KR102608014B1 - Device and method for predicting stripped binary function symbols - Google Patents

Abstract

The present invention relates to a script binary function symbol prediction method and device. A function symbol prediction method according to an embodiment of the present invention includes the steps of extracting a function call and a function call argument from a first source code for a target function to obtain a first code fragment; Obtaining a second code fragment by extracting a function call and a function call argument from a second source code that is more updated than the first source code; Converting the first code fragment and the second code fragment into a first sentence and a second sentence, respectively; Obtaining a first vector and a second vector, respectively, using a word embedding model based on the first sentence and the second sentence; learning a neural network by sequentially inputting the first vector and the second vector; Obtaining a third code fragment from a stripped binary; converting the third code fragment into a third sentence; Obtaining a third vector using the word embedding model based on the third sentence; And inputting the third vector into the learned neural network and obtaining the output result as a function symbol corresponding to the third code fragment; may include.

Description

Script binary function symbol prediction method and device {DEVICE AND METHOD FOR PREDICTING STRIPPED BINARY FUNCTION SYMBOLS}

The present invention relates to a stripped binary function symbol prediction method and device. More specifically, it relates to a method and device for predicting function symbols in a script binary file from which function symbol information has been deleted through neural network learning.

Functions are one of the most common structures in programming languages. Although function definitions and declarations are explicit in the source code, much information is lost in the binary during compilation. However, many binary analysis techniques require function information.

Since it is necessary to check which functions are used in vulnerability detection, function symbol prediction technology is greatly needed. For example, the use-after-free vulnerability is a vulnerability caused by incorrect memory access by reusing a released function pointer, and it is very important to detect the malloc() function that allocates memory space and the free() function that frees it. If such an important function name cannot be detected, vulnerability detection cannot be performed.

And in the decompilation field, it is also necessary to predict function symbols in script binaries. Since decompilation requires converting the compiled binary code back into a high-level code that humans can understand, it is necessary to be able to predict the removed symbols to know which function was called in the code, and the decompilation accuracy can be considered high.

It is also widely needed in the field of malware and malicious code detection. Most malicious codes are no different from regular programs. When you just look at it, it looks like normal program code. In reality, malicious code is very small and hidden in normal code. Then, we remove the symbol of the function so that it cannot be detected. When analyzing a binary, if the function symbol is predicted, you can know which function was used and it will be very helpful in detecting malicious behavior.

DEBIN is the most widely used related technology. A big problem with function symbol prediction is that there is no information available to predict symbols in the binary. DEBIN collected a large number of binaries with symbols and learned them structurally or semantically. The key technology used here is the creation of a data dependency graph, a technology that can express the context of the variables used in each function.

When DEBIN receives binary input when performing decompilation, it analyzes the data dependency of the function and predicts the variable or function call of the function by mapping if there is a similar dependency graph in the learned source code. That is, first, the data dependence graph of a function with a symbol is compared and mapped to the data dependence graph of a function without a symbol. After mapping, the variable and function call information inside the function is recovered.

However, the accuracy of conventional methods including DEBIN was not high, with an average of 62.6%. The reason is that the core content of the existing method is that learning the function structurally or semantically in the binary learns the context of the function call instruction. In other words, it learns what commands are above and below the function call command and the structure of how the values are passed to the variables, and when a specific command combination is identified through this, it is predicted as a specific function.

With this method, only patterns that exist in the reference function data can be identified, and there is a problem of not being able to identify if the used factors or parameters change in the middle, so a method to overcome this problem is required.

Korean Patent No. 10-1228899

The technical problem to be solved by the present invention is to provide a method and device for predicting script binary function symbols.

The technical problem to be solved by the present invention is to provide a method and device for predicting script binary function symbols based on function matching through neural network learning.

The technical problems of the present invention are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the description below.

