DFSGraph: Data Flow Semantic Model for Intermediate Representation Programs Based on Graph Network

Obfuscation techniques have become complex and diverse, and while they play a crucial role in software copyright protection, they also help produce numerous malware variants that evade antivirus software. Automatic detection of malware is inseparable from binary code similarity detection technology. However, the existing code detection methods are difficult to cope with the increasingly complex obfuscation techniques. Therefore, in this paper, we propose a method combining data flow relationships and neural network to analyze obfuscated code for the first time. In our approach, we first construct the data transformation graph based on LLVM IR. Then, we design a novel intermediate language representation model based on graph neural network, named DFSGraph, to learn the data flow semantic from DTG. Through extensive experiments on obfuscated dataset, it is proved that our method can extract the semantic information of obfuscated code well. And it can achieve surprising results in binary code similarity detection task and obfuscation technique classification task. Our method provides an idea for further research on deobfuscation techniques.