A binary generative code detection method and system based on multi-scale features and cross-level learning aggregation

Abstract

This application discloses a binary generative code detection method and system based on multi-scale features and cross-level learning aggregation. The method includes: disassembling the binary executable file to be detected to extract the first instruction sequence corresponding to each function; inputting the first instruction sequence into a first classification model to obtain a first probability value for each function as generative code; extracting a first statistical feature corresponding to the distribution of the first probability values ​​based on the first probability values ​​of all functions; and inputting the first statistical feature into a first aggregation model to obtain a first determination result on whether the binary executable file contains generative code. This application effectively suppresses the amplification effect of function-level false positives at the software level by using the statistical features of the generative probability distribution of all functions as input to a learning aggregation model for comprehensive decision-making, replacing the simple strategy of fixed threshold voting, thus achieving stable and reliable end-to-end software-level determination.

Description

Technical Field

[0001] This application relates to the fields of computer software security and artificial intelligence, and in particular to a binary generative code detection method and system based on multi-scale features and cross-level learning aggregation. Background Technology

[0002] With the widespread application of large language models in code generation tasks, code automatically generated by artificial intelligence is being introduced into the software supply chain in large quantities. Because generative code may conceal risks such as copyright infringement, license conflicts, and security vulnerabilities, detecting the presence of generative code in binary executable files has become an important requirement for software security auditing.

[0003] However, once generative code is compiled into binary, its source-level statistical features are completely erased, making traditional source-code-based detection methods unsuitable for binary scenarios. Existing function-level detection methods typically employ single-scale feature extraction strategies, which struggle to simultaneously capture local and structural patterns at different scales within the assembly instruction sequence. More critically, current technologies lack a mechanism for learning-based aggregation of function-level classification probabilities as a whole. Simple fixed-threshold voting or averaging strategies can amplify false positives at the function level at the software level, failing to provide stable and reliable software-level judgments. Summary of the Invention

[0004] To address the shortcomings of existing technologies in generative code detection of binary executables, such as the lack of an end-to-end solution and the amplification of function-level false positives at the software level, this application provides a binary generative code detection method and system based on multi-scale features and cross-level learning-based aggregation. This method extracts function-level instruction sequences by disassembling the binary executable file, obtains the generative probability of each function using a first classification model, and then extracts statistical features based on the distribution of all function probabilities. These features are then input into a first aggregation model for comprehensive decision-making. This approach can suppress the amplification effect of function-level false positives at the software level, achieving stable and reliable end-to-end software-level determination.

[0005] Specifically, this application provides the following technical solutions: This application provides a binary generative code detection method based on multi-scale features and cross-level learning aggregation, including: The binary executable file to be tested is disassembled to extract the first instruction sequence corresponding to each function in the binary executable file; The first instruction sequence is input into the first classification model to obtain the first probability value of each function as a generative code; Based on the first probability value of all functions, extract the first statistical feature corresponding to the distribution of the first probability value; The first statistical feature is input into the first aggregation model to determine the first determination result of whether the binary executable file contains generative code.

[0006] Optionally, the method further includes: Obtain the compilation optimization level of the binary executable file; Based on the compilation optimization level, select a target first classification model that matches the compilation optimization level from the pre-trained first classification models; The target first classification model is used as the first classification model to classify the first instruction sequence.

[0007] Optionally, obtaining the compilation optimization level of the binary executable file includes: Analyze the stack frame creation characteristics in the first preamble instructions of each function, and count the first proportion of functions with stack frames among all functions; When the first ratio value exceeds a preset threshold, the compilation optimization level is determined to be the first optimization level; otherwise, it is determined to be the second optimization level.

[0008] Optionally, before inputting the first instruction sequence into the first classification model, the method further includes: Each assembly instruction in the first instruction sequence is parsed into a mnemonic, and each operand is mapped to a predefined category generalization tag to generate a first tag sequence; The first labeled sequence is encoded into a fixed-length integer sequence, and then the integer sequence is input into the first classification model.

[0009] Optionally, the first classification model is a multi-scale one-dimensional convolutional neural network, and the first probability values ​​obtained for each function as generative code include: The encoded integer sequence is processed through an embedding layer to obtain a feature tensor; The feature tensors are input into multiple parallel one-dimensional convolutional layers to extract features at different scales. Perform global pooling operations on the outputs of each convolutional layer, and then concatenate the results of the global pooling operations to form the first fused feature; The first fused feature is processed by a fully connected layer to obtain the first probability value.

[0010] Optionally, the first statistical feature includes at least two of the following: central tendency feature, dispersion feature, quantile feature, extreme value feature, and high probability function proportion feature, wherein: The central tendency features include the mean and median of the first probability values ​​of all functions; The high-probability function proportion feature includes the ratio of the number of functions whose first probability value exceeds a preset probability threshold to the total number of functions.

[0011] Optionally, the first aggregation model is a random forest classifier or a logistic regression classifier, and obtaining the first determination result includes: Based on the first statistical characteristic, determine the second probability value; When the second probability value is greater than or equal to a preset judgment threshold, a judgment tag is determined that the binary executable file contains generative code.

[0012] Optionally, before extracting the first instruction sequence corresponding to each function in the binary executable file, the method further includes: Filter the function set obtained from disassembly; The functions retained after filtering are used as the set of target functions to be classified.

[0013] Secondly, this application provides a binary generative code detection system based on multi-scale features and cross-level learning aggregation, including: The function extraction module is used to disassemble the binary executable file to be detected and extract the first instruction sequence corresponding to each function. The classification module is used to input the first instruction sequence into the first classification model to obtain the first probability value of each function being a generative code; The feature extraction module is used to extract the first statistical feature corresponding to the distribution of the first probability value based on the first probability value of all functions; An aggregation module is used to input the first statistical feature into a first aggregation model to determine a first determination result of whether the binary executable file contains generative code.

