Binary vulnerability detection method based on unified ir and verifiable inference framework

Abstract

The application provides a binary vulnerability detection method based on unified IR and verifiable reasoning framework, comprising the following steps: converting a binary code sample into a cross-architecture unified intermediate representation; constructing a multi-relation program graph based on the cross-architecture unified intermediate representation; performing feature extraction on the multi-relation program graph through double-channel collaborative representation learning; performing sample-level vulnerability type determination and node-level risk scoring based on the output of the double-channel collaborative representation learning, and obtaining a positioning set through threshold screening; performing verifiable construction on source-sink paths based on formalized taint propagation and constraint slicing, performing logical verification on candidate paths through SMT satisfiability checking; and generating a structured evidence package. The application is used for simultaneously improving the generalization ability, logical verifiability and engineering scalability of vulnerability detection in a complex scene with multiple architectures, no source code and existing differences in compilation optimization.

Description

Technical Field

[0001] This invention relates to the fields of software security and binary analysis technology, and in particular to a binary vulnerability detection method based on a unified IR and verifiable inference framework. Background Technology

[0002] In the context of protecting critical information infrastructure and governing software supply chain security, traditional vulnerability detection technologies heavily rely on source code, often resulting in a "no code, no detection" blind spot when facing third-party closed-source modules and firmware with multiple architectures. However, due to the complexity of different instruction set architectures, compilation optimization options, and limited resources, performing accurate and interpretable static vulnerability detection directly on binary programs faces numerous challenges.

[0003] Existing static source code analysis and machine learning detection technologies mainly fall into two categories: one is based on traditional static source code analysis methods, such as tools like Flawfinder, cppcheck, and CBMC. These methods typically perform well in small or manually constructed benchmark tests, but face serious problems of false negatives and false negatives in complex real-world scenarios. Empirical studies show that existing static C code analyzers miss as many as 47% to 80% of vulnerabilities in the real world. The other category is based on machine learning and deep learning methods. These methods usually introduce natural language processing or semantic feature engineering to enhance the model's understanding of code patterns, but their core pain point is that the research object is still generally limited to source code. Due to its strong dependence on source code, it cannot be directly applied to third-party binary programs that lack source code.

[0004] Beyond source code-level analysis, fundamental research and engineering practices have emerged in the area of ​​vulnerability detection directly targeting binary files, such as open-source binary analysis frameworks like angr, Ghidra, Radare2, and BAP. However, these general-purpose analysis frameworks primarily exist as low-level tools and typically lack built-in algorithms or advanced features for automated detection of various mainstream CWE vulnerabilities. Furthermore, traditional byte signature and heuristic matching methods are highly susceptible to failure when dealing with cross-compilation optimizations and code obfuscation, exhibiting weak generalization capabilities. Meanwhile, traditional large-scale static analysis is often severely limited by performance bottlenecks in practical applications, making it difficult to maintain high efficiency with large sample sizes.

[0005] In addition, existing binary vulnerability detection technologies also have the following technical shortcomings:

[0006] First, there is a lack of semantic heterogeneity and feature representation in multi-architecture and source code-less scenarios: Due to the existence of different instruction set architectures (ISAs) and compilation optimization options, binary programs exhibit significant morphological differences. Traditional byte signatures or heuristic matching schemes are prone to failure under cross-compilation optimization and obfuscation conditions, and a single control flow or data flow graph is insufficient to fully reflect the complex behavior of the program;

[0007] Second, the vulnerability detection results lack interpretability and precise verifiable logical evidence. The black-box machine learning model cannot generate structured evidence containing precise byte-level offset mappings, cross-process links, and key conditional predicate witnesses, resulting in extremely high costs of evidence collection disputes and trust crises in actual regulatory, judicial, auditing, and compliance enforcement processes.

[0008] Third, large-scale analysis of complex cross-function calls faces performance bottlenecks and difficulties in rule evolution. Traditional static analysis is often limited by performance bottlenecks in large-scale applications, facing problems such as severe path explosion and memory overflow. Furthermore, manually writing rules for various CWE vulnerabilities is time-consuming and inefficient.

[0009] Therefore, there is an urgent need for a robust testing system that can provide generalization capability, provable reasoning and definitive evidence output in a heterogeneous environment without source code, fundamentally balancing the three major requirements of "cross-architecture generalization, logical provability and engineering scalability". Summary of the Invention

[0010] To overcome the shortcomings of existing technologies, this invention provides a binary vulnerability detection method based on a unified IR and verifiable reasoning framework, which can simultaneously improve the generalization ability, logical verifiability and engineering scalability of vulnerability detection in complex scenarios with multiple architectures, no source code and different compilation optimizations.

[0011] The technical solution adopted by this invention to solve its technical problem is:

[0012] In a first aspect, the present invention provides a binary code vulnerability detection and localization method based on static analysis, comprising:

[0013] Obtain a binary code sample to be detected, and convert the binary code sample into a cross-architecture unified intermediate representation through a semantically preserved instruction-level promotion mechanism;

[0014] A multi-relationship program graph is constructed based on the cross-architecture unified intermediate representation. The multi-relationship program graph includes control dependencies, data dependencies, and inter-procedure call relationships, and an invertible mapping between graph nodes and binary offsets is established.

[0015] Feature extraction is performed on the multi-relation procedural graph through dual-channel collaborative representation learning. The dual channels include a sequence channel and a graph channel, wherein the sequence channel is used to converge long-range contextual semantics at the function level, and the graph channel is used to propagate local relations and causal clues along control dependencies and data dependencies.

[0016] Based on the output of the dual-channel collaborative representation learning, sample-level vulnerability type determination and node-level risk scoring are performed, and the location set is obtained through threshold filtering.

[0017] Verifiable source-sink paths are constructed based on formal taint propagation and constraint slicing, and candidate paths are logically verified through SMT satisfiability checks.

[0018] Generate a structured evidence package, which includes byte-level offset mappings, cross-procedure call chains, and satisfiability witnesses for key condition predicates.

[0019] In conjunction with the first aspect, in a first embodiment of the first aspect of the present invention, the semantically preserved instruction-level promotion mechanism satisfies the semantically preserved mapping condition:

[0020]

[0021] in For the observable semantics of program trajectory, This refers to a machine-level program. This is an intermediate representation level program.

[0022] In conjunction with the first aspect, in a second embodiment of the first aspect of the present invention, the relation-normalized adjacency matrix of the multi-relation procedural graph... for:

[0023]

[0024] in, For relationship The original adjacency matrix, For relationship The degree matrix.

[0025] In conjunction with the first aspect, in a third embodiment of the first aspect of the present invention, the dual-channel collaborative representation learning specifically includes:

[0026] Construct a fused representation of type and content for each node v:

[0027]

[0028] in, Embedded for node type, Embed the content of the intermediate representation token sequence contained in the node. This indicates vector concatenation.

[0029] On the sequence channel, the function-level notation sequence is encoded to obtain the global representation. ;

[0030] On the graph channel, a multi-relational gated graph neural network is used for message passing and gating updates;

[0031] The joint loss function for the dual-channel collaborative representation learning is:

[0032]

[0033] in, For classifying losses, For consistency loss, and The regularization coefficient is... The sparsity coefficient is the relational sparsity factor. For a set of learnable parameters, This is the relation weight vector.

[0034] In conjunction with the first aspect, in the fourth embodiment of the first aspect of the present invention, the verifiable construction of source-sink paths based on formal taint propagation and constraint slicing specifically includes:

[0035] A semantic prior model is introduced as a signal for candidate expansion and ranking;

[0036] The extended set is obtained through thresholding;

[0037] Reverse slicing is performed along data dependencies and inter-procedure call relationships to obtain a set of candidate paths;

[0038] Define stain predicate With the propagation operator, perform formal taint propagation;

[0039] The hypothesis-verification collaborative paradigm is adopted, which uses semantic priors to summarize operators that may retain taints and template hypotheses that may constitute purification, and then confirms or eliminates them one by one through constraint slicing and satisfiability checks.

[0040] In conjunction with the first aspect, in the fifth embodiment of the first aspect of the present invention, the logical verification of the candidate path through the SMT satisfiability check specifically includes:

[0041] Transform the conditional branches and memory constraints on the path into mathematical logic formulas;

[0042] The SMT solver is invoked to verify the satisfiability of the mathematical logic formula.

