Multi-relationship function graph and layout optimization binary code similarity analysis method

Abstract

The application relates to a multi-relation function graph and layout optimization binary code similarity analysis method. The method comprises the following steps: receiving a binary file pair to be analyzed; performing static analysis to extract a function set and a virtual address sequence; constructing a multi-relation function graph containing control flow edges, data dependency edges and spatial proximity edges for each function, and extracting basic block intermediate code; generating basic block semantic embedding based on a DeBERTa model; generating function-level semantic embedding by using a relation-aware graph attention network; calculating a semantic similarity matrix, introducing macro layout consistency constraints in combination with a virtual address sequence to perform optimized matching, and outputting a similar function matching result. By using the method, the homogenization bottleneck in functions can be effectively relieved, the false positive matching rate can be reduced, and the generalization capability across instruction set architectures can be enhanced.

Description

Technical Field

[0001] This application relates to the field of software security technology, and in particular to a binary code similarity analysis method based on multi-relation function graphs and layout optimization. Background Technology

[0002] Binary Code Similarity Analysis (BCSA) is a fundamental technology in the field of software security, widely used in vulnerability detection, malware analysis, software supply chain auditing, and patch analysis. Its core objective is to determine whether two binary functions generated for different instruction set architectures or different compilation optimization levels originate from the same source code implementation. Existing technologies mainly develop along three technical routes: First, traditional methods based on manually designed features rely on expert experience to extract statistical, syntactic, or structural features of functions, achieving function matching through feature comparison or similarity calculation. Second, sequence modeling methods based on natural language processing treat binary code as a special language, mapping instructions to words, basic blocks to sentences, and functions to paragraphs, automatically extracting semantic features using natural language processing models. Third, graph modeling methods based on graph neural networks model functions as control flow graphs with basic blocks as nodes and control flow transitions as edges, using graph neural networks for message passing on the graph to learn the graph-level semantic embedding of functions.

[0003] However, the aforementioned existing technologies suffer from the following technical shortcomings. While existing relation-aware graph neural network methods can distinguish between control flow edges and data dependency edges, they generally ignore the spatial proximity relationships between basic blocks or discard such relationships as noise. Specifically, when aggregating information on graph connections, existing methods do not consider the relative memory addresses of basic blocks, thus losing execution order constraints that pure control flow abstraction cannot capture. For example, two functions may have isomorphic control flow graphs and the same data dependencies, but if their key operations have different spatial arrangements in memory, their semantics are completely different. Due to the lack of spatial proximity edges, existing representations lack the ability to distinguish between "structurally similar but functionally different" code. Existing program-level matching methods mainly rely on function call graphs to model the relationships between functions, treating each function as an isolated node connected only by explicit call edges, ignoring a stable and strong prior knowledge in binary organization: the macroscopic layout order of functions in the binary address space. Empirical analysis shows that compilers tend to place related functions close together in memory, and this spatial organization remains highly consistent across different instruction set architectures and optimization levels. Function layout, as a stable syntactic signature of a compilation unit, is ignored by existing methods, thus missing a natural filtering mechanism: in similar compilation environments, the relative positional relationship of two functions in one binary file should also exist in similar binary files. This constraint can effectively eliminate false positives caused by isolated pairwise comparisons. Existing basic block encoding methods based on BERT or RoBERTa, when dealing with cross-architecture instructions and heterogeneous instruction formats from different instruction set architectures, often separate instruction opcodes and operands in their word segmentation strategies, resulting in impaired semantic coherence. Furthermore, traditional BERT's positional encoding method struggles to distinguish the different semantic roles of opcodes and operands within the same instruction. Summary of the Invention

[0004] Therefore, it is necessary to provide a binary code similarity analysis method that can alleviate the bottleneck of homogenization within functions, reduce the false positive matching rate, and adapt to multiple instruction set architectures, based on multi-relational function graphs and layout optimization, to address the aforementioned technical problems.