[0014] Thirdly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0015] The embodiments of this application have the following beneficial effects: by disassembling the binary executable file and processing it layer by layer, an end-to-end detection process that does not rely on the source code is realized; by using the statistical characteristics of the generative probability distribution of all functions as the input of the learning aggregation model for comprehensive decision-making, the simple strategy of fixed threshold voting is replaced, which effectively suppresses the amplification effect of function-level false alarms at the software level and improves the stability and reliability of software-level judgment results. Attached Figure Description

[0016] Figure 1 A flowchart of the binary generative code detection method provided in the embodiments of this application.

[0017] Figure 2 This is a schematic diagram of the binary generative code detection system architecture provided in an embodiment of this application. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0019] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0020] The binary generative code detection method provided in this application can be deployed on various computing devices and application scenarios: on the terminal device side, it can run on devices with certain computing power, such as security workstations, software audit platforms, and code tracing systems; in cloud scenarios, it can be deployed as a backend inference node for software supply chain security scanning services; in embedded and edge scenarios, it can run on dedicated security chip hosts with x86_64 or ARM64 instruction sets. This method uses ELF executable files as the typical processing object, while also supporting other binary executable file formats such as PE format, making it suitable for software security auditing needs under different operating system environments.

[0021] The runtime environment of this method includes: a processor (for performing computational tasks such as disassembly, tokenization, and model inference), memory (for storing pre-trained model parameters, token vocabulary, and intermediate results), and readable storage medium (for persistently saving the first classification model and the software-level aggregation model). These components work together to form the basic hardware support layer of this method, completing the entire process from inputting the ELF executable file to outputting the software-level judgment result by executing program instructions in memory.

[0022] like Figure 1 As shown, the binary generative code detection method based on multi-scale features and cross-level learning aggregation provided in this embodiment includes the following steps: S100, disassemble the binary executable file to be detected and extract the first instruction sequence corresponding to each function in the binary executable file.

[0023] like Figure 1 As shown, the function extraction module uses the objdump toolchain to disassemble the ELF executable file to be detected, with the command `[objdump -d --no-show-raw-insn]`. The objdump tool identifies function boundaries in the format `[hexadecimal address<function name>:]`. When a new function header label matching this format is detected, the previously accumulated instruction lines are archived as a function record. Each function record contains the function name, starting address, and all assembly instruction lines for that function. This method uses the operating system's native function symbol table as the basis for segmentation, eliminating the need for additional function boundary inference on the binary file. Specifically: S110 filters the function set obtained from disassembly, removing functions with fewer than the preset number of instructions, special functions automatically generated by the compiler, and stub functions, and uses the filtered functions as the target function set to be classified.

[0024] After disassembling, the function extraction module applies multiple filtering criteria to the initial function set, removing functions that do not substantially contribute to the generative code feature analysis, thereby reducing noise in the subsequent classification stage. The filtering criteria are divided into three categories.

[0025] The first category is name blacklist filtering.

[0026] The module maintains a predefined set of compiler-specific function names, including initialization and destructor functions automatically generated by the compiler or C runtime, such as _init, _fini, _start, register_tm_clones, frame_dummy, do_global_dtors_aux, and libc_csu_init. Any function whose name matches any entry in this set is directly removed from the function set. The assembly instruction patterns of these functions are highly fixed and independent of the source code writer's coding style; failure to filter them would introduce systematic bias into the classification model.

[0027] The second category is PLT / GOT stub function filtering.

[0028] In dynamically linked executables, the stub functions corresponding to the Procedure Linking Table (PLT) and Global Offset Table (GOT) entries contain only about three jump instructions and do not carry any business logic features. The module detects whether the function name contains the suffix [@plt] or [@GLIBC], and removes it if detected.

[0029] The third category is short function filtering and ultra-long function filtering.

[0030] For example, functions with fewer than 5 instructions are considered too short and cannot provide effective local pattern information for the sequence model, and are therefore removed; functions with more than 50,000 instructions are considered too long. Such functions are usually generated by automatic generation tools (such as lookup functions or giant loops after code expansion), and their size will result in extremely low effective information density in the padded sequence, and are therefore removed.

[0031] The above filtering threshold can be set to a minimum of 5 instructions and a maximum of 50,000 instructions in typical engineering scenarios, and can also be adjusted according to actual engineering needs.

[0032] For example, taking an ELF executable file containing 312 primitive functions as an example, after filtering by name blacklist, 8 compiler-generated functions are removed; after filtering by PLT / GOT, 41 stub functions are removed; after filtering by short functions, 23 functions with fewer than 5 instructions are removed; and after filtering by excessively long functions, 0 functions are removed, ultimately retaining 240 object functions. The set of retained functions is denoted as . each The corresponding assembly instruction sequence for this function is the first instruction sequence. This first instruction sequence will be used as input for subsequent steps, and after tokenization, it will be fed into the function-level classification model (i.e., the first classification model).

[0033] In another embodiment, the function-level instruction sequence can also be extracted using the Radare2 toolchain. Radare2 performs deep analysis on the target binary using the [aaa] command and then exports the disassembly instruction list of each function in batches through the [pDj @F:function_name] interface. The resulting instruction sequence is semantically equivalent to the objdump toolchain result and can also be used as the first instruction sequence input into the subsequent processing flow.

[0034] In an alternative implementation, IDA Pro's idat batch analysis script can be used instead of the objdump tool. IDA Pro has stronger control flow analysis capabilities and can identify some internal functions that the compiler cannot symbolize, making it suitable for highly optimized or obfuscated binary file scenarios.

