WO2023284172A1 - 一种控制流平坦化自动检测方法、装置 - Google Patents

一种控制流平坦化自动检测方法、装置 Download PDF

Info

Publication number
WO2023284172A1
WO2023284172A1 PCT/CN2021/127519 CN2021127519W WO2023284172A1 WO 2023284172 A1 WO2023284172 A1 WO 2023284172A1 CN 2021127519 W CN2021127519 W CN 2021127519W WO 2023284172 A1 WO2023284172 A1 WO 2023284172A1
Authority
WO
WIPO (PCT)
Prior art keywords
node
dominator
control flow
dominated
dominant
Prior art date
Application number
PCT/CN2021/127519
Other languages
English (en)
French (fr)
Inventor
齐增田
Original Assignee
苏州浪潮智能科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 苏州浪潮智能科技有限公司 filed Critical 苏州浪潮智能科技有限公司
Publication of WO2023284172A1 publication Critical patent/WO2023284172A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/70—Software maintenance or management
    • G06F8/74—Reverse engineering; Extracting design information from source code

Definitions

  • the present application relates to the technical field of code analysis, in particular to a control flow flattening automatic detection method and device.
  • Control flow flattening is one of the most popular obfuscation techniques. Without changing the function of the source code, it converts the sequential control flow in the code into a jump control flow, eliminates the sequence of execution between basic blocks, and converts the basic Blocks are placed under the same hierarchy for display.
  • each basic block is a node, including the following steps:
  • step of finding an intermediate dominator block used to represent the dominance relationship and hierarchical relationship of nodes specifically includes:
  • the dominating node closest to the dominated node in the dominating relationship table Search the dominating node closest to the dominated node in the dominating relationship table, and confirm that the dominating node is an intermediate dominating block. Once the intermediate dominator block is determined, the dominator chain of the entire code function can be determined.
  • steps of establishing the dominance relationship table include:
  • a more representative structural dominance tree is derived based on dominator nodes and intermediate dominator blocks.
  • the step of determining the dominant node based on the constructed dominant tree includes:
  • the dominator tree determine whether there is a loop in the control flow of the basic block by looking for the reverse edge, if there is a loop in the control flow of the basic block, determine the dominator node, otherwise, continue to perform the steps: in the dominator tree, by looking for the reverse edge method to determine if there is a loop in the basic block control flow.
  • a dominator tree is a compact structure representing dominance relationships, displayed in the form of a dendrogram. With all intermediate dominator blocks as nodes, a dominator tree can be constructed.
  • the calculation determines the control flow flattening similarity of the basic block dominated by the dominant node. If the calculated similarity is greater than or equal to the set threshold, it is judged that the code of the basic block is processed by the control flow flattening
  • the steps of the code specifically include:
  • control flow flattening similarity of the basic block is greater than or equal to the set threshold, it is determined that the code of the basic block serving as the dominant node has been processed by control flow flattening. Judging that the function obfuscated with the control flow flattening technique was found. Lay the foundation for the next step to remove obfuscation and restore the code control flow structure.
  • the step of determining the dominant node includes:
  • node B dominates node A; node B is the dominant node;
  • node B does not dominate node A. Each node dominates itself.
  • each basic block is a node, and the device includes a search module, a construction module, a determination module, and a calculation processing module;
  • a search module configured to find an intermediate dominator block used to represent node dominance relationships and hierarchical relationships
  • a construction module used to construct a dominator tree with all the found intermediate dominator blocks as nodes;
  • a determining module configured to determine a dominant node based on the constructed dominant tree
  • the calculation processing module is used to calculate the control flow flattening similarity of the basic block dominated by the determined dominant node. If the calculated similarity is greater than or equal to the set threshold, it is judged that the code of the basic block is processed by the control flow flattening code.
  • a dominator tree is a compact structure representing dominance relationships, displayed in the form of a dendrogram. With all intermediate dominator blocks as nodes, a dominator tree can be constructed.
  • the device also includes a relationship table building module
  • a relationship table building module used to create a dominating relationship table
  • the determining module is specifically configured to search the dominating node closest to the dominated node in the dominating relationship table, and confirm that the dominating node is an intermediate dominating block.
  • the determination module is specifically used to determine the dominant node and the dominated node according to the execution order from the entry node to the exit node;
  • the relationship table building module is used to output the relationship lists of all the dominating nodes and the dominated nodes to form a dominating relationship table.
  • the determining module also includes a cycle checking unit and a determining unit;
  • a cycle checking unit is used to determine whether there is a cycle in the control flow of the basic block by finding the reverse edge in the dominator tree;
  • the determining unit is used for determining the dominant node when the loop checking unit determines that there is a loop in the control flow of the basic block.
  • the calculation processing module includes a number confirmation unit, a calculation unit, a judgment unit and a judgment output unit;
  • the number confirmation unit is used to calculate the number of basic blocks dominated by the dominant node; it is also used to obtain the number of all basic blocks in the dominant tree;
  • the calculation unit is used to divide the number of basic blocks dominated by the dominator node by the number of all basic blocks in the dominator tree, which is the control flow flattening similarity of the basic block;
  • a judging unit configured to judge whether the control flow flattening similarity of the basic block is greater than or equal to a set threshold
  • the judgment output unit is used for judging that the code of the basic block serving as the dominant node has been processed by control flow flattening.
  • the determination module in the process of determining the dominant node, all paths between the entry node and node A have passed through node B, then node B dominates node A; node B is the dominant node; if there is a path, from the entrance Node B does not pass through node B to node A, then node B does not dominate node A. Each node dominates itself.
  • Fig. 1 is a schematic flowchart of a method according to an embodiment of the present application.
  • FIG. 2 is a schematic diagram of node paths in the embodiment of the present application.
  • Fig. 3 is a control flow diagram of the reconstruction function in the embodiment of the present application.
  • FIG. 4 is a schematic diagram of a dominator tree constructed from the schematic diagram in FIG. 2 in the embodiment of the present application.
  • Fig. 5 is a schematic block diagram of a device according to an embodiment of the present application.
  • 11-finding module 12-building module, 13-determining module, 14-computing processing module.
  • each basic block is a node, including the following steps:
  • S101 Find an intermediate dominator block used to represent node dominance relationship and hierarchical relationship