A function symbol prediction method according to an embodiment of the present invention for achieving the above technical problem includes the steps of extracting a function call and a function call argument from a first source code for a target function to obtain a first code fragment; Obtaining a second code fragment by extracting a function call and a function call argument from a second source code that is more updated than the first source code; Converting the first code fragment and the second code fragment into a first sentence and a second sentence, respectively; Obtaining a first vector and a second vector, respectively, using a word embedding model based on the first sentence and the second sentence; learning a neural network by sequentially inputting the first vector and the second vector; Obtaining a third code fragment from a stripped binary; converting the third code fragment into a third sentence; Obtaining a third vector using the word embedding model based on the third sentence; And inputting the third vector into the learned neural network and obtaining the output result as a function symbol corresponding to the third code fragment; may include.

According to the present invention as described above, the function content is made into a sentence based on a binary with source code or symbols, vectorized, and then trained a neural network based on the vector, thereby converting the function symbol of the script binary based on the conventional function pattern. There is an effect of improving accuracy compared to predicting.

1 is an example of decompilation of a script binary function according to an embodiment of the present invention.
Figure 2 is a configuration diagram of a function symbol prediction device according to an embodiment of the present invention.
Figure 3 is an example showing the process of extracting the first code fragment and the first sentence from the first source code according to an embodiment of the present invention.
Figure 4 is an example showing the process of extracting a second code fragment and a second sentence from a second source code according to an embodiment of the present invention.
Figure 5 is an algorithm model of Word2Vec among word embeddings, according to an embodiment of the present invention.
Figure 6 is an algorithm model of GRU (Gated Recurrent Unit), a type of neural network, according to an embodiment of the present invention.
Figure 7 is an example to explain function symbol prediction using a decompiled function of a script binary, according to an embodiment of the present invention.
Figure 8 is a flowchart of a function symbol prediction method according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the attached drawings. The advantages and features of the present invention and methods for achieving them will become clear by referring to the embodiments described in detail below along with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below and may be implemented in various different forms. The present embodiments are merely intended to ensure that the disclosure of the present invention is complete and to provide common knowledge in the technical field to which the present invention pertains. It is provided to fully inform those who have the scope of the invention, and the present invention is only defined by the scope of the claims. Like reference numerals refer to like elements throughout the specification.

Unless otherwise defined, all terms (including technical and scientific terms) used in this specification may be used with meanings that can be commonly understood by those skilled in the art to which the present invention pertains. Additionally, terms defined in commonly used dictionaries are not interpreted ideally or excessively unless clearly specifically defined.

1 is an example of decompilation of a script binary function according to an embodiment of the present invention.

Referring to FIG. 1, the source code 10 decompiled from the binary containing function symbol information includes function symbols.

For convenience of explanation, in the following description, function names and function symbols are used with the same meaning.

Source code can be written in a programming language such as C, java, C++, or C#, and the source code used in the following description is pseudocode and is not limited to any one language. .

Generally, when converting source code into binary, a compiler includes information about function symbols in the binary for use in debugging, etc. However, in order to reduce the size of the binary or prevent decompilation, it may be compiled by removing information about function symbols. Alternatively, malicious codes may remove function symbol information to hide their own information.

A binary from which information about function symbols has been removed is called a stripped binary.

Referring to FIG. 1, it can be seen that the source code 20 decompiled from the script binary has no information about function symbols, so the function name is arbitrarily determined, such as “sub_80534BA.”

Figure 2 is a configuration diagram of a function symbol prediction device according to an embodiment of the present invention.

Referring to FIG. 2, the function symbol prediction device 100 includes a source code database 200, a code fragment acquisition unit 300, an embedding processing unit 400, a neural network processing unit 500, and a function symbol acquisition unit 600. can do.

The source code database 200 may store source code including function symbols. The source code may have multiple update versions for one function.

According to another embodiment of the present invention, the source code database 200 may store binaries containing function symbols. Since the binary containing the function symbol can be simply generated as source code through decompilation, and the generated source code can be used as in an embodiment of the present invention, a detailed description is provided to avoid duplication of explanation. Omit it.

