task instructions and intermediate representation code sequences as input to the model, as well as pre-set label information corresponding to the input to the model; Step 12: Use the training sample set to perform supervised fine-tuning training on the initial large language model to obtain the target large language model; The intermediate representation code sequence is obtained by converting machine instructions in binary file samples of any processor architecture into semantic operation sequences that are independent of the processor architecture.

[0053] This embodiment provides a method for training a large language model, the execution entity of which can be one or more electronic devices deployed on a cloud server, a local server cluster, or an edge computing node. These electronic devices include, but are not limited to, processors, memory, and a communication bus for connecting the two. The following embodiments will use this electronic device as the execution entity for description.

[0054] In this embodiment, the core training data is referred to as a special data format of intermediate representation code sequence, which is essentially a semantic operation sequence that is independent of specific hardware platforms. The design goal of this semantic operation sequence is to uniformly convert the underlying machine languages ​​of different processor architectures (such as x86-64, ARM, MIPS, etc.) into a common intermediate language that can represent the program execution logic.

[0055] Specifically, the intermediate representation represents one method of obtaining the code sequence, which may include, but is not limited to: First, obtain binary file samples for any processor architecture. These binary file samples refer to the executable files or library files generated after compilation.

[0056] Subsequently, the machine instructions in the binary file sample are processed using a disassembler, converting them into the aforementioned processor architecture-independent semantic operation sequence. Here, machine instructions refer to binary codes that the processor can directly execute. This conversion process is the foundation for the cross-platform capability of this invention. The principle is that regardless of the differences in the underlying machine instructions, the program execution semantics they ultimately implement (such as data loading, storage, arithmetic operations, conditional jumps, etc.) are finite and common. The resulting semantic operation sequence is precisely an abstract representation of these common semantics.

[0057] After obtaining the intermediate representation code sequence, training samples can be constructed. A training sample is the smallest unit of data used for training. In this embodiment, it typically consists of a triplet, including: the task instruction and intermediate representation code sequence as input to the model, and pre-set label information corresponding to the model input.

[0058] The task instruction can be a piece of natural language text, used to define what analysis task the large language model needs to perform. For example, the task instruction could be "Please decompile the following code into C language" or "Please analyze whether this function has a buffer overflow vulnerability." The label information is the standard answer corresponding to the model input, and its specific content depends on the type of task instruction. For example, if the task instruction is decompilation, then the label information is the original high-level language source code corresponding to the binary file sample.

[0059] Finally, the training sample set is formed by combining a large number of pre-constructed training samples.

[0060] This embodiment transforms a general initial large language model (e.g., an open-source base model with code) into an expert model capable of understanding the intermediate representation code sequence and performing specific program analysis tasks. This process can be achieved through supervised fine-tuning (SFT), and the specific implementation method can be: Training samples are batch-wise extracted from the training sample set. The task instructions and intermediate representation code sequences in each training sample are used as model input and fed into the initial large language model. The initial large language model will autoregressively generate a prediction result based on the model input.

[0061] Subsequently, the prediction result is compared with the corresponding label information in the training sample, and the loss between the two is calculated using a preset loss function (such as the cross-entropy loss function).

[0062] Finally, the gradient of the loss with respect to all trainable parameters within the model is calculated using the backpropagation algorithm, and an optimizer (such as the Adam optimizer) is used to make small adjustments to the model parameters based on this gradient so that the loss for the next prediction is reduced.

[0063] The above training process will be carried out iteratively until the performance of the trained model on the validation set reaches the preset standard or the preset number of training rounds is completed. The model obtained at this time is the target large language model.

[0064] The large language model training method provided in this invention does not directly use assembly or source code. Instead, it innovatively adopts platform-independent intermediate representation code as training corpus, unifying the instruction sets of different hardware platforms at the semantic level. This solves the technical problem that existing models cannot be universally used across platforms due to their dependence on specific architectures, thereby achieving the effect of training once and being universal across multiple architectures. This significantly improves the generalization ability and applicability of the model in the field of binary program analysis.

[0065] To ensure that the final trained target large language model possesses sufficiently strong generalization ability to handle the complex and diverse binary programs in the real world, high-quality, large-scale, and diverse training data is crucial. Therefore, in one optional embodiment, the construction process of the binary file samples includes the following steps: First, collect source code from multiple high-level languages. For example, you can collect a massive amount of source code projects in system-level programming languages ​​such as C, C++, Rust, and Go from large open-source code hosting platforms (such as GitHub and GitLab). Selecting source code from multiple languages ​​aims to ensure that the large language model can learn the general program structure and patterns exhibited by different programming languages ​​after compilation, rather than being limited to the compilation characteristics of a single language.

[0066] Secondly, using different versions of compilers and setting different optimization levels, the source code is compiled into binary executables covering multiple instruction set architectures. In a specific implementation, this step is further subdivided into: (1) Use multiple compiler versions. For example, for the same source code, you can use multiple mainstream compilers such as GCC, Clang, and MSVC, and cover their different distributions. Since different compilers or different versions of compilers have differences in code generation strategies, register allocation and instruction selection, this can make the training sample set contain training samples composed of different machine instruction sequences generated by different compilation toolchains.

[0067] (2) Set multi-level optimization options. For example, multiple optimization levels can be set at compile time, ranging from no optimization to the highest level of optimization. Because compiler optimization can greatly change the code structure, such as function inlining and loop unrolling, covering multi-level optimization options allows the model to learn to understand both logically straightforward unoptimized code and structurally complex optimized code.

[0068] (3) Covering multiple instruction set architectures. The target platform to be compiled can cover multiple mainstream instruction set architectures, such as x86, x86-64, ARMv7, AArch64, MIPS, etc. This is the core of building cross-platform training data and ensures that the training sample set contains the binary instructions of all target platforms that the large language model will need to analyze in the future.

[0069] The binary executable file obtained through the above cross-compilation process is the binary file sample.

[0070] The embodiments of the present invention greatly enrich the diversity of binary file samples by adopting a combination of multi-language source code, multi-version compilers, multi-level optimization options and multi-instruction set architecture. This diversity ensures that the training dataset can fully simulate the form of binary programs in the real world, so that the large language model can be exposed to the widest possible range of instruction patterns, code structures and compilation products during the training phase, thereby training a cross-platform binary analysis model with high generalization ability.