  • S104 Calculate the control flow flattening similarity of the basic block dominated by the determined dominant node, and if the calculated similarity is greater than or equal to the set threshold, it is determined that the code where the basic block is located is the code that has been processed by control flow flattening. It should be noted that a decimal between 0 and 1 represents the similarity of a certain basic block, and the setting range of the threshold is between 0 and 1.
  • each basic block is a node, including the following steps:
  • S201 Establish a dominating relationship table; specifically, determine the dominating node and the dominated node according to the execution order from the entry node to the exit node; output the relationship list of all dominating nodes and the dominating node to form a dominating relationship table;
  • S202 Find the dominating node closest to the dominated node in the dominating relationship table, confirm that the dominating node is an intermediate dominating block, and the intermediate dominating block is used to represent the dominating relationship and hierarchical relationship of nodes; after determining the intermediate dominating block, the entire code can be determined function dominator chain;
  • S203 Construct a dominator tree with all the found intermediate dominator blocks as nodes; for convenience, based on dominator nodes and intermediate dominator blocks, lead to a more representative structure dominator tree;
  • S205 Calculate the control flow flattening similarity of the basic block dominated by the determined dominant node. If the calculated similarity is greater than or equal to the set threshold, it is judged that the code where the basic block is located is the code after the control flow flattening process. It should be noted that a decimal between 0 and 1 represents the similarity of a certain basic block, and the setting range of the threshold is between 0 and 1.
  • each basic block is a node, including the following steps:
  • S301 Establish a dominating relationship table; specifically, determine the dominating node and the dominated node according to the execution order from the entry node to the exit node; output the relationship list of all dominating nodes and the dominating node to form a dominating relationship table;
  • S302 Find the dominating node closest to the dominated node in the dominating relationship table, confirm that the dominating node is an intermediate dominating block, and the intermediate dominating block is used to represent the dominating relationship and hierarchical relationship of nodes; after determining the intermediate dominating block, the entire code can be determined function dominator chain;
  • S303 Construct a dominator tree with all the found intermediate dominator blocks as nodes; for convenience, based on the dominator nodes and intermediate dominator blocks, a more representative structure dominator tree is derived; the dominator tree is a compact structure representing the dominance relationship, with displayed in the form of a dendrogram. With all intermediate dominator blocks as nodes, a dominator tree can be constructed;
  • S304 Based on the constructed dominator tree, determine the dominator node; in the dominator tree, determine whether there is a loop in the control flow of the basic block by searching the reverse edge, if there is a loop in the control flow of the basic block, determine the dominator node, otherwise, Continue to execute the steps: determine whether there is a cycle in the control flow of the basic block by finding the reverse edge in the dominator tree;
  • S305 Calculate the control flow flattening similarity of the basic block dominated by the determined dominant node, and if the calculated similarity is greater than or equal to the set threshold, it is determined that the code where the basic block is located is the code that has been processed by control flow flattening. It should be noted that a decimal between 0 and 1 represents the similarity of a certain basic block, and the setting range of the threshold is between 0 and 1.
  • step S305 specifically include:
  • S305-3 divide the number of basic blocks dominated by the dominator node by the number of all basic blocks in the dominator tree, which is the control flow flattening similarity of the basic block;
  • S305-4 Determine whether the control flow flattening similarity of the basic block is greater than or equal to a set threshold
  • control flow flattening similarity of the basic block is greater than or equal to the set threshold, it is determined that the code of the basic block serving as the dominant node has been processed by control flow flattening. Judging that the function obfuscated with the control flow flattening technique was found. Lay the foundation for the next step to remove obfuscation and restore the code control flow structure.
  • each basic block is a node, which includes the following steps:
  • S401 Find an intermediate dominator block used to represent node dominance relationship and hierarchical relationship
  • a dominating relationship table needs to be established; in the dominating relationship table, the dominating node closest to the dominated node is searched to confirm that the dominating node is an intermediate dominating block. Once the intermediate dominator block is determined, the dominator chain of the entire code function can be determined.
  • Node a has no edge pointing to itself, which is called an entry node, and node f has no edge pointing outward, which is called an exit node.
  • the transfer chain from one node to another is called a path, for example, a->b->d->f is called the path from a to f.
  • a cycle is a word graph in which every node is accessible through every other node in the subgraph. For example, in Figure 2, nodes c, e, and g form a cycle, because from c to c can be realized through the path c->e->g->c, similarly, from e to e, from g to g path.
  • the dominance relationship describes the inheritance relationship between nodes, and it represents the execution order of basic blocks. For example, a dominator x can guarantee that basic block x can be executed before basic block y in any case.
  • Node x dominates node y if all paths between the entry node and node y pass through node x. If there is a path from the entry node to node y that does not pass through node x, then x does not dominate y. In particular, each node dominates itself.
  • the dominance relationship between the nodes in the above graph can be determined, as shown below, for each x, all nodes dominated by x are listed:
  • node a Since node a is an entry node, it dominates all nodes. Since the passage from a to e and from a to g passes through c, c dominates c, e, and g. From a to g, e is also passed, so e also dominates g. For nodes b and d, f and g, only themselves are dominated.
  • node a will always be executed first, and node f will be executed last. Since c dominates g, c will execute before g. Furthermore, the above relationship can lead to an execution hierarchy relationship: a is executed before c, c is executed before e, and e is executed before g.
  • the process of establishing the dominating relationship table determine the dominating node and the dominated node according to the execution order from the entry node to the exit node; output the relationship list of all the dominating nodes and the dominated nodes to form the dominating relationship table.
  • both node x and node y are unique nodes, and the closest node x that dominates y is called the intermediate dominator block of y.
  • the closest node x that dominates y is called the intermediate dominator block of y.
  • c dominates c, e, and g, so c is the nearest dominator of e and is its middle dominator block.
  • e dominates g and is the closest, e is an intermediate dominating block of g.
  • node x:x is immediate dominator of nodes
