Library function identification and detection method and system based on convolutional autoencoder

Abstract

The present disclosure proposes a library function identification and detection method and system based on a convolutional autoencoder, including: extracting the instruction sequence corresponding to the binary function from each software to be tested, and then extracting the operation code in the instruction sequence; The continuous sequence of codes is counted to construct a co-occurrence matrix for each function, which is used as input to train the convolutional autoencoder model, and the convolutional autoencoder model is used to extract bottleneck features and complete model training; use training The final model encodes the library functions, and then performs similarity analysis on the library functions, and identifies the library function with the highest similarity coefficient as the final match. It has good versatility, and can directly mark various newly introduced matching objects, and obtain good results.

Description

technical field [0001] The present disclosure belongs to the field of computer technology, and in particular relates to a library function identification and detection method and system based on a convolutional autoencoder. Background technique [0002] The statements in this section merely provide background information related to the present disclosure and do not necessarily constitute prior art. [0003] Binary code analysis, also known as binary analysis, is the practice of analyzing software's raw binary files to extract its internal design and implementation. For code analysts, binary code contains a large amount of information that can be retrieved, such as code (instructions, basic blocks, and functions), structure (control and data flow), and data (global variables and stack variables). Additionally, binary analysis provides a fundamental picture of a program's behavior because computers execute binaries (executables) rather than source code directly. In situation...

AI Technical Summary

Problems solved by technology

However, the library function identification work has particularities: First, because the function call relationship of library functions is very small, the method of relying on CFG for identification has a low accuracy rate

Second, the function similarity analysis may face a large version span, so the internal structure of the function may change greatly, resulting in the failure of the identification method using the graph structure

Third, these methods that rely on function syntax for recognition introduce expert knowledge, which inevitably brings human bias, resulting in poor stability of the results of the method itself

Therefore, for library function identification, these related methods are not suitable for library function matching work

Images