[0005] A binary code similarity analysis method based on multi-relation function graphs and layout optimization, the method comprising: Receives a pair of executable binary files to be analyzed, which includes a source binary file and a target binary file; Static reverse analysis is performed on the source binary file and the target binary file respectively to identify and extract the function identifiers, start addresses, and end addresses of all functions in each file, resulting in the source function set and the target function set; at the same time, the source virtual address sequence corresponding to the source function set and the target virtual address sequence corresponding to the target function set are generated. For each function in the source function set and the target function set, control flow analysis and data flow analysis are performed respectively. Combined with the virtual memory address information of the basic block, a multi-relation function graph containing control flow edges, data dependency edges and spatial proximity edges is constructed. At the same time, the intermediate code corresponding to each basic block is extracted to obtain the multi-relation function graph and the set of intermediate code of the basic block for each function. The intermediate code sequence of each basic block is input into a pre-trained DeBERTa model. A type embedding layer is added to the DeBERTa model to distinguish between opcode terms and operand terms. Attention weights between terms are calculated through a decoupled attention mechanism, and the semantic embedding vector of each basic block is output. The semantic embedding vector of each basic block is used as the initial node representation of the corresponding multi-relation function graph. A relation-aware graph attention network is used to perform multi-layer message passing on the multi-relation function graph, aggregating the information of neighbor nodes under different relation types, generating the semantic embedding vector of each function, and obtaining the source function embedding set and the target function embedding set respectively. The semantic similarity matrix of function pairs is calculated based on the source function embedding set and the target function embedding set. Then, macro-layout consistency constraints are introduced by combining the source virtual address sequence and the target virtual address sequence to optimize the matching of the semantic similarity matrix, and the final similarity function matching result is output.

[0006] The aforementioned binary code similarity analysis method based on multi-relation function graphs and layout optimization constructs a multi-relation function graph containing control flow edges, data dependency edges, and spatial proximity edges. This explicitly models the continuous arrangement of basic blocks in memory as graph edges, enabling the model to capture semantic differences caused by basic block reordering. This effectively distinguishes structurally similar but functionally different codes, alleviating the homogenization bottleneck. Addressing the false positive matching problem caused by insufficient context utilization between functions, a macro-layout consistency constraint is introduced in the similarity matching stage. Utilizing the prior order of functions in the binary address space, anchor point matching is used to segment local intervals and perform sequence constraint verification, thereby filtering out erroneous matches that violate layout monotonicity and significantly reducing the false positive rate. Assembly code is converted into intermediate code to be compatible with heterogeneous formats such as x86 variable-length instructions and ARM fixed-length instructions. A DeBERTa model is adopted with a type embedding layer. The intermediate code is decomposed into opcode terms and operand terms, each assigned an independent position and content representation. A decoupling attention mechanism preserves the semantic role differences between the two, significantly improving the method's adaptability to various instruction set architectures. Attached Figure Description

[0007] Figure 1 This is a flowchart illustrating a binary code similarity analysis method based on multiple relation function graphs and layout optimization in one embodiment. Figure 2This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0008] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0009] In one embodiment, such as Figure 1 As shown, a binary code similarity analysis method based on multiple relation function graphs and layout optimization is provided, including the following steps: Step 1: Receive the executable binary file pair to be analyzed, which includes the source binary file and the target binary file.

[0010] Executable binaries include binary files and binary files ,in and It can compile binary files from different instruction set architectures, compilers, or compilation optimization options, covering a wide range of mainstream executables and analysis objects: including executables, dynamic libraries, drivers, kernel modules, and bare-metal images for Windows, Linux, macOS, and embedded platforms under architectures such as x86-64, ARM, MIPS, RISC-V, and PowerPC; it is also compatible with compilation artifacts from GCC, Clang / LLVM, MSVC, ICC, and various embedded-specific compilers; it supports binary files generated from the same source code at different levels of optimization, such as no optimization, basic optimization, full optimization, and size optimization, as well as binary files generated with / without debugging information, link-time optimization, and code obfuscation; in addition, it covers common analysis objects in the software security field such as static libraries, device firmware images, software patch files, and unpacked malware samples, fully adapting to the needs of core application scenarios such as vulnerability detection and malware analysis.

[0011] Step 2: Perform static reverse analysis on the source binary file and the target binary file respectively, identify and extract the function identifiers, start addresses and end addresses of all functions in each file, and obtain the source function set and the target function set; at the same time, generate the source virtual address sequence corresponding to the source function set and the target virtual address sequence corresponding to the target function set.