The code fragment acquisition unit 300 may acquire a sample code fragment based on the source code stored in the source code database 200.

The sample code fragment can be generated by extracting only the function call and function call arguments from the code of the target function included in the source code.

The embedding processing unit 400 may generate a vector based on the sample code fragment generated by the code fragment acquisition unit 300.

The embedding processing unit 400 can transform the sample code fragment into one sample sentence and input the sentence into a word embedding model to learn the word embedding model.

The embedding processing unit 400 may input each word of the sample sentence into the word embedding model and train the word embedding model to have a vector value whose distance is inversely proportional to the relationship between each word.

The embedding processing unit 400 may obtain an embedding matrix as a vector related to the sample code fragment from the learned word embedding model.

The word embedding model can convert sentences consisting of one or more words into vector values. The word embedding model may be any one of word2vec, GloVe, and FastText. Since the word embedding model is a technology widely known to those skilled in the art to which the present invention pertains, a detailed description thereof will be omitted.

The neural network processing unit 500 may input the vector obtained from the embedding processing unit 400 into a neural network and train the neural network to output a symbol of the target function.

The neural network processing unit 500 can strengthen and learn a neural network based on sequential input. A plurality of updated versions of one target function are stored in the source code database 200, and the updated versions are sequentially vectorized and input to the neural network, thereby enabling reinforcement learning of the neural network. .

The neural network may be any one of RNN (Recurrent Neural Network), LSTM (Long Short Term Memory), and LSTM (Long Short Term Memory). Since the neural network is a technology widely known to those skilled in the art to which the present invention pertains, a detailed description will be omitted.

The function symbol acquisition unit 600 may obtain the third source code by decompiling the script binary. The function symbol acquisition unit 600 acquires a third code fragment from the third source code, generates a third sentence based on this, and obtains a third vector using the third sentence and the word embedding model. , the function symbol can be obtained by inputting the third vector into the neural network.

The function symbol acquisition unit 600 acquires the third code fragment using the same method as the code fragment acquisition unit 300 obtains the code fragment, and the third vector is acquired by the embedding processing unit 400. Use the same method as obtaining the vector from

Figure 3 is an example showing the process of extracting the first code fragment and the first sentence from the first source code according to an embodiment of the present invention.

Referring to FIG. 3, the first source code 210 includes symbol information of the target function. For example, in the example shown in FIG. 3, the symbol of the target function is “test_func”.

The code fragment acquisition unit 300 may obtain the first code fragment 212 by extracting only the function call and function call arguments from the target function code of the first source code 210.

The embedding processing unit 400 may regard each function call and function call argument included in the first code fragment 212 as one word, and connect the words to create one sentence. The generated sentence may be the first sentence 214.

Figure 4 is an example showing the process of extracting a second code fragment and a second sentence from a second source code according to an embodiment of the present invention.

Referring to FIG. 4, the second source code 220 includes symbol information of the target function. For example, in the example shown in FIG. 4, the symbol of the target function is “test_func”.

The second source code 220 may be an updated version of the first source code 210. The second source code 220 may be a source code written temporally later than the first source code 210.

The second source code 220 may include similar function calls and function call arguments as the first source code 210, and the calling order of the function calls may also be similar.

The code fragment acquisition unit 300 may obtain the second code fragment 222 by extracting only the function call and function call arguments from the target function code of the second source code 220.

The embedding processing unit 400 may regard each function call and function call argument included in the second code fragment 222 as one word, and connect the words to create one sentence. The generated sentence may be the second sentence 224.

Figure 5 is an algorithm model of Word2Vec among word embeddings, according to an embodiment of the present invention.

With reference to FIG. 5, word embedding used in one embodiment of the present invention will be described.

Expressing text words into numbers for artificial intelligence processing is called encoding. The simplest encoding is called one-hot encoding or one-hot vector. Hereinafter, for convenience of explanation, it is referred to as a one-hot vector.

