19 results about "Control flow diagram" patented technology

The invention discloses an intelligent contract vulnerability detection method and system based on semantic comprehension and program path analysis, and belongs to the technical field of network security. The method comprises the following steps: firstly, analyzing an intelligent contract code by using a large language model, and reasoning to generate a structured security rule for defining a taint source, a taint sink and a purifier; secondly, guiding a taint analysis engine by using a security rule, and tracking on a data flow and a control flow diagram of a program so as to efficiently screen out a high-risk taint path; then, carrying out reachability verification on the high-risk path by adopting a symbolic execution technology; and finally, performing final context review on the verified vulnerability path by using the large language model again to generate a vulnerability report. According to the method, the semantic comprehension ability of the large language model and the preciseness of traditional program analysis are subjected to multi-stage cooperation, so that the detection precision and efficiency of the intelligent contract logic vulnerability can be remarkably improved, the interpretability of a report result is greatly enhanced, and the method has important application value.

In various examples, static single assignment-based control flow graph traversal analysis for uninitialized variable detection system and methods are disclosed. A pre-compiler stage of a compiler system, may reconstruct source code into an SSA form IR and detect and identify uninitialized variables based on applying a variable analysis pass that traverses a CFG corresponding to the SSA form IR. A variable analysis pass may traverse through the CFG to build a defined variable map and a Phi variable map. The maps may be used to map undefined variables to basic blocks of the CFG where the undefined variables occur. The variable analysis pass may pass uninitialized variable data to a compiler error handling process. The compiler error handling process may produce an error report that traces the basic block with undefined variables to lines of the source code to assist in efficiently debugging the source code.

The invention provides a code detection and protection method, system and device and a medium, and belongs to the technical field of malicious code detection.The method specifically comprises the steps that WASM byte codes are obtained; converting the byte code into a WAT text and an intermediate representation, and analyzing meta-information; respectively constructing control flow diagrams and program dependency diagrams of the JS and the WASM based on the AST and the intermediate representation, and fusing the control flow diagrams and the program dependency diagrams into a unified dependency diagram through cross-language interface nodes; matching the dependency graph by using a preset malicious rule base, and marking a suspicious level; if not, WASM is injected into a Unikernel mirror image to be executed in an isolation environment, and behavior fingerprints during operation are collected; and outputting a malicious and non-malicious conclusion by combining the static analysis result with dynamic feature rating such as resource consumption and abnormal events. Through cross-language dependency graph fusion and dynamic and static combination analysis, malicious behaviors in WASM and JS interaction are captured, execution and behavior collection are isolated, the misjudgment risk is reduced, the detection accuracy is improved, and efficient and accurate WebAssembly module protection is achieved.

The invention discloses a method for evaluating vulnerabilities by combining vulnerability codes and vulnerability description texts and using a cross-task attention mechanism. The method comprises the following steps: firstly, for a vulnerability code part, converting the vulnerability code part into a control flow diagram, and generating a plurality of execution paths from the control flow diagram; for the vulnerability description text part, some key vulnerability elements are extracted from the vulnerability description text part; then, considering that seven evaluation tasks have certain relevance, when feature representation of codes and texts is learned, a cross-task attention mechanism is introduced to capture relevance features among the tasks; and finally, carrying out weighted summation on the probability predicted by the classifiers at the code level and the text level to obtain a prediction result of final vulnerability assessment.

The invention provides a binary program static analysis method based on a comprehensive control flow diagram. According to the scheme, the method comprises preprocessing, a control flow diagram generation module, a reverse control flow diagram generation module, target address ambiguity instruction recognition and a specific basic block path. The control flow diagram generation module obtains binary program information through preprocessing and generates a control flow diagram by using a breadth-first search algorithm. The reverse control flow diagram generation module initializes a reverse control flow diagram and generates a reverse edge by traversing the control flow diagram. A target address ambiguity instruction analysis module identifies a target address ambiguity jump or call instruction in the basic block. The specific basic block path analysis module uses a path search algorithm to obtain all paths of a specific basic block, and analyzes execution conditions of the paths through a symbolic execution technology. According to the method, the binary program can be comprehensively analyzed, the analysis efficiency and accuracy are improved, and powerful support is provided for software security and quality improvement.

The invention discloses an intelligent contract vulnerability detection method and system based on multi-modal knowledge distillation, and the method comprises the steps: collecting training source code data, and obtaining byte code data, operation code data, and corresponding control flow diagram information, gray matrix and sequence embedding vector according to the training source code data; inputting the multi-modal data into a teacher model to obtain a multi-modal feature and a classification prediction probability; inputting the multi-modal features and the classification prediction probability into a preset student model to obtain a final feature vector and a classification prediction probability; constructing a total loss function, and training the student model according to the total loss function to obtain an optimal student model; and processing the target source code data to obtain multi-modal features, and inputting the multi-modal features into the optimal student model to obtain an intelligent contract vulnerability detection result. According to the method, the security of on-chain transactions is improved while the vulnerability detection performance is remarkably improved.

