DFSGraph: Data Flow Semantic Model for Intermediate Representation Programs Based on Graph Network

With the improvement of software copyright protection awareness, code obfuscation technology plays a crucial role in protecting key segments. As becomes more and complex diverse, it has spawned large number malware variants, which make easy to evade detection anti-virus software. Malicious mainly depends on binary similarity analysis. However, existing analysis technologies are difficult deal with growing technologies. To solve this problem, paper proposes new obfuscation-resilient program method, is based data flow transformation relationship intermediate representation graph network model. In our approach, we first construct LLVM IR. Then, design novel language model networks, named DFSGraph, learn semantics from DTG. DFSGraph can detect obfuscated by extracting semantic information without deobfuscation. Extensive experiments prove that approach accurate than deobfuscation tools when searching for similar functions code.