融合语义与属性特征的跨架构漏洞检测

doi:10.3778/j.issn.1673-9418.2404080

摘要/Abstract

摘要： 二进制漏洞检测在程序安全领域有着重要的作用，为应对大规模的漏洞检测任务，越来越多的神经网络技术被应用到跨架构漏洞检测中，这些技术显著提高了漏洞检测的准确率，但是现有方法仍然面临提取到的信息单一、不能进行跨架构漏洞检测等问题。提出了一种融合语义与属性特征的跨架构漏洞检测方法。使用二进制函数的汇编代码和属性控制流图作为输入，提取基本块中所有汇编代码的语义信息，将基本块级的语义信息与属性特征信息进行特征融合，生成139维的基本块级向量表示，以此来更全面地表示函数的语义和属性信息。使用基于卷积神经网络的孪生网络模型生成函数级的嵌入向量，以此来提取不同基本块中不同空间层次结构的特征并减少神经网络的参数量，通过计算函数级嵌入向量的距离来判断待检测的两个二进制函数是否相似。在进行跨架构漏洞检测时，只需要输入二进制文件中的函数和已知漏洞函数的汇编代码和属性控制流图即可完成漏洞检测。实验结果表明，该方法检测的准确率为95.64%，AUC（area under curve）值为0.996 9，与现有方法相比，准确率可以提升0.26~7.04个百分点，AUC可以提升0.11~1.59个百分点，在真实环境的漏洞检测中表现优异。

关键词: 漏洞检测, 神经网络, 跨架构, 特征融合, 函数级

Abstract: Binary vulnerability detection plays an important role in the field of program security. In order to cope with large-scale vulnerability detection tasks, more and more neural network technologies have been applied to cross-architecture vulnerability detection, which significantly improves the accuracy of vulnerability detection, however, existing methods still face problems such as single extracted information and inability to perform cross-architecture vulnerability detection. A cross-architecture vulnerability detection method combining semantic and attribute feature is proposed. The assembly code and attribute control flow diagram of binary function are used as input to extract the semantic information of all assembly code in basic block, and the basic block-level semantic information and attribute feature information are fused to generate a 139-dimensional basic block-level vector representation, in order to represent the semantic and attribute information of the function more comprehensively. The twin network model based on convolutional neural network is used to generate function-level embedding vectors, in order to extract the features of different spatial hierarchies in different basic blocks and reduce the number of parameters in the neural network. Moreover, the distance of the function-level embedding vectors is calculated to determine whether the two binary functions to be detected are similar. Finally, when cross-architecture vulnerability detection is carried out, it is only necessary to input the assembly code and attribute control flow diagram of functions and known vulnerability functions in binary files to complete vulnerability detection. Experimental results show that the detection accuracy of this method is 95.64%, and the value of AUC (area under curve) is 0.9969. Compared with the existing methods, the accuracy can be increased by 0.26 to 7.04 percentage points, and the AUC can be increased by 0.11 to 1.59 percentage points, which has excellent performance in the real environment vulnerability detection.

Key words: vulnerability detection, neural network, cross-architecture, feature fusion, function-level

李坤, 李斌, 朱文静, 周清雷. 融合语义与属性特征的跨架构漏洞检测[J]. 计算机科学与探索, 2025, 19(3): 787-801.

LI Kun, LI Bin, ZHU Wenjing, ZHOU Qinglei. Cross-Architecture Vulnerability Detection Combining Semantic and Attribute Feature[J]. Journal of Frontiers of Computer Science and Technology, 2025, 19(3): 787-801.