A one-hot vector expresses a word as a vector with dimensions equal to the number of dictionaries. For example, the sentence “king man queen woman” consists of six words. If each word is expressed as a one-hot vector, “king” is (1,0,0,0) and “man” is (0). ,1,0,0), “queen” can be expressed as (0,0,1,0), and “woman” can be expressed as (0,0,0,1).

One-hot vectors have the disadvantage of not being able to express relationships between words because the distances between words are all the same. To overcome this, expressing words as N-dimensional vectors with characteristics is called word embedding.

For example, if each word of “king man queen woman” is expressed as a two-dimensional vector of gender and status through word embedding, “king” is (1,2), “man” is (1,3), “ “queen” can be expressed as (5,1), and “woman” can be expressed as (5,3). The above word embedding result is an example and may vary depending on the implementation method. An embedding matrix is an embedding matrix that represents the vector of each word as a single matrix.

Word2Vec is a word embedding method that turns words into N-dimensional embedding vectors with features. Because Word2Vec considers preceding and following words during the embedding process, words that are frequently used adjacently have vector values of close distances. Word2Vec can be implemented using CBOW or Skip-Gram models.

CBOW is a model that predicts what the standard word will be by looking at the context word, and Skip-Gram is a model that looks at the standard word and predicts which context word will appear.

Since Word2Vec can be easily implemented by a person skilled in the art through public technologies such as Tensorflow and Python, a detailed description will be omitted.

Referring to Figure 5, Word2Vec converts each word in a sentence into a one-hot vector, and creates an embedding matrix so that when entered as an input, the base word (CBOW model) or surrounding words (Skip-Gram model) are output. You go through a learning process to modify W. The value of the embedding matrix W generated through this learning process becomes the result of word embedding.

The present invention can use Word2Vec as a word embedding model. Among the elements that make up a function, code fragments that include only function calls and function call arguments, excluding variable declarations and operations, can be embedded through Word2Vec. Because the order of function calls included in code fragments for the same function or similar functions is similar, each function call can be embedded into a vector with a short distance through word embedding.

Referring to Figures 3 and 4, the code fragments for each version of test_func() are “void test_func() malloc(100) malloc(50) memcpy(b, a, sizeof(a))”, “void test_func () malloc(100) malloc(50) memcpy(b, a, sizeof(a)) memcpy(a, b, sizeof(b))”. If you embed this into Word2Vec, “test_func()” is adjacent to the words “malloc(100)”, “malloc(50)”, and “memcpy(b, a, sizof(a))”, so it is close to the words above. It can be embedded as a vector of distances.

According to an embodiment of the present invention, through the learned word vectors of “malloc(100)”, “malloc(50)”, and “memcpy(b, a, sizof(a))”, The function symbol “test_func()” can be predicted.

Figure 6 is an algorithm model of RNN (Recurrent Neural Network), a type of neural network, according to an embodiment of the present invention.

Referring to FIG. 6, RNN is a recurrent neural network, and the connection between units constituting the artificial neural network constitutes a recurrent structure. RNN propagates the information generated in the process of processing output ht-1 for input Xt-1 to the next unit.

For example, by entering each word of the sentence “I Love You” sequentially, the sentence can ultimately be classified as a “good feeling.”

A neural network according to an embodiment of the present invention may include an RNN, a Long Short Term Memory (LSTM), and a Gated Recurrent Unit (GRU). LSTM and GRU are both neural network models based on RNN and improved upon RNN. LSTM and GRU are neural network models that solve the long-term dependency problem of RNN, and GRU has a simpler structure and faster operation by reducing the number of input stages than LSTM.

According to one embodiment of the present invention, a vector that is the output of a word embedding model can be input to the GRU, and the GRU neural network can be trained to output a function symbol.

