基于命名函数和共同向量空间的二进制代码相似性分析
Bing Xia1,2, Jianmin Pang3, Xin Zhou4
1State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou, China. xiabing@zut.edu.cn.
Scientific reports
|September 22, 2023
概括
N_Match通过提取稳定,独立于平台的语义来改进跨平台二进制代码相似性分析. 这提高了漏洞搜索的准确性,在识别不同平台上的类似计算方面超过了现有模型.
科学领域:
- 计算机科学 计算机科学
- 软件工程 软件工程 软件工程
- 网络安全 网络安全
背景情况:
- 二进制代码相似性分析对于当源代码无法使用时的漏洞搜索至关重要.
- 现有的跨平台方法在指令语法差异和调整控制流程图方面扎.
- 高级,稳定的语义在强大的跨平台二进制函数比较中未被充分探索.
研究的目的:
- 提出一个新的跨平台二进制函数相似性比较模型,N_Match.
- 解决现有方法在处理特定平台的指令变化和语义对齐方面的局限性.
- 为了提高在不同平台和优化级别的二进制函数中识别类似计算的准确性.
主要方法:
- 开发了N_Match,该模型将多种平台指令映射到统一的语义空间中.
- 利用图形嵌入来学习稳定的邻居语义,并将命名函数知识纳入高级语义.
- 结合稳定的图形结构与独立于平台的API知识,用于最终函数的语义表示.
主要成果:
- 在跨平台,跨优化和工业场景中,N_Match表现出比基线模型更高的准确性.
- 漏洞搜索实验显示,使用N_Match的hit@N显著改善.
- 通过N_Match实现的平均平均精度 (mAP) 超过了当前图形嵌入模型的66%.
结论:
- 提取稳定,独立于平台的语义是提高二进制代码相似性分析准确性的关键.
- 通过统一指令语义和利用高级知识,N_Match有效地克服跨平台的挑战.
- 拟议的模型为漏洞搜索和二进制分析提供了重大进展.
相关概念视频
Vector Algebra: Method of Components
14.0K
It is cumbersome to find the magnitudes of vectors using the parallelogram rule or using the graphical method to perform mathematical operations like addition, subtraction, and multiplication. There are two ways to circumvent this algebraic complexity. One way is to draw the vectors to scale, as in navigation, and read approximate vector lengths and angles (directions) from the graphs. The other way is to use the method of components.
In many applications, the magnitudes and directions of...
In many applications, the magnitudes and directions of...
14.0K
Cartesian Vector Notation
793
Cartesian vector notation is a valuable tool in mechanical engineering for representing vectors in three-dimensional space, performing vector operations such as determining the gradient, divergence, and curl, and expressing physical quantities such as the displacement, velocity, acceleration, and force. By using Cartesian vector notation, engineers can more easily analyze and solve problems in various areas of mechanical engineering, including dynamics, kinematics, and fluid mechanics. This...
793
Vector Operations
1.3K
Vectors are physical quantities that have both magnitude and direction. The vector operations include addition, subtraction, and scalar multiplication.
A vector multiplied by a scalar value is called scalar multiplication. The result obtained is a new vector with a different magnitude. If the scalar is positive, the direction of the vector remains the same, but if it is negative, the direction of the vector is reversed. For example, the product of the mass and velocity yields the momentum.
A vector multiplied by a scalar value is called scalar multiplication. The result obtained is a new vector with a different magnitude. If the scalar is positive, the direction of the vector remains the same, but if it is negative, the direction of the vector is reversed. For example, the product of the mass and velocity yields the momentum.
1.3K
Vector Representation of Complex Numbers
141
Complex numbers, represented in Cartesian coordinates, can also be visualized as vectors. These vectors can be expressed in polar form, emphasizing their magnitude and angle. When a complex number is input into a function, the output is another complex number, highlighting the function's zero point from which the vector representation can originate.
Consider a function defined as the product of the complex factors in the numerator divided by the product of the complex factors in the...
Consider a function defined as the product of the complex factors in the numerator divided by the product of the complex factors in the...
141
Sign Test for Matched Pairs
155
The sign test for matched pairs offers a robust method for comparing two paired samples, often for the effects of an intervention in one of them. This method is very useful in situations where the underlying distribution of the data is unknown. The test compares two related samples—often pre- and post-treatment measurements on the same subjects—to determine if there are significant differences in their median values.
To conduct the sign test, we first calculate the differences in...
To conduct the sign test, we first calculate the differences in...
155
Vector Algebra: Graphical Method
12.2K
Vectors can be multiplied by scalars, added to other vectors, or subtracted from other vectors. The vector sum of two (or more) vectors is called the resultant vector or, for short, the resultant.
We use the laws of geometry to construct resultant vectors, followed by trigonometry to find vector magnitudes and directions. For a geometric construction of the sum of two vectors in a plane, we follow the parallelogram rule. Suppose two vectors are at arbitrary positions. Translate either one of...
We use the laws of geometry to construct resultant vectors, followed by trigonometry to find vector magnitudes and directions. For a geometric construction of the sum of two vectors in a plane, we follow the parallelogram rule. Suppose two vectors are at arbitrary positions. Translate either one of...
12.2K


