| In many binary security tasks such as investigation and forensics,malware analysis,vulnerability mining,etc.,the source code is inaccessible.Consequently,to verify the logic and comprehend the inner mechanisms of binary files,reverse engineering is indispensable.As we all know,binary code is very difficult for human engineers to understand.Because the compiler irreversibly strips a large amount of information in binary files during the compilation process,such as variable names,comments,function names,etc.All this information could reflect the behavior of the function to a certain extent.If this information could be inferred or recovered,researchers would be able to read the binary code as if it was the source code,and completed relevant security tasks faster.Therefore,inferring the original information of the source code corresponding to the binary code,i.e.binary code information inference,is increasingly becoming a key task in the research of information security.Considering the importance and challenge of binary code information inference,and the outstanding learning ability of deep learning models for other tasks,this dissertation designs and implements a framework for deep learning-based binary code information inference.This dissertation accomplishes information inference from two different perspectives:from an indirect perspective,retrieves the existence of similar functions in the function library and indirectly infers unknown functions by the information of existing similar functions;from a direct perspective,unify multiple types of semantic features into high-level semantic features and implement direct inference of high-level semantic information through the pre-training method of semantic features fusion.The main work and innovation points are briefly described as follows:1)Binary code similarity retrieval:Existing methods mainly face the one-toone comparison scenario,searching slowly in large function libraries is not sufficiently considered.However,the research task of this dissertation requires a large volume and diversity of functions in the codebase.Moreover,most of the existing neural network-based models use Siamese networks to train the model,which is very prone to collapsing similarity scores during training,affecting the accuracy of large-scale retrieval.Therefore,this dissertation designs and implements a largescale similarity retrieval algorithm based on deep hashing and contrastive learning to solve the problems of insufficient similarity retrieval accuracy and low retrieval efficiency.The experimental results show that the accuracy of similarity retrieval task metrics is improved by 9%on average compared with existing methods.In addition,while ensuring accuracy,we reduce the time overhead by an average of 89.15%.2)Binary codes high-level semantic information inferrence:Existing methods for the function name and variable name recovery usually focus on one task,and face the problem of insufficient accuracy.To learn the semantics of binary code more precisely,this dissertation introduces a new feature," code summarization",and combines it with the existing semantic features such as variable names and function names,collectively referred to as high-level semantics.Based on the pre-training fine-tuning paradigm,four types of pre-train tasks-mask prediction,source identifier prediction,bimodal single generation and contrastive learning are simultaneously performed in the model to fully learn the semantics of the pseudo-code.Comparative experiments show that our model outperforms existing approaches in the summarization task with the BLEU score outperforming existing methods by 47%.Meanwhile,our modal outperforms existing methods in other high-level semantic understanding tasks such as variable name recovery and function name recovery by 20%. |
