Machine learning approach to identify software supply chain vulnerabilities from binary code similarity detection

A system for identifying software chain vulnerabilities using machine learning comprising:

• at least one data processor;
• and
• memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
• receiving a software package;
• unpacking the software package into a plurality of components;
• lifting each function of each component into a corresponding intermediate representation, the lifting comprising decoding machine code bytes corresponding to the function into a higher level intermediate representation instruction, the intermediate representation comprising data structure or code used by a compiler or virtual machine to represent corresponding low-level machine instructions and operational semantics of corresponding code, wherein, during the lifting, a control-flow graph (CFG) and a data-flow graph (DFG) for each function are reconstructed;
• generating, for each intermediate representation, an embedding preserving code semantics from the corresponding component by inputting the corresponding intermediate representation into an embedding machine learning model configured to generate embeddings;
• extracting or deriving, from each intermediate representation, intermediate representation-derived data flow features comprising at least one of:
• detection of constant static variables on a stack, stack reaching definitions, uninitialized variables, and intra-procedural aliases;
• determining, for each component by inputting the corresponding features and a corresponding CFG embedding into at least one machine learning, a level of code similarity associated with the component, the at least one machine learning model being trained and configured to identify components;
• and
• providing the determined level of code similarity to a consuming application or process, the determined level of code similarity being used to identify software chain vulnerabilities.

A method for identifying software chain vulnerabilities using machine learning comprising:

• receiving a software package;
• unpacking the software package into a plurality of components;
• lifting each component into a corresponding intermediate representation, the lifting comprising decoding machine code bytes corresponding to the function into a higher level intermediate representation instruction, the intermediate representation comprising data structure or code used by a compiler or virtual machine to represent corresponding low-level machine instructions and operational semantics of corresponding code, wherein, during the lifting, a control-flow graph (CFG) and a data-flow graph (DFG) for each function are reconstructed;
• extracting or deriving features from each of the components and their corresponding intermediate representations, the features comprising intermediate representation-derived data flow features including at least one of:
• detection of constant static variables on a stack, stack reaching definitions, uninitialized variables, and intra-procedural aliases;
• determining, for each component by at least one first machine learning model using the extracted or derived features, software supply chain risk for the component;
• providing data characterizing the determined supply chain risk for the components to a consuming application or process;
• generating, for each intermediate representation, at least one embedding preserving code semantics from the corresponding component by inputting the intermediate representation into at least one second machine learning model;
• determining, using a component identification module and based on the at least one embedding generated for each component, an identity of such component;
• and
• providing data the determined component identities to the consuming application or process, the determined level of code similarity being used to identify software chain vulnerabilities.