High throughput embedding generation system for executable code and applications

Abstract

A novel high-throughput embedding generation and comparison system for executable code is presented in this invention. More specifically, the invention relates to a deep-neural-network based graph embedding generation and comparison system. A novel bi-directional code graph embedding generation has been proposed to enrich the information extracted from code graph. Furthermore, by deploying matrix manipulation, the throughput of the system has significantly increased for embedding generation. Potential applications such as executable file similarity calculation, vulnerability search are also presented in this invention.

What is claimed is: 
     
         1 . A system for high-throughput embedding generation and comparison, compromising:
 take executable code and extract Bi-directional ACFGs of every function from it;   conduct high-throughput embedding generation for the Bi-directional ACFG;   conduct high-throughput similarity comparison of functions using the embeddings;   compare the similarity of executable files by applying Principal Component Analysis on embeddings of functions;   search the vulnerability by combining high-throughput embedding generation and comparison with condition formula comparison.   
     
     
         2 . The system of  claim 1 , further comprising the definition of Bi-directional ACFG. 
     
     
         3 . The system of  claim 1 , further comprising the high-throughput embedding generation which deploys stacked Bi-directional ACFGs to maximize the throughput of the embedding network. 
     
     
         4 . They system of  claims 1 , further comprising the usage of bi-directional ACFG as the input of graph embedding network, which improves the accuracy of the invention. 
     
     
         5 . The system of  claim 1 , further comprising the high-throughput similarity calculation which deploys matrix manipulation to maximize the throughput of the system. 
     
     
         6 . The system of  claim 5 , wherein the matrix manipulation is implemented by stacking function embedding vectors into matrix format, and processing in batches through one calculation to provide high speed cosine similarity calculation. 
     
     
         7 . The system of  claim 1 , wherein an executable file similarity comparison system is implemented using high-throughput embedding generation and comparison system. 
     
     
         8 . The system of  claim 7 , wherein principal component analysis is conducted on embeddings of functions extracted from executable to generate the embedding of executable file. 
     
     
         9 . The system of  claim 7 , wherein the cosine similarity of executable files' embeddings are used to calculate the similarity of executable files. 
     
     
         10 . The system of  claim 1 , wherein a vulnerability search system is implemented using high-throughput embedding generation and comparison system. 
     
     
         11 . The system of  claim 10 , wherein high-throughput embedding generation and comparison system is used to identify the candidates list of vulnerable functions. 
     
     
         12 . The system of  claim 10 , wherein condition formula comparison is used to identify the true positive vulnerable functions in the candidates list.