High throughput embedding generation system for executable code and applications

Patent metadata

Field	Value
Publication number	US-11080236-B1
Application number	US-202117198312-A
Country	US
Kind code	B1
Filing date	Mar 11, 2021
Priority date	Jul 18, 2019
Publication date	Aug 3, 2021
Grant date	Aug 3, 2021

Abstract

A novel high-throughput embedding generation and comparison system for executable code is presented in this invention. More specifically, the invention relates to a deep-neural-network based graph embedding generation and comparison system. A novel bi-directional code graph embedding generation has been proposed to enrich the information extracted from code graph. Furthermore, by deploying matrix manipulation, the throughput of the system has significantly increased for embedding generation. Potential applications such as executable file similarity calculation, vulnerability search are also presented in this invention.

First claim

What is claimed is:

1. A system for high-throughput embedding generation and comparison, comprising:
circuitry configured to
take executable code and extract Bi-directional Attributable Control Flow Graphs (ACFGs) of functions from the executable code;
conduct high-throughput embedding generation to generate embeddings for the Bi-directional ACFGs;
conduct high-throughput similarity comparison of the functions using the embeddings; and
conduct the high-throughput similarity comparison to compare a similarity of a plurality of executable files by applying Principal Component Analysis on the embeddings.

2. The system of claim 1 , wherein each of the Bi-directional ACFGs is a directed graph with two edges.

3. The system of claim 1 , wherein the high-throughput embedding generation deploys stacked Bi-directional ACFGs to maximize a throughput of an embedding network.

4. They system of claim 1 , wherein the circuitry is further configured to implement a graph embedding network to which the bi-directional ACFGs are input.

5. The system of claim 1 , wherein the circuitry is configured to conduct the high-throughput similarity comparison using matrix manipulation.

6. The system of claim 5 , wherein the circuitry is configured to implement the matrix manipulation by stacking function embedding vectors into matrix format, and processing the function embedding vectors in batches through one calculation to provide high speed cosine similarity calculation.

7. The system of claim 1 , wherein the circuitry is configured to implement an executable file similarity comparison system using the high-throughput embedding generation and comparison.

8. The system of claim 7 , wherein the circuitry is configured to conduct the principal component analysis on the embeddings of the functions extracted from the plurality of executable files to generate the embeddings of the executable files.

9. The system of claim 7 , wherein the circuitry is configured to use cosine similarity of the embeddings of the executable files to calculate the similarity of the executable files.

10. The system of claim 1 , wherein the circuitry is configured to implement a vulnerability search system using the high-throughput embedding generation and comparison.

11. The system of claim 10 , wherein the circuitry is configured to use the high-throughput embedding generation and comparison to identify candidates list of vulnerable functions.

12. The system of claim 10 , wherein the circuitry is configured to use condition formula comparison to identify true positive vulnerable functions in the candidates list.

13. A method for high-throughput embedding generation and comparison, compromising:
taking executable code and extracting Bi-directional Attributable Control Flow Graphs (ACFGs) of functions from the executable code;
conducting high-throughput embedding generation to generate embeddings for the Bi-directional AFCGs;
conducting high-throughput similarity comparison of the functions using the embeddings; and
conducting the high-throughput similarity comparison to compare a similarity of a plurality of executable files by applying Principal Component Analysis on the embeddings.

14. A non-transitory, computer-readable storage medium storing instructions that, when executed on a computer, control the computer to perform a method for high-throughput embedding generation and comparison, compromising:
taking executable code and extracting Bi-directional Attributable Control Flow Graphs (ACFGs) of functions from the executable code;
conducting high-throughput embedding generation to generate embeddings for the Bi-directional AFCGs;
conducting high-throughput similarity comparison of the functions using the embeddings; and
conducting the high-throughput similarity comparison to compare a similarity of a plurality of executable files by applying Principal Component Analysis on the embeddings.

Assignees

• Deepbits Tech Inc
• Univ California

Inventors

• Yin Heng
• Hu Xunchao
• Yu Sheng
• Zheng Yu

Classifications

• G06F17/10 Primary

  Complex mathematical operations {(function generation by table look-up G06F1/03; evaluation of elementary functions by calculation G06F7/544)} · CPC title

• G06F16/148 Primary

  File search processing · CPC title

• G06F18/2135

  based on approximation criteria, e.g. principal component analysis · CPC title

• G06F18/22

  Matching criteria, e.g. proximity measures · CPC title

• G06F18/29

  Graphical models, e.g. Bayesian networks · CPC title