[0012] Static reverse engineering tools include IDAPro, Ghidra, or BinaryNinja; let the set of functions extracted from the source binary file be the source function set, and the set of functions extracted from the target binary file be the target function set; both the source virtual address sequence and the target virtual address sequence are arranged in ascending order of address, for subsequent introduction of macro-layout consistency constraints for optimization matching, specifically: Call the reverse engineering tool to analyze the binary file and binary files Static analysis is performed separately to identify and extract the function identifiers, start addresses, and end addresses of all functions in each file. The reverse analysis tools include IDAPro, Ghidra, or BinaryNinja. Let's assume we start from... The extracted function set is ,from The extracted function set is , where n and m are the number of functions in the two files, respectively.

[0013] For each function The control flow analysis engine is invoked to extract its control flow graph. ,in For the set of basic blocks, It is a set of control flow edges; control flow transfers include sequential execution, conditional jumps, unconditional jumps, and function call returns.

[0014] For each function The data flow analysis engine is invoked to extract the set of data dependency edges between basic blocks. The specific determination method is as follows: for each pair of basic blocks If there are variables x Make There exists a to x Fixed value operation and There is a reference operation to x. ,and It may precede other programs in the execution order. If executed, a flow dependency edge is added. to .

[0015] For each function A set of spatial proximity edges is constructed based on the virtual memory addresses of each basic block. ,in Representing basic blocks The starting virtual address, For basic blocks The length of the space proximity edge; spatial proximity edges are used to capture the layout continuity of basic blocks in memory, making up for the deficiency that pure control flow edges cannot reflect the physical arrangement order of basic blocks.

[0016] Step 3: For each function in the source function set and the target function set, perform control flow analysis and data flow analysis respectively. Combine the virtual memory address information of the basic blocks to construct a multi-relation function graph containing control flow edges, data dependency edges, and spatial proximity edges. At the same time, extract the intermediate code corresponding to each basic block to obtain the multi-relation function graph and the set of intermediate code of the basic block for each function.

[0017] Intermediate code includes microcode, LLVMIR, pcode, and VEX; by constructing a multi-relation function graph that integrates three types of relational edges, it can capture fine-grained semantics and layout patterns at the basic block level, compensating for the deficiency that pure control flow edges cannot reflect the physical arrangement order of basic blocks. Specifically: By integrating control flow edges, data dependency edges, and spatial proximity edges, a multi-relation function graph is constructed. ,in Let be the total set of edges. For a set of relation types; each edge Associate a relation type , representing control flow relationships, data dependencies, or spatial proximity relationships, respectively. For each basic block... Extract intermediate code generated from assembly instructions, including microcode, LLVMIR, pcode, and VEX; and process the multi-relation function graph. and basic block intermediate code set Output step 4.

[0018] Step 4: Input the intermediate code sequence of each basic block into the pre-trained DeBERTa model, add a type embedding layer to the DeBERTa model to distinguish between opcode terms and operand terms, calculate the attention weights between terms through a decoupled attention mechanism, and output the semantic embedding vector of each basic block.

[0019] By adding a type embedding layer to distinguish the semantic roles of opcodes and operands, and combining this with a decoupled attention mechanism, opcodes and operands can maintain independent semantic representations. Simultaneously, cross-attention captures the semantic relationships between them, solving the problem that traditional BERT segmentation and positional encoding cannot adapt to heterogeneous instruction formats. Specifically: Receive multiple relation function graphs and block-level feature set .

[0020] Construct semantic embeddings for the basic block instruction sequences. For each basic block... , and its intermediate code sequence DeBERTa encoding is performed as follows: First, the intermediate code is decomposed into opcode tokens and operand tokens, and a type embedding layer is added to the DeBERTa structure for differentiation. Then, a decoupled attention mechanism is used to calculate the attention weights for the token sequence. The decoupled attention mechanism decomposes the traditional self-attention matrix into a content-aware part and a position-aware part, enabling the model to distinguish tokens of different semantic types. The specific calculation method is as follows: For the input word sequence The decoupling attention score for DeBERTa is calculated as follows: ; in, For content query vectors and content key vectors, For location lookup vector and location key vector, The attention head dimension is used; the decoupled attention mechanism allows the opcode and operand to maintain independent semantic representations, while capturing the semantic relationship between them through cross attention.

[0021] Based on the DeBERTa output, obtain the basic block semantic embedding, and then use the vector corresponding to the first token [CLS] of the last hidden state of DeBERTa. As a basic block semantic embedding, i.e. ,in is the hidden layer dimension of DeBERTa.