For example, the vector of each word included in the first sentence “void test_func() malloc(100) malloc(50) memcpy(b, a, sizeof(a))” illustrated in Figure 3 is sequentially processed by the GRU model. , and the GRU model can be trained so that the final output value is “test_func()”.

According to one embodiment of the present invention, the GRU can be trained by inputting the embedding matrix of the word embedding learned in the embedding processing unit 400 into the GRU. Each row of the embedding matrix is a vector of each word, and the vectors can be sequentially input into the GRU.

Since designing and learning a GRU model is a skill well known to those skilled in the art to which the present invention pertains, a detailed description will be omitted.

Figure 7 is an example to explain function symbol prediction using a decompiled function of a script binary, according to an embodiment of the present invention.

The function symbol acquisition unit 600 may obtain the third source code 230 by decompiling the script binary.

Since the third source code 230 is a decompiled result with the function information deleted, the function symbol is arbitrarily set to “sub_8030BA()”.

The function symbol acquisition unit 600 may generate a third code fragment 232 and a third sentence 234 based on the third source code 230.

The function symbol acquisition unit 600 may obtain the third vector by inputting the third sentence 234 into the word embedding model.

When comparing the third sentence 234 with the first sentence 214 and the second sentence 224, the included function calls and function call arguments are similar and the order of function calls is similar, so the third vector is the first sentence 214 and the second sentence 224. It may have a vector value with high similarity to the 1 vector and the second vector.

The function symbol acquisition unit 600 may obtain a function symbol by inputting the third vector into the neural network.

The neural network trained by the neural network processing unit 500 can output “test_func()” for the input of the third vector based on the results learned by the first vector and the second vector.

Figure 8 is a flowchart of a function symbol prediction method according to an embodiment of the present invention. The function symbol prediction method according to an embodiment of the present invention will be described with reference to FIG. 8 as follows.

The code fragment acquisition unit 300 may acquire the first code fragment from the first source code (S110).

The code fragment acquisition unit 300 may acquire the second code fragment from the second source code (S120).

The embedding processing unit 400 may generate a first sentence and a second sentence from the first and second code fragments, respectively, and learn a word embedding model (S130).

The embedding processing unit 400 may obtain the results output as a first vector and a second vector when the first sentence and the second sentence are respectively input to the learned word embedding model (S140).

The neural network processing unit 500 may input the first vector and the second vector into the neural network to train the neural network (S150).

The function symbol acquisition unit 600 may acquire the third code fragment from the script binary (S160).

The function symbol acquisition unit 600 may generate a third sentence based on the third code fragment, input the third sentence into the word embedding model, and obtain the output value as a third vector (S170). .

The function symbol acquisition unit 600 may obtain a function symbol by inputting the third vector into the neural network (S180).

Although embodiments of the present invention have been described above with reference to the attached drawings, those skilled in the art will understand that the present invention can be implemented in other specific forms without changing its technical idea or essential features. You will be able to understand it. Therefore, the embodiments described above should be understood in all respects as illustrative and not restrictive.

Function symbol acquisition device 100
Source code database 200
Code fragment acquisition unit 300
Embedding processing unit 400
Neural network processing unit 500
Function symbol acquisition unit 600

Claims (12)

