GBsim:用于跨架构二进制代码相似性分析的强大的GCN-BERT方法
Jiang Du1, Qiang Wei1, Yisen Wang1
1School of Cyber Science and Engineering, Information Engineering University, Zhengzhou 450001, China.
Entropy (Basel, Switzerland)
|April 26, 2025
概括
GBsim通过结合图形神经网络和自然语言处理来增强二进制代码相似性检测. 这种方法可以提高不同架构的漏洞识别准确度,即使有噪音数据.
科学领域:
- 计算机科学 计算机科学
- 人工智能的人工智能
- 网络安全 网络安全
背景情况:
- 图形神经网络 (GNN) 在结构模式学习方面表现出色,但在二进制代码分析中与杂的图形构造和交叉架构变化作斗争.
- 现有的GNN在信号噪声比较低的环境和跨域设置中会显著退化,影响诸如漏洞识别等关键安全任务.
研究的目的:
- 开发一种强大的二进制代码相似性检测和漏洞识别方法,克服噪音和跨架构分布转移.
- 通过整合自然语言处理技术,提高GNN在关键任务安全应用中的性能.
主要方法:
- 提出了GBsim,这是一个结合GNN和NLP的新方法.
- 利用跨架构语言模型将二进制函数转换为语义图.
- 采用多层GCN用于结构特征提取和变压器层用于语义信息集成.
主要成果:
- 在一个大规模的跨架构数据集上,GBsim实现了0.901的平均互惠等级 (MRR) 和0.831的Remember@1,超过了最先进的方法.
- 在真实世界的漏洞检测中,GBsim在1天的漏洞数据集上显示了81.3%的平均召回率,比现有的方法高出2.1%.
结论:
- GBsim产生了强大的跨架构嵌入,尽管有重大分布转移和杂的图形数据,但仍然保持了高性能.
- 该方法有效地保护跨架构边界的信息,增强实用的安全敏感漏洞识别任务的模型稳定性.
相关概念视频
Comparing Copy Number Variations and SNPs
16.7K
Sequencing of the human genome has opened up several best-kept secrets of the genome. Scientists have identified thousands of genome variations that exist within a population. These variations can be a single nucleotide or a larger chromosomal variation.
Copy number variations or CNVs are the structural variations that cover more than 1kb of DNA sequence. The single nucleotide polymorphism (SNP), on the other hand, is a single nucleotide change or a point mutation that is found in more than 1%...
Copy number variations or CNVs are the structural variations that cover more than 1kb of DNA sequence. The single nucleotide polymorphism (SNP), on the other hand, is a single nucleotide change or a point mutation that is found in more than 1%...
16.7K
Multiple Comparison Tests
3.8K
Multiple comparison test, abbreviated as MCT, is a post hoc analysis generally performed after comparing multiple samples with one or more tests. An MCT will help identify a significantly different sample among multiple samples or a factor among multiple factors.
It would be easy to compare two samples using a significance alpha level of 0.05. In other words, there is only one sample pair to be compared. However, it would be difficult to identify a significantly different sample if the number...
It would be easy to compare two samples using a significance alpha level of 0.05. In other words, there is only one sample pair to be compared. However, it would be difficult to identify a significantly different sample if the number...
3.8K
Evolutionary Relationships through Genome Comparisons
5.6K
Genome comparison is one of the excellent ways to interpret the evolutionary relationships between organisms. The basic principle of genome comparison is that if two species share a common feature, it is likely encoded by the DNA sequence conserved between both species. The advent of genome sequencing technologies in the late 20th century enabled scientists to understand the concept of conservation of domains between species and helped them to deduce evolutionary relationships across diverse...
5.6K
Improving Translational Accuracy
8.5K
Base complementarity between the three base pairs of mRNA codon and the tRNA anticodon is not a failsafe mechanism. Inaccuracies can range from a single mismatch to no correct base pairing at all. The free energy difference between the correct and nearly correct base pairs can be as small as 3 kcal/ mol. With complementarity being the only proofreading step, the estimated error frequency would be one wrong amino acid in every 100 amino acids incorporated. However, error frequencies observed in...
8.5K
Genome-wide Association Studies-GWAS
12.1K
Genome-wide association studies or GWAS are used to identify whether common SNPs are associated with certain diseases. Suppose specific SNPs are more frequently observed in individuals with a particular disease than those without the disease. In that case, those SNPs are said to be associated with the disease. Chi-square analysis is performed to check the probability of the allele likely to be associated with the disease.
GWAS does not require the identification of the target gene involved in...
GWAS does not require the identification of the target gene involved in...
12.1K
Sign Test for Matched Pairs
71
The sign test for matched pairs offers a robust method for comparing two paired samples, often for the effects of an intervention in one of them. This method is very useful in situations where the underlying distribution of the data is unknown. The test compares two related samples—often pre- and post-treatment measurements on the same subjects—to determine if there are significant differences in their median values.
To conduct the sign test, we first calculate the differences in...
To conduct the sign test, we first calculate the differences in...
71