[0071] Based on the above embodiments, unifying machine instructions from different platforms into platform-independent semantic operation sequences is the core of achieving cross-architecture capabilities. As an optional embodiment, a specific implementation method for this conversion process is provided below, aiming to ensure the accuracy, efficiency, and granularity consistency of the conversion process. This process may include the following steps: First, the binary file sample is physically segmented according to function granularity to obtain the segmented binary functions.

[0072] A complete binary file sample may contain hundreds or thousands of functions and non-code data. In order for a large language model to focus on learning and analysis of independent logical units, the binary file sample can be parsed in a structured manner first.

[0073] In one specific implementation, this step can be performed using a program segmentation module. This program segmentation module can parse the format of the binary file sample (e.g., ELF, PE, etc.), identify the code segments and symbol table information, and thus accurately locate the address information of each function in the binary file sample. The address information here mainly includes the start address, end address, etc.

[0074] Based on this address information, the program segmentation module extracts binary data blocks representing individual functions; these data blocks are the segmented binary functions. This approach, using functions as the basic processing unit, aligns with the modular analysis conventions in software engineering and provides large language models with appropriately sized and logically cohesive analysis objects.

[0075] During the segmentation process, the program segmentation module can also create index information for each binary function. This index information includes at least the function name and its position within the binary file sample, among other metadata. The purpose of creating the index information is to support the accurate association and retrieval of the corresponding label information for the binary function element, such as its high-level program source code, when constructing training samples later, thereby ensuring the correct pairing of model input and label information.

[0076] Secondly, the reverse analysis engine is invoked to disassemble the segmented binary function to obtain the semantic operation sequence.

[0077] After obtaining the binary function at the function granularity, it can be elevated from platform-specific machine instructions to a platform-independent semantic representation. In one specific implementation, this step can be accomplished using a reverse engineering engine.

[0078] Reverse engineering engines, such as the open-source tool Ghidra or the commercial tool IDA Pro, generally possess powerful multi-architecture disassembly capabilities and intermediate representation enhancement capabilities.

[0079] In one specific implementation, the segmented binary function obtained in the previous step is used as input and fed into the reverse analysis engine. The reverse analysis engine first calls the corresponding disassembler based on the processor architecture information of the binary function to translate its machine instruction sequence line by line into human-readable assembly instructions.

[0080] Next, the reverse engineering engine further promotes these platform-specific assembly instructions into an internally defined, processor architecture-independent intermediate representation, namely the semantic operation sequence. For example, the Ghidra tool promotes it into a P-Code opcode sequence. This process maps functionally identical instructions across different architectures, such as x86's mov eax, [ebx] and ARM's LDR R0, [R1], to the unified semantic operations LOAD(tmp, ebx) and COPY(eax, tmp)).

[0081] Through the above-described implementation methods of function-level granular segmentation and invoking the reverse analysis engine, this invention not only ensures the uniformity of training data granularity and logical cohesion, but also reliably and efficiently completes the key transformation from platform-specific machine instructions to platform-independent semantic operation sequences by utilizing mature reverse engineering tools, providing a data source for the subsequent construction of high-quality cross-architecture training sample sets.

[0082] Based on the above embodiments, processor-independent intermediate representation code sequences can be obtained. However, intermediate representation code sequences generated by automated tools often introduce a large number of redundant instructions to ensure accurate semantic translation. These redundant instructions, such as variable assignment operations for temporarily storing calculation results or invalid code paths left over from compiler optimizations, do not affect the final execution result of the program, but they significantly increase the length of the sequence and reduce the density of effective information. If such intermediate representation code sequences containing a large number of redundant instructions are directly used for training large language models, the large language models will be forced to spend a lot of effort to process these irrelevant noises while understanding the core program logic, thereby reducing the training efficiency and the upper limit of model performance.

[0083] To address this technical problem, this embodiment adds a crucial data preprocessing step before constructing the training sample set. This step involves removing redundant instructions from the intermediate representation code sequence based on the data flow analysis results of the intermediate representation code sequence, resulting in a reduced intermediate representation code sequence.

[0084] In one optional implementation, the semantic reduction processing may employ a program dependency-based analysis method, including: First, the intermediate representation code sequence is parsed to identify all control dependencies and data dependencies.

[0085] Subsequently, by constructing a simplified program dependency graph, a subset of instructions that do not affect any program output or critical side effects (such as system calls) can be quickly identified as redundant instructions.

[0086] For example, if a code block calculates a value that is never used by any subsequent part of the code (including function returns), its corresponding instruction sequence will be marked as redundant and removed.

[0087] Based on the above embodiments, as an optional embodiment, the step of removing redundant instructions from the intermediate representation code sequence based on the data stream analysis results of the intermediate representation code sequence may include, but is not limited to: Construct the data flow graph representing the intermediate code sequence; Traverse the data flow graph and delete assignment operation instructions that are not referenced by subsequent instructions; Based on the data flow graph, the definition instructions and usage instructions for temporary variables used only for data transfer are merged.

[0088] In this embodiment, the intermediate representation code sequence at the function granularity is first parsed into a series of basic blocks, and a control flow graph (CFG) is constructed based on the jump relationship between the basic blocks.

[0089] Subsequently, within each basic block of the control flow graph and across basic blocks, iterative calculations are performed to analyze the definition points (assignment points) and usage points (read points) of each variable, thereby establishing a precise Define-Use Chain (DU-Chain). Combining the control flow graph with this Define-Use Chain constitutes the data flow graph that can fully describe the data flow path within the function.

[0090] After constructing the data flow graph, dead code elimination can be performed. Specifically, this involves traversing each variable definition point (i.e., assignment operation instruction) in the data flow graph. For each assignment operation, the graph is checked to see if there is at least one subsequent usage point. If, after an assignment operation, no instruction reads the value of the variable until it is reassigned or the function ends, then the assignment operation instruction is considered dead code. In this embodiment, all assignment operation instructions deemed dead code are removed from the intermediate code sequence.