[0043] The vulnerability is determined to be valid only if the formula is satisfied, and a satisfiability witness is generated.

[0044] Unsatisfiable candidate paths are automatically eliminated, and relevant constraint fragments are rewritten as convergence conditions of rules or purification prerequisites.

[0045] In conjunction with the first aspect, in a sixth embodiment of the first aspect of the present invention, the generation of the structured evidence package specifically includes:

[0046] Define the cost function:

[0047]

[0048] in, Paths The nodes on for arrive The relationship type. For relation type weights, For nodes The significance of For nodes The significance of This is the count of ignored or invalid cleanup instances along the path, where P is the path. This is the penalty coefficient for purification failure.

[0049] Generate evidence quadruples:

[0050] in, For offset and risk pair, This is a summary of the cross-process source-sink call sequence and the flow of key variables. For key predicates and their satisfiability testimonies, Human-readable summaries generated from semantic priors;

[0051] summary asked to The truth value must be consistent, that is, ζ(P) must not contradict the solution result of any predicate in Y(P).

[0052] In conjunction with the first aspect, the seventh embodiment of the present invention further includes:

[0053] Automatic synthesis of cross-function context-sensitive rules based on declarative security patterns;

[0054] A dual-backend execution system is constructed, non-recursive structural relations are compiled into Datalog relational closures to support large-scale graph-level fast screening, and inter-process propagation and alias determination are normalized to IFDS / IDE data flow solving tasks;

[0055] Rule matching is performed through a three-level pipeline: the first level performs rapid recall on the graph, the second level applies context-sensitive propagation in the IFDS / IDE backend, and the third level performs satisfiability verification.

[0056] Secondly, the present invention provides a binary vulnerability detection device based on a unified IR and verifiable inference framework, comprising:

[0057] The intermediate representation conversion module is used to acquire the binary code sample to be detected and convert the binary code sample into a cross-architecture unified intermediate representation through a semantically preserved instruction-level promotion mechanism.

[0058] The graph construction module is used to construct a multi-relationship program graph based on the cross-architecture unified intermediate representation. The multi-relationship program graph includes control dependencies, data dependencies, and inter-process call relationships, and establishes a reversible mapping between graph nodes and binary offsets.

[0059] The feature extraction module is used to extract features from the multi-relation program graph through dual-channel collaborative representation learning. The dual channels include a sequence channel and a graph channel, wherein the sequence channel is used to converge long-range context semantics at the function level, and the graph channel is used to propagate local relations and causal clues along control dependencies and data dependencies.

[0060] The vulnerability determination module is used to determine the sample-level vulnerability type and the node-level risk score based on the output of the dual-channel collaborative representation learning, and obtain the location set through threshold filtering;

[0061] The path verification module is used to construct verifiable source-sink paths based on formal taint propagation and constraint slicing, and to perform logical verification of candidate paths through SMT satisfiability checks.

[0062] The evidence generation module is used to generate a structured evidence package, which includes byte-level offset mapping, cross-procedure call chain, and satisfiability witnesses of key condition predicates.

[0063] Thirdly, the present invention provides an electronic device, comprising: a processor; a storage device for storing one or more programs; a communication interface for data interaction with an external device; and, when the one or more programs are executed by the processor, causing the processor to perform the method as described in the first aspect.

[0064] Fourthly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in the first aspect.

[0065] One of the above technical solutions has the following advantages or beneficial effects: In response to the "blind spots" and feature failures in scenarios without source code and with multiple architectures, this invention aligns heterogeneous instructions in an equivalent semantic space through a heterogeneous program graph collaborative fusion framework based on a cross-architecture unified intermediate representation. Combined with dual-channel collaborative representation learning of sequence channels and graph channels, it effectively overcomes the distribution drift caused by differences in decompilation morphology and significantly improves the discrimination accuracy and robustness of the model under multiple architectures and multiple compilation options.

[0066] Another technical solution mentioned above has the following advantages or beneficial effects: In response to the "blind spots" and feature failures in scenarios without source code and with multiple architectures, a "hypothesis-verification" collaborative paradigm is introduced. The final vulnerability determination strictly relies on formal taint semantics, constraint slicing, and SMT satisfiability checks. It can stably output a structured evidence package containing byte-level offset mapping, cross-procedure call chains, and key predicate witnesses, thus completely solving the pain point that static detection results are difficult to independently verify.

[0067] Another technical solution mentioned above has the following advantages or beneficial effects: In response to the path explosion and memory overflow problems caused by complex cross-function calls, this invention uses a declarative safety pattern to automatically synthesize and standardize the specifications of source, cleanup and sink into first-order logical rules. Combined with the dual backend system of Datalog relational closure and IFDS / IDE data flow solution, it realizes large-scale scalable inference in resource-constrained environments while ensuring context-sensitive accuracy.

[0068] Furthermore, this invention solves the fundamental challenges of static analysis, automatically transforming obscure formal evidence and graphical features into readable analytical conclusions and remedial recommendations. This provides a truly implementable and deliverable overall practical framework for software supply chain security auditing and the underlying protection of critical information infrastructure. Verified results show that, compared to traditional static detection tools and black-box machine learning detection solutions, this invention improves vulnerability detection recall by 15% and reduces false positives by over 30% while maintaining context-sensitive and field-sensitive detection accuracy. For large-scale binary programs with millions of lines of code, the average analysis latency is reduced by over 30%, and memory usage is controlled to within 65% of traditional solutions, effectively supporting the needs of black-box vulnerability detection and supply chain security auditing in real-world scenarios. Attached Figure Description

[0069] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0070] Figure 1 This is a schematic diagram of a cross-architecture multi-relationship program graph structure provided in an embodiment of the present invention;

[0071] Figure 2 This is a schematic diagram of dangerous flow extraction on the inter-process call graph provided in an embodiment of the present invention;

[0072] Figure 3 Example diagram of semantic prior generation of human-readable summary and judgment prompts provided for embodiments of the present invention;

[0073] Figure 4 A flowchart illustrating the binary code vulnerability detection and localization method based on static analysis provided in this embodiment of the invention;

[0074] Figure 5 This is a structural block diagram of a binary code vulnerability detection and location device based on static analysis provided in an embodiment of the present invention. Detailed Implementation

[0075] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the spirit or scope of the invention. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.

[0076] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0077] The terminology involved in this invention is explained as follows:

[0078] Intermediate Representation (IR): Transforms machine code from different architectures into a unified, architecture-independent representation by preserving semantics, providing a common basis for subsequent analysis.

[0079] Multi-relation program graph: Based on the program structure, it integrates various semantic relationships such as control dependency, data dependency, and inter-procedure call to form a heterogeneous knowledge graph. Nodes and edges are all equipped with rich semantic attributes.

[0080] Dual-channel collaborative representation learning: Simultaneously utilizing the sequence channel (processing the contextual semantics of the instruction sequence) and the graph channel (processing the relational propagation of the program structure), a feature extraction mechanism jointly optimized through consistency constraints is employed.

[0081] Semantic Prior Model: A deep learning model trained on large-scale security knowledge, capable of providing soft discrimination of candidate source and sink points and assumptions for operator taint retention / purification for specific CWE vulnerability types.

[0082] Formal taint propagation: Define the taint predicate Taint(v) and propagation rules on the program graph, and strictly follow the semantics of data flow and control flow to propagate taint markings.

[0083] Constraint Slicing and SMT Satisfaction Check: The conditional branches, memory accesses, type constraints, etc. on the program path are transformed into mathematical logic formulas, and their satisfiesness is verified by the SMT solver, providing a formal proof for vulnerability determination.

[0084] Structured evidence package: a quadruple formal evidence containing offset mapping, call chain, satisfiability witness, and human-readable summary, ensuring the verifiability and interpretability of the evidence.

[0085] Dual backend execution system: Combining the Datalog relational closure engine (handling graph-level queries and relational closures) and the IFDS / IDE data flow solver (handling inter-process data flow and alias analysis) to achieve a balance between accuracy and efficiency.