  • a is the middle dominator of b, c, d and f, c is the middle dominator of e, and e is the middle dominator of g.
  • S402 Construct a dominator tree using all the found intermediate dominator blocks as nodes;
  • a dominator tree is a compact structure representing dominance relationships, displayed in the form of a dendrogram. With all intermediate dominator blocks as nodes, a dominator tree can be constructed. Therefore, the tree can be constructed using the following edges:
  • Dominance trees show dominance relationships and hierarchies in a compact form. From this it can be seen that a dominates the whole graph and c dominates e and g.
  • cycles can be automatically identified by detecting reverse edges.
  • a cycle is detected if an edge from a node points to one of its dominant nodes.
  • the dominator node controls the loop because it dominates all the nodes in it.
  • there is an edge from node g to c because c dominates g, so there is a loop between c, e and g, and c controls this loop.
  • the dominator tree determine whether there is a cycle in the control flow of the basic block by searching the reverse edge, if there is a cycle in the control flow of the basic block, determine the dominator node, otherwise, continue to perform the steps: in the dominator tree, by searching the reverse edge
  • the edgewise method determines whether there is a loop in the control flow of a basic block.
  • S404 Calculate the control flow flattening similarity of the basic block dominated by the determined dominant node, and judge whether the calculated similarity is greater than or equal to the set threshold; if the calculated similarity is greater than or equal to the set threshold, determine the location where the basic block is located.
  • the code is the code that has been flattened by the control flow.
  • the code logic can also be reconstructed through basic blocks. For example, the following code can be reconstructed:
  • the function check takes x as an input parameter, checks whether x is less than 10, and if so, returns 20, otherwise returns 30.
  • Control flow flattening is a code transformation technique that removes structural information in the control flow. All basic blocks have nothing to do with each other, and control flow cannot be easily restored.
  • control flow platforming is essentially a state machine, where each basic block represents a state. At the code level, it can be realized through an infinite loop structure. Inside the loop body, the value of the state variable is checked through the switch structure and specific operations are performed. Although the control flow cannot be restored through the above diagram, you can remove confusion and restore the control flow structure by viewing the code and analyzing the state transition.
  • Control flow flattening removes the structure of the control flow graph by introducing a state machine, constructing state parameters, and tracking the control flow in an infinite loop body.
  • This application proposes to use a decimal between 0 and 1 to represent the similarity of a certain basic block: find the dominator x through the reverse edge, x is a certain basic block, calculate the number n of basic blocks dominated by x, and divide by The number of all basic blocks in the dominator tree is the control flow flattening similarity of the basic block.
  • the step S404 specifically includes:
  • the set threshold in this embodiment may be 0.9. When the score is greater than or equal to 0.9, it can be determined that the basic block x in the function is a dispatcher, and the function has been flattened by the control flow.
  • each basic block is a node, and the device includes a search module 11, a construction module 12, a determination module 13, Calculation processing module 14;
  • a search module 11 configured to search for an intermediate dominator block representing a node dominance relationship and a hierarchical relationship
  • a construction module 12 configured to construct a dominator tree with all the found intermediate dominator blocks as nodes;
  • a determining module 13 configured to determine a dominant node based on the constructed dominant tree
  • the calculation processing module 14 is used to calculate the control flow flattening similarity of the basic block dominated by the determined dominant node. If the calculated similarity is greater than or equal to the set threshold, it is judged that the code where the basic block is located is processed by control flow flattening after the code.
  • each basic block is a node, and the device includes a search module 11, a construction module 12, a determination module 13, and a calculation processing module 14;
  • a search module 11 configured to search for an intermediate dominator block representing a node dominance relationship and a hierarchical relationship
  • a construction module 12 configured to construct a dominator tree with all the found intermediate dominator blocks as nodes;
  • a determining module 13 configured to determine a dominant node based on the constructed dominant tree
  • the calculation processing module 14 is used to calculate the control flow flattening similarity of the basic block dominated by the determined dominant node. If the calculated similarity is greater than or equal to the set threshold, it is judged that the code where the basic block is located is processed by control flow flattening after the code.
  • the device also includes a relationship table building module
  • the relationship table building module is used to output the relationship lists of all the dominating nodes and the dominated nodes to form a dominating relationship table.
  • the determining module is specifically configured to search the dominating node closest to the dominated node in the dominating relationship table, and confirm that the dominating node is an intermediate dominating block. It is also used to determine the dominant node and the dominated node according to the execution order from the entry node to the exit node;
  • the determining module also includes a cycle checking unit and a determining unit;
  • a cycle checking unit is used to determine whether there is a cycle in the control flow of the basic block by finding the reverse edge in the dominator tree;
  • the determining unit is used for determining the dominant node when the loop checking unit determines that there is a loop in the control flow of the basic block.
  • the calculation processing module includes a number confirmation unit, a calculation unit, a judgment unit and a judgment output unit;
  • the number confirmation unit is used to calculate the number of basic blocks dominated by the dominant node; it is also used to obtain the number of all basic blocks in the dominant tree;
  • the calculation unit is used to divide the number of basic blocks dominated by the dominator node by the number of all basic blocks in the dominator tree, which is the control flow flattening similarity of the basic block;
  • a judging unit configured to judge whether the control flow flattening similarity of the basic block is greater than or equal to a set threshold
  • the judgment output unit is used for judging that the code of the basic block serving as the dominant node has been processed by control flow flattening.
  • the determination module in the process of determining the dominant node, all paths between the entry node and node A have passed through node B, then node B dominates node A; node B is the dominant node; if there is a path, from the entrance Node B does not pass through node B to node A, then node B does not dominate node A. Each node dominates itself.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Operation Control Of Excavators (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本申请提供一种控制流平坦化自动检测方法、装置，所述方法包括如下步骤：查找用于表示节点支配关系和层级关系的中间支配块；以查找出的所有中间支配块为节点构建支配树；以构建的支配树为基础，确定支配节点；计算确定的支配节点支配的基本块的控制流平坦化相似度，若计算的相似度大于或等于设定阈值，判断该基本块所在的代码是被控制流平坦化处理后的代码。本文提出的方法简单有效，而且能够在主流的逆向工具中实现，帮助逆向工程师快速定位和去除控制流平坦化，还原代码本来的控制流结构。