[0022] Step 5: Use the semantic embedding vector of each basic block as the initial node representation of the corresponding multi-relation function graph. Use a relation-aware graph attention network to perform multi-layer message passing on the multi-relation function graph, aggregate the information of neighbor nodes under different relation types, generate the semantic embedding vector of each function, and obtain the source function embedding set and the target function embedding set respectively.

[0023] Relation-aware graph attention networks can use different projection matrices and attention weights for different types of edges (control flow edges, data dependency edges, spatial proximity edges), thereby more accurately aggregating neighbor information under different relationships. This allows the generated function embeddings to simultaneously capture control flow structure, data dependency patterns, and spatial layout features. Specifically: Embed the basic block semantics and set them as the initial node representation of the graph. .

[0024] Perform multi-layer message passing in a Relationship-Aware Graph Attention Network (RGAT). For the i-th layer (i=1,2,...,L), each node... The update method for representing is: ; in, Represents a node In relationship The following is a collection of neighbors. For relationship A dedicated projection matrix, is the self-loop projection matrix, and sigma is the nonlinear activation function (ReLU). Let be the attention weights from node k to node j under relation r.

[0025] Attention weight The calculation employs a multi-head attention mechanism. For the h-th attention head, the attention score under relation r is calculated as follows: ; ; in and Let r be the query matrix and key matrix under the h-th head, respectively. Let H be the dimension of each attention head, and H be the total number of attention heads. Finally, the outputs of all heads are concatenated and subjected to a linear transformation to obtain the aggregated representation.

[0026] After L-layer RGAT message passing, a mean pooling layer (MeanPool) is used to generate function-level embeddings: ; in For function The final semantic embedding vector, For embedded dimensions, The output projection matrix is ​​obtained by embedding graph structure information and instruction semantic information, enabling function embedding to simultaneously capture control flow structure, data dependency patterns, and spatial layout features. The embedding is then L2 normalized.

[0027] Step 6: Calculate the semantic similarity matrix of function pairs based on the source function embedding set and the target function embedding set. Combine the source virtual address sequence and the target virtual address sequence to introduce macro-layout consistency constraints to optimize the semantic similarity matrix and output the final similarity function matching result.

[0028] Introducing macro-layout consistency constraints leverages the compiler's prior knowledge that it tends to place related functions close together in memory. This decomposes the global matching problem into multiple smaller subproblems, allowing for the solution of optimal function pairings through integer programming or greedy strategies. This reduces computational complexity and effectively filters out false positives from isolated pairwise comparisons. Specifically: Step 6.1, Receive binary file function embedding set With binary files function embedding set And the virtual address sequence of each function in the corresponding binary file. and The addresses are arranged in ascending order.

[0029] Step 6.2, calculate the semantic similarity matrix of the function pairs. , of which elements Representation function and The cosine similarity.

[0030] Step 6.3: Construct the layout consistency constraint function and select a high confidence threshold. A subset of highly feasible matching pairs are obtained as anchor matching pairs. Based on these highly reliable anchor matching pairs, the binary file is... With binary files The function sequence is divided into multiple groups. Then, code similarity matching is performed on the function set formed by two adjacent anchor point matching pairs. Functions that do not meet the function sequence constraints and whose similarity is below the minimum threshold are removed from the matching pair. Finally, maximum value matching is performed on the unmatched functions.

[0031] Step 6.4, set the high confidence threshold (Values ​​range from [0.75, 0.90]), select values ​​from the semantic similarity matrix S that satisfy... The matching pairs constitute the anchor matching pair set. The anchor point matching pairs are high-confidence functional correspondences, and their reliability is higher than that of ordinary semantic matching results; the anchor point matching pairs are classified according to... The function addresses in the array are sorted in ascending order to obtain an ordered anchor sequence. ,in p represents the number of anchor point matching pairs.

[0032] Step 6.5: Based on the ordered anchor sequence, the function set is divided into multiple local matching groups. For two adjacent anchor matching pairs... ,definition The local function interval on is , The local function interval on is The local function intervals between adjacent anchor point pairs constitute the first... k Local matching groups If there are still ungrouped functions before the first anchor pair or after the last anchor pair, then construct the first boundary group respectively. With the final boundary group .

