Binary code tracing method for multi-granularity information fusion under software gene perspective

Abstract

The invention belongs to the technical field of network security, and discloses a binary code tracing method for multi-granularity information fusion under a software gene perspective, which comprises the following steps of: 1, extracting a software gene sequence, a software gene and a software gene map of a target program and common information which can be directly extracted from IDA to an sqlite database; 2, carrying out word embedding on the software gene sequence in the sqlite database, and then carrying out bidirectional GRU model training to obtain a feature vector; 3, performing multi-granularity sequence information fusion based on the feature vector obtained after training in the step 2 and information in the sqlite database to obtain a feature vector containing multi-granularity information, and then performing structured learning through graph convolution; 4, mapping the learned hidden layer space feature vector representation to a sample marking space through a full connection layer to serve as a voting value of judgment, and finally obtaining a classification result. The method has high binary code traceability accuracy.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a binary code traceability method for multi-granularity information fusion from the perspective of software genes. Background technique [0002] Binary code traceability refers to identifying the hidden author or team behind the scenes through the characteristics of the author of the binary code, and replacing the error-prone and time-consuming manual reverse engineering tasks by automated means. "Who is behind the malicious code?" A very important issue in today's security community is the traceability of the code. By finding the source of malicious code and correlating it with previously known threats, we can better defend against it and develop techniques to counter possible future dangers. With more and more malicious codes and the number of modified malicious codes increases dramatically. Malware groups and authors are creating numerous malware variant...

AI Technical Summary

Problems solved by technology

[0005] This invention aims at the problem that it is difficult to obtain the source code from the point of view of malicious code, and the existing binary code traceability method causes the loss of binary code semantic information, and proposes a software Binary code traceability method for multi-granularity information fusion from the perspective of genes

Images