[0086] To enable those skilled in the art to better understand the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0087] Overall process of technical solution

[0088] This invention first proposes a binary code vulnerability detection and localization method based on static analysis (a binary vulnerability detection method based on a unified IR and verifiable inference framework). This method is designed to improve the generalization ability, logical verifiability, and engineering scalability of vulnerability detection in complex scenarios involving multiple architectures, lack of source code, and differences in compilation optimization. The technical solution of this invention is mainly divided into a low-level semantic modeling and representation learning stage, and a top-level rule solving and verifiable inference stage, and is achieved through the close collaboration of the following three key functional modules:

[0089] (1) A heterogeneous program graph collaborative fusion and semantic consistency modeling framework based on cross-architecture unified intermediate representation

[0090] To address static vulnerability detection and localization tasks in multi-architecture binary systems, this invention proposes a graph-based modeling framework centered on a unified intermediate representation. Starting with semantically preserved instruction-level elevation, the method constructs a multi-relational program graph simultaneously covering control dependencies, data dependencies, and inter-procedural calls. By combining collaborative representation learning of sequence channels and graph channels, it achieves unified inference of vulnerability types, byte-level offsets, and source-to-sink trigger paths. The framework emphasizes semantic consistency and verifiability, maintaining robust inference quality and verifiable evidence output under strict resource constraints and large sample sizes. This invention uses a unified intermediate representation as a semantic commonality to construct a multi-relational program graph covering control dependencies, data dependencies, and inter-procedural calls. Based on this, it uses collaborative learning of sequence semantics and graph structure semantics as a hub to unify local causal clues and global context into the same discriminant space, and maintains stable convergence and transferability through consistency constraints. Around this discriminative space, the method generates structured evidence oriented towards location and path through verifiable reasoning, forming a verifiable closed loop consisting of risk measurement, offset mapping, and source-sink links. The supporting resource awareness implementation and governance specifications ensure sustainable operation and deliverability under complex sample and limited computing power conditions, thereby achieving the unification of semantic alignment, representation collaboration, and evidence generation at the engineering and methodological levels.

[0091] The core detection algorithm employs a layered and collaborative execution logic: First, it loads the unified intermediate representation converted from the binary program, the multi-relation semantic graph, and predefined declarative vulnerability rules. Then, it starts the Datalog relational closure backend to perform a lightweight full-path scan of the entire program, quickly filtering normal code and identifying potential vulnerability candidate paths, completing an efficient initial screening of large-scale code. Next, using the unified intermediate representation as a standardized data interaction format, it synchronizes the candidate paths to the IFDS / IDE data flow solving backend, which performs context-sensitive, cross-process precise data flow tracing and completes formal verification by combining constraint slicing and SMT satisfiability checks. Finally, it integrates the filtering results from the Datalog backend and the verification results from the IFDS / IDE backend, eliminating invalid candidates and retaining provable vulnerabilities, ultimately outputting accurate vulnerability location information and structured verification evidence. This algorithm, through its "rapid coarse screening + precise fine-tuning" division of labor, solves the industry pain point that a single analysis engine cannot simultaneously balance performance and accuracy.

[0092] (2) A method for constructing verifiable source-sink paths and generating evidence based on formal taint propagation and constraint slices to enhance semantic priors

[0093] The semantic prior model described in this invention is a dual-modal fusion customized model adapted to binary code vulnerability detection scenarios. Unlike general pre-trained language models or pure graph neural networks, it takes the unified intermediate representation of binary programs and multi-relation program graphs as the core modeling objects. The specific structure is a dual-branch fusion architecture of "unified IR sequence encoder + multi-relation program graph encoder": the sequence encoder adopts a Transformer encoder based on program instruction semantic pre-training, and the graph encoder adopts a multi-relation gated graph neural network (MR-GGNN). First, pre-training is completed based on unlabeled binary program unified IR fragments and multi-relation graphs, and then domain fine-tuning is performed by combining labeled vulnerability samples. The model is optimized through a joint loss function of "source-sink identification accuracy + taint propagation hypothesis accuracy". The dual-branch features are output as the final prior features through the attention fusion layer.

[0094] Unified intermediate representation and multi-relational procedural graph Given the established premises, this invention introduces a semantic prior model without altering the verifiable main thread. As a read-only knowledge enhancement layer, it provides prior clues for candidate sinks and sources, gives assumptions about operator taint preservation and cleansing templates, and generates more readable semantic summaries during the evidence presentation stage; while path construction and conclusion determination strictly rely on formal taint semantics, constraint slicing, and satisfiability checks. This forms a closed loop of prior guidance, formal verification, and evidence solidification.

[0095] (3) A framework for automatic synthesis of cross-function context-sensitive rules and generation of multi-level matchers based on declarative security patterns;

[0096] Within the established semantic domain of a unified intermediate representation and a multi-relation procedural graph G=(V,ℰ,ℛ), this invention constructs a formalized route from automatic rule growth to context-sensitive solution and then to evidence consistency adjudication. The core idea is to use a declarative security model as an intermediate carrier: first, based on semantic priors, credible candidates are given for potential source, sink, and cleansing primitives; then, the candidate rules are normalized into compilable logical formulas; subsequently, the rules are compiled into graph queries and inter-process data flow tasks, maintaining scalability while ensuring context sensitivity and alias accuracy; finally, path predicates are generated for the obtained matching instances, and satisfiability checks are performed, resulting in consistency binding with structured evidence objects.

[0097] In summary, the overall goal of this invention is to simultaneously achieve vulnerability type determination, byte-level offset location, and verifiable evidence generation of source-sink paths, while maintaining semantic consistency, verifiability, and resource controllability under heterogeneous architectures, compilation options, and morphological differences.

[0098] Specifically, such as Figure 4As shown, the binary code vulnerability detection and localization method based on static analysis according to this invention includes the following core steps:

[0099] Step S410 Intermediate representation conversion

[0100] The system first acquires the binary code sample to be tested and then converts it into a cross-architecture unified intermediate representation using a semantically preserved instruction-level promotion mechanism. To ensure cross-platform consistency, a semantically preserved mapping is introduced. This requires that the observable semantics of the program remain consistent between the machine level and the intermediate representation level. Using trace semantics as a criterion, let... For the observable semantics of the program trajectory, we have:

[0101]

[0102] in For the observable semantics of program trajectory, This refers to a machine-level program. This is an intermediate representation level program. The instructions, basic blocks, functions, and global objects of the intermediate representation are uniformly abstracted into a set of nodes. Based on this, a multi-relationship program graph is constructed.

[0103] It should be noted that the unified intermediate representation in this step can be implemented in various ways, including LLVM IR, VEXIR, and REIL intermediate representation. For binary samples from different instruction set architectures (ISAs), such as x86, x86_64, ARM, ARM64, and MIPS, they are all converted into a unified intermediate representation form through the corresponding ISA-specific booster, thereby eliminating the semantic heterogeneity problem caused by architecture differences. The boosting process must ensure semantic integrity, including key elements such as instruction semantics, control flow semantics, and data flow semantics. For example, for ARM architecture binary code, the system first identifies instruction boundaries and basic block structures, and then maps each ARM instruction to an equivalent intermediate representation instruction sequence, while maintaining semantic consistency in register states, memory accesses, and control flow transfers. This process is implemented through a predefined instruction semantic table and a complex control flow recovery algorithm, ensuring that the converted intermediate representation can faithfully depict the behavioral characteristics of the original binary code.

[0104] Step S420: Construction of the multi-relationship procedural graph

[0105] Based on a unified intermediate representation across architectures, the system constructs a multi-relationship program graph. ,in For a set of nodes, Let be the set of edges. A set of relations. A set of nodes. It includes instruction nodes, basic block nodes, function nodes, and global object nodes, each with different attributes and characteristics. (Edge set) Based on semantic relationships, edges can be categorized into several types, including control dependency edges, data dependency edges, inter-procedure call edges, and alias relationship edges.

[0106] This invention uses a unified intermediate representation as a semantic carrier and achieves alignment of multi-architecture binary representations within a unified domain through a semantically preserved instruction-level promotion mechanism. A schematic diagram of the cross-architecture multi-relationship program graph structure is shown below. Figure 1 As shown.

[0107] To handle memory and register aliases, an abstract location set is defined. and alias relationship For any read operation With write operations satisfy:

[0108]

[0109] in, For memory aliasing predicate, it indicates that there is a potential aliasing relationship between memory location l and memory location l′; l and l′ are abstract memory location identifiers in the unified intermediate representation of binary programs; Let be the global edge set of the multi-relation semantic graph of the program; e is a single semantic edge in the multi-relation semantic graph; This is a semantic edge that characterizes the data propagation relationship between memory locations. Potential data propagation paths are explicitly encoded on the graph using this condition.