[0033] Step 6.6, perform local similarity matching in each local matching group inside. For each local matching group , extract a sub-similarity matrix , and use a greedy strategy or Hungarian algorithm to solve the optimal matching within the group: for each function in the group , select the unmatched function that maximizes as the candidate matching, if ( is the local matching intermediate threshold, with a value range of [0.55, 0.70]), then the matching is confirmed; local matching decomposes the global matching problem into multiple small-scale sub-problems, which reduces the computational complexity, and simultaneously uses anchor point constraints to ensure the monotonic consistency of the matching results on the function sequence.

[0034] Step 6.7, perform sequence constraint verification and filtering on the local matching results. For each confirmed matching pair , check the following constraint conditions in sequence: (1) Address order constraint: if i<i' and are both confirmed matching pairs, then j<j' must be satisfied; if j>=j' exists, the address order constraint is violated; (2) Similarity lower limit constraint: if < ( is the minimum similarity threshold, with a value range of [0.40, 0.55]), it is regarded as a low-confidence matching. For matching pairs that both violate the address order constraint and < , remove them from the matching results; for matching pairs that only violate a single constraint, comprehensively determine whether to retain them according to the constraint violation degree and the similarity value.

[0035] Step 6.8, perform maximum value supplementary matching for unmatched functions. After anchor point matching and local matching, the set of functions that are not matched in is denoted as , and the set of functions that are not matched in is denoted as . For each function in , select the function in that maximizes its semantic similarity ; if >= , add the matching pair to the final matching result, and remove from ; the maximum value supplementary matching ensures that functions with high semantic similarity but not covered by local matching still have the opportunity to be matched.

[0036] ​​Step 6.9: Output the final similarity function detection result. The set of all matching pairs obtained from steps 6.4 to 6.8 is denoted as... .

[0037] The aforementioned binary code similarity analysis method based on multi-relation function graphs and layout optimization constructs a multi-relation function graph containing control flow edges, data dependency edges, and spatial proximity edges. This explicitly models the continuous arrangement of basic blocks in memory as graph edges, enabling the model to capture semantic differences caused by basic block reordering. This effectively distinguishes structurally similar but functionally different codes, alleviating the homogenization bottleneck. Addressing the false positive matching problem caused by insufficient context utilization between functions, a macro-layout consistency constraint is introduced in the similarity matching stage. Utilizing the prior order of functions in the binary address space, anchor point matching is used to segment local intervals and perform sequence constraint verification, thereby filtering out erroneous matches that violate layout monotonicity and significantly reducing the false positive rate. Assembly code is converted into intermediate code to be compatible with heterogeneous formats such as x86 variable-length instructions and ARM fixed-length instructions. A DeBERTa model is adopted with a type embedding layer. The intermediate code is decomposed into opcode terms and operand terms, each assigned an independent position and content representation. A decoupling attention mechanism preserves the semantic role differences between the two, significantly improving the method's adaptability to various instruction set architectures.

[0038] In one embodiment, the process of constructing a multi-relation function graph includes: Perform control flow analysis on each function and extract the control flow graph of the function. The control flow graph includes a set of basic blocks and a set of control flow edges. The control flow edges represent the control flow transition relationship between basic blocks. Control flow transitions include sequential execution, conditional jump, unconditional jump, and function call return. Perform data flow analysis on each function to extract the set of data dependency edges between basic blocks. The data dependency edge represents the flow dependency relationship in which a variable defined in one basic block is referenced in another basic block. Based on the starting virtual address and length of each basic block in each function, a set of spatial proximity edges between basic blocks is extracted. Spatial proximity edges represent the relationship of two basic blocks being arranged consecutively in virtual memory addresses. The control flow edge set, data dependency edge set, and spatial proximity edge set are merged into a total edge set. Combined with the basic block set and relation type set, a multi-relation function graph is constructed. The relation type set includes control flow relations, data dependency relations, and spatial proximity relations.

[0039] Specifically, by adding spatial proximity edges, the layout continuity of basic blocks in memory can be captured, making up for the execution order constraints that pure control flow abstraction cannot capture, thereby improving the ability to distinguish between code with similar structures but different functions.

[0040] In one embodiment, the attention weights between lexical units are calculated by decoupling the attention mechanism as follows: ; in, For the first word in the input word sequence i The word element and the first j Decoupling attention score between word units For the first i Content query vector of each term element For the first j Content key vector of each word element For the first i The position query vector of each word element For the first j A vector of position keys for each word. For the dimension of the attention head, superscript T This indicates the transpose operation.

