中国科学院软件研究所 http://ir.iscas.ac.cn:80 2026-07-15T08:02:34Z 2026-07-15T08:02:34Z 梁蕙霖 http://ir.iscas.ac.cn:80/handle/311060/20059 2026-06-08T06:05:23Z 2026-06-08T06:09:40Z

Title: 基于增强型代码属性图的二进制漏洞挖掘研究 Authors: 梁蕙霖 Description: <div><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">二进制程序作为软件分发的常见形态，其安全问题受到广泛关注。然而，针 </span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">对二进制程序的安全分析面临诸多挑战：静态分析方法虽能提供完整的代码覆 </span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">盖，但面临高级语义信息缺失、路径爆炸和间接调用解析困难等问题；动态分析</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">方法虽能精确追踪实际执行路径，但覆盖率受限于测试用例。为突破这些瓶颈，</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">在现有二进制漏洞研究等相关理论基础以及实践基础上，本文提出一种基于增 </span></span></span></div> <div><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">强型代码属性图（</span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">Enhanced Code Property Graph, EnCPG</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">）的二进制漏洞挖掘方</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">法，将静态分析与动态分析深度融合，提高了检测全面性与精确性。 </span></span></span></div> <div><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">本文的主要贡献包括以下四部分： </span></span></span></div> <div><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">（</span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">1</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">）针对二进制程序缺乏高级语义、难以直接支撑代码属性图构建与漏洞分</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">析的问题，本研究提出基于反编译的代码属性图构建方法。该方法利用反编译引</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">擎将机器码提升为类 </span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">C </span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">伪代码，并通过后处理规范化步骤对反编译器简化类型</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">系统进行统一转换与语义校正，在此基础上构建能支撑数据流分析与漏洞模式</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">匹配的代码属性图。 </span></span></span></div> <div><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">（</span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">2</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">）针对代码属性图缺乏动态执行信息的局限，提出了基于动态执行记录</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">（</span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">Trace</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">）的增强方法。首先形式化定义了基于函数调用粒度的 </span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">Trace </span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">表示；其次</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">设计了 </span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">Trace </span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">采集与解析算法，从动态执行轨迹中提取已覆盖函数集合和动态调</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">用关系两类关键信息；最后开发了代码属性图增强算法，为已覆盖函数节点添加</span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">BeenTraced </span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">属性，为动态调用关系添加 </span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">TRACE_CALL </span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">边。增强后的 </span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">CPG </span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">既保 </span></span></span></div> <div><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">持了静态分析的完整性，又具备了动态分析的精确性，使后续漏洞检测能够聚焦</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">于实际可达代码，显著降低误报率。 </span></span></span></div> <div><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">（</span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">3</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">）针对六类高危漏洞设计了基于 </span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">EnCPG </span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">的检测算法。算法遵循统一的设</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">计范式：从语法、控制流和数据流三个维度提取漏洞特征，将特征转化为图模式</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">匹配规则，结合 </span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">BeenTraced </span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">属性和 </span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">TRACE_CALL </span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">边将检测范围限定在实际执</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">行代码上。这些算法充分利用了 </span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">EnCPG </span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">的静态全面性和动态精确性，实现了自</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">动化的二进制漏洞挖掘方案。 </span></span></span></div> <div><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">（</span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">4</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">）设计并实现了基于 </span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">EnCPG </span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">的二进制漏洞挖掘原型系统 </span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">BinScan</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">，并通过</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">系统性实验验证了所提方法的有效性。在基于 </span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">EnCPG </span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">构建的真实漏洞程序测试</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">集上，</span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">BinScan </span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">能够发现全部已知漏洞，并挖掘出若干潜在漏洞，其中 </span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">2 </span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">个已获</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">得 </span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">llama.cpp </span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">项目维护者的确认与致谢。此外，本课题研究方案应用于 </span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">IoT </span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">设备漏 </span></span></span></div> <div><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">洞挖掘场景，成功发现零日漏洞并获得了两个 </span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">CNVD </span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">编号 </span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">(CNVD-2026-06050</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">、</span></span></span><span style="font-size:12pt"><span style="font-family:'XITS-Regular-Identity-H'"><span style="color:#000000">CNVD-2026-06209)</span></span></span><span style="font-size:12pt"><span style="font-family:'FandolSong-Regular-Identity-H'"><span style="color:#000000">。</span></span></span></div>

2026-06-08T06:09:40Z 白潇 http://ir.iscas.ac.cn:80/handle/311060/20033 2025-11-06T19:24:47Z 2025-11-06T19:24:47Z

Title: 基于预训练语言模型的两阶段信息抽取方法研究 Authors: 白潇

2025-11-06T19:24:47Z 张龙 http://ir.iscas.ac.cn:80/handle/311060/20032 2025-10-30T19:27:15Z 2025-10-30T19:27:15Z

Title: 通过智能化测试用例排序与选择优化持续集成 Authors: 张龙

2025-10-30T19:27:15Z 亢良伊 http://ir.iscas.ac.cn:80/handle/311060/20031 2025-10-30T19:26:10Z 2025-10-30T19:26:10Z

Title: 基于多模态信息的讽刺检测方法研究 Authors: 亢良伊

2025-10-30T19:26:10Z 王佳星 http://ir.iscas.ac.cn:80/handle/311060/20030 2025-10-16T17:30:06Z 2025-10-16T17:30:06Z

Title: 基于改进注意力机制的光学图像中小目标检测算法研究 Authors: 王佳星

2025-10-16T17:30:06Z 鲍庆超 http://ir.iscas.ac.cn:80/handle/311060/20029 2025-10-16T17:28:13Z 2025-10-16T17:28:13Z

Title: DCx：扩展 Dual Contouring 算法用于神经无符号距离场零值面提取 Authors: 鲍庆超

2025-10-16T17:28:13Z 王天舒 http://ir.iscas.ac.cn:80/handle/311060/20028 2025-10-16T17:27:03Z 2025-10-16T17:27:03Z

Title: 基于大模型的真实场景数据集成关键技术研究 Authors: 王天舒

2025-10-16T17:27:03Z 沈垚杰 http://ir.iscas.ac.cn:80/handle/311060/20027 2025-10-16T17:25:26Z 2025-10-16T17:25:26Z

Title: 面向知识增强的视频描述生成方法研究 Authors: 沈垚杰

2025-10-16T17:25:26Z 秦昊 http://ir.iscas.ac.cn:80/handle/311060/20026 2025-10-16T17:23:47Z 2025-10-16T17:23:47Z

Title: 开源自然语言处理模型的对抗鲁棒性增强与内容真实性检验系统 Authors: 秦昊

2025-10-16T17:23:47Z 金翔宇 http://ir.iscas.ac.cn:80/handle/311060/20025 2025-10-16T17:22:24Z 2025-10-16T17:22:24Z

Title: 基于定理证明的混成系统验证 Authors: 金翔宇

2025-10-16T17:22:24Z