[0091] Furthermore, this embodiment also employs temporary variable folding to eliminate redundant instructions in the intermediate representation code sequence.

[0092] In intermediate representation code sequences generated by disassemblers, there are often temporary variables used only to pass a calculation result from one instruction to the next. For example, in the intermediate representation code sequences tmp=a+b and result=tmp c. During the traversal of the data flow graph, temporary transit variables tmp with extremely short lifecycles (defined or used only once) are identified. Once identified, a forward substitution is performed, directly replacing its definition (a+b) with its usage, thus merging the two instructions into a single equivalent instruction result=(a+b). c, and delete the original two instructions.

[0093] After the above processing, the resulting sequence is the reduced intermediate representation code sequence. Accordingly, in the subsequent step of constructing the training sample set, the reduced intermediate representation code sequence can be used to replace the original intermediate representation code sequence to construct the training samples.

[0094] This invention, through the introduction of semantic reduction processing, purifies the training data, significantly shortening the length of the input sequence without compromising the core logic of the program. This allows the model to process functions with more complex logic and longer code within a limited context window. Furthermore, by eliminating redundant instructions, the signal-to-noise ratio of the data is improved, enabling the large language model to focus more on learning the key control and data flows that determine program behavior. This not only accelerates the model's convergence process but also further enhances the accuracy and depth of the final target large language model in program understanding and analysis tasks.

[0095] Based on the above embodiments, as an optional embodiment, a specific method for constructing a training sample set is also provided, wherein the label information is specifically determined according to the type of the task instruction.

[0096] The training samples consist of task instructions, intermediate representation code sequences, and label information. This "instruction-input-answer" format allows for diverse supervised fine-tuning of the large language model. To enable the trained target large language model to perform comprehensive and multi-dimensional analysis and understanding of binary programs, this embodiment designs various types of analysis tasks based on the actual needs of the binary analysis field. When constructing the training sample set, the corresponding specific label information is determined according to the type of task instruction.

[0097] As an optional implementation, constructing the training sample set includes determining the label information based on the type of the task instruction, as follows: (1) If the task instruction indicates a high-level semantic restoration task, for example, the task instruction is "Please summarize the function of the following code", then a natural language summary describing the function of the binary file sample is obtained as the tag information. The natural language summary can be a general description of the function algorithm logic, main function or implementation purpose, used to train the model to understand and generate high-level program semantics from the underlying intermediate representation code.

[0098] (2) If the task instruction indicates a security and vulnerability analysis task, for example, the task instruction is "Please analyze whether this function has a security vulnerability", then an analysis report containing at least one of the following: vulnerability type, vulnerability location, and remediation suggestion is obtained as the tag information. This analysis report can clearly indicate the specific vulnerability (such as buffer overflow, integer overflow, etc.) in the function, the line number or instruction address that caused the vulnerability, and may provide corresponding remediation suggestions. It is mainly used to train the model to have the ability to automatically discover potential security risks in binary programs.

[0099] (3) If the task instruction indicates a performance behavior analysis task, for example, the task instruction is "Please evaluate the performance bottleneck of this function", then obtain an analysis report containing algorithm complexity evaluation and / or optimization suggestions as the tag information. The analysis report may be an evaluation of the function's time complexity or space complexity, or it may identify performance bottlenecks such as hot code paths and inefficient loops, and provide optimization suggestions. It is mainly used to train the model to have the ability to perform static analysis and bottleneck location of program performance.

[0100] (4) If the task instruction indicates a code generation task, for example, the task instruction is "Please decompile the following intermediate representation code into C++ code", then the high-level program source code corresponding to the binary file sample is obtained as the tag information. This is the core task in reverse engineering, used to train a model to restore the machine-level intermediate representation code into human-readable high-level language code. Its core lies in learning the semantic mapping between two languages ​​with different levels of abstraction.

[0101] (5) If the task instruction indicates a complex generation task under multiple constraints, such as "Rewrite this function to fix the integer overflow vulnerability while keeping the original logic unchanged", then obtain the intermediate representation code sequence and / or analysis text that satisfies the specific constraints as the label information. This type of task requires the model to perform controlled code generation or modification based on one or more new constraints (such as fixing vulnerabilities, improving performance, changing code style, etc.) after understanding the original code logic. Its label information is usually a modified new code sequence that satisfies all constraints or a corresponding analysis description, used to train the model to possess advanced capabilities for code refactoring or security fixes under complex requirements.

[0102] In another alternative implementation, the task format is first standardized, with each training sample following a uniform prompt word template structure. This prompt word template structure mainly includes: 1. Task Instruction: This is a piece of natural language text used to define the task objective, such as "Analyze whether this function has a security vulnerability" or "Generate pseudocode for this function".

[0103] 2. Model Input (INPUT): This contains the intermediate representation code sequence to be analyzed and may include relevant contextual metadata, such as the processor architecture and compilation options of the function.

[0104] 3. Label information (OUTPUT), which is the expected result as the model's prediction target. It can be in the form of a natural language analysis report or a generated code sequence.

[0105] Based on this standardized format and according to the actual needs of the binary analysis field, the following five core tasks are constructed to achieve comprehensive coverage of the semantic features of the intermediate representation code sequence, which may include the following: One type is the high-level semantic reconstruction task. The purpose of this type of task is to train the model to understand and generate high-level program semantics from low-level intermediate representation code. For example, in one high-level semantic reconstruction task, if the task instruction is "generate pseudocode," then the corresponding label information is high-level pseudocode describing the logic sequence of the intermediate representation code. This task is used to train the model to map low-level operations to human-readable control flow logic. In another high-level semantic reconstruction task, if the task instruction is "infer the original programming language," then the corresponding label information is the most likely original programming language of the function, such as C, C++, or Rust. This task is used to train the model to recognize the unique code patterns generated by different compilers for different languages.

[0106] The second type is security and vulnerability analysis tasks. The purpose of these tasks is to train models to automatically uncover potential security risks in binary programs. For example, in one type of security and vulnerability analysis task, if the task instruction is "identify code defects," the corresponding label information is a description of potential code defects or logical vulnerabilities (such as buffer overflows, uninitialized variable usage, etc.). In another type of security and vulnerability analysis task, if the task instruction is "analyze external dependencies," the corresponding label information is a list of external symbol references analyzed from the sequence, used to identify the program's dependencies on specific library files, system calls, or APIs.