[0041] Specifically, the decoupled attention mechanism decomposes the traditional self-attention matrix into a content-aware part and a position-aware part, enabling the model to distinguish lexical units of different semantic types, thereby better capturing the semantic relationship between opcodes and operands.

[0042] In one embodiment, when using a relation-aware graph attention network for multi-layer message passing of a multi-relation function graph, the first... l The formula for updating the representation of each node in the layer is as follows: ; in, For the first l Layer nodes The representation vector, Let ReLU be the non-linear activation function, and R be a set of relation types. For nodes In relationship r The set of neighboring nodes below, For relationship r Next node k To the node j Attention weights For the projection matrix specific to relation r, For the self-loop projection matrix, For the first l -1 level nodes k The representation vector, For the first l -1 level nodes The representation vector.

[0043] Specifically, by setting up dedicated projection matrices for different relationship types, the model can learn the information transmission patterns under different relationships, thereby more accurately integrating the structural and semantic information in multi-relationship graphs.

[0044] In one embodiment, the relationship r Next node k To the node j The attention weights are calculated using a multi-head attention mechanism. h The attention scores for each attention head are: ; ; in, For each dimension of attention head, For the h-th attention head relationship r Middle node k Attention score to node j For nodes represents the transpose of a vector. Let be the transpose of the representation vector of node k. For relationship r In the h Query matrix under attention heads For relationship r In the h The key matrix under each attention head For the first h A person's attention is under the relationship r Middle node k To the node j Normalized attention weights Indicates that belonging to the set All neighboring nodes k Perform summation.

[0045] Specifically, the multi-head attention mechanism can capture the dependencies between nodes from multiple different semantic subspaces, thereby improving the accuracy of attention weight calculation.

[0046] In one embodiment, the process of generating the semantic embedding vector for each function includes: go through L After message passing in the layer relation-aware graph attention network, average pooling is performed on the final representations of all nodes. Then, a linear transformation is performed using the output projection matrix and bias term to obtain the semantic embedding vector of the function. Finally, the semantic embedding vector is L2 normalized as follows: ; in, For function The final semantic embedding vector, For embedded dimensions, To output the projection matrix, k This represents the number of basic blocks in the multi-relation function graph corresponding to the function. For the first L Layer nodes The representation vector, This is a bias term.

[0047] Specifically, average pooling can aggregate node-level representations into graph-level function representations, and L2 normalization can make subsequent cosine similarity calculations more stable.

[0048] In one embodiment, a macro-layout consistency constraint is introduced by combining the source virtual address sequence and the target virtual address sequence to optimize the semantic similarity matrix matching, and the final similarity function matching result is output, including: Based on the source function embedding set and the target function embedding set, the cosine similarity between each source function and each target function is calculated, and a semantic similarity matrix is ​​constructed. Set a high confidence threshold, and select matching pairs with similarity greater than or equal to the high confidence threshold from the semantic similarity matrix to form an anchor matching pair set; Based on the source virtual address sequence, the set of anchor matching pairs is arranged in ascending order according to the virtual address of the source function to obtain an ordered anchor sequence; Based on the ordered anchor sequence, and combined with the source virtual address sequence and the target virtual address sequence, the source function set and the target function set are divided into multiple local function intervals, and the corresponding source local function intervals and target local function intervals constitute local matching groups.

[0049] Specifically, anchor point matching pairs are high-confidence functional correspondences, and their reliability is higher than that of ordinary semantic matching results. By decomposing the global matching problem into multiple local matching sub-problems through anchor point matching pairs, the computational complexity can be significantly reduced.

[0050] In one embodiment, if there is an ungrouped function before the first anchor point pair or after the last anchor point pair, then the first boundary local matching group and the last boundary local matching group are constructed respectively.

[0051] Specifically, by constructing boundary local matching groups, it is possible to ensure that all functions are included in the matching process, thus avoiding the omission of potential similar function pairs.

