Constraint limited clustering and information measuring software birthmark feature selection method and computer

Abstract

The invention belongs to the technical field of birthmark-based software recognition, discloses a constraint limited clustering and information measuring software birthmark feature selection method, and aims at measuring distances between same-class features and distances between different-class features on the basis of mutual information by adoption of constraint limited clustering analysis. Themethod comprises the following steps of: during software feature selection, carrying out equivalent semantic transformation on software; carrying out feature segmentation; combining a program slice technology to carry out limited group classification on features; constructing gain function and penalty function evaluations for segmented feature fragment sets; and carrying out different constructiongroup-based hierarchical clustering selection so as to screen invariable features in same classes and get rid of common features in different classes. According to the method, relevancy between features is considered, and in a set formed by the screened birthmark features, the differentiation information amount is the maximum and the redundancy is the minimum, so that the anti-attack performanceof the birthmark features is ensured and the uniqueness of the birthmark features is ensured. According to the method, the robustness and credibility of the software birthmark features are improved, and the feature-based software recognition rate is greatly improved.

Description

technical field [0001] The invention belongs to the technical field of software birthmarks, and in particular relates to a feature selection method of constraint-defined clustering and information measurement software birthmarks and a computer. Background technique [0002] Traditional software feature extraction techniques are summarized into two categories: one is segmental extraction, which is a fixed-length or variable-length segmentation mode combined with grammar. After feature extraction, it can be cut into segments by static word segmentation. Segmented feature selection, or selection based on variable-length P-gram segmentation; without combining semantic analysis and analyzing the correlation between features, the obtained birthmark features are less robust to software encryption, deformation, polymorphic attacks, etc. ; The other is slicing extraction, combined with the selection method of software semantic structure, the program slicing is based on the program de...

AI Technical Summary

Problems solved by technology

[0003] To sum up, the existing problems in the prior art are as follows: First, the traditional software feature acquisition method without clustering and screening is characterized by a large feature library, which contains relatively large feature redundant information, and feature-based software identification The rate is low; or there is no contextual semantic analysis feature group combined with software, lack of dynamic feature selection

Images