The invention provides a structured annotation enhanced vulnerability detection method based on dynamic path selection, and belongs to the field of source code vulnerability detection. Comprising the steps that 1, each code snippet is analyzed into an abstract syntax tree, and a corresponding control flow graph is constructed; 2, evaluating the importance of paths in the control flow diagram, and dynamically selecting a plurality of paths; 3, the code snippets are provided for the large language model, corresponding row-level annotations are generated for each row of codes, and the annotations are inserted into a selected path according to a predefined annotation insertion rule; and step 4, coding the annotation paths into vectors, extracting a local dependency relationship between the paths, modeling a global dependency relationship between the paths, and finally performing vulnerability detection based on fusion features. According to the model provided by the invention, a code structure and a vulnerability situation can be comprehensively understood, and more efficient and more accurate vulnerability detection is realized.

The invention relates to a UML (Unified Modeling Language) model-oriented event-driven behavior code automatic generation method and system. The method comprises the following steps: exporting an XMI file containing class, activity and state machines from a UML (Unified Modeling Language) modeling tool, constructing a document tree through DOM (Document Object Model) analysis, and extracting meta-model elements and relationships thereof; and generating attributes and methods of the main class and the associated class and Java source codes of the main method according to an analysis result, taking the main method of the main class as a simulation / operation entry, and calling the main method of the associated class during operation. Aiming at the behavior type of the classifier: when the behavior type is Activity, traversing an identification sequence, branching / merging, parallelizing / synchronizing and circulating from an InitialNode, constructing a behavior control flow diagram, decomposing the behavior into SimpleTask and LoopTask, and generating a Java code containing an Execute method and a scheduling statement; and when the state conversion diagram is the StateMach, reconstructing the state conversion diagram and generating a state machine instance and a StateMach Runner operation management type instance code, thereby realizing migration execution driven by a signal event and a time event and mixed triggering of the signal event and the time event and the activity. The method is suitable for the field with high requirements for model consistency and rapid verification.

The application discloses a code annotation generation method and device. The application obtains the source code of a first project, compiles the source code into bytecode, generates a control flow diagram according to the bytecode, inputs the bytecode and the control flow diagram into an annotation translation model, and obtains the annotation of the source code output by the annotation translation model. According to the application, the source code of a second project is converted into bytecode and a control flow diagram, the annotation translation model is trained by using the bytecode and the control flow diagram of the second project, the annotation of the source code of the second project output by the annotation translation model is obtained, and compared with the prior art, the annotation translation model can be trained by using the training data of the second project because the bytecode of the source code of the second project and the first project has similarity. The annotation translation model obtained can be used for the first project with similar bytecode, and the learning cost of the annotation translation model is reduced.

This invention relates to a method for identifying malicious app families based on multimodal feature fusion, belonging to the field of information security technology. The method preprocesses Android APKs, including unpacking and decompiling, to obtain bytecode files and smali code files. Bytecode image features, opcode sequence features, and control flow graph features are extracted respectively. Bytecode image features are extracted using an EfficientNetV2L convolutional neural network; opcode sequence features are extracted using the k-Shingles and SimHash algorithms; and control flow graph features are extracted using static analysis tools and capsule graph neural networks. The three features are then fused using low-rank multimodal methods, and a CNN-BiLSTM-Attention detection and classification model is constructed to identify and judge malicious app families. This invention improves the accuracy of identification and enhances the model's generalization ability.

The invention belongs to the technical field of vulnerability detection, and particularly relates to a vulnerability detection method and system based on an enhanced graph and comparative learning. A control flow graph in a source code of a to-be-detected program is obtained, and grammar type features of a post-dominating edge, an abnormal flow edge and a function calling edge are introduced, and nodes are fused; expanding the control flow diagram into a program heterogeneous diagram and pruning and optimizing the program heterogeneous diagram; code texts corresponding to nodes in the graph are subjected to deep semantic analysis, refined feature representations of the nodes are generated and serve as initial input features of a graph neural network, and the nodes are made to conduct information interaction and feature updating with neighbor nodes according to different types of relation edges based on relation graph convolution and a relation perception multi-head attention mechanism; generating a final node representation containing local information and a global context; performing joint optimization by constructing a view-level and node-level contrast learning task and a vulnerability detection task; and embedding and aggregating all the optimized nodes into a function-level feature vector with a unified dimension, and completing vulnerability discrimination through a classifier.

The invention discloses a code execution path identification method, system and device in an industrial control special protocol software packaging process and a medium, and the method comprises the steps: constructing industrial control special protocol software and control flow diagrams of all dependency libraries, and taking an upper calling function of a message sending class function as a to-be-analyzed target function; recursively identifying all subfunctions called by the target function to form a calling subset of the target function; analyzing the calling subsets of all the target functions in sequence to obtain a function-level definition dependency relationship; and forming an instrumentation target address set based on the function level definition dependency relationship and the function abstract of the non-system library function, and performing instrumentation tracking on the instrumentation target address set to obtain a code execution path in the industrial control special protocol software packaging process. According to the method, the influence on the operation of the industrial control special protocol software can be obviously reduced on the premise of ensuring the analysis precision, and the automatic identification of the code execution path in the packing process is efficiently completed.