[0107] Thirdly, there are performance and program behavior analysis tasks. The purpose of these tasks is to train the model to perform static analysis of program performance and pinpoint bottlenecks. For example, in one performance and program behavior analysis task, if the task instruction is "analyze memory access patterns," then the corresponding label information is an analysis and description of the sequence of memory access behaviors (such as sequential access and random access) to assist in cache analysis. In another performance and program behavior analysis task, if the task instruction is "derive the caller," then the corresponding label information is the set of upper-level functions that may call this function, used to train the model to understand cross-function call graph relationships.

[0108] Fourthly, there are code generation tasks. These tasks serve as the dual to understanding tasks and aim to enhance the model's ability to generate intermediate representation code syntax. For example, in one code generation task, if the task instruction is "generate P-Code based on the description," then the model input is a piece of pseudocode or a natural language description, and its corresponding label information is an accurate sequence of intermediate representation code that can implement the logic of the description.

[0109] Fifthly, there are complex generation tasks under multiple constraints. The purpose of these tasks is to train models to possess advanced capabilities for code refactoring or repair under complex requirements. For example, in a complex generation task under multiple constraints, if the task instructions include logical descriptions and additional constraints, the model input is a piece of pseudocode and one or more constraints, such as specific call relationship requirements or performance requirements. The corresponding label information is a specific intermediate representation code sequence that not only implements the pseudocode logic but also satisfies all additional constraints.

[0110] This invention, through the design of various task types, constructs a structured training system covering the core needs of binary program analysis. This multi-task learning paradigm enables the final trained target large language model to perform not only single decompilation or search tasks, but also to become a general-purpose binary analysis assistant capable of deep semantic understanding, security vulnerability discovery, performance bottleneck analysis, and complex code generation, greatly expanding the breadth and depth of application of large language models.

[0111] In practical implementation, large language models may experience catastrophic forgetting if they undergo long-term supervised fine-tuning training on a single, highly specialized dataset (e.g., data containing only intermediate representation code sequences). This phenomenon manifests as a significant decline in the model's original general language capabilities, such as fluent conversation, understanding complex questions, and generating general text, while improving its domain-specific abilities. This reduces the model's versatility and user experience.

[0112] As an optional implementation, in order to maintain and enhance the target large language model's ability to understand and generate general natural language during training and to avoid its ability degradation after training on proprietary code data, the step of constructing the training sample set further includes the hybrid processing of the corpus, mainly including: First, acquire general natural language text data. This general natural language text data can refer to a large, high-quality corpus consisting of web pages, books, encyclopedias, news articles, and other texts covering various topics. This data represents the broad knowledge learned by the model as a general language model before it becomes a binary analysis expert.

[0113] Secondly, the general natural language text data is added to the training sample set according to a preset ratio. In specific implementations, this preset ratio is a hyperparameter that needs to be weighed. If the preset ratio is too low, it will be insufficient to combat catastrophic forgetting; if the ratio is too high, it will dilute the training effect of the specialized data and prolong the time required for the model to converge on the core task. In an optional implementation of this embodiment, the preset ratio can be set between 5% and 10%, which means that in each training batch, in addition to containing a large number of specialized task training samples, a small portion of general natural language text data will also be randomly mixed in.

[0114] This invention employs a hybrid training method that combines specialized code data with general text data. This allows the large language model to learn the syntax and semantics of intermediate representation code sequences while periodically reviewing and consolidating its existing natural language knowledge. This strategy effectively suppresses accidental forgetting and ensures that the final target large language model is not only a professional binary analysis tool but also an intelligent assistant capable of smooth and natural interaction with users, significantly enhancing the comprehensive capabilities and practical value of the large language model.

[0115] In practical implementation, the initial large language model can be an open-source base model based on the Transformer architecture, such as the Qwen series models, as the starting point for supervised fine-tuning training. Directly mixing training sample sets containing intermediate representation code sequences of varying lengths, ranging from hundreds to hundreds of thousands of tokens, together for training will make it difficult for the model to effectively learn the dependencies in long sequences, and long sequence samples will bring huge computational overhead.

[0116] In a specific embodiment of the present invention, in order to solve the problems of convergence difficulty and low training efficiency caused by directly processing intermediate representation code sequences with huge length differences during the training process, the step of supervising and fine-tuning the initial large language model using the training sample set adopts an optimization strategy based on curriculum learning, which mainly simulates the human learning process from easy to difficult.

[0117] The optimization strategy first buckets all training samples in the training sample set according to the length of the intermediate representation code sequence they contain (e.g., in terms of the number of tokens), and obtains a bucket sequence arranged in ascending order of length. Then, following the order of the bucket sequence, the initial large language model is trained sequentially using training samples from different buckets.

[0118] In a more specific implementation, the binning sequence includes a first bin, a second bin, and a third bin, corresponding to three training phases: The length of the intermediate representation code sequence of the training samples in the first bucket is less than a first threshold (e.g., the first threshold may be set to 8K Tokens).

[0119] The first stage of training, namely the basic semantic matching stage, uses only the training samples (which may be mixed with general natural language text data) within the first bucket to train the initial large language model. In this stage, since only short sequences are processed, the computational cost is low, and the large language model can quickly establish the semantic mapping relationship between the intermediate representation code sequence and the label information.

[0120] Specifically, large language models primarily learn the basic syntactic structure of intermediate representation codes, the semantics of individual operation instructions, and their direct correspondence with natural language descriptions or high-level code snippets. This stage typically involves the largest amount of training data, aiming to lay a solid semantic foundation for the model.

[0121] The length of the intermediate representation code sequence of the training samples in the second bucket is between the first threshold and the second threshold (for example, the second threshold may be set to 32K tokens).