A function symbol prediction device extracting a function call and a function call argument from a first source code for a target function to obtain a first code fragment;
obtaining, by the function symbol prediction device, a second code fragment by extracting a function call and a function call argument from a second source code that is more updated than the first source code;
converting, by the function symbol prediction device, the first code fragment and the second code fragment into a first sentence and a second sentence, respectively;
Obtaining, by the function symbol prediction device, a first vector and a second vector, respectively, using a word embedding model based on the first sentence and the second sentence;
The function symbol prediction device training a neural network by sequentially inputting the first vector and the second vector;
Obtaining, by the function symbol prediction device, a third code fragment from a stripped binary;
converting, by the function symbol prediction device, the third code fragment into a third sentence;
Obtaining, by the function symbol prediction device, a third vector using the word embedding model based on the third sentence; and
The function symbol prediction device inputting the third vector into the learned neural network to obtain an output result as a function symbol corresponding to the third code fragment; Including, wherein the first vector and the second vector are vectors indicating the symbol of the target function,
The step of converting into the first sentence and the second sentence is,
Characterized in that the function call and function call arguments included in the code fragment are regarded as one word, and the words are connected to create one sentence,
Function symbol prediction method. According to paragraph 1,
The word embedding model is,
One of word2vec, GloVe and FastText,
Function symbol prediction method. According to paragraph 1,
The neural network is,
Any one of RNN (Recurrent Neural Network), LSTM (Long Short Term Memory), and GRU (Gated Recurrent Unit),
Function symbol prediction method. According to paragraph 1,
The step of acquiring the first vector and the second vector is,
learning the word embedding model by inputting each word of the first sentence into the word embedding model;
Obtaining an embedding matrix of the learned word embedding model as a first vector;
learning the word embedding model by inputting each word of the second sentence into the word embedding model; and
Including, obtaining an embedding matrix of the learned word embedding model as a second vector.
Function symbol prediction method. According to paragraph 1,
The step of learning the neural network is,
A step of training the neural network to output a symbol of the target function when the first vector and the second vector are input to the neural network.
Function symbol prediction method. According to paragraph 1,
The step of learning the neural network is,
When the first vector includes an embedding matrix, training the neural network by sequentially inputting each row included in the embedding matrix into the neural network; and
When the second vector includes an embedding matrix, reinforcing learning of the neural network by sequentially inputting each row included in the embedding matrix into the neural network.
Function symbol prediction method. According to paragraph 1,
The step of obtaining the third code fragment is,
Obtaining a third source code through a decompile process of the script binary; and
Including; extracting a function call and a function call argument from the third source code to obtain a third code fragment;
Function symbol prediction method. A source code database storing one or more source codes containing target functions;
a code fragment acquisition unit that obtains a sample code fragment by extracting a function call and a function call argument from the source code included in the source code database;
Embedding that generates a sample sentence based on the obtained sample code fragment, inputs the sample sentence into a word embedding model to learn the word embedding model, and obtains a vector related to the sample sentence from the learned word embedding model. processing department;
a neural network processing unit that trains a neural network to output a symbol of the target function when the vector obtained by the embedding processing unit is input; and
Obtain a third code fragment of a function from which symbols have been removed from the script binary, generate a third sentence based on the code fragment, obtain a third vector using the third sentence and the word embedding model, and A symbol acquisition unit that inputs a third vector into the neural network and obtains the output value as a symbol of the function from which the symbol has been removed,
By generating the sample sentence above,
Characterized in that the function call and function call arguments included in the code fragment are regarded as one word, and the words are connected to create one sentence,
Function symbol prediction device. According to clause 8,
The word embedding model is,
One of word2vec, GloVe, and FastText,
The neural network is,
Any one of RNN (Recurrent Neural Network), LSTM (Long Short Term Memory), and GRU (Gated Recurrent Unit),
Function symbol prediction device. According to clause 8,
The embedding processing unit,
Each word included in the sample sentence is converted into a one-hot vector, the word embedding model is learned by inputting the one-hot vector into the word embedding model, and the embedding matrix of the learned word embedding model is converted to a vector of the sample sentence. acquiring,
Function symbol prediction device. According to clause 8,
The neural network processing unit,
When the vector obtained from the embedding processing unit includes an embedding matrix, training the neural network by sequentially inputting each row included in the embedding matrix into the neural network.
Function symbol prediction device. According to clause 8,
The symbol acquisition unit,
A third source code from which function symbols have been removed is obtained through a decompilation process of the script binary, a third code fragment is obtained by extracting a function call and a function call argument from the third source code, and the third code fragment is obtained. Obtaining a third sentence by generating the function name, function argument, function parameter, and variable name included in as one sentence,
Function symbol prediction device.