参考文献

[1] 詹奇, 潘圣益, 胡星, 等. 开源软件漏洞感知技术综述[J]. 软件学报, 2024, 35(1): 19-37.
ZHAN Q, PAN S Y, HU X, et al. Survey on vulnerability awareness of open source software[J]. Journal of Software, 2024, 35(1): 19-37.
[2] 李韵, 黄辰林, 王中锋, 等. 基于机器学习的软件漏洞挖掘方法综述[J]. 软件学报, 2020, 31(7): 2040-2061.
LI Y, HUANG C L, WANG Z F, et al. Survey of software vulnerability mining methods based on machine learning[J]. Journal of Software, 2020, 31(7): 2040-2061.
[3] DUAN Y, LI X, WANG J H, et al. DeepBinDiff: learning program-wide code representations for binary diffing[C]//Proceedings of the 2020 Network and Distributed System Security Symposium, 2020: 1-9.
[4] FENG Q, WANG M H, ZHANG M, et al. Extracting conditional formulas for cross-platform bug search[C]//Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security. New York: ACM, 2017: 346-359.
[5] 方磊, 魏强, 武泽慧, 等. 基于神经网络的二进制函数相似性检测技术[J]. 计算机科学, 2021, 48(10): 286-293.
FANG L, WEI Q, WU Z H, et al. Neural network-based binary function similarity detection[J]. Computer Science, 2021, 48(10): 286-293.
[6] KIM G, HONG S, FRANZ M, et al. Improving cross-platform binary analysis using representation learning via graph alignment[C]//Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis. New York: ACM, 2022: 151-163.
[7] LI X, QU Y, YIN H, et al. PalmTree: learning an assembly language model for instruction embedding[C]//Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. New York: ACM, 2021: 3236-3251.
[8] COLLYER J, WATSON T, PHILLIPS I. FASER: binary code similarity search through the use of intermediate representations[C]//Proceedings of the 2023 Conference on Applied Machine Learning in Information Security, 2023: 193-202.
[9] WANG H, GAO Z Y, ZHANG C, et al. CLAP: learning transferable binary code representations with natural language supervision[C]//Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis. New York: ACM, 2024: 503-515.
[10] KHURANA D, KOLI A, KHATTER K, et al. Natural language processing: state of the art, current trends and challenges[J]. Multimedia Tools and Applications, 2023, 82(3): 3713-3744.
[11] PEI K X, XUAN Z, YANG J F, et al. TREX: learning execution semantics from micro-traces for binary similarity[EB/OL]. [2024-03-06]. https://arxiv.org/abs/2012.08680.
[12] LUO Z H, WANG P F, WANG B S, et al. VulHawk: cross-architecture vulnerability detection with entropy-based binary code search[C]//Proceedings of the 2023 Network and Distributed System Security Symposium, 2023: 1-18.
[13] CONG S, ZHOU Y. A review of convolutional neural network architectures and their optimizations[J]. Artificial Intelligence Review, 2023, 56(3): 1905-1969.
[14] CHICCO D. Siamese neural networks: an overview[J]. Methods in Molecular Biology, 2021, 2190: 73-94.
[15] XU X J, LIU C, FENG Q, et al. Neural network-based graph embedding for cross-platform binary code similarity detection[C]//Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. New York: ACM, 2017: 363-376.
[16] YANG S G, CHENG L, ZENG Y C, et al. Asteria: deep learning-based AST-encoding for cross-platform binary code similarity detection[C]//Proceedings of the 2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks. Piscataway: IEEE, 2021: 224-236.
[17] WANG H J, MA P C, YUAN Y Y, et al. Enhancing DNN-based binary code function search with low-cost equivalence checking[J]. IEEE Transactions on Software Engineering, 2022, 49(1): 226-250.
[18] WANG H, QU W J, KATZ G, et al. jTrans: jump-aware transformer for binary code similarity detection[C]//Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis. New York: ACM, 2022: 1-13.
[19] DAI H J, DAI B, SONG L, et al. Discriminative embeddings of latent variable models for structured data[C]//Proceedings of the 33rd International Conference on Machine Learning. New York: ACM, 2016: 2702-2711.
[20] LUO Z H, WANG B S, TANG Y, et al. Semantic-based representation binary clone detection for cross-architectures in the Internet of things[J]. Applied Sciences, 2019, 9(16): 3283-3304.
[21] VENKATAKEERTHY S, BANERJEE S, DEY S, et al. VEXIR2Vec: an architecture-neutral embedding framework for binary similarity[EB/OL]. [2024-03-06]. https://arxiv.org/abs/2312.00507.
[22] LIU Y H, OTT M, GOYAL N, et al. RoBERTa: a robustly optimized BERT pretraining approach[EB/OL]. [2024-03-06]. https://arxiv.org/abs/1907.11692.
[23] MASSARELLI L, DI LUNA G A, PETRONI F, et al. SAFE: self-attentive function embeddings for binary similarity[C]//Proceedings of the 16th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment. Cham: Springer, 2019: 309-329.
[24] KENTON J D M W C, TOUTANOVA L K. BERT: pre-training of deep bidirectional transformers for language understanding[C]//Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies. Stroudsburg: ACL, 2019: 4171-4186.
[25] GROHE M, GROHE M. word2vec, node2vec, graph2vec, X2vec: towards a theory of vector embeddings of structured data[C]//Proceedings of the 39th ACM SIGMOD-SIGACT-SIGAI Symposium on Principles of Database Systems. New York: ACM, 2020: 1-16.
[26] DEY R, SALEM F M. Gate-variants of gated recurrent unit (GRU) neural networks[C]//Proceedings of the 2017 IEEE 60th International Midwest Symposium on Circuits and Systems. Piscataway: IEEE, 2017: 1597-1600.
[27] HOCHREITER S, SCHMIDHUBER J. Long short-term memory[J]. Neural Computation, 1997, 9(8): 1735-1780.
[28] YANG S D, YU X Y, ZHOU Y. LSTM and GRU neural network performance comparison study: taking Yelp review dataset as an example[C]//Proceedings of the 2020 International Workshop on Electronic Communication and Artificial Intelligence. Piscataway: IEEE, 2020: 98-101.
[29] KIM D, KIM E, CHA S K, et al. Revisiting binary code similarity analysis using interpretable feature engineering and lessons learned[J]. IEEE Transactions on Software Engineering, 2023, 49(4): 1661-1682.
[30] JIANG S, FU C, QIAN Y K, et al. IFAttn: binary code similarity analysis based on interpretable features with attention[J]. Computers & Security, 2022, 120: 102804.
[31] HAN K, WANG Y H, CHEN H T, et al. A survey on vision transformer[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2023, 45(1): 87-110.

编辑推荐 0

Metrics

阅读次数

全文

HTML			PDF

最新录用	在线预览	正式出版	最新录用	在线预览	正式出版
0	0	0	13	0	17

	来源	本网站

	次数	30
	比例	100%

摘要

最新录用	在线预览	正式出版

15	0	15

	来源	本网站

	次数	30
	比例	100%