[0122] The second phase of training, the long context expansion phase, builds upon the training in the first phase by incorporating a certain proportion of training samples from the second bucket for mixed training. In this phase, the large language model begins to engage with and process longer code sequences, with the training objective of learning contextual dependencies across basic blocks. For example, the large language model needs to understand how a variable defined at the beginning of a function is used after multiple branches and loops, thereby improving its logical understanding of medium-sized functions.

[0123] The length of the intermediate representation code sequence of the training samples in the third bucket is greater than the second threshold (e.g., greater than 32K tokens, up to 128K tokens or higher).

[0124] The third stage of training, the ultra-long sequence learning stage, builds upon the training in the first two stages by further introducing training samples from the third bucket for fine-tuning. In this stage, the large language model will process extremely complex ultra-large functions or complete program slices, with the training objective of learning the global logical features of the functions. This requires the large language model to possess the ability to capture key information within extremely long contexts and understand the global flow of complex control and data flows, thereby gaining a global perspective for analyzing large, complex binary programs.

[0125] This invention employs a phased learning strategy to decompose a complex long-sequence learning problem into multiple sub-tasks of increasing difficulty. This progressive training method not only effectively reduces the difficulty of long-sequence training and avoids the problem of the model failing to converge in the early stages of training due to excessively long contexts, but also significantly improves the stability and efficiency of the training process. This allows the final target large language model to gradually master comprehensive program analysis capabilities, from local syntax to global logic.

[0126] Figure 2 This is the second flowchart of the large language model training method provided by this invention. The following is a combination of... Figure 2 As shown, a complete implementation of the large language model training method provided by the present invention is fully described.

[0127] The overall process of the large language model training method provided in this embodiment begins with the construction of the data source, followed by data preprocessing and multi-dimensional task construction. Finally, the supervised fine-tuning training of the model is completed through a phased course learning strategy to obtain the target large language model.

[0128] First, construct a multi-architecture binary data source.

[0129] To ensure the wide applicability of the final trained large language model, this embodiment first constructs a diverse binary file sample dataset. First, a massive amount of source code in various high-level languages ​​such as C, C++, and Rust is collected from open-source code hosting platforms. Then, using a cross-compilation strategy, different versions of compilers (e.g., GCC 8.x, Clang 10.x, etc.) and different optimization levels are used to compile these source codes into binary executables covering multiple instruction set architectures (e.g., x86-64, AArch64, MIPS, etc.). Through this combination of multiple languages, compilers, optimization levels, and architectures, a highly diverse set of binary file samples with varied code styles, compilation artifacts, and underlying instructions can be generated.

[0130] Next, the intermediate representation code sequence is extracted and processed.

[0131] After obtaining the binary file sample, this embodiment converts it into a processor architecture-independent format that the large language model can understand. This process includes the following steps: (1) P-Code Extraction, Segmentation, and Metadata Association. Using the program segmentation module, each binary file sample is parsed and segmented at the function granularity to obtain independent binary function data blocks. At the same time, metadata (such as function name, source file information, etc.) is associated with each function to build an index. Subsequently, a reverse analysis engine (such as Ghidra) is called to process each segmented binary function, "raising" its platform-specific machine instruction sequence into a platform-independent intermediate representation code sequence, i.e., the P-Code sequence.

[0132] (2) Semantic Reduction of P-Code Based on Data Flow Analysis. Directly boosted P-Code sequences often contain a large number of redundant instructions. To improve data quality, this embodiment performs semantic reduction on the sequence. Specifically, by constructing a data flow graph within the function, the definition-use chain of variables is analyzed, thereby identifying and deleting dead code that is not referenced by subsequent instructions, and merging temporary variable folding that is only used for data transfer. After this step, a simplified intermediate representation code sequence with a higher signal-to-noise ratio and shorter length is obtained.

[0133] (3) Task construction. After obtaining a high-quality, concise intermediate representation code sequence, it needs to be organized into a format that can be learned by a large language model.

[0134] First, this embodiment uses a unified prompt word template to construct all training samples. This template consists of three parts: task instruction (INSTRUCTION), which defines the task objective; model input (INPUT), which contains the simplified intermediate representation code sequence to be analyzed; and label information (OUTPUT), which is the standard answer expected to be generated by the model.

[0135] Furthermore, based on the above template, five core tasks were constructed, including: semantic restoration tasks, security analysis tasks, performance analysis tasks, code generation tasks, and multi-constraint generation tasks.

[0136] Then, general prediction mixing and length binning are performed. To prevent the model from forgetting general language capabilities during specialized training, general natural language text data is mixed into the training sample set at a ratio of 5%-10%. At the same time, all training samples are divided into three buckets based on the token length of the intermediate representation code sequences they contain: short sequences (e.g., less than 8K), medium-long sequences (e.g., 8K-32K), and very long sequences (e.g., greater than 32K).

[0137] Finally, the course-based supervised fine-tuning (SFT) phase begins. This embodiment employs a course-based supervised fine-tuning (SFT) strategy, training the model from easy to difficult.

[0138] Phase 1, Short Sequence Basic Semantic Adaptation: In this phase, only training samples from the short sequence buckets are used. The model quickly learns the basic syntax, instruction semantics, and fundamental mapping relationship between the intermediate representation code and label information.

[0139] Phase Two, Medium-to-Long Sequence Context Expansion: Building upon the training in Phase One, training samples from medium-to-long sequence buckets are added. In this phase, the model begins to learn control flow and data flow dependencies spanning multiple basic blocks over longer distances, improving its understanding of medium-complexity functions.

[0140] Phase Three, Global Training with Ultra-Long Sequences: Building upon the first two phases, ultra-long sequence buckets are introduced for fine-tuning. In this phase, the model learns to understand the global logic and overall structure of large, complex functions, gaining a global perspective for handling complex real-world programs.

[0141] After completing all the above training phases, the model parameters are saved, resulting in the final target large language model. This model not only excels at low-level, platform-independent program execution logic but also possesses powerful natural language interaction capabilities, making it suitable for subsequent program analysis tasks.

[0142] Figure 3 This is a flowchart illustrating the program analysis method provided by the present invention, as shown below. Figure 3 As shown, this embodiment of the invention also provides a program analysis method, which aims to automatically analyze new and unknown binary programs using a target large language model obtained by the large language model training method described in any of the foregoing embodiments.