[0035] S200, identify the compilation optimization level of the binary executable file, select a target first classification model that matches the compilation optimization level from a plurality of pre-trained first classification models, and use the target first classification model as the first classification model to classify the first instruction sequence.

[0036] In this embodiment, the following sub-steps are specifically included: S210, analyze the stack frame creation characteristics in the first preamble instruction of each function, and count the first proportion of functions with stack frames among all functions.

[0037] The classification module classifies the set of objective functions. Each function in The first three assembly instructions are taken as the preamble (i.e., the first preamble instruction), and the stack frame is used to establish feature detection. The detection logic is divided into two sub-judgments: If the first instruction in the preamble is `endbr64` (an x86_64 indirect branch tracing instruction, introduced by the `-fcf-protection` compiler option and present in all optimization levels), then skip this instruction and continue testing from the second instruction onwards. Check if the current instruction is a `push` opcode with the operand being the `rbp` register (i.e., `push %rbp`). This instruction is the first instruction in the standard stack frame creation sequence specified by the x86_64 System V ABI. If the `push %rbp` instruction is detected in the preamble, it is determined that the function has a stack frame, and the function's stack frame flag is set to 1; otherwise, it is set to 0.

[0038] After labeling the stack frame flags of all functions, the classification module counts the number of functions in the target function set whose stack frame flags are 1, and divides this number by the total number of functions in the target function set to obtain the stack frame ratio. That is, the first proportional value:

[0039] For example, using the aforementioned 240 target functions as input, after scanning the preamble region, 210 functions with the preamble "push%rbp" are detected. The stack frame ratio is then... If the value exceeds the preset threshold (the preset threshold in this embodiment is 0.5), the system enters the 00 level judgment branch of S220.

[0040] S220, when the first ratio value exceeds the preset threshold, the compilation optimization level is determined to be the first optimization level; otherwise, it is determined to be the second optimization level, and the corresponding pre-trained first classification model is selected.

[0041] The classification module will With preset threshold (Typically in the range of 0.4 to 0.6, this embodiment uses 0.5) for comparison. When When the compilation optimization level of the ELF executable file to be detected is determined to be the first optimization level (corresponding to 00, i.e., no optimization compilation), the pre-trained 00-specific AsmCNN model is called as the first classification model for the target; when When the system is determined to be at the second optimization level (corresponding to 02 / 03, i.e., compiler optimization is enabled), the pre-trained 02 / 03 dedicated AsmCNN model is called, with the 02 model being selected as the primary classification model by default. The pre-trained model is persistently stored as a file, with naming conventions such as [deep_00_asmcnn_model.pt] and [deep_02_asmcnn_model.pt]. It is loaded into memory during system initialization and remains resident, being directly called during the inference phase without needing to be reloaded.

[0042] The binary comparison between 00 and 02 / 03 is performed because: 00 compilation does not perform stack frame optimization (Frame Pointer Omission, or FPO), and almost all functions retain the standard prologue; 02 / 03, however, activates FPO optimization, omitting stack frames for many leaf functions and short functions, resulting in a significant decrease in the proportion of "push %rbp" appearing in the prologue. These differences in compilation behavior lead to... This becomes an effective feature for distinguishing between the two optimization levels, without relying on additional metadata or symbol table information.

[0043] In another embodiment, the identification of the compilation optimization level can also be achieved by analyzing static features such as function instruction density and constant pool access frequency. This mechanism can also distinguish the differences in the assembly structure of 00 and 02 / 03 compilation products and is applicable to binary file scenarios where the symbol table is stripped.

[0044] S300, each assembly instruction in the first instruction sequence is parsed into a mnemonic, and each operand is mapped to a predefined category generalization tag to generate a first tag sequence. The first tag sequence is then encoded into a fixed-length integer sequence and input into the first classification model.

[0045] In this embodiment, the following sub-steps are specifically included: S310 parses each assembly instruction into mnemonic and operand components, performs category generalization tag mapping on the operands, and generates the first tag sequence.

[0046] The classification module classifies each function in the target function set. The first instruction sequence performs tokenization processing. The tokenizer (AsmTokenizer) uses the standard assembly format [address: mnemonic operand 1, operand 2] output by objdump as the parsing object. It extracts the mnemonic and operand fields from each line using regular expressions. The mnemonic is directly represented as a lowercase string as a token (such as [mov], [push], [call], etc.). The operand fields are mapped to predefined tokens one by one according to the following category generalization rules: 64-bit general-purpose registers (rax, rbx, rcx, rdx, rsi, rdi, rbp, rsp, and r8 through r15) are mapped to tags. REG64 32-bit general-purpose registers (eax, ebx, ecx, edx, esi, edi, ebp, esp, and r8d to r15d) are mapped to tags. REG32 ; 16-bit registers (ax, bx, etc.) are mapped to REG16 ; 8-bit registers (al, bl, etc.) are mapped to REG8 Segment registers (cs, ds, es, fs, gs, ss) are mapped to SEGREG The XMM registers (xmm0 to xmm15) are mapped as follows: XMM The YMM registers (ymm0 to ymm15) are mapped as follows: YMM .

[0047] Memory addressing operands are classified into four tag types based on pattern matching: Matching the pattern "-?0x[0-9a-f]+(%\w+)" (base address plus offset addressing) maps to MEM_DISP ; Matching the pattern "(%\w+,%\w+,\d)" (indexed addressing with scaling factor) maps to MEM_IDX ; Matching the pattern "-?0x[0-9a-f]+(%\w+,%\w+,\d)" (offset plus indexed compound addressing) maps to MEM_DISP_IDX ; Matching the pattern "(%\w+)" (pure base addressing) maps to MEM_BASE ; Operands containing percent signs or dollar signs but not conforming to the above pattern are mapped as follows: MEM .