[0110] To improve the physical realizability and statistical stability of the graph, relation-normalized adjacency is used:

[0111] ,

[0112] in, For relationship The adjacency matrix, For relationship The degree matrix. This normalization process can eliminate the dimensional differences between different relation types, improving the stability and convergence speed of subsequent graph neural network learning.

[0113] To ensure semantic consistency across architectures, further structural preservation constraints are introduced. Let's denote the control dependency abstraction. With data dependency abstraction If instruction-level control and data dependencies maintain semantic mapping If the following is maintained, then:

[0114]

[0115]

[0116] This ensures the multi-relationship program graph Complete embedding at the control and data levels.

[0117] To support subsequent vulnerability localization, a reversible mapping from nodes to binary offsets is established. It also maintains a reverse index to the instruction for evidence backtracking.

[0118] Step S430 Dual-channel collaborative representation learning

[0119] After completing the semantic alignment of the unified intermediate representation and the formal definition of the multi-relation procedural graph, the key to representation learning lies in simultaneously capturing structural dependencies and global semantics, thereby obtaining task representations that are both distinguishable and transferable. To achieve this goal, this invention constructs a joint representation and optimization mechanism composed of a sequence channel and a graph channel. Specifically, it extracts features from the multi-relation procedural graph through dual-channel collaborative representation learning. The dual channels include a sequence channel and a graph channel. The sequence channel is used to converge long-range contextual semantics and calling conventions at the function level, while the graph channel is used to propagate local relations and causal clues along control and data dependencies. The two channels achieve synchronous convergence during the training phase through consistency constraints and obtain stable outputs during the inference phase through weighted coupling.

[0120] Specifically, for each node The fusion of type and content is represented as follows:

[0121]

[0122] in, Embedding for node type ( Represents the set of real numbers. (for type embedding dimension) Embedding the content of the intermediate representation token sequence contained in the node ( (for content embedding dimensions) This represents vector concatenation. .

[0123] On the sequence channel, the function-level notation sequence is encoded to obtain the global representation. ,in This is the global representation dimension of the sequence channels, used to model long-range contextual semantics and calling convention information. Sequence encoders can employ sequence modeling architectures such as Recurrent Neural Networks (RNNs), Long Short-Term Memory Networks (LSTMs), Gated Recurrent Units (GRUs), or Transformers. In this implementation, our system uses a two-layer bidirectional LSTM with 256 hidden units, effectively capturing semantic dependencies within functions and contextual information across function calls.

[0124] On the graph channel, a multi-relation gated graph neural network is used for message passing and gating updates. Let the first... The hidden state of the step node is Initialized to ,in This is the initial projection matrix. A relation weight vector is then introduced. and satisfy and Multi-relationship aggregated messages are defined as follows:

[0125]

[0126] in, For a specific mapping of relations, The normalized adjacency matrix of relation r The edge weight from node u to node v. For bias.

[0127] The gating system has been updated to:

[0128]

[0129] in, The update gate vector encoded for semantic features. To reset the gate vector; is the candidate hidden state vector. This is the hidden state vector at the current time. σ is the hidden state vector of the previous time step; σ is the Sigmoid activation function, and tanh is the hyperbolic tangent activation function. , and , All are learnable weight matrices of the semantic prior model; W and U are learnable weight matrices calculated from the candidate hidden states; The intermediate representation is used to extract the semantic feature vector of the program; ∘ represents the Hadamard product (element-level multiplication operation).

[0130] exist After propagation, the graph-level representation is obtained through convolution and max pooling readout operators as follows:

[0131]

[0132] in, .

[0133] The classification head provides the class probabilities for each of the two channels as follows:

[0134]

[0135]

[0136] in, and Here are the classification weight matrix and bias vector for the map channels; and Here are the classification weight matrix and bias vector for the sequence channels; Total number of vulnerability categories; and These are the category probability distributions for the spectral channel and the sequence channel, respectively.

[0137] And during the training phase, optimization is performed through a joint objective of consistency and classification:

[0138]

[0139] in, For class imbalance weights, and The regularization coefficient is... The sparsity coefficient is the relational sparsity factor. Let N be the set of learnable parameters, N be the number of training samples, and C be the total number of vulnerability categories. This is the true label of sample i (1 if sample i belongs to category c, 0 otherwise). Predict the probability that sample i belongs to category c for the model.

[0140] A stable trade-off is achieved between local dependencies and global semantics. Temperature scaling is used to improve calibration accuracy.

[0141]

[0142] in, Let p be the temperature parameter and p be the original probability distribution. or ), p̃ is the temperature-scaled calibration probability distribution.

[0143] Step S440 Vulnerability Identification and Location

[0144] Based on the output of the dual-channel collaborative representation learning, sample-level vulnerability type determination and node-level risk scoring are performed, and the location set is obtained through threshold filtering.

[0145] After obtaining sample-level judgments through joint representation and consistency optimization, the global judgments still need to be translated into verifiable security evidence to meet the requirements of vulnerability identification, offset localization, and source-sink path reconstruction. The relevant steps of this invention (vulnerability identification, offset localization, and path evidence generation based on multi-layered discrimination and verifiable reasoning) propose a multi-layered discrimination and verifiable reasoning mechanism based on the aforementioned graph-level representation and node hidden states. First, node-level risk scoring and threshold screening are provided to achieve fine-grained localization. Then, under reachability and semantic consistency constraints, a minimum-cost path search is performed to generate an evidence package containing offsets, call sequences, and key conditional predicates. Simultaneously, time and space complexity analysis, as well as hierarchical summarization, on-demand slicing, and parallel partitioning strategies under resource constraints, are provided to ensure timeliness and verifiability on large-scale samples.

[0146] Specifically, after sample-level judgment, fine-grained inferences are performed at the node and path levels. The node-level risk score is:

[0147]

[0148] in, The risk score for node v The Sigmoid activation function is used. For risk scoring weight vector, Let be the final hidden state vector of node v after T steps of propagation in the graph channel, and b be the bias term.

[0149] The location set is obtained by threshold filtering.

[0150] To enhance robustness, cost-sensitive learning and label smoothing strategies are introduced to mitigate the impact of class imbalance on the thresholding strategy. Cost-sensitive learning assigns different misclassification cost weights to different classes, making the model focus more on correctly classifying minority class samples. Label smoothing replaces hard labels with soft labels.

[0151] Path evidence is constructed based on the criteria of reachability and cost minimization. An edge cost function is defined. Let relation type weights be defined. With node significance weight Then the edge cost can be written as:

[0152]

[0153] Where u and v are connected node pairs in the graph, and r is the relationship type from u to v; For relation type weights, and represent the significance indices of nodes u and v, respectively. This form ensures that connections between highly significant nodes have lower edge costs, thus guiding path search to prioritize traversing high-confidence regions.

[0154] Path cost is defined as:

[0155]

[0156] Where P is the directed path from the candidate source node to the high-risk node, and Cost(P) is the cumulative total cost of path P, obtained by summing the costs c(u, v, r) of all edges on the path. Under the premise of satisfying the source-sink reachability constraint, the system outputs the set of paths with the minimum Cost(P) as the vulnerability evidence chain.

[0157] Given the reachability constraint from the candidate source set to the high-scoring node, output the set of paths with the minimum cost as evidence. To ensure logical consistency, define paths that satisfy the predicate. This involves considering conditional branch predicates, inter-procedural call constraints, and memory alias consistency. The final optimization problem is:

[0158]

[0159] Where F(P) is the path-satisfiable predicate.

[0160] To enhance the verifiability of the report, an evidence package is generated that includes offsets, call sequences, key conditions, and summaries of affected objects, along with the values ​​of fusion weights, calibration temperature, and consistency loss on the sample as confidence metrics.

[0161] In terms of complexity, the time complexity of single-step propagation is:

[0162]

[0163] The space complexity is:

[0164]

[0165] in, The dimension of the node feature vector. Let r be the number of edges corresponding to relation r. This represents the total number of nodes in the program graph.