[0052] In one embodiment, for each local matching group, the corresponding sub-semantic similarity matrix is ​​extracted, and a greedy strategy or Hungarian algorithm is used to perform local optimal matching within the group to select matching pairs with similarity greater than or equal to the local matching intermediate threshold. Based on the source virtual address sequence and the target virtual address sequence, the selected matching pairs are verified for address order constraints and similarity lower limit constraints. Matching pairs that violate both address order constraints and have similarity lower than the minimum similarity threshold are removed. The address order constraint is as follows: if the order of two source functions in the source virtual address sequence is smaller first and larger second, then the order of their corresponding target functions in the target virtual address sequence must also satisfy the condition of smaller first and larger second.

[0053] Specifically, address order constraints leverage the stability of function layouts under different compilation environments, effectively filtering out false positive matches that violate spatial order; for matches that violate only a single constraint, a comprehensive judgment can be made on whether to retain them based on the degree of constraint violation and similarity value.

[0054] In one embodiment, functions that did not obtain a match in the source function set and the target function set are collected respectively to form the source unmatched function set and the target unmatched function set; For each function in the source unmatched function set, select the function with the highest semantic similarity in the target unmatched function set. If the maximum similarity is greater than or equal to the minimum similarity threshold, add the function pair to the final matching result. Summarize all valid matching pairs and output the final similarity function matching result.

[0055] Specifically, maximum value supplemental matching can ensure that functions with high semantic similarity but not covered by local matching still have a chance to be matched, thus improving the recall rate of similar function detection.

[0056] It should be understood that, although Figure 1 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 1 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0057] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 2As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When executed by the processor, the computer program implements a binary code similarity analysis method for multiple relational function graphs and layout optimization. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0058] Those skilled in the art will understand that Figure 2 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0059] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0060] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0061] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A binary code similarity analysis method based on multiple relation function graphs and layout optimization, characterized in that, The method includes: Receive a pair of executable binary files to be analyzed, the pair of executable binary files including a source binary file and a target binary file; Static reverse analysis is performed on the source binary file and the target binary file respectively to identify and extract the function identifiers, start addresses, and end addresses of all functions in each file, resulting in a source function set and a target function set; at the same time, a source virtual address sequence corresponding to the source function set and a target virtual address sequence corresponding to the target function set are generated. For each function in the source function set and the target function set, control flow analysis and data flow analysis are performed respectively. Combined with the virtual memory address information of the basic block, a multi-relation function graph containing control flow edges, data dependency edges and spatial proximity edges is constructed. At the same time, the intermediate code corresponding to each basic block is extracted to obtain the multi-relation function graph and the basic block intermediate code set corresponding to each function. The intermediate code sequence of each basic block is input into a pre-trained DeBERTa model. A type embedding layer is added to the DeBERTa model to distinguish between opcode terms and operand terms. Attention weights between terms are calculated through a decoupled attention mechanism, and the semantic embedding vector of each basic block is output. The semantic embedding vector of each basic block is used as the initial node representation of the corresponding multi-relation function graph. A relation-aware graph attention network is used to perform multi-layer message passing on the multi-relation function graph, aggregating the information of neighbor nodes under different relation types, generating the semantic embedding vector of each function, and obtaining the source function embedding set and the target function embedding set respectively. Based on the source function embedding set and the target function embedding set, the semantic similarity matrix of the function pairs is calculated. Then, the source virtual address sequence and the target virtual address sequence are combined to introduce macro-layout consistency constraints to optimize the matching of the semantic similarity matrix, and the final similarity function matching result is output.

2. The method according to claim 1, characterized in that, The process of constructing a multi-relation function graph includes: For each function, perform control flow analysis and extract the control flow graph of the function. The control flow graph includes a set of basic blocks and a set of control flow edges. The control flow edges represent the control flow transition relationship between basic blocks. The control flow transition includes sequential execution, conditional jump, unconditional jump, and function call return. Perform data flow analysis on each function to extract the set of data dependency edges between basic blocks. The data dependency edges represent the flow dependency relationship in which a variable defined in one basic block is referenced in another basic block. Based on the starting virtual address and length of each basic block in each function, a set of spatial proximity edges between basic blocks is extracted. The spatial proximity edges represent the relationship of two basic blocks being arranged consecutively in virtual memory addresses. The control flow edge set, data dependency edge set, and spatial proximity edge set are merged into a total edge set. Combined with the basic block set and relation type set, a multi-relation function graph is constructed. The relation type set includes control flow relations, data dependency relations, and spatial proximity relations.

