Similar vulnerability detection method and device for binary program

Abstract

The invention discloses a similar vulnerability detection method and device for a binary program, and the method comprises the steps: carrying out the coarse-grained similar vulnerability function screening and the fine-grained similar vulnerability function recognition of each to-be-detected function in a to-be-detected binary file according to a known vulnerability function, a corresponding binary file and a known vulnerability point; and a similar vulnerability function similar to the known vulnerability is acquired. By introducing known vulnerability points and combining information of functions and vulnerabilities, coarse-grained screening can be carried out on a to-be-detected function set through the lightweight feature distance, the extraction of the lightweight features does not depend on a specific instruction set, meanwhile, the features are less affected by compiling options and code customization reuse. And the execution semantics of the binary codes can be accurately captured, so that the detection efficiency and accuracy are effectively improved.

Description

technical field [0001] The invention relates to the field of binary program loophole mining and binary code similarity detection, in particular to a similar loophole detection method and device for binary programs, belonging to the technical field of computer program detection. Background technique [0002] With the vigorous development of the global Internet market and Internet technology, computer software has been gradually applied to all aspects of people's daily life, while supporting the normal operation of society. While the quantity of these computer softwares is growing rapidly, security problems are also becoming more and more serious. For computer software, in order to facilitate development, developers usually use code reuse to develop software. That is, developers use the same or similar source code on different series of products or devices. While computer software provides functions, it is also likely to have several vulnerabilities, such as buffer overflow ...

AI Technical Summary

Problems solved by technology

[0007] The present invention aims at the problems of low accuracy and insufficient scale capability existing in the existing similar loophole detection methods, and provides a similar loophole detection method and device for binary programs. Compilation options and binary programs in the case of code customization and reuse can improve the accuracy of detection, and at the same time, when the data scale is large, it can improve the efficiency of detection and solve the above-mentioned limitations and deficiencies of existing similar vulnerability detection methods

Images