Description

一种控制流平坦化自动检测方法、装置
本申请要求在2021年07月14日提交中国专利局、申请号为202110792580.2、发明名称为“一种控制流平坦化自动检测方法、装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及代码分析技术领域，具体涉及一种控制流平坦化自动检测方法、装置。
背景技术
商业软件和恶意病毒软件的作者经常使用代码混淆来保护特定代码块，防止逆向工程分析出代码的逻辑。通常来说，知道了哪块代码使用了混淆技术，可以以此作为出发点，对这块代码进行更详细更深入的分析。控制流平坦化是最热门的混淆技术之一，在不改变源代码功能的前提下，将代码中的顺序控制流转换成跳转控制流，消除基本块之间的前后执行顺序特征，将基本块放置在同一个层级下进行展示。
在逆向工程领域，大家对如何生成混淆代码以及如何去除混淆代码，还原本来控制流研究比较热门，但是对于如何检测代码中究竟哪一块代码使用了何种混淆技术，公开方法还是比较少。现有的方法针对已经混淆的代码，如何获取真实块、序言和无用块进行讨论，并没有说明如何确定混淆代码的位置。也就是如何检测出二进制代码中究竟哪一块代码使用了控制流平坦化是需要解决的技术问题。
发明内容
现有的方法针对已经混淆的代码，如何获取真实块、序言和无用块进行讨论，如何检测出代码中究竟哪一块代码使用了控制流平坦化并没有公开，本申请提供一种控制流平坦化自动检测方法、装置以解决上述技术问题。
本申请的技术方案是：
一方面，本申请技术方案提供一种控制流平坦化自动检测方法，每一个基本块为一个节点，包括如下步骤：
查找用于表示节点支配关系和层级关系的中间支配块；
以查找出的所有中间支配块为节点构建支配树；
以构建的支配树为基础，确定支配节点；
计算确定的支配节点支配的基本块的控制流平坦化相似度，若计算的相似度大于或等于设定阈值，判断该基本块所在的代码是被控制流平坦化处理后的代码。
进一步的，所述的查找用于表示节点的支配关系和层级关系的中间支配块的步骤具体包括：
建立支配关系表；
在支配关系表中查找距离被支配节点最近的支配节点，确认该支配节点为中间支配块。确定了中间支配块，即可以确定整个代码函数的支配链。
进一步的，所述的建立支配关系表的步骤包括：
从入口节点到出口节点按照执行顺序确定支配节点和被支配节点；
将所有支配节点和被支配节点的关系列表输出形成支配关系表。
为了方便以支配节点和中间支配块为基础，引出更具代表性的结构支配树。
进一步的，所述的以构建的支配树为基础，确定支配节点的步骤包括：
在支配树中通过查找反向边的方法确定基本块控制流中是否有循环，若基本块控制流中有循环，确定支配节点，否则，继续执行步骤：在支配树中通过查找反向边的方法确定基本块控制流中是否有循环。
支配树是代表支配关系的紧凑型结构，以树状图的形式展示。以所有中间支配块为节点，可以构造出支配树。
进一步的，所述的计算确定的支配节点支配的基本块的控制流平坦化相似度，若计算的相似度大于或等于设定阈值，判断该基本块所在的代码是被控制流平坦化处理后的代码的步骤具体包括：
计算支配节点支配的基本块的数目；
获取支配树中所有基本块的数目；
将支配节点支配的基本块的数目，除以支配树中的所有基本块数目，即为该基本块的控制流平坦化相似度；
判断基本块的控制流平坦化相似度是否大于或等于设定阈值；
若基本块的控制流平坦化相似度大于或等于设定阈值，判定作为支配节点的基本块所在的代码被控制流平坦化处理过。判断找到了用控制流平坦化技术混淆的函数。为下一步去除混淆，还原代码控制流结构奠定基础。
进一步的，所述的从入口节点到出口节点按照执行顺序确定支配节点和被支配节点的步骤中，确定支配节点的步骤包括：
在入口节点和节点A之间的所有路径，都经过了节点B，那么节点B支配了节点A；节点B为支配节点；
若存在一条路径，从入口节点到节点A没有经过节点B，那么节点B没有支配节点A。每个节点都支配了它本身。
另一方面，本申请技术方案还提供一种控制流平坦化自动检测装置，每一个基本块为一个节点，所述装置包括查找模块、构建模块、确定模块、计算处理模块；
查找模块，用于查找用于表示节点支配关系和层级关系的中间支配块；
构建模块，用于以查找出的所有中间支配块为节点构建支配树；
确定模块，用于以构建的支配树为基础，确定支配节点；
计算处理模块，用于计算确定的支配节点支配的基本块的控制流平坦化相似度，若计算的相似度大于或等于设定阈值，判断该基本块所在的代码是被控制流平坦化处理后的代码。
在支配树中通过查找反向边的方法确定基本块控制流中是否有循环，若基本块控制流中有循环，确定支配节点。支配树是代表支配关系的紧凑型结构，以树状图的形式展示。以所有中间支配块为节点，可以构造出支配树。
进一步的，该装置还包括关系表建立模块；
关系表建立模块，用于建立支配关系表；
确定模块，具体用于在支配关系表中查找距离被支配节点最近的支配节点，确认该支配节点为中间支配块。
进一步的，确定模块，具体用于从入口节点到出口节点按照执行顺序确定支配节点和被支配节点；
关系表建立模块，用于将所有支配节点和被支配节点的关系列表输出形成支配关系表。
进一步的，确定模块还包括循环检查单元、确定单元；
循环检查单元，用于在支配树中通过查找反向边的方法确定基本块控制流中是否有循环；
确定单元，用于循环检查单元确定基本块控制流中存在循环时，确定支配节点。
进一步的，计算处理模块包括数目确认单元、计算单元、判断单元和判定输出单元；
数目确认单元，用于计算支配节点支配的基本块的数目；还用于获取支配树中所有基本块的数目；
计算单元，用于将支配节点支配的基本块的数目，除以支配树中的所有基本块数目，即为该基本块的控制流平坦化相似度；
判断单元，用于判断基本块的控制流平坦化相似度是否大于或等于设定阈值；
判定输出单元，用于判定作为支配节点的基本块所在的代码被控制流平坦化处理过。
确定模块，在确定支配节点的过程中，在入口节点和节点A之间的所有路径，都经过了节点B，那么节点B支配了节点A；节点B为支配节点；若存在一条路径，从入口节点到节点A没有经过节点B，那么节点B没有支配节点A。每个节点都支配了它本身。从以上技术方案可以看出，本申请具有以下优点：本文提出的方法简单有效，而且能够在主流的逆向工具中实现，帮助逆向工程师快速定位和去除控制流平坦化，还原代码本来的控制流结构。
此外，本申请设计原理可靠，结构简单，具有非常广泛的应用前景。
由此可见，本申请与现有技术相比，具有突出的实质性特点和显著地进步，其实施的有益效果也是显而易见的。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，对于 本领域普通技术人员而言，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本申请一个实施例的方法的示意性流程图。
图2是本申请实施例中节点路径示意图。
图3是本申请实施例中重建函数的控制流图。
图4是本申请实施例中由图2中的示意图构造出的支配树示意图。