[0143] In one specific implementation, the execution entity of this program analysis method can be a server or local computer on which the target large language model is deployed. Its core principle lies in the fact that the data processing flow during the inference phase maintains a high degree of consistency with the training phase, ensuring that when the large language model processes new data, its input format perfectly matches the patterns learned during training, thereby enabling accurate application of its learned knowledge. This program analysis method typically includes the following steps: First, obtain the target binary file to be analyzed. The target binary file can be any binary program or library file submitted by the user through the command line, API interface, or graphical user interface, which the user wishes to analyze. Its processor architecture can be any one that the large language model has encountered during the training phase (e.g., x86-64, AArch64, etc.).

[0144] Secondly, the target function in the target binary file is converted into a semantic operation sequence independent of the processor architecture of the target binary file. Specifically, this embodiment first parses the target binary file and extracts the corresponding machine instruction sequence based on the target function specified by the user or automatically identified. Then, the same reverse analysis engine (e.g., Ghidra) used during training is invoked to promote the machine instructions of the target function into the platform-independent semantic operation sequence. This process ensures that the input data fed into the large language model is exactly the same as the language seen by the large language model during training.

[0145] Next, the user-inputted task instructions and the intermediate representation code sequence are combined to form the model input, which is then input into the target large language model. When submitting an analysis request, the user will clearly state their analysis intent through natural language, i.e., the user-inputted task instructions, such as "Please decompile this function" or "Analyze the security vulnerabilities of this function." In this embodiment, the task instructions are combined with the semantic operation sequence obtained in the previous step, according to the same format as the training samples (e.g., a template where INSTRUCTION is followed by INPUT), to form the final model input.

[0146] Finally, the analysis result text output by the target large language model is obtained. After the assembled model input is fed into the target large language model, the large language model will perform a forward inference calculation and autoregressively generate a text sequence as the analysis result text, the content of which corresponds to the task instruction input by the user. For example, if the task instruction is decompiled, the analysis result text is the high-level program source code generated by the model, corresponding to the input sequence.

[0147] The program analysis method provided in this embodiment reuses the data processing flow of the training phase and uses the pre-trained target large language model for inference to build an end-to-end automated binary program analysis workflow. This allows users to perform in-depth, multi-dimensional analysis of binary programs under different processor architectures in a natural language interactive manner. This not only greatly reduces the threshold and workload of manual reverse engineering, but also fully leverages the powerful cross-platform program understanding and generation capabilities of the target large language model.

[0148] In practice, a complex task instruction is directly given to the large language model, such as "Please analyze whether the following code has any logical vulnerabilities and explain why". The large language model may directly give a final conclusion, but its internal reasoning process is an invisible black box to the user, which makes the result difficult to verify and makes it difficult to locate the problem when the large language model makes a mistake.

[0149] To address this issue, this embodiment employs a Chain of Thought (CoT) prompting strategy when assembling model input. The core of this strategy is to guide the large language model to mimic the thought process of human experts by using specific prompt word structures, rather than directly requiring the large language model to output the final answer. This involves thinking step by step before drawing a conclusion.

[0150] In order to guide the target large language model to exhibit a clearer and more logical reasoning process when handling complex analysis tasks, thereby improving the accuracy and interpretability of the analysis results, as an optional embodiment, the process of combining the user-inputted task instructions with the intermediate representation code sequence to form the model input also includes the special construction of prompt information.

[0151] One alternative implementation is to embed thought chain prompts into the model input. These prompts can be additional instruction text that guides the target large language model to output intermediate reasoning steps and / or logical derivation processes before outputting the analysis result text.

[0152] For example, for a security analysis task, a task instruction without thought chain hints might be: "Task Instruction: Analyze vulnerabilities. Model Input: [P-Code Sequence]". A task instruction with embedded thought chain hints, however, might be constructed as: "Task Instruction: Please think step-by-step and analyze whether the following code contains vulnerabilities. First, identify the key functions of the code; then, check for unsafe function calls or data processing; finally, summarize your findings and draw conclusions. Model Input: [P-Code Sequence]".

[0153] When the target large language model receives this model input containing embedded thought chain hints, it first generates a series of intermediate reasoning steps before generating the final analysis result text. These steps may include: "Step 1: Code function analysis. This function implements xx function...", "Step 2: Dangerous function investigation. At address xxx, a call to the unsafe function yyy was detected...", "Step 3: Data flow tracing. The input of variable zzz was not validated and was directly passed as a parameter to yyy...". Only after outputting these logical deduction processes will the large language model give the final conclusion, i.e., the analysis result text, for example: "Conclusion: This function has a buffer overflow vulnerability because...".

[0154] This embodiment embeds thought chain prompts into the model input, breaking down a complex analysis task into a series of smaller, simpler logical steps. This effectively stimulates and utilizes the stepwise reasoning capabilities already learned by the large language model, enabling it to think more deeply and systematically when facing complex problems. This significantly improves the accuracy and logical rigor of its analysis results. Furthermore, because the large language model outputs detailed intermediate reasoning steps, its decision-making process becomes transparent and interpretable, greatly enhancing user trust in the analysis results.

[0155] In the aforementioned embodiments, although the large language model has been adequately trained, it may still generate "illusory" content that does not conform to grammatical rules or contains logical fallacies when generating code or analysis reports containing code snippets. If such results are presented directly to users, it may mislead them or cause subsequent toolchain processing to fail.

[0156] To address this issue, this embodiment introduces a self-consistency verification and self-correction mechanism. It utilizes external, deterministic analysis tools to verify the model's generated output and uses the verification results as feedback to trigger the model's self-correction behavior. Specifically, this may include the following steps: First, a static analysis tool is invoked to verify the grammatical correctness or logical consistency of the analysis result text.

[0157] Once the target large language model generates the analysis result text (e.g., a decompiled C code or a sequence of intermediate representation code that has fixed vulnerabilities), this embodiment will not immediately use it as the final output, but will call one or more pre-built static analysis tools to verify the text.

[0158] The static analysis tool can be a compiler for a high-level language (such as GCC or Clang), a syntax checker for intermediate representation code, or a more complex program logic analysis tool (such as CodeQL or Clint).