[0048] Immediate operands (matching hexadecimal or decimal integer format) are mapped to IMM ; Relative jump target (matching relative offset format) mapping to JMP_REL ; Absolute jump targets (starting with "*") are mapped as JMP_ABS ; Prefix instructions (such as "rep", "repz", etc.) are mapped to PREFIX Operands that cannot match any of the above rules are mapped as follows: UNK_OP .

[0049] For example, the original assembly instruction [mov -0x8(%rbp),%rax] is tokenized to generate 3 tokens: [mov], MEM_DISP , REG64 This effectively eliminates the difference between specific register names and offset values, abstracting the instruction into a semantic pattern of "[loading from base address offset memory into a 64-bit register]". After tokenization, the token sequences for the same semantic operation (such as accessing local variables) are highly consistent across different functions, enabling the model to capture differences in coding style rather than specific numerical differences.

[0050] S320, the first marker sequence is encoded into a fixed-length integer sequence and then input into the first classification model.

[0051] The AsmTokenizer maintains a fixed vocabulary, where each token corresponds to a unique integer ID. The vocabulary size is typically between tens and thousands of tokens (in this embodiment, the vocabulary size is a finite set covering all register class markers, memory addressing class markers, immediate / jump markers, and high-frequency mnemonics, with a typical size of less than several thousand). Token IDs are numbered starting from 1, with ID 0 reserved as a padding marker. PAD The number, and retain it. UNK Tags are used for out-of-vocabulary tokens. CLS The marker is used at the beginning of the sequence.

[0052] For each function The token sequence, with AsmTokenizer inserting at the beginning of the sequence. CLS Each token is labeled (with a fixed ID), and then each token is converted into a corresponding integer ID, forming an integer sequence. If the length of the integer sequence is less than the preset maximum length... (This embodiment) Typically, the value is taken in the range of 128 to 512 (in this embodiment, 256 is used), then padding is applied to the end of the sequence. PAD (ID=0) to length If the sequence length exceeds Then cut off to Simultaneously, an attention mask sequence of equal length is generated, with the effective token position marked as 1. PAD The padding position is marked as 0; the mask is not directly consumed during convolution-based AsmCNN inference (GlobalMaxPool naturally suppresses zero embeddings of padding positions, so no explicit masking is required), but when using an alternative implementation based on a self-attention mechanism (see S430), the mask will be used as the padding_mask input of the Transformer encoder to mask the effect of padding positions on attention weight calculation.

[0053] For example, taking a function with an original token sequence length of 180 as an example, inserting... CLS The final length is 181. When it is cut down to 256, it does not need to be cut off again. 75 more are added to the tail. PAD (ID=0), resulting in an integer sequence of length 256, with the first 181 bits of the attention mask set to 1 and the last 75 bits to 0. If another function has an original token sequence length of 340, inserting... CLS The length is 341. Since it exceeds 256, it is truncated to 256, and the attention mask is all 1s.

[0054] After encoding, each function obtains a shape of Integer vectors, during batch processing The integer vectors of functions are organized into shape. The batch tensors are fed into the target first classification model for inference, where... The number of functions in the current batch. .

[0055] In an alternative implementation, a byte-pair encoding (BPE)-based word tokenization strategy can be used instead of the rule-based category generalization tokenization scheme described above. BPE can adaptively learn compressed representations of high-frequency instruction combinations from the training corpus and is suitable for cross-architecture detection scenarios with diverse instruction set architectures (simultaneously handling x86 and ARM binary).

[0056] S400, input the first instruction sequence into the first classification model to obtain the first probability value of each function being a generative code.

[0057] The first classification model employs a multi-scale one-dimensional convolutional neural network (AsmCNN) architecture; the first classification model converts the batch tensors output by S320 (with shape...) The integer sequence (batch) is fed into the target AsmCNN model, passing through the embedding layer, multi-scale parallel convolutional layer, global pooling layer, feature concatenation layer, and fully connected output layer. The final output is the first probability value of each function being a generative code. . Specifically: S410, the encoded integer sequence is passed through the embedding layer to obtain the feature tensor.

[0058] The first layer of the AsmCNN model is the word embedding layer, which maps discrete integer IDs to continuous dense vector representations. The input to the embedding layer is the shape. Integer batch tensors, with a vocabulary size consistent with the AsmTokenizer vocabulary (typically several thousand), embedding dimensions Typically, the value is between 64 and 128; in this embodiment, it is taken as... The embedded layer output shape is A three-dimensional feature tensor, where the first dimension is the batch size. The second dimension is the sequence length of 256, and the third dimension is the embedding dimension of 64.

[0059] For example, when (That is, a batch contains 32 functions), and the 256 integer IDs of each function are transformed by the embedding layer to obtain the shape of... The feature tensor, where the 64-dimensional dense vector corresponding to each integer ID is learned by the model training process, encodes the distribution representation of the corresponding token category in the assembly semantic space.

[0060] S420, the feature tensor is input into multiple parallel one-dimensional convolutional layers for feature extraction at different scales. The multiple parallel one-dimensional convolutional layers have different kernel sizes. The outputs of each convolutional layer are then concatenated after performing global pooling operations to form the first fused feature.

[0061] The core structure of the AsmCNN model is a three-way parallel one-dimensional convolutional branch with kernel sizes of 3, 5, and 7, respectively. These kernel sizes capture local patterns with different temporal spans in the assembly instruction sequence: the branch with a kernel size of 3 captures short-range co-operational patterns between three adjacent instructions (such as a typical instruction pair where an immediate value is loaded followed by a register operation); the branch with a kernel size of 5 captures mid-range patterns consisting of five instructions (such as parameter setting and return value processing sequences before and after a function call); and the branch with a kernel size of 7 captures long-range patterns consisting of seven instructions (such as loop unrolling or matrix operation inner structures commonly found in generative code).

