Automatic generation method and architecture of security protection software test set based on software gene

Abstract

The present invention provides a method and architecture for automatically generating a security protection software test set based on software genes, which relates to the field of network and information security. The method comprises the following steps: S1: preparing a sample of a data set to be tested, and extracting a software gene code fragment in the sample; S2: by comparing the similarity of the software gene code fragments of each sample, the sample is clustered with mixed attribute data automatically determined by a density-based cluster center to form a plurality of clusters of different sizes; S3: density deviation sampling based on a variable grid is performed on each cluster to obtain a test sample, and the test samples obtained in all clusters are summarized to obtain a test sample set. The method is not limited to forming a test sample set by analyzing sample behavior characteristics by artificial experience, and is used to solve the technical problems of unstable performance, long time consumption, and inability of the test set to well reflect the density distribution characteristics of the original data set in most test set automatic generation architectures in the prior art.

Description

Technical Field

[0001] The present invention relates to the field of network and information security, and in particular to a method and architecture for automatically generating a security protection software test set based on software genes. Background Art

[0002] Malware and security protection strategies evolve together in the form of mutual competition, and improving the accuracy of identifying malicious samples has become the main work of research institutions. Different security protection software has different recognition capabilities and definitions of malicious programs. Constructing high-quality test sample sets can more fully evaluate the performance of security protection software and help improve security protection strategies. Test sample sets should have the characteristics of appropriate size, rich variety, and retain the density distribution characteristics of the original data set. Considering the source of the sample set, the recognition accuracy of security protection software for different test sets is not the same, but the performance of the test set and the method of generating the test set cannot be judged based on the recognition accuracy.

[0003] Many industries provide standardized evaluations for corresponding work by formulating or constructing evaluation standards. In the field of network security, it is necessary to continuously update the original sample library to ensure the generation of the latest and effective test sample sets. Some scholars obtain malicious samples and related data through AV-TEST or AV-Comparatives to test the performance of security protection software; some researchers mainly detect and obtain the behavioral characteristics of samples based on the dynamic characteristics of sandbox programs; or generate test sample sets through sample signature codes based on static analysis.

[0004] However, their methods have some serious problems: 1. Now more and more samples have a strong ability to identify sandboxes. In the sandbox environment, many of their behaviors will not be exposed, resulting in inaccurate observation results; 2. The sample mutation speed is too fast, and it is increasingly difficult to update the sample library to meet the timeliness requirements; 3. Due to the accelerated mutation speed of malicious programs and the use of shell technology, the malicious program sample library is aging or invalidated faster, making it unsuitable for studying new malicious programs. These traditional analysis methods have certain limitations and are overly dependent on manual experience, which is seriously lagging behind the rapidly updated malicious programs. Summary of the invention

[0005] In view of the shortcomings of the prior art mentioned above, the purpose of the present invention is to provide a method and architecture for automatically generating a security protection software test set based on software genes, which is not limited to forming a test sample set by analyzing the behavior characteristics of samples through artificial experience, and is used to solve the technical problems in the prior art that most test set automatic generation architectures are unstable and time-consuming, and the test sample sets cannot well reflect the density distribution characteristics of the original data set.

[0006] The present invention provides a method for automatically generating a security protection software test set based on software genes, the method comprising the following steps:

[0007] S1: Prepare a sample of the data set to be tested, and extract the software gene code fragment in the sample;

[0008] S2: By comparing the similarity of the software gene code fragments of each sample, the samples are clustered with mixed attribute data automatically determined based on the density of the cluster center to form multiple clusters of different sizes;

[0009] S3: Perform density deviation sampling based on a variable grid on each cluster to obtain a test sample, and summarize the test samples obtained from all clusters to obtain a test sample set.

[0010] In one embodiment of the present invention, step S1 specifically includes:

[0011] S11: Input a sample and disassemble the sample to obtain the code to be processed;

[0012] S12: Obtain the position of the code that calls the system API in the code to be processed, take the part between two adjacent codes that call the system API as a software code gene segment, and cut the code to be processed into multiple software gene code segments.

[0013] In one embodiment of the present invention, step S2 specifically includes:

[0014] S21: Calculating the data of the two dimensions of numerical attribute and categorical attribute of the software gene code fragment to obtain the position of each sample and the distance between any two samples;

[0015] S22: Calculate the number of clusters K and the cluster centers according to the automatic cluster center determination method and the distance;

[0016] S23: Combined with the particle swarm algorithm, the optimal stage distance of each cluster is determined;

[0017] S24: By comparing the distance between the location of each sample and each cluster center, determine to which cluster each sample specifically belongs.

[0018] In one embodiment of the present invention, step S24 specifically includes:

[0019] S241: Compare the distance between the sample and the cluster center of the cluster;

[0020] S242: When the distance is less than or equal to the optimal stage distance of the cluster, find the cluster to which the sample belongs;

[0021] S243: When the distance is greater than the optimal stage distance of clustering, steps S241 and S242 are repeated until the cluster to which the sample belongs is found.

[0022] In one embodiment of the present invention, step S3 specifically includes:

[0023] S31: sorting the data of the two dimensions of the software gene code fragments in each cluster, and dividing the sorted data into a plurality of grid units with equal depth;

[0024] S32: Calculate the density information of the grid cells, compare the similarity of the density information of adjacent grid cells in two dimensions respectively, merge grids with similar density information to form a grid space; each cluster forms a corresponding grid space, each grid space contains a different number of grids, and each grid contains a different number of samples.