[0166] A two-stage workflow is employed under a strict resource budget. The first stage uses function and basic block level readouts for risk pre-screening, retaining only the top few polymer graphs for the second stage of propagation and path reconstruction. The interprocess graphs are partitioned and parallelized with lazy loading, combined with relation pruning, readout caching, and mixed precision to ensure that memory usage does not exceed a predetermined threshold and that analysis time limits are met for large-volume samples.

[0167] Step S450 Formal path verification

[0168] Verifiable source-sink path construction is performed based on formal taint propagation and constraint slicing, and candidate paths are logically verified through SMT satisfiability checks. The verifiable source-sink path construction based on formal taint propagation and constraint slicing includes: introducing a semantic prior model as a signal for candidate expansion and ranking; obtaining an expansion set through thresholding; performing reverse slicing along data dependencies and inter-process call relationships to obtain a candidate path set; and defining taint predicates. With the propagation operator, formal taint propagation is performed; the hypothesis-verification collaborative paradigm is adopted, which uses semantic priors to summarize operators that may retain taints and template hypotheses that may constitute purification, and then confirms or eliminates them one by one through constraint slicing and satisfiability checks.

[0169] Specifically, given the established unified intermediate representation and multi-relational procedural graph, the complete identification of sources and sinks directly determines the upper bound of subsequent path construction and search efficiency. Actual binary samples often exhibit semantic folding due to library function aliases, differences in calling conventions, and compilation optimizations; a fixed table alone cannot cover all candidates. To expand the candidate space without sacrificing verifiability, this invention introduces controlled semantic priors into the graph: the priors are only used to provide probabilistic clues for suspicious sinks and sources, and accordingly adjust the reverse slicing order and bundle width from sink to source; all candidates included in the priors are then uniformly entered into a formalized judgment process, ensuring that the openness of the search and the reliability of the conclusions are not mutually exclusive, such as... Figure 2 As shown in Algorithm 1, the semantic prior-guided call chain extraction, hazard flow generation, and prior template sequence construction are performed. This algorithm takes binary samples, a prior template library, and the target CWE vulnerability type as input, and outputs a prior template sequence and a set of candidate hazard flows. First, the binary samples are elevated to a unified intermediate representation and a multi-relation semantic graph, and external functions are extracted from the graph. Based on the semantic prior model, the parameters of the external functions are context-modeled, and high-risk sinks that meet the confidence threshold are selected. The call locations of all sinks are located, the actual parameters at the call points are extracted, and variable dependencies are generated. Back-slice analysis is performed on each variable dependency to construct the corresponding call chain set. Similarly, source points that meet the conditions are selected through the semantic prior model. All call chains are traversed, and source points and variable dependencies with data dependencies are matched to generate candidate hazard flows and perform deduplication. Finally, based on the prior template library, a corresponding prior template sequence is constructed for each hazard flow, and all prior template sequences and candidate hazard flow sets are output.

[0170] Specifically, let the call point context (called function identifier, parameter-argument summary, locally unified intermediate representation fragment, constants and string information) be... Semantic prior model Provide a target for CWE type Soft discrimination:

[0171]

[0172] in, Can be candidate sink pairs or candidate source pair κ represents the target CWE vulnerability type. This represents the confidence score output by the semantic prior model. (At the threshold) and The following results in an expanded set:

[0173]

[0174] in, and These are the initial sink set and the source set, respectively. and These are the expanded sink set and source set, respectively.

[0175]

[0176]

[0177]

[0178] At each identified dangerous call point At this point, reverse slicing is performed along data dependencies and inter-procedure call relationships to obtain a set of candidate paths. To prioritize exploring paths more likely to correspond to actual hazardous flows during the search phase, an evaluation function coupling prior discounts and structural costs is introduced:

[0179]

[0180] in, For path and Strongly related elements (such as suspected parameters, equivalent API aliases, and suspicious string operations). This is the prior confidence level adjustment coefficient. For its local context, The structural cost consists of dependency type weighting and purification penalties (see above). Reverse slicing uses a method based on... The bundle search is used for sorting and pruning, but not by... As a basis for correctness. Each candidate path Ultimately, the following must be satisfied:

[0181]

[0182] in, This indicates the satisfiability of the decision logic formula. For path predicates with branching and memory constraints, This is a taint predicate (src is a candidate source node for the starting point of the path). This is a type-triggered condition; if it cannot be satisfied, the path is discarded. Therefore, semantic priors only affect the exploration order and do not change the formal decision boundaries.

[0183] Synergistic verification of the formalized taint propagation and cleansing template hypothesis:

[0184] Taint propagation and cleansing modeling are core steps in verifying the satisfiability of source-sink paths. In binary scenarios, the same semantics can be achieved by combining multiple instructions. Decoding and decompiling may introduce morphological differences, making it difficult to directly determine the taint preservation and boundary check effectiveness of operator families. To balance expressiveness and rigor, this section adopts a hypothetical-verification collaborative paradigm: first, semantic priors are used to summarize operators that may preserve taints and templates that may constitute cleansing; then, these candidates are embedded into path predicates, and each is confirmed or eliminated through constraint slicing and satisfiability checks. The resulting propagation rules and cleansing predicates have traceable origins and logical witnesses, improving pruning efficiency while ensuring the provable correctness of propagation semantics.

[0185] Define taint predicates on multi-relation graphs With propagation operators. For any data-dependent edges... With control dependency edge ,have:

[0186]

[0187]

[0188] in, Represents a node The instruction semantics, where u is the source node of the data dependency or control dependency edge, This provides a taint preservation indicator function for the operator family. `MayAlias(u,v)` is the memory alias predicate defined earlier; semantic cleansing is performed using the predicate. It is stated that once the order is established... Inter-process propagation uses parameter-to-parameter mapping. Binding to return Formalization:

[0189]

[0190]

[0191] in, For the caller's (Caller's) formal parameters, The actual argument of the called function (Callee) The return value of the called function. For the caller, μ is the parameter-to-argument mapping function, and ρ is the return value binding function.

[0192] The semantic prior model makes assumptions regarding operator preservation and template cleanup. and To avoid being misled by prior knowledge, a combined rule of hypothesis, verification, and convergence is introduced:

[0193]

[0194] in, For the set of prior assumptions preserved by operator taints, Let x'(o) be the set of prior assumptions for clean templates, and let x'(o) be the taint retention function verified by SMT. Based on the basic blemish retention rules Here, ' is the SMT satisfiability check function, and 'Sanitize'(v) is the sanitization predicate validated by SMT. For the basic purification rule, T represents "true" or "satisfiable". Embed candidate operators or cleanup templates into the current path predicate. A logical check is performed, and the hypothesis is only adopted if the satisfiability result supports the corresponding property. or .

[0195] Accordingly, the path-level criterion is updated as follows:

[0196]

[0197] Where SAT(·) represents the satisfiability of the decision logic formula, and src is the source node of the path. For the type trigger condition set (or CWE-κ trigger condition). To The constraint slicing results retain only constraints related to the trigger variable cluster, thereby reducing the solution size. This mechanism ensures that semantic priors do not exceed the safety envelope defined by formal semantics and satisfiability, while actively pruning infeasible branches and redundant constraints using correct priors.

[0198] Cost-bounded satisfyable path selection and structured evidence generation:

[0199] After obtaining a set of source-sink paths that satisfy semantics and constraints, two key engineering and governance issues still need to be addressed: first, selecting the representative path with sufficient information and minimal redundancy from multiple satisfiable paths; and second, organizing location offsets, call chains, key predicates, and textual descriptions into structured evidence for verification and auditing. This section establishes a consistent selection criterion between the cost of graph structure and statistical heuristics, and binds the witness of satisfiability solution and human-readable summaries into an integrated evidence object; all natural language summaries are derived from verified facts and subject to consistency constraints, thus forming a stable closed-loop output between interpretability and verifiability. Semantic priors only generate descriptive summaries consistent with offsets and variables, such as... Figure 3 As shown.

[0200] The conditional branches and memory constraints on the path are transformed into mathematical logic formulas, and the satisfiability of these formulas is verified using the SMT solver. The SMT solver uses Z3 version 4.8.10. A vulnerability is determined to exist only if the formula is satisfiable, and a satisfiability testimonies are generated. Unsatisfiable candidate paths are automatically eliminated, and relevant constraint fragments are rewritten as convergence conditions or pre-cleansing parameters for optimizing subsequent analysis.