[0159] The content of the verification depends on the task type. For example, if the analysis result text is a piece of C code, the GCC compiler can be called to attempt to compile it for syntax correctness verification. If the compilation is successful, the syntax is considered correct. If the analysis result text is a piece of code that claims to have fixed a vulnerability, a specific static vulnerability scanning tool can be called to scan it for logical consistency verification, that is, to check whether the original vulnerability has indeed been fixed and whether no new problems have been introduced.

[0160] Secondly, if the verification fails, the verification error information is fed back to the target large language model to trigger the target large language model to correct the analysis result text.

[0161] If the static analysis tool reports an error during the verification process, such as a compilation failure returning an error message, or if the vulnerability scanning tool still detects a vulnerability, it means that the initial analysis result text generated by the large language model has defects. In this case, these verification error messages (e.g., "error: 'variable' undeclared" or "Buffer overflow detected at line 25") can be captured and reconstructed together with the original model input and the model-generated error output to form a new model input, which is then fed back to the target large language model.

[0162] This new model input includes an explicit correction instruction, such as: "The code you previously generated has the following compilation error: [Verification error message]. Please correct your code based on this error." Upon receiving this input containing feedback, the target large language model understands the defects in its previous output and attempts to generate a corrected, new version of the analysis result text. This "generate-verify-feedback-correct" process can be iterated until verification passes or the preset correction limit is reached.

[0163] This invention significantly improves the reliability of program analysis results by introducing external static analysis tools for verification and establishing a feedback correction closed loop. This self-consistency verification and self-correction mechanism effectively suppresses the illusion phenomenon of the model and ensures that the final output code snippets are syntactically correct and logically self-consistent, thereby significantly enhancing the practical value and credibility of this invention in key tasks such as automated code generation, code repair, and vulnerability analysis.

[0164] Based on the above embodiments, as an optional embodiment, the present invention also provides a large language model training device, which mainly includes, but is not limited to: A sample construction module is used to construct a training sample set. Each training sample in the training sample set includes task instructions and intermediate representation code sequences as input to the model, as well as pre-set label information corresponding to the model input. The intermediate representation code sequence is obtained by converting machine instructions in binary file samples of arbitrary processor architecture into semantic operation sequences that are independent of the processor architecture. The model training module is used to perform supervised fine-tuning training of the initial large language model using the training sample set to obtain the target large language model.

[0165] It should be noted that the large language model training device provided by the present invention can execute the large language model training method described in any of the above embodiments during specific operation, which will not be elaborated in this embodiment.

[0166] Based on the above embodiments, as an optional embodiment, the present invention also provides a program analysis device, which mainly includes, but is not limited to: The acquisition module is used to acquire the target binary file to be analyzed; A conversion module is used to convert the target function in the target binary file into a semantic operation sequence that is independent of the processor architecture of the target binary file; The input construction module is used to combine the user-inputted task instructions with the intermediate representation code sequence to form the model input, input it into the target large language model, and obtain the analysis result text output by the target large language model.

[0167] The target large language model is trained based on the large language model training method provided in any of the above embodiments.

[0168] The program analysis device provided in this invention innovatively uses platform-independent intermediate representation code as training corpus, unifying the instruction sets of different hardware platforms at the semantic level. This solves the technical problem that existing models cannot be universally used across platforms due to their dependence on specific architectures, thereby achieving the effect of training once and being universal across multiple architectures, and significantly improving the generalization ability and applicability of the model in the field of binary program analysis.

[0169] Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention, such as... Figure 4 As shown, the electronic device may include a processor 410, a communications interface 420, a memory 430, and a communication bus 440, wherein the processor 410, communications interface 420, and memory 430 communicate with each other via the communication bus 440. The processor 410 can call logical instructions in the memory 430 to execute a large language model training method, including: constructing a training sample set, wherein each training sample in the training sample set includes task instructions and intermediate representation code sequences as model input, and pre-set label information corresponding to the model input; using the training sample set to perform supervised fine-tuning training on an initial large language model to obtain a target large language model; wherein the intermediate representation code sequence is obtained by converting machine instructions in binary file samples of any processor architecture into semantic operation sequences independent of the processor architecture.

[0170] Alternatively, the execution program analysis method includes: acquiring the target binary file to be analyzed; converting the target function in the target binary file into a semantic operation sequence independent of the processor architecture of the target binary file; combining the user-inputted task instructions with the intermediate representation code sequence to form a model input, inputting it into a target large language model, and acquiring the analysis result text output by the target large language model; wherein the target large language model is trained based on the large language model training method provided in any embodiment.

[0171] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0172] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, wherein when the program instructions are executed by a computer, the computer is able to execute the large language model training method provided in the above embodiments, the method comprising: constructing a training sample set, wherein each training sample in the training sample set comprises task instructions and intermediate representation code sequences as model input, and pre-set label information corresponding to the model input; using the training sample set to perform supervised fine-tuning training on an initial large language model to obtain a target large language model; wherein the intermediate representation code sequence is obtained by converting machine instructions in binary file samples of arbitrary processor architecture into semantic operation sequences independent of the processor architecture.

[0173] Alternatively, the execution program analysis method includes: acquiring the target binary file to be analyzed; converting the target function in the target binary file into a semantic operation sequence independent of the processor architecture of the target binary file; combining the user-inputted task instructions with the intermediate representation code sequence to form a model input, inputting it into a target large language model, and acquiring the analysis result text output by the target large language model; wherein the target large language model is trained based on the large language model training method provided in any embodiment.

[0174] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the large language model training method provided in the above embodiments. The method includes: constructing a training sample set, wherein each training sample in the training sample set includes task instructions and intermediate representation code sequences as model inputs, and pre-set label information corresponding to the model inputs; using the training sample set to perform supervised fine-tuning training on an initial large language model to obtain a target large language model; wherein the intermediate representation code sequence is obtained by converting machine instructions in binary file samples of any processor architecture into semantic operation sequences independent of the processor architecture.