图5是本申请一个实施例的装置的示意性框图。
图中，11-查找模块，12-构建模块，13-确定模块，14-计算处理模块。
具体实施方式
为了使本技术领域的人员更好地理解本申请中的技术方案，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本申请保护的范围。
如图1所示，本申请实施例提供一种控制流平坦化自动检测方法，每一个基本块为一个节点，包括如下步骤：
S101：查找用于表示节点支配关系和层级关系的中间支配块；
S102：以查找出的所有中间支配块为节点构建支配树；
S103：以构建的支配树为基础，确定支配节点；
S104：计算确定的支配节点支配的基本块的控制流平坦化相似度，若计算的相似度大于或等于设定阈值，判断该基本块所在的代码是被控制流平坦化处理后的代码。需要说明的是，从0到1之间的小数表示某个基本块的相似度，阈值的设定范围在0到1之间。
作为本申请的另一个实施例，提供一种控制流平坦化自动检测方法，每一个基本块为一个节点，包括如下步骤：
S201：建立支配关系表；具体的，从入口节点到出口节点按照执行顺序确定支配节点和被支配节点；将所有支配节点和被支配节点的关系列表输出形成支配关系表；
S202：在支配关系表中查找距离被支配节点最近的支配节点，确认该支配节点为中间支配块，中间支配块用于表示节点支配关系和层级关系；确定了中间支配块，即可以确定整个代码函数的支配链；
S203：以查找出的所有中间支配块为节点构建支配树；为了方便以支配节点和中间支配块为基础，引出更具代表性的结构支配树；
S204：以构建的支配树为基础，确定支配节点；
S205：计算确定的支配节点支配的基本块的控制流平坦化相似度，若计算的相似度大于或等于设定阈值，判断该基本块所在的代码是被控制流平坦化处理后的代码。需要说明的是，从0到1之间的小数表示某个基本块的相似度，阈值的设定范围在0到1之间。
作为本申请的另一个实施例，提供一种控制流平坦化自动检测方法，每一个基本块为一个节点，包括如下步骤：
S301：建立支配关系表；具体的，从入口节点到出口节点按照执行顺序确定支配节点和被支配节点；将所有支配节点和被支配节点的关系列表输出形成支配关系表；
S302：在支配关系表中查找距离被支配节点最近的支配节点，确认该支配节点为中间支配块，中间支配块用于表示节点支配关系和层级关系；确定了中间支配块，即可以确定整个代码函数的支配链；
S303：以查找出的所有中间支配块为节点构建支配树；为了方便以支配节点和中间支配块为基础，引出更具代表性的结构支配树；支配树是代表支配关系的紧凑型结构，以树状图的形式展示。以所有中间支配块为节点，可以构造出支配树；
S304：以构建的支配树为基础，确定支配节点；在支配树中通过查找反向边的方法确定基本块控制流中是否有循环，若基本块控制流中有循环，确定支配节点，否则，继续执行步骤：在支配树中通过查找反向边的方法确定基本块控制流中是否有循环；
S305：计算确定的支配节点支配的基本块的控制流平坦化相似度，若计算的相似度大于或等于设定阈值，判断该基本块所在的代码是被控制流平坦化处理后的代码。需要说明的是，从0到1之间的小数表示某个基本块的相似度，阈值的设定范围在0到1之间。
步骤S305中，具体包括：
S305-1：计算支配节点支配的基本块的数目；
S305-2：获取支配树中所有基本块的数目；
S305-3：将支配节点支配的基本块的数目，除以支配树中的所有基本块数目，即为该基本块的控制流平坦化相似度；
S305-4：判断基本块的控制流平坦化相似度是否大于或等于设定阈值；
若基本块的控制流平坦化相似度大于或等于设定阈值，判定作为支配节点的基本块所在的代码被控制流平坦化处理过。判断找到了用控制流平坦化技术混淆的函数。为下一步去除混淆，还原代码控制流结构奠定基础。
对于二进制逆向工程分析来说，大多数的二进制文件比较大，代码块很多，但并不是所有代码块都用到了混淆技术。所以，首要的任务是找到哪些代码块用到了控制流平坦化技术，本申请实施例提供种控制流平坦化自动检测方法，每一个基本块为一个节点，包括如下步骤：
S401：查找用于表示节点支配关系和层级关系的中间支配块；
本步骤中，需要建立支配关系表；在支配关系表中查找距离被支配节点最近的支配节点，确认该支配节点为中间支配块。确定了中间支配块，即可以确定整个代码函数的支配链。
在图2中，有7个节点和9条边。节点a没有指向自己的边，称为入口节点，节点f没有指向外的边，称为出口节点。此外，从一个节点到另一个节点的传递链称为路径，比如，a->b->d->f，称为a到f的路径。循环是一个字图，在这个子图中，每个节点都可以通过其他节点访问到。比如，图2中，节点c，e和g形成一个循环，因为从c到c可以通过路径c->e->g->c实现，同理，从e到e，从g到g都有路径。
支配关系描述了节点间的继承关系，它代表了基本块的执行顺序。举个例子，支配者x能够保证，在任何情况下，基本块x都能在基本块y之前执行。如果在入口节点和节点y之间的所有路径，都经过了节点x，那么节点x支配了节点y。如果有一条路径，从入口节点到节点y没有经过节点x，那么x没有支配y。特别地，每个节点都支配了它自己。
根据以上说明，能够确定在上述图中节点间的支配关系，如下所示，对于每一个x，列出了x所支配的所有节点：
node x:nodes dominated by x
a:a,b,c,d,e,f
b:b
c:c,e,g
d:d
e:e,g
f:f
g:g
由于节点a是入口节点，它支配了所有节点。因为从a到e和从a到g都经过c，c支配了c，e和g。从a到g，也经过了e，因此e也支配了g。对于节点b和d，f和g，只支配了他们自己。
从上述关系可以看出，节点a总是会第一个执行，节点f会最后一个执行。因为c支配了g，c会在g之前执行。更进一步地，上述关系能够引申出执行层级关系：a在c之前执行，c在e之前执行，e在g之前执行。
这样，建立支配关系表的过程：从入口节点到出口节点按照执行顺序确定支配节点和被支配节点；将所有支配节点和被支配节点的关系列表输出形成支配关系表。
以支配关系中的图2为例，节点x和节点y都是独一无二的节点，支配y的最接近的节点x称为y的中间支配块。在支配关系表中，c支配c，e和g，所以，c是e的最近的支配者，是它的中间支配块。相似，因为e支配g，而且是最近的，因此e是g的中间支配块。将此规则运用在所有节点中，得出以下关系表：
node x:x is immediate dominator of nodes
a:b,c,d,e,f
b:-
c:e
d:-
e:g
f:-
g:-
从上述可以看出，a是b、c、d和f的中间支配块，c是e的中间支配块，e是g的中间支配块。
S402：以查找出的所有中间支配块为节点构建支配树；
支配树是代表支配关系的紧凑型结构，以树状图的形式展示。以所有中间支配块为节点，可以构造出支配树。因此，可以使用以下的边构造出这棵树：
ua->b
ua->c
ua->d
ua->f
然后增加c和e的边：
uc->e
ue->g
最后，构造出的支配树如图4所示：