[0201] Step S460: Generation of Structured Evidence

[0202] Generate a structured evidence package, which includes byte-level offset mappings, cross-procedure call chains, and satisfiability witnesses for key condition predicates.

[0203] Specifically, the set of all paths that pass the satisfiability check. The representative path with sufficient information and minimal redundancy is selected, and normalized evidence is derived. The cost function is the cost function Cost(P) defined in the sixth implementation of the first aspect mentioned above.

[0204] This work incorporates node risk scoring based on pre-trained graph channel discrimination. and the probability of the channel in the graph Related heuristics:

[0205]

[0206] in, This represents the marginal probability of nodes for the target category, where y is the target vulnerability category. The final target used for search ranking and representative selection is:

[0207]

[0208] in, The trade-off between the structural costs of control and statistical heuristics. This is the set of all paths that pass the satisfiability check. For multiple satisfiable paths, we take the top few paths that satisfy the above objective as representatives and generate evidence quadruples:

[0209]

[0210] in, For the offset and risk pair, π(v) is the binary offset corresponding to node v. Risk score for node v This is a summary of the cross-process source-sink call sequence and the flow of key variables. For key predicates and their satisfiability testimonies, A human-readable summary generated from semantic priors. asked to The truth value must remain consistent, meaning that ζ(P) must not contradict the solution result of any predicate in Y(P). The evidence is exported in a structured format, carrying versioned model parameters, fusion weights, calibration temperatures, and other meta-information, thereby meeting the governance requirements of being verifiable, traceable, and deliverable.

[0211] Furthermore, it also includes: automatic synthesis of cross-function context-sensitive rules based on declarative security patterns; construction of a dual-backend execution system, compiling non-recursive structural relations into Datalog relational closures to support large-scale graph-level fast screening, and normalizing inter-process propagation and alias determination into IFDS / IDE data flow solving tasks; and rule matching through a three-level pipeline, with the first level performing fast recall on the graph, the second level applying context-sensitive propagation on the IFDS / IDE backend, and the third level performing satisfiability verification.

[0212] Specifically, the prior is only responsible for candidate expansion and search ranking, while all conclusions are decided by formal semantics and satisfiability solutions, thus achieving a stable balance between coverage, efficiency, and verifiability, as shown in Algorithm 2. This algorithm takes binary samples, a unified multi-relation program graph, a semantic prior model, target CWE types, and a cleaned template library as core inputs, and also incorporates a key hyperparameter verified by multi-architecture binary vulnerability detection: the source confidence threshold. (Recommended value: 0.6~0.85) Sink confidence threshold (Recommended value: 0.7~0.9) Weight of multi-relationship edges (Recommended value: 0.1~0.9) Statistical heuristic coefficient (Recommended values ​​are 0.2~0.5); the algorithm ultimately outputs a set of representative paths and a set of structured candidate hazard flows. The algorithm first scores the confidence of program elements using a semantic prior model, then filters high-confidence vulnerability sources and sinks based on the aforementioned thresholds, and matches them with cleanup rule templates supported by the model. Based on the filtered source-sink pairs, it automatically synthesizes declarative detection rules and performs standardization. Through the IFDS / IDE dataflow solution backend, it performs cross-function propagation verification sensitive to the rule execution context, retaining logically consistent path sets. For each valid path, it constructs formal constraint predicates and performs SMT satisfiability checks, retaining satisfiable valid paths while optimizing detection rules using unsatisfiable kernels. Representative paths are selected based on statistical heuristic coefficients and path cost functions. Finally, it generates structured features, call chain dataflows, formal predicates, and verification text summaries for each representative path, assembling them into a set of structured candidate hazard flows. The range of the above hyperparameter values ​​is determined based on the Juliet standard, balancing detection accuracy and analysis efficiency.

[0213]

[0214]

[0215]

[0216] Automatic synthesis and formal specification of sanitized semantic specifications based on semantic priors and unified intermediate representation:

[0217] Within the established semantic domain of unified intermediate representation and multi-relational procedural graphs, the first step is to converge scattered security knowledge and empirical clues into compileable and verifiable rule forms. This section aims to expand the candidate pool of potential source, sink, and purification primitives using semantic priors without altering the verifiable decision boundaries, and to automatically generate declarative security patterns that meet cross-architecture and cross-version reuse requirements. The priors only handle candidate selection and ranking; all propagation and purification properties ultimately revert to logical decisions under formal semantics. Therefore, we unify the candidate specifications to a first-order logic rule representation and normalization paradigm, enabling seamless compilation into subsequent graph query and dataflow solving backends, and maintaining a consistent interface with Section 2.1.2 at the path predicate and satisfiability check levels.

[0218] To enable rules to be reused across architectures and versions, firstly, a unified abstraction of the security specification is provided. Let:

[0219]

[0220] in, It represents the semantic position of the matched entity, and F is the structured feature of the function or call point (namespace, prototype signature, formal and actual parameter patterns, constant form, etc.). For a safety role. The specification is explained in the diagram as follows:

[0221]

[0222] in, V represents the set of instances of the specification Spec on the graph G, where V is the set of nodes in the graph.

[0223] For a given CWE type κ, the semantic prior model ℳψ assigns confidence to the specification score under the context C (which includes the called function, parameter summary, fragments of locally unified intermediate representations, and constant and string evidence):

[0224]

[0225] And an expanded set is generated through thresholding:

[0226]

[0227]

[0228] in, The source confidence threshold. This is the confidence threshold for the sink. For the expanded set of source point specifications, This is the expanded set of sink specifications.

[0229] To avoid prior noise entering the decision boundary, this paper only considers... and Used as candidate and ranking signals, all propagation and purification properties must be confirmed by satisfiability checks in subsequent path predicates. Candidate specifications are normalized to first-order rules of the safety-mode DSL. Let ℛκ be the rule set for the target type, and each rule is characterized by four elements: source, path, purification, and sink.

[0230]

[0231] Where u and v are the candidate source node and sink node on the path, respectively; and P is a structured feature descriptor for the source / sink; P is a specific path instance from u to v; The graph is parameterized by control dependencies, data dependencies, and inter-procedure call relationships; san(P) is a cleansing predicate that can be proposed a priori and then verified by constraint solving, ¬san(P) indicates that there is no valid cleansing operation on the path or the cleansing predicate is invalid; vul(κ,u→v) is a vulnerability determination predicate, indicating that there is a vulnerability of type κ from u to v. The above rules converge to an equivalent set of paradigms after standardization transformation N(∙). This ensures that the same semantic rules have consistent compilation and execution behavior in different code formats.

[0232] Formal compilation and context-sensitive solving of declarative safety patterns

[0233] Once the rules are standardized, the key is to stably implement them as a scalable and context-sensitive execution process. This section presents a formal compilation path from declarative safety patterns to executable analysis tasks: First, non-recursive structural relations in the rules are translated into relational closures to support large-scale graph-level reasoning; second, sub-formulas involving inter-process propagation and aliasing are reduced to context-sensitive dataflow solving tasks, and the minimum fixed point is iteratively solved under field sensitivity and return binding constraints. Through this dual-backend collaborative mechanism, rule semantics can cover complex control and data dependency patterns while maintaining verifiability. All candidate matches are then promoted to path predicates and entered into satisfiability checks, thereby decoupling execution and adjudication while maintaining consistent alignment.

[0234] The semantics of the rules are given in a model-theoretic manner:

[0235]

[0236] The engineering execution employs a dual-backend collaboration. Non-recursive structural relations and graph closure subforms are translated into Datalog family relational programs, with semantics represented by the minimum fixed points of monotonic operators.

[0237]

[0238] For the rule set The compiled Datalog relational program, This indicates finding the smallest fixed point of a monotonic operator. Guided by rules, this corresponds to graph-level reachability, pattern connectivity, and attribute filtering. Secondly, the inter-procedural propagation sub-formulas are reduced to IFDS / IDE tasks within the calling context. Up to maintenance point information With cross-process flow function

[0239]

[0240] Where x is the data flow analysis object, and c and c′ are the context identifiers of the caller and the called function, respectively. For CWE type Cross-process data flow transformation function.