[0062] Each convolutional branch contains a one-dimensional convolutional layer (Conv1d) and a ReLU activation layer. Taking a branch with a kernel size of 3 as an example, the input feature tensor shape is... One-dimensional convolution is performed along the sequence dimension, with a kernel size of 3 and an output channel number of... Typically, the value is between 32 and 128; in this embodiment, it is taken as... With a step size of 1 and padding of 1 (keeping the sequence length constant), the output shape is... After ReLU activation, global max pooling is performed on the sequence dimension, taking the maximum value of each output channel over the entire sequence, and shaping the result. Compress to Similarly, branches with kernel sizes of 5 and 7 are padded with sizes of 2 and 3 respectively to maintain sequence length, with 64 output channels each. After global max pooling, each branch yields a shape... eigenvectors.

[0063] The feature vectors output from the three branches are concatenated along the last dimension to obtain the first fused feature, which has the following shape: 192 This represents the total dimension of the three feature vectors. The purpose of global max pooling is to compress the variable-length convolutional output into a fixed-length feature vector, enabling the model to respond to local patterns appearing at any position in the sequence, rather than focusing only on features at fixed positions.

[0064] For example, for a feature value of "call" REG64 / mov MEM_DISP REG64 / push REG64 / sub IMM REG64 / mov IMM MEM_DISP The 5-Token subsequence can be mapped to a feature activation value by a branch with a kernel of 5, while the branch with a kernel of 3 can independently activate the two triples [call, mov, push] and [push, sub, mov] respectively. Together, they provide local descriptions of different granularities for the fused features.

[0065] S430, the first fused feature is passed through a fully connected layer to output the first probability value.

[0066] The first fused feature passes through a Dropout layer (with a dropout rate typically between 0.3 and 0.5; in this embodiment, it is 0.3) and then enters a two-stage fully connected network. The first fully connected layer (FC1) maps the 192-dimensional input to a 64-dimensional intermediate representation, using ReLU as the activation function. The output of the first fully connected layer then passes through a Dropout layer (with a dropout rate of 0.3) and enters the second fully connected layer (FC2), which maps the 64-dimensional input to a 2-dimensional logits vector. The two logits correspond to the unnormalized scores of the [generative code] and [hand-written code] categories, respectively. The 2-dimensional logits vector is normalized to a probability distribution using the Softmax function, and the probability value corresponding to the [generative code] category is taken as the first probability value of this function. .

[0067]

[0068] In the formula, , , These are the activation outputs of the three convolutional branches, respectively. For global max pooling, To stitch along the last dimension, subscript This indicates that the Softmax output component corresponding to the "Generative Code" category is retrieved.

[0069] For the set of objective functions All of them A function, batched (batch size) Typically, it is between 16 and 64; in this embodiment, it is 32. The above reasoning process is executed, and each batch... The results are aggregated to obtain a function-level probability sequence. each Represents the corresponding function The first probability value of the generative code, i.e. the generative probability of each function, constitutes the input for software-level statistical feature extraction.

[0070] For example, for the aforementioned 240 objective functions, inference is performed in 8 batches (32 functions in each of the first 7 batches, and 16 functions in the last batch), resulting in 240 first probability values. Among these, the first to 240th functions... The values ​​are exemplarily distributed in the interval [0,1], with a high probability ( Most functions contain assembly patterns typical of generative code (such as numerous consecutive register parameter passing instructions, system call sequences, etc.), with a low probability of... Functions are mostly in the traditional manual assembly mode (such as manual inline assembly, complex bit operation sequences, etc.).

[0071] In another embodiment, the first classification model can also be implemented using an assembly instruction sequence encoder based on the Transformer architecture, replacing the parallel convolutional layer with a multi-head self-attention mechanism to model the global dependencies in the assembly instruction token sequence. This is suitable for detection scenarios with long function bodies (token sequences exceeding 256) and the need to capture long-distance instruction dependencies.

[0072] S500, based on the first probability value of all functions, extract the first statistical feature corresponding to the distribution of the first probability value.

[0073] The feature extraction module receives the function-level probability sequence output by S400. (in (The total number of functions in the objective function set), extract multidimensional statistical features from the distribution of probability values, and construct the first statistical feature vector. , as input to the software-level learning aggregation model.

[0074] In this embodiment, the first statistical feature vector It is a 23-dimensional real-valued vector, covering five dimensions: central tendency, dispersion, quantiles, extrema, and proportion of high-probability functions. Specifically: S510 extracts central tendency and dispersion features.

[0075] The central tendency feature extracts the mean and median of the first probability values ​​of all functions.

[0076] Among them, the mean for:

[0077] median To be After sorting in ascending order, take the middle element. When it is an odd number, take the first one. One element, Take the first number when it is even. With the (arithmetic mean of elements).

[0078] The dispersion characteristic is the standard deviation of the probability value. :

[0079] For example, for the probability sequence of the aforementioned 240 objective functions, if generative functions and manually written functions each account for a certain proportion, then the mean... For example, the value is approximately 0.45, the median is approximately 0.38, and the standard deviation is... The value is approximately 0.29, indicating that the probability distribution is relatively discrete and has a clear bimodal shape, which is a statistical reflection of the ELF file's mixture of generative and manual code.

[0080] S520 extracts quantile and extreme value features.

[0081] The quantile feature extracts the 75th, 90th, 95th, and 99th percentile values ​​of the probability distribution. Sort in ascending order , No. Percentile is defined as The index is The elements (non-integer indices are handled using linear interpolation).