The invention discloses a software defect repairing method and device based on large model analysis and a medium, and relates to the technical field of software development. The method comprises the following steps: generating intermediate representation data comprising an abstract syntax tree, a control flow chart and a dependency graph by obtaining and analyzing a source code; performing multi-dimensional defect detection to generate a defect report; performing cross-context semantic association analysis on the defect by utilizing the pre-training model, positioning a source and generating an enhanced semantic feature; constructing a reinforcement learning environment on the basis, and generating a plurality of candidate restoration schemes under the drive of a scenarized reward function; responding to user selection to execute repair, and performing full-dimension quality evaluation on the repaired software; and finally, carrying out iterative optimization on the detection model, the analysis model and the reward function according to an evaluation result and software operation data to realize closed-loop self-evolution.

The application discloses a kind of digital archives management systems based on block chain, it is related to the technical field of archives management, including, extraction module is used according to the behavior statistical information in digital archives management system, extracts state set;Risk analysis module is used according to normal set in state set, locates text position, predicts semantic layer abnormal risk and permission risk, and constructs control flow diagram, to assess structural layer abnormal risk, risk signal is generated by summarizing;Correlation analysis module is used on the basis of risk analysis module, analyzes the running threat condition of Solidity contract in digital archives management system, judges the start of Solidity contract correction mechanism;Influence module is used to start Solidity contract correction mechanism, analyze the influence of abnormal condition to Solidity contract operation;Waiting setting module is used to set time lock waiting period.

The application discloses a kind of control flow chart-oriented cross-platform binary function representation method and device, the method includes: obtaining the instruction set of binary code and statistics feature;Obtain the feature vector of each instruction feature;Based on the feature vector of the instruction feature and LSTM model, the basic block embedding is carried out to each basic block in each CFG, and the feature vector of each basic block is obtained;Filter invalid node in CFG, and obtain the feature vector set corresponding to the filtered basic block;Function representation is carried out using graph neural network model;In the graph neural network model, each node obtains the information of its corresponding k-order neighbor;The k-order neighbor of a node is the node in the graph neural network model, which is connected with the node with less than or equal to k connection number.The method has strong data understanding ability and cognitive ability, and the data size of k-order subgraph is controlled by random sampling of neighbor nodes, to save the cost.

Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include determining a learned control flow diagram for a process on a computing system and monitoring execution of the process on the computing system using the control flow diagram. An unobserved transition is determined based on the learned control flow diagram and the unobserved transition is classified as safe or unsafe based on a monitoring component analysis. An action is performed based on the safety classification and the learned control flow diagram.

The invention relates to an industrial control system firmware function structure feature and semantic feature extraction method. The method comprises the following steps: preprocessing firmware to obtain a function instruction set and a function control flow diagram; performing instruction splitting and relation extraction based on the function control flow diagram, and constructing a structure association diagram; performing instruction normalization on an instruction sequence in the function instruction set, and generating an instruction flow vector by using a Skip-Gram model; inputting the structure association graph into a sparse graph attention network, and performing structure feature extraction; and inputting the instruction flow vector into a BiLSTM-Attention network, and carrying out semantic feature extraction. The problem that the representation information discrimination degree is insufficient due to the fact that structural information in an instruction is ignored in a current firmware function structural feature extraction method and the problem that the representation information discrimination degree extracted in a long-distance sequence scene in a current firmware function semantic feature representation method is insufficient are solved.

This invention provides a binary function similarity detection method and apparatus, comprising: preprocessing two binary functions to be detected to obtain intermediate language sequences and control flow diagrams for each binary function; extracting semantic features from the intermediate language sequences of each binary function based on a first preset neural network model to obtain semantic feature vector representations for each binary function; and extracting structural features from the control flow diagrams of each binary function based on a second preset neural network model to obtain structural feature vector representations for each binary function; and inputting the semantic feature vector representations and structural feature vector representations of each binary function into a preset multilayer perceptron classifier to obtain the similarity detection results of the two binary functions. The method of this invention effectively solves the shortcomings of existing technologies, such as the susceptibility of grammatical and structural features to interference, and improves the accuracy and robustness of binary function similarity detection.

The invention provides an automatic Android binary anti-obfuscation method and system based on an intelligent agent. The method and system are specially used for recovering logic of an Android binary file (. So) subjected to instruction replacement, false control flow injection and control flow planarization processing. According to the method, efficient automation is realized through a hybrid analysis process: an intelligent agent firstly calls a large language model to perform global scanning, identifies confusion features and generates a hierarchical task list; then, the intelligent agent is preferentially simplified, opaque predicates and false branches are removed, and preliminary purification is completed; thirdly, for the residual complex CFF structure, performing deep analysis, iteratively constructing a real control flow diagram, and removing false scheduling blocks; and finally, logically reconstructing and summarizing the RCFG and the anti-obfuscation code and generating an audit log. The hybrid analysis method effectively solves the illusion problems of symbolic execution path explosion, low efficiency of manual analysis and simple large model analysis, and significantly improves the automation degree and code readability of anti-confusion.