[0175] Alternatively, the execution program analysis method includes: acquiring the target binary file to be analyzed; converting the target function in the target binary file into a semantic operation sequence independent of the processor architecture of the target binary file; combining the user-inputted task instructions with the intermediate representation code sequence to form a model input, inputting it into a target large language model, and acquiring the analysis result text output by the target large language model; wherein the target large language model is trained based on the large language model training method provided in any embodiment.

[0176] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0177] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0178] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for training a large language model, characterized in that, include: Construct a training sample set, wherein each training sample in the training sample set includes task instructions and intermediate representation code sequences as input to the model, as well as pre-set label information corresponding to the input to the model; The initial large language model is trained under supervised fine-tuning using the training sample set to obtain the target large language model. The intermediate representation code sequence is obtained by converting machine instructions in binary file samples of any processor architecture into semantic operation sequences that are independent of the processor architecture.

2. The large language model training method according to claim 1, characterized in that, The binary file sample was constructed in the following way: Collect source code for multiple high-level languages; Using different versions of compilers and setting different optimization level options, the source code is compiled into binary executables covering multiple instruction set architectures, which serve as samples of the binary files.

3. The large language model training method according to claim 1, characterized in that, Converting machine instructions in binary file samples of any processor architecture into semantic operation sequences independent of the processor architecture includes: The binary file sample is physically segmented at the function granularity to obtain the segmented binary function; The binary function is disassembled by calling a reverse analysis engine to obtain the semantic operation sequence.

4. The large language model training method according to claim 1, characterized in that, Before constructing the training sample set, the following is also included: Based on the data flow analysis results of the intermediate representation code sequence, redundant instructions in the intermediate representation code sequence are removed to obtain the reduced intermediate representation code sequence.

5. The large language model training method according to claim 4, characterized in that, The step of removing redundant instructions from the intermediate representation code sequence based on the data flow analysis results includes: Construct the data flow graph representing the intermediate code sequence; Traverse the data flow graph and delete assignment operation instructions that are not referenced by subsequent instructions; Based on the data flow graph, the definition instructions and usage instructions for temporary variables used only for data transfer are merged.

6. The large language model training method according to claim 1, characterized in that, The construction of the training sample set includes determining the label information based on the type of the task instruction: If the task instruction directs a high-level semantic restoration task, a natural language summary describing the function of the binary file sample is obtained as the tag information; If the task instruction indicates a security and vulnerability analysis task, obtain an analysis report containing at least one of the following: vulnerability type, vulnerability location, and remediation suggestion, as the tag information; If the task instruction indicates a performance behavior analysis task, obtain an analysis report containing algorithm complexity evaluation and / or optimization suggestions as the tag information; If the task instruction indicates a code generation task, the high-level program source code corresponding to the binary file sample is obtained as the tag information; If the task instruction indicates a complex generation task under multiple constraints, the intermediate representation code sequence and / or analysis text that satisfy the specific constraints are obtained as the tag information.

7. The large language model training method according to claim 1, characterized in that, The construction of the training sample set also includes: Acquire general natural language text data; The general natural language text data is added to the training sample set according to a preset ratio.

8. The method for training a large language model according to any one of claims 1-7, characterized in that, The supervised fine-tuning training of the initial large language model using the training sample set includes: All training samples in the training sample set are bucketed according to the length of the intermediate representation code sequence, and the bucket sequence is obtained in ascending order of length; The initial large language model is trained sequentially using training samples from different buckets, according to the order of the bucket sequence.

9. The large language model training method according to claim 8, characterized in that, The bucketing sequence includes a first bucket, a second bucket, and a third bucket in sequence. The length of the intermediate representation code sequence of the training samples in the first bucket is less than a first threshold. The length of the intermediate representation code sequence of the training samples in the second bucket is between the first threshold and the second threshold. The length of the intermediate representation code sequence of the training samples in the third bucket is greater than the second threshold. The step of training the initial large language model sequentially using training samples from different buckets according to the bucket sequence includes: The initial large language model is trained using the training samples in the first bucket to establish the semantic mapping relationship between the intermediate representation code sequence and the label information; The initial large language model is trained to learn context dependencies using the training samples in the second bucket; The global logical features of the learning function of the initial large language model are trained using the training samples in the third bucket.

10. A program analysis method, characterized in that, include: Obtain the target binary file to be analyzed; The target function in the target binary file is converted into a semantic operation sequence that is independent of the processor architecture of the target binary file; The user-inputted task instructions and the intermediate representation code sequence are combined to form the model input, which is then input into the target large language model to obtain the analysis result text output by the target large language model. The target large language model is trained based on the large language model training method described in any one of claims 1-9.

11. The program analysis method according to claim 10, characterized in that, The step of combining the user-inputted task instructions with the intermediate representation code sequence to form the model input includes: The model input is embedded with thought chain prompts, which are used to guide the target large language model to output intermediate reasoning steps and / or logical derivation processes before outputting the analysis result text.

12. The program analysis method according to claim 10, characterized in that, After obtaining the analysis result text output by the target large language model, the process also includes: Call a static analysis tool to verify the syntactic correctness or logical consistency of the analysis result text; If the verification fails, the verification error message will be fed back to the target large language model to trigger the target large language model to correct the analysis result text.

13. A large language model training device, characterized in that, include: A sample construction module is used to construct a training sample set. Each training sample in the training sample set includes task instructions and intermediate representation code sequences as input to the model, as well as pre-set label information corresponding to the model input. The intermediate representation code sequence is obtained by converting machine instructions in binary file samples of arbitrary processor architecture into semantic operation sequences that are independent of the processor architecture. The model training module is used to perform supervised fine-tuning training of the initial large language model using the training sample set to obtain the target large language model.

14. A program analysis device, characterized in that, include: The acquisition module is used to acquire the target binary file to be analyzed; A conversion module is used to convert the target function in the target binary file into a semantic operation sequence that is independent of the processor architecture of the target binary file; The input construction module is used to combine the user-inputted task instructions with the intermediate representation code sequence to form the model input, input it into the target large language model, and obtain the analysis result text output by the target large language model; The target large language model is trained based on the large language model training method described in any one of claims 1-9.

15. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the large language model training method as described in any one of claims 1-9, or the program analysis method as described in any one of claims 10-12.

Images