[0082] For example, taking the aforementioned 240 functions as an example, the 75th percentile is approximately 0.71, the 90th percentile is approximately 0.88, the 95th percentile is approximately 0.93, and the 99th percentile is approximately 0.98. These four quantile values ​​collectively characterize the right-tail shape of the probability distribution. That is, if a large number of functions in an ELF file are generative functions, the above quantile values ​​will be generally high; if only a small number of functions are generative functions, the step difference in quantile values ​​will be more obvious.

[0083] The minimum value of the probability distribution for extracting extreme value features With the maximum value And the Top-K mean feature: taking the highest 5% of the probability sequence (i.e., the top 5% high probability functions, taking...) The average probability of the functions is used as the first Top-K mean feature, and the highest 10% of the functions (taking...) are selected. The average probability of the functions is used as the second Top-K mean feature, and both reflect the concentration of the high-probability function group.

[0084] S530 extracts the proportion features of high-probability functions.

[0085] The high-probability function proportion feature extracts the proportion of functions exceeding multiple preset probability thresholds, forming multiple components of the high-probability function proportion feature vector. The high-probability function proportion feature includes the following components: The first category is the proportion of coarse-grained particles, which are statistically analyzed separately. and The ratio of functions to all functions:

[0086] In the formula, The former (i.e., the ratio of the number of functions with a first probability value exceeding a preset probability threshold of 0.3 to the total number of functions) characterizes the overall size of functions with a certain generative tendency, while the latter (i.e., the ratio of the number of functions with a first probability value exceeding a preset probability threshold of 0.8 to the total number of functions, i.e., the high probability function proportion feature) characterizes the concentrated size of high-confidence generative functions.

[0087] The second category is the proportion of fine-grained particles, which is statistically analyzed separately. , , The percentage of the function further characterizes the step-like shape of the probability distribution in the interval [0.5, 1.0].

[0088] For example, taking the aforementioned 240 functions as an example, if There are 148 functions, then ;like There are 112 functions, then ;like There are 67 functions, then The stepped shape of the above proportional sequence (gradually decreasing from 0.617 to 0.279) reflects the distribution density of the generative function in this ELF file.

[0089] The third category is the quantitative characteristics of high-probability functions.

[0090] The high-probability function quantity feature extracts the absolute number of functions whose first probability value exceeds a preset threshold. This complements the proportional feature and directly reflects the size of high-confidence generative functions in the target function set. (The threshold is then defined.) Statistically, each satisfies The absolute number of functions:

[0091] The three thresholds correspond to , and These constitute the 19th to 21st dimension feature components, respectively. Unlike proportional features, quantitative features are more sensitive to the absolute size of generative functions in the target ELF file: when the total number of functions in two ELF files differs significantly, their proportions of high-probability functions may be similar, but the absolute number difference is significant; the learning-based aggregation model can distinguish between two scenarios, [high penetration of small-scale files] and [low penetration of large-scale files], through quantitative features, supplementing the scale-sensitive information that proportional features cannot cover.

[0092] For example, taking the probability sequence of the aforementioned 240 objective functions as an example, , , The three values ​​decrease monotonically as the threshold increases, reflecting the internal hierarchical structure of the high-confidence generative function group.

[0093] The fourth category is normalized quantitative features.

[0094] To ensure the comparability of high-probability function counts across documents, for Execution scale normalization yields normalized quantitative characteristics:

[0095] The normalized quantitative feature is the 22nd dimension feature component. Although its value is similar to... While equivalent in definition, it is retained as an independent component in the feature vector, allowing the aggregation model to learn the weights of its independent coefficients during the training phase. This helps stabilize the aggregation model's response to information with a moderate threshold ratio in training scenarios with a small sample size.

[0096] In addition, the statistical feature vector also includes the difference between the mean and the median (i.e., the mean-median skewness indicator feature) and the logarithm of the total number of objective functions. (Logarithmic feature of scale, 18th dimension) and the total number of objective functions These features (direct characteristics of scale, the 23rd dimension) together constitute the 23-dimensional first statistical feature vector. .

[0097] It should be noted that the features of each dimension of the multidimensional statistical feature vector are described as follows: The first dimension is the mean of the first probability values ​​of all functions. The second dimension is the median. The third dimension is the standard deviation. Dimensions 4 through 7 represent the 75th, 90th, 95th, and 99th percentiles (a total of 4 quantile features); dimension 8 represents the minimum value. The 9th dimension is the maximum value. The 10th dimension represents the average probability of the top 5% high-probability function (first Top-K mean feature); the 11th dimension represents the average probability of the top 10% high-probability function (second Top-K mean feature); dimensions 12 to 16 represent the five components of the high-probability function's proportional feature vector, corresponding to the threshold. The values ​​are 0.3, 0.5, 0.6, 0.7, and 0.8 (a total of 5 proportional characteristics); the 17th dimension is the difference between the mean and the median. (Skewness indicator feature); the 18th dimension is the logarithm of the total number of objective functions. (Logarithmic feature of scale); Dimensions 19 to 21 are the three components of the quantitative feature of the high-probability function, respectively , and The first probability value is the absolute number of functions whose first probability values ​​exceed 0.5, 0.6, and 0.7, respectively; the 22nd dimension is the normalized quantitative feature. The 23rd dimension represents the total number of objective functions. It is itself (a direct characteristic of scale).

[0098] The above 23 features constitute the complete dimension of the multidimensional statistical feature vector; in specific implementation, it can be further expanded according to engineering needs (such as adding kurtosis features, function number distribution in different probability intervals, etc.). The hyperparameters and decision thresholds of the aggregation model corresponding to the expanded feature vector need to be retrained and determined.