[0241] Combined with field-sensitive alias relationships Iteratively solve for the minimum fixed point. This allows for scalable inference on large-scale graphs while maintaining context sensitivity and alias accuracy. Each matching candidate generated by the compiler... All were promoted to path predicates and entered into the validation process. Let... A predicate is composed of branch conditions, memory access, bit width, and call constraints. For stain predicate, If the predicate is triggered by a type, then the decision condition is:

[0242]

[0243] Unsatisfiable candidates are automatically eliminated, and relevant constraint fragments are rewritten as convergence conditions or purification prerequisites for the rules, thereby forming a closed loop of matching, verification, and convergence and suppressing the overgeneralization of rules.

[0244] A verifiable reasoning framework for multi-level matcher generation and path-level context trimming for auditable conclusions:

[0245] While ensuring the rules are enforceable, an engineering-acceptable trade-off must be struck between recall and precision, ensuring the output possesses interpretable and verifiable evidentiary attributes. This section constructs a hierarchical matching pipeline: achieving broad recall through graph-level rapid filtering, suppressing false positives caused by aliases and context through inter-process refinement, and finally determining semantic consistency through path predicate satisfiability verification. To complement this, we select representative paths using a joint objective of structural cost and statistical heuristics, and solidify offset mapping, call chain summaries, key predicate witnesses, and human-readable descriptions as evidence objects. This demonstrates that textual and logical witnesses enforce consistency constraints, thereby integrating rapid search, precise judgment, and deliverable evidence into a single technical loop.

[0246] To achieve a steady-state tradeoff between recall and accuracy, matching execution is organized into a three-stage pipeline:

[0247] The first stage performs rapid recall on the graph, using subgraph matching and relation closure to obtain the candidate set. And a scoring function weighted by relational importance:

[0248]

[0249] This serves as a heuristic for beam search to reduce path explosion.

[0250] The second level applies context-sensitive propagation, field-sensitive aliases, and inter-procedural return bindings to the IFDS / IDE backend, outputting a refined collection. .

[0251] Third-level general Transform one by one And perform a satisfiability check to obtain Simultaneously, based on the joint objective of structural costs and statistical heuristics:

[0252]

[0253] Select representative paths, among which Reflecting structural complexity and penalties for purification failure, Reflecting the statistical heuristics of the graph channels, parameters Calibrated by the development set.

[0254] To meet the requirements of interpretability and verifiability, each representative path is fixed as an evidence quadruple:

[0255]

[0256] Among them, For structured evidence packages, Record offsets and risk metrics. For summarizing cross-procedure calls and variable transfers, For key predicates and their satisfiability testimonies, Human-readable descriptions generated from controlled templates.

[0257] The description and witnessing must satisfy the consistency constraint:

[0258]

[0259] in, This represents the set of atomic predicates after decomposing the path predicate Φ(P). The human-readable explanation states that ζ(P) semantically strictly implies or corresponds to the truth value determination of the atomic predicate φ, thereby ensuring that the text interpretation does not exceed the semantic envelope of the formal decision.

[0260] The final output evidence object carries the model version, rule hash, and runtime parameters, supporting independent review, version playback, and cross-tool auditing.

[0261] In summary, this invention proposes a binary vulnerability detection and localization method based on a unified intermediate representation and verifiable reasoning framework. This method deeply integrates low-level semantic modeling with high-level rule solving. Its core technical logic and advantages can be summarized in the following four dimensions: cross-architecture semantic alignment, logically verifiable evidence delivery, large-scale context-sensitive reasoning, multimodal enhancement, and intelligent judgment. Overall, the four core modules of this invention complement each other, systematically balancing cross-architecture generalization ability, logical verifiability, and engineering scalability in complex heterogeneous environments with no source code and multiple architectures. This provides an efficient, reliable, and practical framework for software supply chain security audits and the protection of critical information infrastructure.

[0262] The core innovation of this invention lies not in the optimization of a single module, but in the construction of a closed-loop reasoning chain of "semantic alignment → collaborative representation → prior guidance → formal verification → evidence solidification". The key improvements in the method are explained below:

[0263] Cross-Architecture Unified Intermediate Representation and Program Graph Collaborative Fusion: Addressing the semantic heterogeneity of instructions in multi-architecture and source-code-less scenarios, this paper proposes a heterogeneous program graph collaborative fusion framework based on a cross-architecture unified intermediate representation (IR). By constructing a multi-relational program graph covering control dependencies, data dependencies, and inter-procedural calls, and building a dual-channel collaborative representation of sequence channels and graph channels at the learning level, alignment of heterogeneous instructions in the equivalent semantic space is achieved. Unlike traditional heuristic matching schemes that rely on a single control flow or byte signature, this invention effectively overcomes the distribution drift caused by differences in decompilation morphology, significantly improving the model's discrimination accuracy and robustness across architectures and multiple compilation options.

[0264] The Hypothesis-Verification Collaborative Paradigm and Formalized Verifiable Reasoning: Addressing the pain points of existing black-box detection models' lack of interpretability and definitive logical evidence, this invention innovatively introduces the hypothesis-verification collaborative paradigm. This mechanism utilizes a semantic prior model as a signal (hypothesis) for candidate expansion and ranking, while the final path construction and conclusion determination strictly rely on formalized taint semantics, constraint slicing, and SMT satisfiability checks (verification). Compared to traditional deep learning models that only output probabilities, this invention can stably output structured evidence including byte-level offset mappings, cross-procedural call chains, and key predicate witnesses, enforcing consistency constraints between statements and witnesses, and completely resolving the crisis of detection results being difficult to independently verify and trust-trace.

[0265] Declarative Security Model and Dual-Backend Collaborative Execution System: Addressing the performance bottlenecks and difficulties in manually writing rules for large-scale cross-function and context-sensitive analysis, a declarative security model is introduced. This model automatically synthesizes and standardizes the source, cleanup, and sink specifications into first-order logical rules. The system constructs a layered dual-backend architecture: non-recursive structural relations are compiled into Datalog relational closures to support large-scale graph-level fast screening, and inter-process propagation is reduced to IFDS / IDE data flow solving tasks. Compared to traditional time-consuming and inefficient static rule engines, this invention maintains controllable latency and memory levels while ensuring context-sensitive and field-sensitive accuracy through a resource-adaptive slicing method. Specifically, based on current hardware memory, analysis latency, and program size, only core vulnerability paths are analyzed when resources are limited, while full-scale detailed analysis is performed when resources are sufficient. Lightweight analysis is handled by the Datalog backend, and detailed analysis by the IFDS / IDE backend, achieving scalable inference and adaptive rule evolution in large-scale constrained environments.

[0266] The above three major improvements run through the entire process of this invention, from the underlying binary semantic alignment to the top-level logical verification and intelligent judgment. Through joint optimization at the levels of unified representation, formal provable solution and multimodal collaborative scheduling, the invention systematically solves the problems of weak feature generalization, lack of conclusive evidence and performance bottlenecks in large-scale analysis faced by binary vulnerability detection in heterogeneous environments without source code. These improvements constitute the core innovation of this invention.

[0267] It should be noted that the execution order of steps S410 to S460 above is merely illustrative and is not specifically limited by this invention. Those skilled in the art can adjust the execution order of each step or execute some steps in parallel according to the actual application scenario. For example, the dual-channel representation learning in step S430 can be executed in parallel with the map construction in step S420; the path verification in step S450 can be executed in parallel with the risk scoring in step S440.

[0268] like Figure 5 As shown, this embodiment of the invention further provides a binary vulnerability detection device based on a unified IR and verifiable inference framework, comprising:

[0269] The intermediate representation conversion module 501 is used to acquire the binary code sample to be detected and convert the binary code sample into a cross-architecture unified intermediate representation through a semantically preserved instruction-level promotion mechanism.

[0270] The graph construction module 502 is used to construct a multi-relationship program graph based on the cross-architecture unified intermediate representation. The multi-relationship program graph includes control dependencies, data dependencies, and inter-process call relationships, and establishes a reversible mapping between graph nodes and binary offsets.

[0271] The feature extraction module 503 is used to extract features from the multi-relation program graph through dual-channel collaborative representation learning. The dual channels include a sequence channel and a graph channel, wherein the sequence channel is used to converge long-range context semantics at the function level, and the graph channel is used to propagate local relations and causal clues along control dependencies and data dependencies.