支配树以紧凑的形式展示了支配关系和层次。从中可以看出，a支配了整个图，c支配了e和g。
S403：以构建的支配树为基础，确定支配节点；
以支配树为基础，可以通过检测反向边来自动化地识别环路。如果从某个节点出来的边指向了它的一个支配节点，这就检测到了环路。这个支配节点控制着这个环路，因为它支配着里面所有的节点。在上述的控制流图2中，有一条边从节点g指向了c，因为c支配g，因此在c，e和g三者之间存在环路，c控制着这个环路。也就是，在支配树中通过查找反向边的方法确定基本块控制流中是否有循环，若基本块控制流中有循环，确定支配节点，否则，继续执行步骤：在支配树中通过查找反向边的方法确定基本块控制流中是否有循环。
S404：计算确定的支配节点支配的基本块的控制流平坦化相似度，判断计算的相似度是否大于或等于设定阈值；若计算的相似度大于或等于设定阈值，判断该基本块所在的代码是被控制流平坦化处理后的代码。
进行具体算法前先要了解下逆向工程师是如何使用控制流图的，控制流平坦化对于逆向工程分析的影响。
通过画图说明的方式重建函数的控制流图，如图3所示：可以看到，基本块a0有两条向外的边，一条指向b0，一条指向c0，这是一种典型的条件分支模式：在为true的情况下，由a0跳向b0，为false的情况下，由a0跳向c0。基本块b0和c0执行不同的操作，他们的控制流在基本块d0处融合在一起了。在更高的代码结构层面上，这是一种典型的if-then-else模式。因此，可以根据这个图重建出函数中的if-then-else控制结构：
在重建了高层控制结构后，代码逻辑也可以通过一个个基本块重建出来，例如，可以重建出以下代码：
Figure PCTCN2021127519-appb-000001
函数check以x作为输入参数，检查x是否小于10，如果是，则返回20，否则返回30。
控制流平坦化是一种代码变换技术，它去除了控制流中的结构信息。所有的基本块彼此之间无任何关系，不能轻易恢复控制流。
如果使用前文提到的方法恢复控制流，只能看到基本块a、b、c和d都与一个基本块连接着，看不到这些基本块之间是如何关联的，因为所有的基本块都在同一平面上。
在控制流平坦化技术的最基本形态中，有一个核心基本块dispatcher，引导控制流到每个基本块中。这是通过状态参数实现的，该参数记录着接下来 访问的应该是哪个基本块。基本块entry设置了状态参数的初始值，此处为基本块a。接下来，每个基本块根据程序逻辑动态地更新状态参数的值。简而言之，控制流平台化本质上是一个状态机，每个基本块代表一种状态。在代码层面上，可以通过无限循环结构实现，在循环体内部，通过switch结构检查状态变量的值，并执行特定操作。虽然不能通过上述图恢复控制流，但是可以通过查看代码，分析状态变换去除混淆，还原控制流结构。
控制流平坦化通过引入状态机，构建状态参数，在无限循环体中追踪控制流，从而去除了控制流图的结构。
本实施例中，为能够自动化检测到这些结构，需弄清楚某个图结构与平坦化后的图的相似百分比。为实现这个目标，需要判断是否有反向边指向支配者，其次，这个支配者是否控制着函数中的大多数基本块。换句话说，需寻找某个基本块，它控制着某个循环结构体，并且支配着函数中的大部分基本块。
本申请提出以从0到1之间的小数表示某个基本块的相似度：通过反向边找到这个支配者x，x为某个基本块，计算出x支配的基本块数目n，除以支配树中的所有基本块数目，即为该基本块的控制流平坦化相似度。所述步骤S404中具体包括：
计算支配节点支配的基本块的数目；获取支配树中所有基本块的数目；将支配节点支配的基本块的数目，除以支配树中的所有基本块数目，即为该基本块的控制流平坦化相似度；判断基本块的控制流平坦化相似度是否大于或等于设定阈值；若基本块的控制流平坦化相似度大于或等于设定阈值，判定作为支配节点的基本块所在的代码被控制流平坦化处理过。判断找到了用控制流平坦化技术混淆的函数。为下一步去除混淆，还原代码控制流结构奠定基础。本实施例中的设定的阈值可以是0.9，当得分大于或者等于0.9时，即可判定函数中的基本块x是dispatcher，该函数是被控制流平坦化处理过的。
如图5所示，作为本申请的一个实施例，还提供一种控制流平坦化自动检测装置，每一个基本块为一个节点，所述装置包括查找模块11、构建模块12、确定模块13、计算处理模块14；
查找模块11，用于查找用于表示节点支配关系和层级关系的中间支配块；
构建模块12，用于以查找出的所有中间支配块为节点构建支配树；
确定模块13，用于以构建的支配树为基础，确定支配节点；
计算处理模块14，用于计算确定的支配节点支配的基本块的控制流平坦化相似度，若计算的相似度大于或等于设定阈值，判断该基本块所在的代码是被控制流平坦化处理后的代码。
作为本申请的一个实施例，还提供一种控制流平坦化自动检测装置，每一个基本块为一个节点，所述装置包括查找模块11、构建模块12、确定模块13、计算处理模块14；
查找模块11，用于查找用于表示节点支配关系和层级关系的中间支配块；
构建模块12，用于以查找出的所有中间支配块为节点构建支配树；
确定模块13，用于以构建的支配树为基础，确定支配节点；
计算处理模块14，用于计算确定的支配节点支配的基本块的控制流平坦化相似度，若计算的相似度大于或等于设定阈值，判断该基本块所在的代码是被控制流平坦化处理后的代码。
该装置还包括关系表建立模块；
关系表建立模块，用于将所有支配节点和被支配节点的关系列表输出形成支配关系表。
确定模块，具体用于在支配关系表中查找距离被支配节点最近的支配节点，确认该支配节点为中间支配块。还用于从入口节点到出口节点按照执行顺序确定支配节点和被支配节点；
确定模块还包括循环检查单元、确定单元；
循环检查单元，用于在支配树中通过查找反向边的方法确定基本块控制流中是否有循环；
确定单元，用于循环检查单元确定基本块控制流中存在循环时，确定支配节点。
需要说明的是，计算处理模块包括数目确认单元、计算单元、判断单元和判定输出单元；
数目确认单元，用于计算支配节点支配的基本块的数目；还用于获取支配树中所有基本块的数目；
计算单元，用于将支配节点支配的基本块的数目，除以支配树中的所有基本块数目，即为该基本块的控制流平坦化相似度；
判断单元，用于判断基本块的控制流平坦化相似度是否大于或等于设定阈值；
判定输出单元，用于判定作为支配节点的基本块所在的代码被控制流平坦化处理过。
确定模块，在确定支配节点的过程中，在入口节点和节点A之间的所有路径，都经过了节点B，那么节点B支配了节点A；节点B为支配节点；若存在一条路径，从入口节点到节点A没有经过节点B，那么节点B没有支配节点A。每个节点都支配了它本身。
尽管通过参考附图并结合优选实施例的方式对本申请进行了详细描述，但本申请并不限于此。在不脱离本申请的精神和实质的前提下，本领域普通技术人员可以对本申请的实施例进行各种等效的修改或替换，而这些修改或替换都应在本申请的涵盖范围内/任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (10)