3. The method according to claim 1, characterized in that, The attention weights between lexical units are calculated by decoupling the attention mechanism as follows: in, For the first word in the input word sequence i The word element and the first j Decoupling attention score between word units For the first i Content query vector of each term element For the first j The content key vector of each word element For the first i The position query vector of each word element For the first j A vector of position keys for each word. For the dimension of the attention head, superscript T This indicates the transpose operation.

4. The method according to claim 1, characterized in that, When using a relation-aware graph attention network to perform multi-layer message passing on the multi-relation function graph, the first... l The formula for updating the representation of each node in the layer is as follows: in, For the first l Layer nodes The representation vector, Let ReLU be the non-linear activation function, and R be a set of relation types. For nodes In relation r The set of neighboring nodes below, For relationship r Next node k To the node j Attention weights For relationship r A dedicated projection matrix, For the self-loop projection matrix, For the first l -1 level nodes k The representation vector, For the first l -1 level nodes The representation vector.

5. The method according to claim 4, characterized in that, The relationship r Next node k To the node j The attention weights are calculated using a multi-head attention mechanism. h The attention scores for each attention head are: in, For each dimension of attention head, For the h-th attention head relationship r Middle node k Attention score to node j For nodes represents the transpose of a vector. Let be the transpose of the representation vector of node k. For relationship r In the h Query matrix under attention heads For relationship r In the h The key matrix under each attention head For the first h A person's attention is under the relationship r Middle node k To the node j Normalized attention weights Indicates that belonging to the set All neighboring nodes k Perform summation.

6. The method according to claim 1, characterized in that, The process of generating the semantic embedding vector for each function includes: go through L After message passing in the layer relation-aware graph attention network, average pooling is performed on the final representations of all nodes. Then, a linear transformation is performed using the output projection matrix and bias term to obtain the semantic embedding vector of the function. Finally, the semantic embedding vector is L2 normalized as follows: in, For function The final semantic embedding vector, For embedded dimensions, To output the projection matrix, k This represents the number of basic blocks in the multi-relation function graph corresponding to the function. For the first L Layer nodes The representation vector, This is a bias term.

7. The method according to claim 1, characterized in that, By combining the source virtual address sequence and the target virtual address sequence and introducing macroscopic layout consistency constraints, the semantic similarity matrix is ​​optimized and matched, and the final similarity function matching result is output, including: Based on the source function embedding set and the target function embedding set, the cosine similarity between each source function and each target function is calculated, and a semantic similarity matrix is ​​constructed. A high confidence threshold is set, and matching pairs with a similarity greater than or equal to the high confidence threshold are selected from the semantic similarity matrix to form an anchor matching pair set; Based on the source virtual address sequence, the set of anchor matching pairs is arranged in ascending order according to the virtual address of the source function to obtain an ordered anchor sequence; Based on the ordered anchor sequence, and combined with the source virtual address sequence and the target virtual address sequence, the source function set and the target function set are respectively divided into multiple local function intervals, and the corresponding source local function intervals and target local function intervals constitute a local matching group.

8. The method according to claim 7, characterized in that, The method further includes: If there are ungrouped functions before the first anchor pair or after the last anchor pair, then construct the first boundary local matching group and the last boundary local matching group respectively.

9. The method according to claim 8, characterized in that, The method further includes: For each local matching group, extract the corresponding sub-semantic similarity matrix, and use a greedy strategy or Hungarian algorithm to perform local optimal matching within the group, and select matching pairs with similarity greater than or equal to the local matching intermediate threshold; Based on the source virtual address sequence and the target virtual address sequence, the selected matching pairs are verified for address order constraints and similarity lower limit constraints. Matching pairs that violate address order constraints and have similarity lower than the minimum similarity threshold are removed. The address order constraint is as follows: if the order of two source functions in the source virtual address sequence is smaller first and larger second, then the order of their corresponding target functions in the target virtual address sequence must also satisfy the condition of smaller first and larger second.

10. The method according to claim 9, characterized in that, The method further includes: Collect the functions that did not find a match from the source function set and the target function set respectively, forming the source unmatched function set and the target unmatched function set; For each function in the source unmatched function set, select the function with the highest semantic similarity in the target unmatched function set. If the maximum similarity is greater than or equal to the minimum similarity threshold, add the corresponding function pair to the final matching result. Summarize all valid matching pairs and output the final similar function matching result.

Images