[0099] Each component of the statistical feature vector is calculated in real time by the feature extraction module using pure numerical operations, without the need for additional model parameters, resulting in extremely low computational cost. After calculation, the vector is directly passed to the aggregation module as input.

[0100] S600, input the first statistical feature into the first aggregation model to obtain a first determination result of whether the binary executable file contains generative code.

[0101] The aggregation module receives statistical feature vectors. Input it into the pre-trained first aggregation model, and it outputs software-level generative probabilities. And based on the preset judgment threshold Generate the final judgment label, i.e., the first judgment result. Specifically: S610, input the first statistical feature into the random forest classifier or logistic regression classifier, and output the second probability value.

[0102] In one implementation, the first aggregation model is a random forest classifier, constructed from 300 decision trees (the number of decision trees is typically between 100 and 500; this embodiment uses 300). Each decision tree has a maximum depth of 8 (typically between 5 and 15), a minimum number of samples per leaf node (typically between 1 and 10), and class weights are set to [balanced] (i.e., positive and negative samples are automatically weighted according to the inverse of their frequencies to address imbalances between generative ELF and manually written ELF in the training set). The random forest obtains the software-level generative probability by averaging the predicted probabilities of the 300 decision trees. This is the second probability value. In this mode, the aggregation model assigns higher feature importance weights to the high probability function proportion feature group and the Top-K mean feature group in the statistical feature vector, enabling the model to still provide a high software-level probability value even when a small number of high-confidence generative functions exist.

[0103] In another embodiment, the first aggregation model may also employ a logistic regression classifier with L2 regularization (regularization strength). (Typically in the range of 0.01 to 10.0), with a maximum of 1000 iterations, class weights set to [balanced], and 5-fold cross-validation used during training to select the optimal decision threshold by maximizing the area under the ROC curve. This is to achieve a balance between sensitivity (TPR, true positive rate) and false positive rate (FPR).

[0104] Logistic regression classifiers have good interpretability in linearly separable scenarios. The feature coefficients of each dimension directly reflect the direction and strength of the contribution of the statistical feature to the software-level judgment, making it easier for auditors to understand the judgment basis.

[0105] S620, when the second probability value is greater than or equal to a preset judgment threshold, output a judgment label indicating that the binary executable file contains generative code.

[0106] The aggregation module will use the second probability value Compared with the preset judgment threshold Comparison ( The value is typically taken in the range of 0.4 to 0.6; in this example, it is taken as 0.5.

[0107] when When the output label is _GENERATED, it indicates that the binary executable file contains generative code; when When this condition is met, the output judgment label is HUMAN, indicating that the binary executable file does not contain generative code. The aforementioned judgment label and the second probability value... The total number of functions and statistical information together constitute the first judgment result.

[0108] For example, using the statistical feature vectors of the aforementioned 240 objective functions For example, among which , , The mean of the Top-K (top 5%) is approximately 0.95, obtained through inference using a random forest classifier. .because The output determines the generative expression of the label _GENERATED, indicating that the ELF executable file contains generative code. The aggregation module also selects from the probability sequence... The highest K functions ( Typically, a value of 5 to 20 is used; in this embodiment, 10 is used to construct a list of suspected functions. Each record includes the function name and a first probability value. and the function's starting address, according to Output in descending order to provide auditors with further information for locating the problem.

[0109] The training process of the first aggregation model is independent of the inference stage. The training set is constructed on the basis of ELF files. Each ELF file is characterized by a corresponding 23-dimensional statistical feature vector and labeled with manually annotated [whether it contains generative code]. Through supervised learning, the aggregation model learns the mapping relationship from probability distribution statistical features to software-level judgment, thereby replacing the fixed threshold voting scheme and effectively suppressing the amplification effect of function-level false alarms at the software level.

[0110] This application also provides a binary generative code detection system based on multi-scale features and cross-level learning aggregation.

[0111] like Figure 2 As shown, the system includes: Function extraction module: Used to disassemble the binary executable file to be tested and extract the first instruction sequence corresponding to each function.

[0112] Specifically, the function extraction module calls the objdump toolchain to disassemble the input ELF executable file, parse the function boundary labels and extract the assembly instruction line sequence of each function; it performs name blacklist filtering, PLT / GOT stub function filtering, short function filtering and excessively long function filtering on the initial function set, and passes the filtered target function set and the first instruction sequence of each function to the classification module and the compilation optimization identification module.

[0113] Classification module: Used to input the first instruction sequence into the first classification model to obtain the first probability value of each function being a generative code.

[0114] Specifically, the classification module includes an AsmTokenizer submodule and an AsmCNN inference submodule. The AsmTokenizer submodule performs mnemonic extraction and operand category generalization tokenization on the first instruction sequence of each function, outputting an integer encoding sequence. The AsmCNN inference submodule batches the integer encoding sequences into the target first classification model (selected by the compilation optimization recognition module), passing them through an embedding layer, multi-scale parallel one-dimensional convolutional layers (kernel sizes of 3, 5, and 7), global max pooling, feature concatenation, and a fully connected output layer, outputting the first probability value of each function. The data are aggregated into a function-level probability sequence and passed to the feature extraction module. The classification module also has a built-in compilation optimization recognition function, which analyzes the stack frame establishment ratio of the function prologue in the target function set, determines the compilation optimization level, and loads the corresponding pre-trained AsmCNN model.