  1. 一种控制流平坦化自动检测方法，其特征在于，每一个基本块为一个节点，包括如下步骤：
    查找用于表示节点支配关系和层级关系的中间支配块；其中，确定中间支配块的方法包括：在支配关系表中查找距离被支配节点最近的支配节点，确认该支配节点为中间支配块；
    以查找出的所有中间支配块为节点构建支配树；
    以构建的支配树为基础，确定支配节点；其中，确定支配节点的方法包括：在支配树中通过查找反向边的方法确定基本块控制流中是否有循环，若有循环，确定支配节点；
    计算确定的支配节点支配的基本块的控制流平坦化相似度，若计算的相似度大于或等于设定阈值，判断该基本块所在的代码是被控制流平坦化处理后的代码；其中，平坦化相似度的计算方法的步骤包括：计算支配节点支配的基本块的数目；获取支配树中所有基本块的数目；
    将支配节点支配的基本块的数目，除以支配树中的所有基本块数目，即为该基本块的控制流平坦化相似度。
  2. 根据权利要求1所述的控制流平坦化自动检测方法，其特征在于，该方法还包括：
    建立支配关系表。
  3. 根据权利要求2所述的控制流平坦化自动检测方法，其特征在于，所述的建立支配关系表的步骤包括：
    从入口节点到出口节点按照执行顺序确定支配节点和被支配节点；
    将所有支配节点和被支配节点的关系列表输出形成支配关系表。
  4. 根据权利要求3所述的控制流平坦化自动检测方法，其特征在于，所述的从入口节点到出口节点按照执行顺序确定支配节点和被支配节点的步骤中，确定支配节点的步骤包括：
    在入口节点和节点A之间的所有路径，都经过了节点B，那么节点B支配了节点A；节点B为支配节点。
  5. 根据权利要求4所述的控制流平坦化自动检测方法，其特征在于，所述的从入口节点到出口节点按照执行顺序确定支配节点和被支配节点的步骤中，确定支配节点的步骤包括：
    若存在一条路径，从入口节点到节点A没有经过节点B，那么节点B没有支配节点A。
  6. 根据权利要求5所述的控制流平坦化自动检测方法，其特征在于，每个节点都支配了它本身。
  7. 一种控制流平坦化自动检测装置，其特征在于，每一个基本块为一个节点，所述装置包括查找模块、构建模块、确定模块、计算处理模块；
    查找模块，用于查找用于表示节点支配关系和层级关系的中间支配块；具体用于在支配关系表中查找距离被支配节点最近的支配节点，确认该支配节点为中间支配块；
    构建模块，用于以查找出的所有中间支配块为节点构建支配树；
    确定模块，用于以构建的支配树为基础，确定支配节点；
    计算处理模块，用于计算确定的支配节点支配的基本块的控制流平坦化相似度，若计算的相似度大于或等于设定阈值，判断该基本块所在的代码是被控制流平坦化处理后的代码；计算处理模块包括数目确认单元、计算单元；
    数目确认单元，用于计算支配节点支配的基本块的数目；还用于获取支配树中所有基本块的数目；
    计算单元，用于将支配节点支配的基本块的数目，除以支配树中的所有基本块数目，即为该基本块的控制流平坦化相似度。
  8. 根据权利要求7所述的控制流平坦化自动检测装置，其特征在于，该装置还包括关系表建立模块；
    关系表建立模块，用于建立支配关系表。
  9. 根据权利要求8所述的控制流平坦化自动检测装置，其特征在于，计算处理模块还包括判断单元和判定输出单元；
    判断单元，用于判断基本块的控制流平坦化相似度是否大于或等于设定阈值；
    判定输出单元，用于判定作为支配节点的基本块所在的代码被控制流平坦化处理过。
  10. 根据权利要求8或9所述的控制流平坦化自动检测装置，其特征在于，所述关系表建立模块还配置为用于将所有支配节点和被支配节点的关系列表输出形成支配关系表。
PCT/CN2021/127519 2021-07-14 2021-10-29 一种控制流平坦化自动检测方法、装置 WO2023284172A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110792580.2A CN113254068B (zh) 2021-07-14 2021-07-14 一种控制流平坦化自动检测方法、装置
CN202110792580.2 2021-07-14