[0272] Vulnerability determination module 504 is used to determine the sample-level vulnerability type and the node-level risk score based on the output of the dual-channel collaborative representation learning, and obtain the location set through threshold filtering;

[0273] The path verification module 505 is used to construct verifiable source-sink paths based on formal taint propagation and constraint slicing, and to perform logical verification of candidate paths through SMT satisfiability checks.

[0274] The evidence generation module 506 is used to generate a structured evidence package, which includes byte-level offset mapping, cross-procedure call chain, and satisfiability witnesses of key condition predicates.

[0275] It should be noted that, Figure 5 The device embodiments shown correspond to the method embodiments. The specific implementation of each module in the device embodiments can be referred to the corresponding description in the method embodiments, which will not be repeated here.

[0276] This invention also provides an electronic device, including: a processor; a storage device for storing one or more programs; a communication interface for data interaction with an external device; and when the one or more programs are executed by the processor, the processor executes the above-described binary code vulnerability detection and location method based on static analysis.

[0277] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the above-described method for detecting and locating binary code vulnerabilities based on static analysis.

[0278] Those skilled in the art should understand that although various embodiments are described in a specific manner in the embodiments of the present invention, these embodiments can be modified and varied in various ways without departing from the principles of the present invention. For example, dual-channel collaborative representation learning can be replaced with a single-channel but more complex feature extraction network; the Datalog and IFDS / IDE dual backends can be replaced with a unified symbolic execution engine; the quadruple form of the structured evidence package can be adjusted according to specific application scenarios, etc. These modifications and variations should all be included within the scope of protection of the present invention.

[0279] Furthermore, the various parameters used in the embodiments of the present invention (such as α, λ_c, γ, β, etc.) are all exemplary values. Those skilled in the art can adjust and optimize them according to actual application scenarios, hardware resources and performance requirements. The specific values ​​of these parameters should not limit the scope of protection of the present invention.

[0280] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0281] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0282] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0283] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0284] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0285] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A binary vulnerability detection method based on a unified IR and verifiable inference framework, characterized in that, include: Obtain a binary code sample to be detected, and convert the binary code sample into a cross-architecture unified intermediate representation through a semantically preserved instruction-level promotion mechanism; A multi-relationship program graph is constructed based on the cross-architecture unified intermediate representation. The multi-relationship program graph includes control dependencies, data dependencies, and inter-procedure call relationships, and an invertible mapping between graph nodes and binary offsets is established. Feature extraction is performed on the multi-relation procedural graph through dual-channel collaborative representation learning. The dual channels include a sequence channel and a graph channel, wherein the sequence channel is used to converge long-range contextual semantics at the function level, and the graph channel is used to propagate local relations and causal clues along control dependencies and data dependencies. Based on the output of the dual-channel collaborative representation learning, sample-level vulnerability type determination and node-level risk scoring are performed, and the location set is obtained through threshold filtering. Verifiable source-sink paths are constructed based on formal taint propagation and constraint slicing, and candidate paths are logically verified through SMT satisfiability checks. Generate a structured evidence package, which includes byte-level offset mappings, cross-procedure call chains, and satisfiability witnesses for key condition predicates.

2. The binary vulnerability detection method based on a unified IR and verifiable inference framework according to claim 1, characterized in that: The semantically preserved instruction-level promotion mechanism satisfies the semantically preserved mapping condition: ， in For the observable semantics of program trajectory, This refers to a machine-level program. This is an intermediate representation level program. The relation-normalized adjacency matrix of the multi-relation procedural graph for: ， in, For relationship The original adjacency matrix, For relationship The degree matrix.

3. The binary code vulnerability detection and location method based on static analysis according to claim 1, characterized in that, The dual-channel collaborative representation learning specifically includes: Construct a fused representation of type and content for each node v: ， in, Embedded for node type, Embed the content of the intermediate representation token sequence contained in the node. This represents vector concatenation. On the sequence channel, the function-level notation sequence is encoded to obtain the global representation. ; On the graph channel, a multi-relational gated graph neural network is used for message passing and gating updates; The joint loss function for the dual-channel collaborative representation learning is: ， in, For classifying losses, For consistency loss, and The regularization coefficient is... The sparsity coefficient is the relational sparsity factor. For a set of learnable parameters, This is the relation weight vector.

4. The binary vulnerability detection method based on a unified IR and verifiable inference framework according to claim 1, characterized in that, The verifiable construction of source-sink paths based on formal taint propagation and constraint slicing specifically includes: A semantic prior model is introduced as a signal for candidate expansion and ranking, and the expansion set is obtained through thresholding. Reverse slicing is performed along data dependencies and inter-procedure call relationships to obtain a set of candidate paths; Define stain predicate With the propagation operator, perform formal taint propagation; The hypothesis-verification collaborative paradigm is adopted, which uses semantic priors to summarize operators that may retain taints and template hypotheses that may constitute purification, and then confirms or eliminates them one by one through constraint slicing and satisfiability checks.

5. The binary vulnerability detection method based on a unified IR and verifiable inference framework according to claim 4, characterized in that, The introduction of a semantic prior model as a signal for candidate expansion and ranking, and the obtaining of the expansion set through thresholding, specifically includes: For call point context The semantic prior model Output for target CWE type Confidence score of candidate sink ; By comparing the confidence score with a preset source threshold and sink threshold By comparison, the initial source set is expanded to obtain the expanded set: The semantic prior model is only used to adjust the priority of path search and expand the search space, and is not directly used as the basis for vulnerability determination.

6. The binary vulnerability detection method based on a unified IR and verifiable inference framework according to claim 1, characterized in that, The logical verification of candidate paths through SMT satisfiability checks specifically includes: Transform the conditional branches and memory constraints on the path into mathematical logic formulas; The SMT solver is invoked to verify the satisfiability of the mathematical logic formula. The vulnerability is determined to be valid only if the formula is satisfied, and a satisfiability witness is generated. Unsatisfiable candidate paths are automatically eliminated, and relevant constraint fragments are rewritten as convergence conditions of rules or purification prerequisites.

7. The binary vulnerability detection method based on a unified IR and verifiable inference framework according to claim 1, characterized in that, The generated structured evidence package specifically includes: Define the cost function: ， in, Paths The nodes on for arrive Relationship type; For relation type weights, For nodes The significance of For nodes The significance of This is the count of ignored or invalid cleanup instances along the path, where P is the path. The penalty coefficient for purification failure. Generate evidence quadruples: ， in, For offset and risk pair, This is a summary of the cross-process source-sink call sequence and the flow of key variables. For key predicates and their satisfiability testimonies, Human-readable summaries generated from semantic priors; summary asked to The truth value must be consistent, that is, ζ(P) must not contradict the solution result of any predicate in Y(P).

8. The binary vulnerability detection method based on a unified IR and verifiable inference framework according to claim 1, characterized in that, Also includes: Automatic synthesis of cross-function context-sensitive rules based on declarative security patterns; A dual-backend execution system is constructed, non-recursive structural relations are compiled into Datalog relational closures to support large-scale graph-level fast screening, and inter-process propagation and alias determination are normalized to IFDS / IDE data flow solving tasks; Rule matching is performed through a three-level pipeline: the first level performs rapid recall on the graph, the second level applies context-sensitive propagation in the IFDS / IDE backend, and the third level performs satisfiability verification.

9. A binary vulnerability detection method based on a unified IR and verifiable inference framework as described in claim 8, characterized in that: The dual-backend execution architecture consists of a Datalog relational closure engine as the first backend and an IFDS / IDE dataflow solver as the second backend. The Datalog backend is responsible for processing non-recursive structural relations and graph closures by finding the minimum fixed point of monotonic operators. Achieve large-scale graph-level rapid screening; The IFDS / IDE backend is responsible for handling inter-procedure propagation and alias determination sub-forms within the calling context. Up to maintenance point information With cross-process flow function This is to ensure context-sensitive and field-sensitive detection accuracy.

10. The binary vulnerability detection method based on a unified IR and verifiable inference framework according to claim 1, characterized in that: The node set of the multi-relation procedural graph Includes instruction nodes, basic block nodes, function nodes, and global object nodes; edge set This includes control dependency edges, data dependency edges, inter-procedure call edges, and alias relationship edges; In particular, to address the memory aliasing issue, an abstract location set is defined. and alias relationship For any read operation With write operations If satisfied Then, explicitly construct the data propagation semantic edges in the graph. This is to ensure the integrity of data dependencies.

Images