[0115] Feature extraction module: Used to extract the first statistical features corresponding to the distribution of the first probability values ​​based on the first probability values ​​of all functions. Specifically, the feature extraction module calculates the mean, median, standard deviation, 75th / 90th / 95th / 99th percentiles, minimum, maximum, Top-K mean (top 5% and top 10%), proportion of high-probability functions with multiple thresholds (thresholds are 0.3, 0.5, 0.6, 0.7, and 0.8 respectively), mean-median difference, and logarithmic value of the number of functions for the function-level probability sequence. And the quantitative features of high-probability functions (the absolute number of functions corresponding to thresholds of 0.5, 0.6, and 0.7), and normalized quantitative features. Total number of functions Together, they constitute the 23-dimensional first statistical eigenvector. It is then passed to the aggregation module.

[0116] Aggregation module: used to input the first statistical feature into the first aggregation model to obtain a first determination result of whether the binary executable file contains generative code.

[0117] Specifically, the aggregation module inputs the 23-dimensional first statistical feature vector into a pre-trained random forest classifier or logistic regression classifier to obtain software-level generative probabilities. ;Will Compared with the preset judgment threshold (In this embodiment, 0.5 is used for comparison.) Output the _GENERATED label if the condition is met, otherwise output the HUMAN label; simultaneously output a list of the K most probable functions forming a suspicious function list, along with the label and the function name. The values ​​together constitute the first judgment result.

[0118] The data flow for collaboration among modules is as follows: The input ELF file first enters the function extraction module to extract the target function set and the first instruction sequence; the target function set is simultaneously sent to the compilation, optimization, and identification sub-function within the classification module to determine the optimization level and select the model; the first instruction sequence is tokenized and then sent in batches to the target AsmCNN model for inference to obtain the first probability value of each function; the first probability value sequence of all functions is sent to the feature extraction module to calculate the 23-dimensional statistical feature vector; the statistical feature vector is sent to the aggregation module to output the first judgment result.

[0119] The system also supports a directory scanning mode: In directory scanning mode, the system recursively traverses all ELF executable files in the target directory, performs the above detection process on each file, outputs the generative _GENERATED / HUMAN judgment label and probability distribution statistics for each file, and generates a batch software security audit report.

[0120] The functions of each module of the system are implemented by the processor executing instructions in the memory. The instructions are stored in the form of computer programs in a computer-readable storage medium. When the computer program is executed by the processor, the functions of each module are implemented, and the end-to-end generative code detection process from input of binary executable file to output of software-level judgment result is completed.

[0121] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit described above can be implemented in hardware.

[0122] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A binary generative code detection method based on multi-scale features and cross-level learning-based aggregation, characterized in that, include: The binary executable file to be tested is disassembled to extract the first instruction sequence corresponding to each function in the binary executable file; The first instruction sequence is input into the first classification model to obtain the first probability value of each function as a generative code; Based on the first probability value of all functions, extract the first statistical feature corresponding to the distribution of the first probability value; The first statistical feature is input into the first aggregation model to determine the first determination result of whether the binary executable file contains generative code.

2. The method according to claim 1, characterized in that, The method further includes: Obtain the compilation optimization level of the binary executable file; Based on the compilation optimization level, select a target first classification model that matches the compilation optimization level from the pre-trained first classification models; The target first classification model is used as the first classification model to classify the first instruction sequence.

3. The method according to claim 2, characterized in that, Obtaining the compilation optimization level of the binary executable file includes: Analyze the stack frame creation characteristics in the first preamble instructions of each function, and count the first proportion of functions with stack frames among all functions; When the first ratio value exceeds a preset threshold, the compilation optimization level is determined to be the first optimization level; otherwise, it is determined to be the second optimization level.

4. The method according to claim 1, characterized in that, Before inputting the first instruction sequence into the first classification model, the method further includes: Each assembly instruction in the first instruction sequence is parsed into a mnemonic, and each operand is mapped to a predefined category generalization tag to generate a first tag sequence; The first labeled sequence is encoded into a fixed-length integer sequence, and then the integer sequence is input into the first classification model.

5. The method according to claim 4, characterized in that, The first classification model is a multi-scale one-dimensional convolutional neural network, and the first probability values ​​obtained for each function as generative code include: The encoded integer sequence is processed through an embedding layer to obtain a feature tensor; The feature tensors are input into multiple parallel one-dimensional convolutional layers to extract features at different scales. Perform global pooling operations on the outputs of each convolutional layer, and then concatenate the results of the global pooling operations to form the first fused feature; The first fused feature is processed by a fully connected layer to obtain the first probability value.

6. The method according to claim 1, characterized in that, The first statistical feature includes at least two of the following: central tendency feature, dispersion feature, quantile feature, extreme value feature, and high probability function proportion feature, wherein: The central tendency features include the mean and median of the first probability values ​​of all functions; The high-probability function proportion feature includes the ratio of the number of functions whose first probability value exceeds a preset probability threshold to the total number of functions.

7. The method according to claim 6, characterized in that, The first aggregation model is a random forest classifier or a logistic regression classifier, and obtaining the first determination result includes: Based on the first statistical characteristic, determine the second probability value; When the second probability value is greater than or equal to a preset judgment threshold, a judgment tag is determined that the binary executable file contains generative code.

8. The method according to claim 1, characterized in that, Before extracting the first instruction sequence corresponding to each function in the binary executable file, the method further includes: Filter the function set obtained from disassembly; The functions retained after filtering are used as the set of target functions to be classified.

9. A binary generative code detection system based on multi-scale features and cross-level learning aggregation, characterized in that, include: The function extraction module is used to disassemble the binary executable file to be detected and extract the first instruction sequence corresponding to each function. The classification module is used to input the first instruction sequence into the first classification model to obtain the first probability value of each function being a generative code; The feature extraction module is used to extract the first statistical feature corresponding to the distribution of the first probability value based on the first probability value of all functions; An aggregation module is used to input the first statistical feature into a first aggregation model to determine a first determination result of whether the binary executable file contains generative code.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of any one of claims 1 to 8.

Images