Publications (1)

Publication Number Publication Date
WO2023284172A1 true WO2023284172A1 (zh) 2023-01-19

Family

ID=77191175

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/127519 WO2023284172A1 (zh) 2021-07-14 2021-10-29 一种控制流平坦化自动检测方法、装置

Country Status (2)

Country Link
CN (1) CN113254068B (zh)
WO (1) WO2023284172A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113254068B (zh) * 2021-07-14 2021-10-22 苏州浪潮智能科技有限公司 一种控制流平坦化自动检测方法、装置
CN116956245A (zh) * 2023-09-19 2023-10-27 安徽大学 一种基于控制流平坦化混淆的软件水印实现方法及系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110138351A1 (en) * 2008-08-21 2011-06-09 Antoine Monsifrot Method and device for code obfuscation
US20160117155A1 (en) * 2014-10-24 2016-04-28 Thomson Licensing Control flow graph flattening device and method
CN109101816A (zh) * 2018-08-10 2018-12-28 北京理工大学 一种基于系统调用控制流图的恶意代码同源性分析方法
CN110673852A (zh) * 2019-09-20 2020-01-10 北京智游网安科技有限公司 一种基于编译器前端实现控制流平坦的方法、系统及设备
CN113031930A (zh) * 2019-12-24 2021-06-25 武汉斗鱼鱼乐网络科技有限公司 一种控制流平坦化的源代码混淆生成方法及装置
CN113254068A (zh) * 2021-07-14 2021-08-13 苏州浪潮智能科技有限公司 一种控制流平坦化自动检测方法、装置

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10802806B1 (en) * 2019-03-29 2020-10-13 Advanced Micro Devices, Inc. Generating vectorized control flow using reconverging control flow graphs

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110138351A1 (en) * 2008-08-21 2011-06-09 Antoine Monsifrot Method and device for code obfuscation
US20160117155A1 (en) * 2014-10-24 2016-04-28 Thomson Licensing Control flow graph flattening device and method
CN109101816A (zh) * 2018-08-10 2018-12-28 北京理工大学 一种基于系统调用控制流图的恶意代码同源性分析方法
CN110673852A (zh) * 2019-09-20 2020-01-10 北京智游网安科技有限公司 一种基于编译器前端实现控制流平坦的方法、系统及设备
CN113031930A (zh) * 2019-12-24 2021-06-25 武汉斗鱼鱼乐网络科技有限公司 一种控制流平坦化的源代码混淆生成方法及装置
CN113254068A (zh) * 2021-07-14 2021-08-13 苏州浪潮智能科技有限公司 一种控制流平坦化自动检测方法、装置

Also Published As

Publication number Publication date
CN113254068B (zh) 2021-10-22
CN113254068A (zh) 2021-08-13

Similar Documents

Publication Publication Date Title
WO2023284172A1 (zh) 一种控制流平坦化自动检测方法、装置
US10296443B2 (en) Automatically predicting faults that caused software failures using a Markov logic network
CN106920162B (zh) 一种基于并行环路检测的虚开增值税专用发票检测方法
CN106682514B (zh) 基于子图挖掘的系统调用序列特征模式集生成方法
CN114491566B (zh) 一种基于代码相似性的模糊测试方法、装置及存储介质
Golubev et al. Multi-threshold token-based code clone detection
CN110780879A (zh) 一种基于智能编译技术的决策执行方法、装置、设备及介质
CN112817787A (zh) 中断驱动嵌入式系统数据竞争的自动检测方法
CN112988305A (zh) 策略流程的处理方法、装置、计算机设备及存储介质
CN113886832A (zh) 智能合约漏洞检测方法、系统、计算机设备和存储介质
CN117474091A (zh) 一种知识图谱构建方法、装置、设备及存储介质
CN107871040A (zh) 管网连通性分析方法及装置
CN115328621B (zh) 基于区块链的事务处理方法、装置、设备及存储介质
CN111738290A (zh) 图像检测方法、模型构建和训练方法、装置、设备和介质
CN116341634A (zh) 神经结构搜索模型的训练方法、装置及电子设备
CN114138330A (zh) 基于知识图谱的代码克隆检测优化方法、装置和电子设备
CN115828269A (zh) 源代码漏洞检测模型的构建方法、装置、设备及存储介质
Gangadharan et al. Advancing Bug Detection in Solidity Smart Contracts with the Proficiency of Deep Learning
CN103440122A (zh) 一种新的使用逆向扩展控制流图的静态函数识别方法
Pan et al. Dynamic time window based reward for reinforcement learning in continuous integration testing
CN106844218A (zh) 一种基于演化切片的演化影响集预测方法
CN113688403A (zh) 一种基于符号执行验证的智能合约漏洞检测方法及装置
CN111625727A (zh) 用于社交关系数据的信息处理方法、装置和存储介质
US20230017693A1 (en) Topology design apparatus, topology design method and program
CN111309265A (zh) 基于神经网络的节点存储方法、系统、服务器及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21949945

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE