A large-scale binary function vulnerability scanning method and device, terminal equipment and storage medium

Abstract

The application discloses a large-scale binary function vulnerability scanning method and device, terminal equipment and storage medium, belongs to the vulnerability scanning technical field, the method is, obtaining the vulnerability fingerprint of binary vulnerability code, and the binary function library to be scanned; respectively inputting the binary function library and the vulnerability fingerprint into the preset embedded model, generating a query vector and a to-be-scanned vector; clustering the query vector and the to-be-scanned vector in a high-dimensional vector space, and determining the distance between each to-be-scanned vector and the query vector, determining a plurality of candidate vectors of a preset preliminary screening quantity threshold value from the to-be-scanned vector according to the distance; comparing the similarity of the binary vulnerability code and the binary function corresponding to each candidate vector, and taking the candidate function corresponding to the similarity greater than a preset fine screening score threshold value as a target function with a vulnerability. Therefore, by implementing the application, the scanning efficiency of the existing vulnerability scanning technology can be improved.

Description

Technical Field

[0001] This invention relates to the field of vulnerability scanning technology, and in particular to a method, apparatus, terminal device, and storage medium for scanning large-scale binary function vulnerabilities. Background Technology

[0002] With the increasing complexity of modern software development, software supply chain security has become a core issue in the field of cybersecurity. The widespread use of open-source software (OSS) means that a vulnerability in an upstream component can spread instantly to thousands of downstream applications through dependencies, creating a significant security risk. When a vulnerability is assigned a CVE number and made public, it is usually accompanied by a patch. However, there is a dangerous "time window" between patch release and all affected downstream software completing the update, known as the "patch delay" phenomenon. Attackers often exploit this window to launch attacks on systems that have not yet been updated.

[0003] In most cases, researchers only have access to compiled binaries, not source code. Therefore, for enterprises and security researchers, quickly and accurately identifying binaries affected by known vulnerabilities within their vast software assets is a crucial task. Currently, the core technology for accomplishing this task is Binary Code Similarity Detection (BCSD). Technologies centered on accuracy, such as FIBER, deeply analyze the source code of patches. During detection, it performs the same in-depth analysis on the target binary file, comparing the similarity of entire functions to ensure extremely high accuracy and extremely low false positive rates. However, when facing enterprise-level software repositories containing millions of functions, this meticulous step-by-step approach suffers from severe patch delay issues. Therefore, existing vulnerability scanning technologies suffer from low scanning efficiency. Summary of the Invention

[0004] This invention provides a method, apparatus, terminal device, and storage medium for scanning large-scale binary function vulnerabilities. The method can overcome the shortcomings of low scanning efficiency in existing vulnerability scanning technologies.

[0005] One embodiment of the present invention provides a method for scanning large-scale binary function vulnerabilities, including: Obtain the vulnerability fingerprint of the binary vulnerability code, and the binary function library to be scanned; wherein, the vulnerability fingerprint is generated based on the modified code lines in the binary vulnerability code; The binary function library and the vulnerability fingerprint are respectively input into a preset embedded model, so that the embedded model maps each binary function in the binary function library and the vulnerability fingerprint to a high-dimensional vector space to generate a query vector and a vector to be scanned. Cluster the query vector and the vector to be scanned in a high-dimensional vector space, determine the distance between each vector to be scanned and the query vector, and determine a number of candidate vectors with a preset initial screening threshold from the vectors to be scanned based on the distance. The similarity between the binary vulnerability code and the binary function corresponding to each candidate vector is compared, and the candidate function corresponding to the similarity score greater than the preset screening score threshold is taken as the target function with vulnerability.

[0006] Furthermore, obtaining the vulnerability fingerprint of the binary vulnerability code includes: Obtain the binary vulnerability code; Identify the modifiers in the binary vulnerability code and designate the lines of code containing the modifiers as the modified lines of code; Based on a preset segment truncation threshold, extract several unchanged target code lines from the context of each changed code line; Each changed line of code and its corresponding set of unchanged target lines of code are used as a vulnerability fingerprint.

[0007] Furthermore, the comparison of the similarity between the binary vulnerability code and the binary function corresponding to each candidate vector includes: The binary vulnerability code is used as the query function, the binary function corresponding to the candidate vector is used as the candidate function, and each candidate function is used to generate a candidate query pair with the query function. The candidate query pairs are sequentially input into a preset comparative model so that the comparative model extracts the functional features of each candidate query pair and determines the similarity of each candidate query pair based on the functional features.

[0008] Furthermore, the training of the embedded model includes: Obtain several vulnerability sample functions, corresponding patch sample functions, and binary sample functions; Based on the vulnerability sample function and the patch sample function, generate vulnerability sample fingerprints and patch sample fingerprints; Each vulnerability sample fingerprint, the corresponding patch sample fingerprint, and the binary sample function are used as training sample pairs. Build the initial embedded model; The initial embedded model is trained using the training samples, so that the initial embedded model generates vulnerability fingerprint vector, patch fingerprint vector and function sample vector respectively based on vulnerability sample fingerprint, patch sample fingerprint and binary sample function; In each training round, the model parameters of the initial embedded model are optimized with the goal of minimizing the similarity between the vulnerability fingerprint vector and the patch fingerprint vector and maximizing the similarity between the vulnerability fingerprint vector and the function sample vector, and the first loss function value of the initial embedded model is calculated using a preset first loss function. When the first loss function value converges, the initial embedded model generated in the last round of training is used as the final embedded model.

[0009] Furthermore, the training of the comparative model includes: Construct an initial comparative model; wherein the initial comparative model comprises two subnetworks sharing weights; For each vulnerability sample function, construct several training triplets by using the corresponding patch sample function as the positive sample and the corresponding binary sample function as the negative sample. In each training round, for each training triplet, the vulnerability sample function and the positive sample are first input into different sub-networks to extract the vulnerability function vector of the vulnerability sample function and the positive sample feature vector of the positive sample, and generate the first distance between the vulnerability feature vector and the positive sample feature vector. Then, the vulnerability sample function and the negative sample are input into different sub-networks to extract the vulnerability function vector of the vulnerability sample function and the negative sample feature vector of the negative sample, and generate the second distance between the vulnerability feature vector and the negative sample feature vector. A second loss function is constructed to calculate the difference between the first distance and the second distance. In each training round, the value of the second loss function is calculated based on the first distance and the second distance. The network parameters of the sub-networks in the initial comparative model are adjusted with the maximum loss function value as the objective. When the value of the second loss function converges, the final optimized initial comparative model is used as the comparative model.

