Cross-Architecture Vulnerability Detection Combining Semantic and Attribute Feature

Binary vulnerability detection plays an important role in the field of program security. In order to cope with large-scale vulnerability detection tasks, more and more neural network technologies have been applied to cross-architecture vulnerability detection, which significantly improves the accuracy of vulnerability detection, however, existing methods still face problems such as single extracted information and inability to perform cross-architecture vulnerability detection. A cross-architecture vulnerability detection method combining semantic and attribute feature is proposed. The assembly code and attribute control flow diagram of binary function are used as input to extract the semantic information of all assembly code in basic block, and the basic block-level semantic information and attribute feature information are fused to generate a 139-dimensional basic block-level vector representation, in order to represent the semantic and attribute information of the function more comprehensively. The twin network model based on convolutional neural network is used to generate function-level embedding vectors, in order to extract the features of different spatial hierarchies in different basic blocks and reduce the number of parameters in the neural network. Moreover, the distance of the function-level embedding vectors is calculated to determine whether the two binary functions to be detected are similar. Finally, when cross-architecture vulnerability detection is carried out, it is only necessary to input the assembly code and attribute control flow diagram of functions and known vulnerability functions in binary files to complete vulnerability detection. Experimental results show that the detection accuracy of this method is 95.64%, and the value of AUC (area under curve) is 0.9969. Compared with the existing methods, the accuracy can be increased by 0.26 to 7.04 percentage points, and the AUC can be increased by 0.11 to 1.59 percentage points, which has excellent performance in the real environment vulnerability detection.