[0010] An embodiment of the present invention also provides a scanning device for large-scale binary function vulnerabilities, comprising: The vulnerability function acquisition module is used to acquire the vulnerability fingerprint of binary vulnerability code and the binary function library to be scanned; wherein, the vulnerability fingerprint is generated based on the modified code lines in the binary vulnerability code; The vulnerability feature extraction module is used to input the binary function library and the vulnerability fingerprint into a preset embedded model, so that the embedded model maps each binary function in the binary function library and the vulnerability fingerprint to a high-dimensional vector space, generating a query vector and a vector to be scanned. The vulnerability screening module is used to cluster the query vector and the vector to be scanned in a high-dimensional vector space, determine the distance between each vector to be scanned and the query vector, and determine a number of candidate vectors with a preset screening quantity threshold from the vectors to be scanned based on the distance. The vulnerability screening module compares the similarity between binary vulnerability code and the binary function corresponding to each candidate vector, and selects the candidate function with a similarity greater than a preset screening score threshold as the target function containing the vulnerability.

[0011] Furthermore, the vulnerability function acquisition module acquires the vulnerability fingerprint of the binary vulnerability code, including: Obtain the binary vulnerability code; Identify the modifiers in the binary vulnerability code and designate the lines of code containing the modifiers as the modified lines of code; Based on a preset segment truncation threshold, extract several unchanged target code lines from the context of each changed code line; Each changed line of code and its corresponding set of unchanged target lines of code are used as a vulnerability fingerprint.

[0012] Furthermore, the vulnerability screening module compares the similarity between the binary vulnerability code and the binary function corresponding to each candidate vector, including: The binary vulnerability code is used as the query function, the binary function corresponding to the candidate vector is used as the candidate function, and each candidate function is used to generate a candidate query pair with the query function. The candidate query pairs are sequentially input into a preset comparative model so that the comparative model extracts the functional features of each candidate query pair and determines the similarity of each candidate query pair based on the functional features.

[0013] This application also provides a terminal device, including: One or more processors; A memory, coupled to the processor, for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors perform a large-scale binary function vulnerability scan as described in the above embodiments of the invention.

[0014] This application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs a large-scale binary function vulnerability scan as described in the above embodiments.

[0015] The following benefits can be obtained by implementing the present invention: This invention provides a method, apparatus, terminal device, and storage medium for scanning large-scale binary function vulnerabilities. The method involves inputting a binary function library and vulnerability fingerprints into a preset embedded model. The embedded model maps each binary function in the binary function library and the vulnerability fingerprint to a high-dimensional vector space, generating query vectors and vectors to be scanned. The query vectors and vectors to be scanned are clustered in the high-dimensional vector space, and the distance between each vector to be scanned and the query vector is determined. Based on the distance, several candidate vectors with a preset initial screening threshold are determined from the vectors to be scanned. Considering that a vulnerability often involves only a few lines of critical code in a function, this invention first uses vulnerability fingerprints generated based on changed code lines to initially screen the binary function library, identifying candidate functions that may have changed code lines. Finally, a deep similarity comparison is performed between the complete binary vulnerability code and the binary functions corresponding to each candidate vector to determine the target functions with vulnerabilities from the candidate vectors. Compared to existing technologies that perform a complete scan of the binary function library, this invention can more efficiently screen out target functions with vulnerabilities. Attached Figure Description

[0016] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating a method for scanning large-scale binary function vulnerabilities according to a certain embodiment of this application; Figure 2 This is a schematic diagram of the structure of a scanning device for large-scale binary function vulnerabilities provided in a certain embodiment of this application; Figure 3 This is a schematic diagram of the structure of a terminal device provided in a certain embodiment of this application. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0019] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0020] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly defined.

[0021] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0022] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0023] In the description of the embodiments of this application, the term "multiple" refers to two or more (including two), similarly, "multiple sets" refers to two or more (including two sets), and "multiple pieces" refers to two or more (including two pieces).

[0024] In the description of the embodiments of this application, unless otherwise expressly specified and limited, technical terms such as "installation," "connection," "joining," and "fixing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. For those skilled in the art, the specific meaning of the above terms in the embodiments of this application can be understood according to the specific circumstances.

[0025] See Figure 1 To address the problems in the prior art, an embodiment of the present invention provides a method for scanning large-scale binary function vulnerabilities, comprising: S1. Obtain the vulnerability fingerprint of the binary vulnerability code and the binary function library to be scanned; wherein, the vulnerability fingerprint is generated based on the modified code lines in the binary vulnerability code; Preferably, obtaining the vulnerability fingerprint of the binary vulnerability code includes: Obtain the binary vulnerability code; identify the modifiers in the binary vulnerability code, and take the code lines containing the modifiers as the modified code lines; extract several unmodified target code lines in the context of each modified code line according to a preset fragment truncation threshold; and take each modified code line and its corresponding several unmodified target code lines as the vulnerability fingerprint.

[0026] In a preferred embodiment of the present invention, vulnerability code is first extracted from publicly available vulnerability databases such as NVD and CVE. The vulnerability code is typically presented in Diff format. Then, Diff text parsing is performed. Within each code block (hunk), core change lines are located, namely deleted lines starting with "-" and added lines starting with "+". Centered on these core change lines, N unchanged target code lines (starting with a space or no sign) before and after them are extracted as context. N is the fragment truncation threshold, a configurable hyperparameter, typically set to 3 to 7 to ensure the fingerprint contains sufficient local semantic information. Finally, a semantic fingerprint is generated. For multiple discontinuous changes that may exist within the same function, all change lines and their captured contexts are extracted and combined into a structured code fragment, i.e., the vulnerability fingerprint FP. vuln .

[0027] Understandably, this invention redefines the detection target, no longer matching entire functions or complex semantic formulas, but automatically extracting key code snippets containing minimal context from patches that represent the essence of the vulnerability. This fingerprint is direct, minimal evidence of the vulnerability's existence; it is more focused than an entire function and lighter than a complex semantic formula.

[0028] It should be noted that the large scale mentioned in the embodiments of the present invention refers to the massive size of the binary function library to be scanned, which reaches the level of an enterprise-level software supply chain. For example, the binary function library to be scanned contains millions of binary functions. In addition, the large scale is also reflected in the heterogeneous complexity of the data to be scanned, that is, the binary function library to be scanned contains a set of binary functions compiled using multiple different compilers, multiple different optimization levels, and multiple different instruction set architectures.

[0029] Specifically, the process of obtaining the vulnerability fingerprint of the binary vulnerability code and the binary function library to be scanned serves as the basic input and preparation stage for vulnerability scanning.

[0030] The binary function library to be scanned is massive in size, comparable to that of an enterprise software supply chain, encompassing millions of binary functions. Furthermore, the binary function library exhibits heterogeneous complexity, specifically containing sets of binary functions compiled using multiple different compilers, optimization levels, and instruction set architectures.

[0031] The process for obtaining vulnerability fingerprints from binary vulnerability code begins with acquiring the binary vulnerability code itself. This binary vulnerability code is typically presented in a difference comparison text format. Next, a text parsing operation is performed on the acquired binary vulnerability code in this format. During parsing, change characters are identified within the binary vulnerability code. These change characters include deletion characters (representing code deletion) and addition characters (representing code addition). Lines of code beginning with a deletion character and lines beginning with an addition character are uniformly identified, and these lines are determined to be changed code lines.

[0032] After extracting the modified code lines, based on a preset segment truncation threshold, several unchanged target code lines are extracted from the context of each modified code line, centered on the aforementioned modified code line. Unchanged target code lines refer to consecutive code lines that do not carry change operators. The preset segment truncation threshold is typically set between three and seven lines to ensure that the extracted context contains sufficient local semantic information.

[0033] For cases where there may be multiple discontinuous changes within the same binary function, all changed code lines and several unchanged target code lines are extracted and summarized. Each changed code line is then combined with its corresponding unchanged target code lines to construct a structured code fragment. The constructed structured code fragment is used as the final output vulnerability fingerprint.

[0034] The method described above, which extracts modified code snippets containing a small amount of context as vulnerability fingerprints, abandons the traditional approach of matching complete function bodies or complex semantic logic. It uses the most direct and minimal evidence of vulnerability existence as the feature benchmark. Compared with the method of completely scanning binary function libraries or extracting complete function features for comparison, it effectively reduces the data processing overhead of subsequent detection processes and greatly improves the focus of vulnerability fingerprint extraction and the overall execution efficiency of large-scale vulnerability scanning.

[0035] S2. Input the binary function library and the vulnerability fingerprint into a preset embedded model, so that the embedded model maps each binary function in the binary function library and the vulnerability fingerprint to a high-dimensional vector space, generating a query vector and a vector to be scanned. In a preferred embodiment of the present invention, the embedded model is a pre-trained function encoder. It can encode a binary function into a high-dimensional vector, and this encoding process has high semantic distinguishability. That is, in the generated vector space, vectors containing the same vulnerability are closer together, while vectors that are not related to the fixed version or irrelevant functions are more distant.

[0036] Preferably, the training of the embedded model includes: A number of vulnerability sample functions, corresponding patch sample functions, and binary sample functions are obtained; vulnerability sample fingerprints and patch sample fingerprints are generated based on the vulnerability sample functions and patch sample functions; each vulnerability sample fingerprint, corresponding patch sample fingerprint, and binary sample function are used as training sample pairs; an initial embedded model is constructed; the initial embedded model is trained using the training sample pairs, so that the initial embedded model generates vulnerability fingerprint vectors, patch fingerprint vectors, and function sample vectors based on the vulnerability sample fingerprints, patch sample fingerprints, and binary sample functions, respectively; in each round of training, the model parameters of the initial embedded model are optimized with the goal of minimizing the similarity between the vulnerability fingerprint vector and the patch fingerprint vector and maximizing the similarity between the vulnerability fingerprint vector and the function sample vector, and the first loss function value of the initial embedded model is calculated using a preset first loss function; when the first loss function value converges, the initial embedded model generated in the last round of training is used as the final embedded model.

[0037] In a preferred embodiment of the present invention, when constructing the training sample set of the embedded model, the same method as in step S1 is used: extracting vulnerability sample functions from public vulnerability databases such as NVD and CVE, and extracting patch sample functions from the corresponding open source project fix commits (Git Commit). For each vulnerability sample function, a binary sample function containing the vulnerability code is obtained by writing or extracting historical version code.

[0038] Then, Diff text parsing is performed. Within each code block, the core changed lines are located, and a semantic fingerprint is generated. For multiple discontinuous changes that may exist within the same function, all deleted lines and their captured context are extracted and combined into a structured code fragment, i.e., the vulnerability fingerprint. Similarly, all the added lines and their captured context are combined into another code snippet, namely the patch fingerprint. .

[0039] Finally, a dataset was constructed. To simulate real-world binary scenarios, multiple compilers were used to compile the vulnerability sample functions and patch sample functions to enhance the data and improve the model's generalization ability. The corresponding binary functions were then disassembled from the generated object files. Each record in the dataset contains the vulnerability number, the vulnerability code, the binary function disassembled from the patch code, and information such as the corresponding compiler, optimization level, and architecture.

[0040] Furthermore, using the Transformer encoder as the initial embedded model, in each training batch, samples are extracted from the dataset. A vulnerability fingerprint and a patch fingerprint pair. The number of samples used for training in each iteration; for each vulnerability function, a query vector is obtained by passing it through a Transformer encoder. Simultaneously, another binary sample function vector containing the same vulnerability fingerprint is used as its unique positive sample. All other function vectors in this batch will become part of this query. The negative sample set is used, and the corresponding patch function's encoded vector (also obtained by the Transformer encoder) will be used as a strong negative sample. The training objective is to make it consistent with the negative sample set. The distance should be as far as possible.

[0041] For each query vector in the batch The loss is calculated using the first loss function shown below. Then, the average loss for the entire batch is calculated. The gradient of the loss function with respect to the model parameters is calculated using the backpropagation algorithm. Finally, an optimizer such as Adam is used based on the learning rate. To update the model's parameters.

[0042] ; The parameters in the above formula are defined as follows: This is the value of the first loss function; For query vector, , The dimension of the query vector; For positive sample vectors, it is The only correct match in the current batch; M is the number of negative samples; For the first n negative sample vectors, where ; This is a temperature hyperparameter, a small integer such as 0.07, used to control the smoothness of the softmax distribution; For similarity functions, cosine similarity is usually taken. ,in, Representing the eigenvector With feature vectors Cosine similarity between them; This represents the first feature vector (e.g., the query vector) that participates in the similarity calculation. This represents the second feature vector (such as a positive or negative sample vector) that participates in the similarity calculation. Represents the first eigenvector With the second eigenvector The inner product; Represents the first eigenvector ， The modulus length; Represents the second eigenvector The length of the module.

[0043] Specifically, the acquired binary function library and vulnerability fingerprint are input into a pre-set embedded model. The pre-trained embedded model uses a function encoder, which performs feature mapping operations, mapping each binary function in the binary function library and the vulnerability fingerprint to a unified high-dimensional vector space, generating corresponding scan vectors and query vectors. The high-dimensional vector space possesses highly semantic distinguishing features, causing feature vectors containing the same vulnerability to appear closer in spatial distance within the mapped high-dimensional vector space, while feature vectors of patched functions or completely unrelated functions appear more distant in spatial distance.

[0044] To ensure the pre-defined embedded model possesses the aforementioned semantic distinguishing features, it needs to be trained. The complete training process is based on a rigorous training sample set construction. First, vulnerability sample functions are extracted from publicly available vulnerability databases, and patch sample functions are extracted from the corresponding open-source project fix commit records. For each vulnerability sample function, binary sample functions containing the vulnerable code are obtained by writing code or extracting historical version code. Then, differential comparison text parsing is performed to accurately locate the core change lines in each code block. Next, semantic fingerprints are generated. For multiple discontinuous changes within the same function, all deleted code lines and their associated extracted context code are combined to generate a structured code snippet as the vulnerability sample fingerprint. Using the same method, all added code lines and their associated extracted context code are combined to generate another independent code snippet as the patch sample fingerprint.

[0045] After fingerprint extraction, the dataset was expanded and constructed. To simulate real-world binary execution scenarios, various compilers were used to compile the vulnerability sample functions and patch sample functions, increasing the training data scale and improving the model's generalization ability. The corresponding binary functions were then disassembled from the generated object files. Each record in the constructed dataset contains the vulnerability number, the vulnerability code, the binary sample function disassembled from the patch code, and the corresponding compiler type, optimization level parameters, and instruction set architecture information. Each vulnerability sample fingerprint, its corresponding patch sample fingerprint, and the binary sample function were packaged together as a training sample pair.

[0046] A deformer encoder is selected as the initial embedded model. In each training batch of each round of training, a predetermined number of vulnerability fingerprint and patch fingerprint pairs are extracted from the dataset as training data for a single iteration. For each extracted vulnerability function, the vulnerability function is encoded by the deformer encoder to output a query vector, while the vector generated by encoding another binary sample function containing the same vulnerability fingerprint is used as the unique correct positive sample vector. All other function vectors in the current training batch are assigned to the negative sample set, and the corresponding patch function's encoded vector is also output by the deformer encoder and introduced as a strong negative sample vector. The core training objective is to maximize the spatial distance between the patch function's encoded vector and the query vector.

[0047] In each training round, for each query vector in the batch, a pre-defined first loss function is used to calculate the corresponding first loss function value. The specific calculation process is as follows: The cosine similarity between the query vector and the positive sample vector is calculated as the first similarity. The first similarity is divided by a pre-defined temperature hyperparameter, and the exponent is taken to obtain the target positive feature value. The cosine similarity between the query vector and each negative sample vector in the negative sample set is calculated as the second similarity. Each second similarity is divided by the temperature hyperparameter, and the exponent is taken. All the exponent results are summed to obtain the accumulated negative feature value. The target positive feature value and the accumulated negative feature value are summed to obtain the feature base term. The ratio of the target positive feature value to the feature base term is calculated, and the negative logarithm of the ratio is extracted as the first loss function value. The calculation logic for the cosine similarity is as follows: the inner product of the first and second feature vectors involved in the comparison is calculated, and the inner product is divided by the product of the magnitudes of the first and second feature vectors. The temperature hyperparameter is a pre-defined positive number less than one, used to control the smoothness of the distribution.

[0048] After calculating the average loss for the entire training batch, the gradient of the loss function with respect to the model parameters is calculated using the backpropagation algorithm. The adaptive moment estimation algorithm, combined with a set learning rate, is used to adjust and optimize the model parameters of the initial embedded model. The overall optimization objective is to minimize the similarity between the vulnerability fingerprint vector and the patch fingerprint vector, and to maximize the similarity between the vulnerability fingerprint vector and the function sample vector. When the first loss function value converges, it indicates that the model training is complete, and the initial embedded model generated in the last round of training is used as the final embedded model. By implementing the above feature mapping and introducing patches as strong negative samples for comparative training, the embedded model can accurately capture subtle code change features, effectively eliminate patched interference functions, fundamentally eliminate false positives caused by extremely similar code structures, and greatly improve the accuracy and reliability of large-scale vulnerability scanning tasks.

[0049] Understandably, a vulnerability often involves only a few lines of critical code within a function. The patched and unpatched binary functions are very similar overall, but one is vulnerable while the other has been patched. Existing general similarity models struggle to capture such decisive, subtle differences and cannot distinguish between extremely similar but opposite code pairs, leading to false positives and false negatives. Therefore, this invention adds patch fingerprints as negative samples during the training process of the embedded model. This makes the distance between the patched binary function and the vulnerability fingerprint more equidistant after training, thus improving the accuracy of the initial screening.

[0050] It should be noted that the specific parameter adjustment logic of the embedded model during the optimization process of the first loss function is as follows: In the model training task construction stage, this invention defines the vulnerability fingerprint vector as the query vector, defines the function sample vector that belongs to the same category as the vulnerability or has the same vulnerability characteristics as the vulnerability as the positive sample vector, and defines the patch fingerprint vector after fixing the vulnerability and other irrelevant samples as the negative sample vector.

[0051] Regarding the process of maximizing similarity, the numerator of the first loss function formula represents the exponential similarity between the vulnerability fingerprint vector and the function sample vector. Driven by the optimization objective of minimizing the loss function, the model parameters of the embedded model will be updated in the direction of increasing the cosine similarity between the vulnerability fingerprint vector and the function sample vector. Through this update process, the embedded model can learn the common features between the vulnerability fingerprint vector and the corresponding function sample vector, thereby achieving alignment between the vulnerability fingerprint vector and the function sample vector in the feature space.

[0052] Regarding the similarity minimization process, the denominator of the first loss function formula includes the sum of the similarities between the vulnerability fingerprint vector, the patch fingerprint vector, and other irrelevant samples. Driven by the optimization objective of minimizing the loss function, the model parameters of the embedded model are updated in the direction of reducing the cosine similarity between the vulnerability fingerprint vector and the patch fingerprint vector. Through this update process, the embedded model can extract subtle difference features sufficient to distinguish between vulnerability features and patch features, thereby separating the vulnerability fingerprint vector and the patch fingerprint vector in the vector space.

[0053] Since the binary function corresponding to the patch fingerprint vector is highly similar to the binary function containing the vulnerability in terms of code structure, the embedded model is endowed with the ability to identify extremely subtle code changes through the constraints of the above loss function. This enables it to effectively eliminate the interference functions that have already been fixed in the subsequent initial screening stage, fundamentally solving the false alarm phenomenon that existing technologies are prone to when facing patch delay issues, and significantly improving the accuracy of large-scale vulnerability scanning.

[0054] S3. Cluster the query vector and the vector to be scanned in a high-dimensional vector space, and determine the distance between each vector to be scanned and the query vector. Based on the distance, determine a number of candidate vectors with a preset initial screening threshold from the vectors to be scanned. In a preferred embodiment of the present invention, a trained embedded model is used to perform a query function. Encode to obtain vector Execute in the vector database consisting of the vectors to be scanned -Nearest neighbor search, finding the nearest neighbor vector. The closest in vector space The vectors to be scanned are selected as candidate vectors. 100 is acceptable.

[0055] Specifically, after mapping the generated query vectors and all vectors to be scanned to a unified high-dimensional vector space, clustering is performed on the query vectors and vectors to be scanned within this high-dimensional vector space. The final embedded model, after training, executes the encoding operation on the query function corresponding to the binary vulnerability code to be queried, thereby extracting the query vector located within the high-dimensional vector space. All vectors to be scanned are pre-constructed to form a database of vectors to be scanned.

[0056] A nearest neighbor search mechanism is initiated for the extracted query vector in the vector database to be scanned. The core of the nearest neighbor search mechanism lies in traversing and calculating the spatial distance between each vector to be scanned and the query vector in the vector database. The spatial distance is used to characterize the similarity of binary functions at the code semantic level. The smaller the spatial distance, the closer the binary function corresponding to the vector to be scanned is to the vulnerable code segment in terms of structure and execution logic.

[0057] Based on the calculated spatial distances, all vectors to be scanned are arranged in ascending order of distance. Then, according to a pre-set initial screening threshold, a few closest vectors are selected from the arranged set. These selected vectors are then designated as candidate vectors. The initial screening threshold is specifically set to one hundred, meaning that only the binary functions corresponding to the one hundred closest vectors are selected for the next stage of fine-tuning.

[0058] By combining feature vector space clustering with nearest neighbor search, the massive search space can be rapidly reduced to a preset order of magnitude in a very short time while ensuring the coverage of large-scale vulnerability scanning. This significantly improves the overall efficiency of vulnerability scanning and reduces unnecessary consumption of computing resources.

[0059] S4. Compare the similarity between the binary vulnerability code and the binary function corresponding to each candidate vector, and take the candidate function corresponding to the similarity greater than the preset screening score threshold as the target function with vulnerability.

[0060] Preferably, the comparison of the similarity between the binary vulnerability code and the binary function corresponding to each candidate vector includes: The binary vulnerability code is used as the query function, and the binary function corresponding to the candidate vector is used as the candidate function. Each candidate function is combined with the query function to generate a candidate query pair. The candidate query pairs are then sequentially input into a preset comparative model so that the comparative model extracts the function features of each candidate query pair and determines the similarity of each candidate query pair based on the function features.

[0061] In a preferred embodiment of the present invention, the binary vulnerability code is paired with the binary function corresponding to each candidate vector and input into a comparative model for similarity scoring. If the similarity is higher than a threshold, the binary function is confirmed as the target function, i.e., a vulnerability instance. Finally, a report is generated, outputting a results list containing all the finally confirmed vulnerability instances and their metadata, such as the file they are located in.

[0062] Therefore, this invention, through layered detection, achieves accuracy far exceeding that of traditional BCSD methods while maintaining large-scale scanning capabilities, thanks to an embedded model focused on fingerprints. The initial screening using the embedded model rapidly narrows the search space within seconds, improving vulnerability scanning efficiency.

[0063] Preferably, the training of the comparative model includes: An initial comparative model is constructed, comprising two sub-networks sharing weights. For each vulnerability sample function, a number of training triplets are constructed, with the corresponding patch sample function as the positive sample and the corresponding binary sample function as the negative sample. In each training round, for each training triplet, the vulnerability sample function and the positive sample are first input into different sub-networks to extract the vulnerability function vector of the vulnerability sample function and the positive sample feature vector of the positive sample, generating a first distance between the vulnerability feature vector and the positive sample feature vector. Then, the vulnerability sample function and the negative sample are input into different sub-networks to extract the vulnerability function vector of the vulnerability sample function and the negative sample feature vector of the negative sample, generating a second distance between the vulnerability feature vector and the negative sample feature vector. A second loss function is constructed to calculate the difference between the first distance and the second distance. In each training round, the second loss function value is calculated based on the first distance and the second distance. The network parameters of the sub-networks in the initial comparative model are adjusted with the maximum loss function value as the objective. When the second loss function value converges, the finally optimized initial comparative model is used as the comparative model.

[0064] In a preferred embodiment of the present invention, the comparative model employs a Siamese network architecture, with a pair of functions as input. Output a similarity score between 0 and 1. The core goal of training is to enable the model to distinguish between function pairs that are extremely similar in code but have completely opposite security attributes.

[0065] The model uses a triple loss to fine-tune its performance, maximizing its ability to distinguish between vulnerabilities and patches. For each training triple in a batch, a contrastive model is used to calculate the distance between two pairs of functions. Distance between samples Similarity score The following relationship exists: ; in, This is a sample function for the vulnerability. It can be a positive or negative sample.

[0066] The loss is then calculated using the following loss function, as shown in the equation below, which contains three inputs: a vulnerability sample function. One positive sample and a negative sample Then, the average loss for the entire batch is calculated, the gradient is calculated using the backpropagation algorithm, and finally, the optimizer is used based on the learning rate. To update the model's parameters: ; The parameters in the above formula are defined as follows: This represents the value of the second loss function. A function that contains a vulnerability fingerprint; For another function that also contains a vulnerability fingerprint, such as a version with different compilation options; To and The corresponding fixed function, which includes the patch fingerprint; The distance between two samples. ; The preset boundary value is a positive number, requiring that the distance between negative sample pairs must not only be greater than that between positive sample pairs, but also be at least greater than... The boundary must be clear, otherwise losses will occur.

[0067] Specifically, after obtaining a limited number of candidate vectors that have passed the initial screening, the fine-tuning process is formally initiated. The complete binary vulnerability code is used as the query function, and the binary functions corresponding to the candidate vectors identified in the initial screening stage are used as candidate functions. For each candidate function, it is paired with the aforementioned query function to generate corresponding candidate query pairs. The generated candidate query pairs are then sequentially input into a pre-trained comparative model. The comparative model performs deep feature extraction to extract the function features contained within each candidate query pair and calculates a similarity score for each candidate query pair based on the extracted function features. After obtaining all similarity scores, the similarity scores are compared numerically with a pre-set fine-tuning score threshold. If a candidate query pair has a similarity score greater than the pre-set fine-tuning score threshold, the candidate function associated with the similarity score exceeding the threshold is directly confirmed as a vulnerable target function. Finally, all target functions are integrated to generate an output result list, which lists the specific function instances confirmed as vulnerable, along with associated metadata, including the file location record of the target function.

[0068] To ensure the comparative model possesses the business capability to accurately determine code security attributes, specialized training must be performed on the initial comparative model. The comparative model employs a twin network architecture at its core, containing two sub-networks sharing weights. The core objective of model training is to endow the network structure with the ability to distinguish between function pairs with extremely similar code structures but completely opposite security attributes. During the training sample preparation phase, for each extracted vulnerability sample function, the corresponding patch sample function is set as a positive sample, while the corresponding binary sample function is set as a negative sample, thereby cross-constructing multiple training triples.

[0069] In each round of model network training, for each constructed training triplet, the vulnerability sample function and positive sample are first input into two different sub-networks with shared weights. Through forward propagation of the sub-networks, the vulnerability function vector of the vulnerability sample function and the positive sample feature vector are extracted. Then, the first distance between the generated vulnerability feature vector and the positive sample feature vector is calculated. Subsequently, the same vulnerability sample function and negative sample are input into two different sub-networks with shared weights, extracting the vulnerability function vector of the vulnerability sample function and the negative sample feature vector of the negative sample, and calculating the second distance between the generated vulnerability feature vector and the negative sample feature vector. Specifically, the calculation logic for the aforementioned distance features involves pre-calculating the similarity score between samples, subtracting the similarity score from the first value, and obtaining the numerical difference, which is the distance between the two samples.

[0070] After distance calculation, a second loss function is constructed to optimize network parameters. Based on the aforementioned logic, this second loss function is used to calculate the sum of the difference between the first and second distances and a preset boundary value. During each training round, the value of the second loss function is determined based on the calculated first and second distances. The preset boundary value is an absolute positive number. The purpose of setting this boundary value is to strictly constrain the spatial distance between negative sample pairs to be not only greater than the spatial distance between positive sample pairs, but also that the difference between them must exceed the preset boundary value; otherwise, the network will output a corresponding loss penalty.

[0071] After calculating the average loss value for the entire training batch, the backpropagation mechanism is used to calculate the update gradient of the second loss function with respect to the network's internal parameters. A specified optimization algorithm, combined with a preset learning rate, is invoked to iteratively adjust the network parameters of the sub-networks in the initial comparative model. During parameter adjustment, minimizing the second loss function value is strictly the optimization objective. When the second loss function value reaches convergence, network parameter updates are stopped, and the final optimized initial comparative model is used as the final comparative model for the fine-tuning operation.

[0072] By adopting the aforementioned layered scanning mode that combines initial screening and fine screening, the system can ensure the ability to scan large-scale function libraries while implementing deep feature comparison by introducing a comparative model with a triple loss training mechanism. This greatly reduces the scope of retrieval and comparison and effectively eliminates similarity interference caused by minor code changes, significantly improving the detection accuracy and overall operating efficiency of large-scale binary vulnerability scanning.

[0073] See Figure 2 This is a scanning device for large-scale binary function vulnerabilities provided in an embodiment of the present invention, comprising: The vulnerability function acquisition module is used to acquire the vulnerability fingerprint of binary vulnerability code and the binary function library to be scanned; wherein, the vulnerability fingerprint is generated based on the modified code lines in the binary vulnerability code; The vulnerability feature extraction module is used to input the binary function library and the vulnerability fingerprint into a preset embedded model, so that the embedded model maps each binary function in the binary function library and the vulnerability fingerprint to a high-dimensional vector space, generating a query vector and a vector to be scanned. The vulnerability screening module is used to cluster the query vector and the vector to be scanned in a high-dimensional vector space, determine the distance between each vector to be scanned and the query vector, and determine a number of candidate vectors with a preset screening quantity threshold from the vectors to be scanned based on the distance. The vulnerability screening module compares the similarity between binary vulnerability code and the binary function corresponding to each candidate vector, and selects the candidate function with a similarity greater than a preset screening score threshold as the target function containing the vulnerability.

[0074] Furthermore, the vulnerability function acquisition module acquires the vulnerability fingerprint of the binary vulnerability code, including: Obtain the binary vulnerability code; Identify the modifiers in the binary vulnerability code and designate the lines of code containing the modifiers as the modified lines of code; Based on a preset segment truncation threshold, extract several unchanged target code lines from the context of each changed code line; Each changed line of code and its corresponding set of unchanged target lines of code are used as a vulnerability fingerprint.

[0075] Specifically, regarding the internal execution logic of the vulnerability function acquisition module in obtaining the vulnerability fingerprint of binary vulnerability code, the module first performs the binary vulnerability code acquisition operation. The acquired binary vulnerability code typically originates from a publicly available vulnerability database and is presented in a specific data format as a difference comparison text.

[0076] After extracting the binary vulnerability code in the difference comparison text format, the vulnerability function acquisition module performs in-depth code block parsing of the difference comparison text to accurately identify the change tokens carried in the binary vulnerability code. Specifically, change tokens include deletion tokens representing code deletion operations and addition tokens representing code addition operations. The vulnerability function acquisition module performs a global scan within each code block, locating code lines with deletion tokens at the beginning and code lines with addition tokens, and uniformly defining code lines containing these specific change tokens as changed code lines.

[0077] After identifying all modified lines of code, the vulnerability function acquisition module, based on a pre-set segment truncation threshold, extracts several unchanged target lines of code within the context, centered on each modified line and extending along the areas above and below it. Unchanged target lines of code refer to consecutive lines of code that do not begin with any change marker. The preset segment truncation threshold limits the range of lines extracted from the context, typically set to a specific value between three and seven lines. The purpose of setting this threshold is to ensure that the extracted context code contains sufficiently rich and complete local semantic information.

[0078] Considering the high probability of multiple discontinuous code changes within the same target function, the vulnerability function acquisition module uniformly collects and concatenates each changed line of code and several corresponding unchanged target lines. This module tightly integrates each changed line of code with its corresponding unchanged target lines, thus constructing a structured code fragment. This structured code fragment is then formally established as the final vulnerability fingerprint output.

[0079] By employing context interception and fingerprint generation techniques targeting the modified parts of the vulnerable code, the vulnerability function acquisition module accurately filters out redundant function background logic and extracts the most minimal and direct code fragments representing the essential characteristics of the vulnerability as feature identifiers. This significantly reduces the data processing overhead of subsequent vector mapping and similarity comparison stages, while effectively improving the accuracy and execution efficiency of large-scale feature screening.

[0080] Furthermore, the vulnerability screening module compares the similarity between the binary vulnerability code and the binary function corresponding to each candidate vector, including: The binary vulnerability code is used as the query function, the binary function corresponding to the candidate vector is used as the candidate function, and each candidate function is used to generate a candidate query pair with the query function. The candidate query pairs are sequentially input into a preset comparative model so that the comparative model extracts the functional features of each candidate query pair and determines the similarity of each candidate query pair based on the functional features.

[0081] Specifically, regarding the execution details of the vulnerability screening module comparing the similarity between the binary vulnerability code and the binary functions corresponding to each candidate vector, the vulnerability screening module first defines the roles of the input code data. The vulnerability screening module establishes the obtained complete binary vulnerability code as the query function, and simultaneously establishes the actual binary functions mapped to by the candidate vectors determined in the preliminary screening stage as candidate functions.

[0082] After defining the roles, the vulnerability screening module begins the pairing and combination operation. For each selected candidate function, the module binds and assembles it one-to-one with the previously established query functions. Through this pairing and combination process, multiple sets of candidate query pairs containing information about the functions to be compared are generated. Each set of candidate query pairs carries a clear and independent similarity verification task as its foundation.

[0083] After preparing the comparison data, the vulnerability screening module sequentially inputs all generated candidate query pairs into a pre-built and trained comparative model, according to the order of their arrangement. The comparative model integrates a Siamese network architecture with deep semantic awareness features. Upon receiving a candidate query pair, the model simultaneously performs deep function feature extraction on the query function and candidate function contained within the candidate query pair. After extracting the paired function features, the comparative model performs cross-calculation on the vector dimension based on the extracted paired function features, ultimately quantifying and determining the similarity score for each candidate query pair.

[0084] By introducing a specialized comparative model into the vulnerability screening module to perform one-to-one feature extraction and similarity calculation, the degree of fit between the binary code to be detected and the known vulnerable code at the underlying logic level can be accurately measured. This effectively eliminates misjudgments caused by relying solely on the similarity of the surface code structure, significantly improving the accuracy of the vulnerability identification process and the reliability of the final judgment results.

[0085] In a preferred embodiment, training the embedded model includes: Obtain several vulnerability sample functions, corresponding patch sample functions, and binary sample functions; Based on the vulnerability sample function and the patch sample function, generate vulnerability sample fingerprints and patch sample fingerprints; Each vulnerability sample fingerprint, the corresponding patch sample fingerprint, and the binary sample function are used as training sample pairs. Build the initial embedded model; The initial embedded model is trained using the training samples, so that the initial embedded model generates vulnerability fingerprint vector, patch fingerprint vector and function sample vector respectively based on vulnerability sample fingerprint, patch sample fingerprint and binary sample function; In each round of training, the model parameters of the initial embedded model are optimized with the goal of minimizing the similarity between the vulnerability fingerprint vector and the patch fingerprint vector, and maximizing the similarity between the vulnerability fingerprint vector and the function sample vector. The first loss function value of the initial embedded model is calculated using a preset first loss function. When the first loss function value converges, the initial embedded model generated in the last round of training is used as the final embedded model.

[0086] In a preferred embodiment, training the comparative model includes: Construct an initial comparative model; wherein the initial comparative model comprises two subnetworks sharing weights; For each vulnerability sample function, construct several training triplets by using the corresponding patch sample function as the positive sample and the corresponding binary sample function as the negative sample. In each training round, for each training triplet, the vulnerability sample function and the positive sample are first input into different sub-networks to extract the vulnerability function vector of the vulnerability sample function and the positive sample feature vector of the positive sample, and generate the first distance between the vulnerability feature vector and the positive sample feature vector. Then, the vulnerability sample function and the negative sample are input into different sub-networks to extract the vulnerability function vector of the vulnerability sample function and the negative sample feature vector of the negative sample, and generate the second distance between the vulnerability feature vector and the negative sample feature vector. A second loss function is constructed to calculate the sum of the difference between the first distance and the second distance and a preset boundary value. In each training round, the value of the second loss function is calculated based on the first distance and the second distance. With the goal of minimizing the value of the second loss function, the network parameters of the sub-networks in the initial comparative model are adjusted. When the value of the second loss function converges, the final optimized initial comparative model is used as the comparative model.

[0087] It should be noted that the device embodiments described above are merely illustrative, and some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can specifically be implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0088] See Figure 3One embodiment of this application also provides a terminal device, including: One or more processors; A memory, coupled to the processor, for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement a large-scale binary function vulnerability scanning method as described above.

[0089] The processor controls the overall operation of the terminal device to complete all or part of the steps of the aforementioned method for scanning large-scale binary function vulnerabilities. The memory stores various types of data to support the operation of the terminal device; this data may include, for example, instructions for any application or method operating on the terminal device, as well as application-related data. The memory can be implemented using any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0090] In an exemplary embodiment, the terminal device may be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform a large-scale binary function vulnerability scanning method as described in any of the foregoing embodiments, and achieve the same technical effect as the method described above.

[0091] In another exemplary embodiment, a computer-readable storage medium including a computer program is also provided. When executed by a processor, the computer program implements the steps of a method for scanning large-scale binary function vulnerabilities as described in any of the foregoing embodiments. For example, the computer-readable storage medium may be the aforementioned memory including the computer program, which may be executed by a processor of a terminal device to complete the method for scanning large-scale binary function vulnerabilities as described in any of the foregoing embodiments and achieve the same technical effects as the aforementioned method.

[0092] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for scanning large-scale binary function vulnerabilities, characterized in that, include: Obtain the vulnerability fingerprint of the binary vulnerability code, and the binary function library to be scanned; wherein, the vulnerability fingerprint is generated based on the modified code lines in the binary vulnerability code; The binary function library and the vulnerability fingerprint are respectively input into a preset embedded model, so that the embedded model maps each binary function in the binary function library and the vulnerability fingerprint to a high-dimensional vector space to generate a query vector and a vector to be scanned. Cluster the query vector and the vector to be scanned in a high-dimensional vector space, determine the distance between each vector to be scanned and the query vector, and determine a number of candidate vectors with a preset initial screening threshold from the vectors to be scanned based on the distance. The similarity between the binary vulnerability code and the binary function corresponding to each candidate vector is compared, and the candidate function corresponding to the similarity score greater than the preset screening score threshold is taken as the target function with vulnerability.

2. The method for scanning large-scale binary function vulnerabilities as described in claim 1, characterized in that, The method of obtaining the vulnerability fingerprint of the binary vulnerability code includes: Obtain the binary vulnerability code; Identify the modifiers in the binary vulnerability code and designate the lines of code containing the modifiers as the modified lines of code; Based on a preset segment truncation threshold, extract several unchanged target code lines from the context of each changed code line; Each changed line of code and its corresponding set of unchanged target lines of code are used as a vulnerability fingerprint.

3. The method for scanning large-scale binary function vulnerabilities as described in claim 1, characterized in that, The comparison of the similarity between the binary vulnerability code and the binary function corresponding to each candidate vector includes: The binary vulnerability code is used as the query function, the binary function corresponding to the candidate vector is used as the candidate function, and each candidate function is used to generate a candidate query pair with the query function. The candidate query pairs are sequentially input into a preset comparative model so that the comparative model extracts the functional features of each candidate query pair and determines the similarity of each candidate query pair based on the functional features.

4. The method for scanning large-scale binary function vulnerabilities as described in claim 3, characterized in that, The training of the embedded model includes: Obtain several vulnerability sample functions, corresponding patch sample functions, and binary sample functions; Based on the vulnerability sample function and the patch sample function, generate vulnerability sample fingerprints and patch sample fingerprints; Each vulnerability sample fingerprint, the corresponding patch sample fingerprint, and the binary sample function are used as training sample pairs. Build the initial embedded model; The initial embedded model is trained using the training samples, so that the initial embedded model generates vulnerability fingerprint vector, patch fingerprint vector and function sample vector respectively based on vulnerability sample fingerprint, patch sample fingerprint and binary sample function; In each round of training, the model parameters of the initial embedded model are optimized with the goal of minimizing the similarity between the vulnerability fingerprint vector and the patch fingerprint vector, and maximizing the similarity between the vulnerability fingerprint vector and the function sample vector. The first loss function value of the initial embedded model is calculated using a preset first loss function. When the first loss function value converges, the initial embedded model generated in the last round of training is used as the final embedded model.

5. The method for scanning large-scale binary function vulnerabilities as described in claim 4, characterized in that, The training of the comparative model includes: Construct an initial comparative model; wherein the initial comparative model comprises two subnetworks sharing weights; For each vulnerability sample function, construct several training triplets by using the corresponding patch sample function as the positive sample and the corresponding binary sample function as the negative sample. In each training round, for each training triplet, the vulnerability sample function and the positive sample are first input into different sub-networks to extract the vulnerability function vector of the vulnerability sample function and the positive sample feature vector of the positive sample, and generate the first distance between the vulnerability feature vector and the positive sample feature vector. Then, the vulnerability sample function and the negative sample are input into different sub-networks to extract the vulnerability function vector of the vulnerability sample function and the negative sample feature vector of the negative sample, and generate the second distance between the vulnerability feature vector and the negative sample feature vector. A second loss function is constructed to calculate the sum of the difference between the first distance and the second distance and a preset boundary value. In each training round, the value of the second loss function is calculated based on the first distance and the second distance. With the goal of minimizing the value of the second loss function, the network parameters of the sub-networks in the initial comparative model are adjusted. When the value of the second loss function converges, the final optimized initial comparative model is used as the comparative model.

6. A scanning device for large-scale binary function vulnerabilities, characterized in that, include: The vulnerability function acquisition module is used to acquire the vulnerability fingerprint of binary vulnerability code and the binary function library to be scanned; wherein, the vulnerability fingerprint is generated based on the modified code lines in the binary vulnerability code; The vulnerability feature extraction module is used to input the binary function library and the vulnerability fingerprint into a preset embedded model, so that the embedded model maps each binary function in the binary function library and the vulnerability fingerprint to a high-dimensional vector space, generating a query vector and a vector to be scanned. The vulnerability screening module is used to cluster the query vector and the vector to be scanned in a high-dimensional vector space, determine the distance between each vector to be scanned and the query vector, and determine a number of candidate vectors with a preset screening quantity threshold from the vectors to be scanned based on the distance. The vulnerability screening module compares the similarity between binary vulnerability code and the binary function corresponding to each candidate vector, and selects the candidate function with a similarity greater than a preset screening score threshold as the target function containing the vulnerability.

7. The scanning device for large-scale binary function vulnerabilities as described in claim 6, characterized in that, The vulnerability function acquisition module acquires the vulnerability fingerprint of the binary vulnerability code, including: Obtain the binary vulnerability code; Identify the modifiers in the binary vulnerability code and designate the lines of code containing the modifiers as the modified lines of code; Based on a preset segment truncation threshold, extract several unchanged target code lines from the context of each changed code line; Each changed line of code and its corresponding set of unchanged target lines of code are used as a vulnerability fingerprint.

8. The scanning device for large-scale binary function vulnerabilities as described in claim 7, characterized in that, The vulnerability screening module compares the similarity between the binary vulnerability code and the binary function corresponding to each candidate vector, including: The binary vulnerability code is used as the query function, the binary function corresponding to the candidate vector is used as the candidate function, and each candidate function is used to generate a candidate query pair with the query function. The candidate query pairs are sequentially input into a preset comparative model so that the comparative model extracts the functional features of each candidate query pair and determines the similarity of each candidate query pair based on the functional features.

9. A terminal device, characterized in that, include: One or more processors; A memory, coupled to the processor, for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement a method for scanning large-scale binary function vulnerabilities as described in any one of claims 1-5.

10. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements a method for scanning large-scale binary function vulnerabilities as described in any one of claims 1-5.

Images