[0025] S33: extract samples from each grid space.

[0026] In one embodiment of the present invention, step S34 specifically includes:

[0027] S341: Each grid space contains multiple grids. The number of samples contained in a grid is the density of the grid. When extracting, the sample extraction rate in the same grid is equal. The sample extraction rate in different grids is determined by their density ratio. The higher the density ratio, the more samples are extracted from the grid.

[0028] S342: The samples extracted from the grid space are test samples, and the test samples obtained in each grid space are summarized to obtain a test sample set.

[0029] An automatic generation architecture of a security protection software test set based on software genes, the architecture comprising:

[0030] A preprocessing module is used to extract software gene code fragments from samples of the data set to be tested;

[0031] The cluster analysis module is used to compare the similarity of the software gene code fragments of each sample, and to cluster the samples with mixed attribute data automatically determined by density-based cluster centers to form multiple clusters of different sizes;

[0032] The sampling module is used to perform density deviation sampling based on a variable grid for each cluster to obtain a test sample, and to aggregate the test samples obtained from all clusters to obtain a test sample set.

[0033] Specifically, the preprocessing module includes a disassembly submodule and a cutting submodule.

[0034] The disassembly submodule is used to disassemble the sample to obtain the code to be processed;

[0035] The cutting submodule is used to obtain the location of the code that calls the system API in the code to be processed, take the part between two adjacent codes that call the system API as a software code gene segment, and cut the code to be processed into multiple software gene code segments.

[0036] Specifically, the cluster analysis module includes a sample position calculation submodule, a cluster center calculation submodule, an optimal stage distance calculation submodule and a judgment submodule.

[0037] The sample position calculation submodule is used to calculate the data of two dimensions, namely, the numerical attribute and the categorical attribute of the software gene code fragment, to obtain the position of each sample and the distance between any two samples;

[0038] The cluster center calculation submodule is used to calculate the number of clusters K and the cluster center according to the cluster center automatic determination method and the distance;

[0039] The optimal stage distance calculation submodule is used to determine the optimal stage distance of each cluster in combination with the particle swarm algorithm;

[0040] The judgment submodule is used to judge to which cluster each sample belongs by comparing the distance between the location of each sample and each cluster center.

[0041] Specifically, the sampling module includes a grid unit division submodule, a grid unit merging submodule and a sample extraction submodule;

[0042] The grid unit division submodule is used to sort the data of the two dimensions of the software gene code fragments in each cluster, and divide the sorted data into multiple grid units with equal depth;

[0043] The grid unit merging submodule is used to calculate the density information of the grid unit, compare the similarity of the density information of adjacent grid units in two dimensions, merge grids with similar density information to form a grid space; each cluster forms a corresponding grid space, each grid space contains a different number of grids, and each grid contains a different number of samples;

[0044] The sample extraction submodule is used to extract samples in each grid space.

[0045] As described above, the present invention has the following beneficial effects:

[0046] 1. The present invention uses software gene technology to analyze samples of the data set to be tested. Since malicious samples have significant "genetic characteristics" in terms of mutation or updating, that is, a new generation of malicious samples will borrow or directly use a considerable part of the code in the earlier version, classifying samples according to software genes can effectively avoid the problem of sample sets becoming invalid too quickly or failing to generate high-quality test sample sets due to too fast iteration of malicious samples; and avoid inaccurate sample classification due to insufficient exposure of sample behavior.

[0047] 2. The present invention adopts a mixed attribute data clustering algorithm based on density-based automatic determination of cluster centers to cluster samples with mixed attributes about software genes. The gene expressions of the samples in the obtained clusters are very similar and have a high degree of homology.

[0048] 3. The present invention uses a density deviation sampling algorithm based on a variable grid to rationally sample the samples in the cluster and construct a test sample set whose volume is no more than one percent of the original data set. The obtained test sample set has high quality, strong anti-noise ability, and better maintains the distribution characteristics consistent with the original data.

[0049] 4. The present invention provides an automated production architecture with very stable performance and fast sample processing speed. The average time required from inputting samples of the data set to be tested to outputting the test sample set is 1 second. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 Shown is a flowchart of a method for automatically generating a security protection software test set based on software genes according to an embodiment of the present invention.

[0051] Figure 2 It is a schematic diagram of the process disclosed in step S2 in an embodiment of the present invention.

[0052] Figure 3 It shows an algorithm flow chart of the method for automatically determining cluster centers disclosed in step S22 of an embodiment of the present invention.

[0053] Figure 4 It is a schematic diagram of the process disclosed in step S3 in the embodiment of the present invention.

[0054] Figure 5 Shown is a schematic diagram of the disclosed architecture for automatically generating a security protection software test set based on software genes in an embodiment of the present invention.

[0055] Component number description

[0056] 01-preprocessing module; 011-disassembly submodule; 012-cutting submodule; 02-clustering analysis module; 021 sample position calculation submodule; 022-cluster center calculation submodule; 023-optimal stage distance calculation submodule; 024 judgment submodule; 03-sampling module; 031-grid unit division submodule; 032-grid unit merging submodule; 033-sample extraction submodule. DETAILED DESCRIPTION

[0057] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0058] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0059] See also Figure 1 The present invention provides a method for automatically generating a security protection software test set based on software genes, characterized in that the method comprises the following steps:

[0060] S1: Prepare a sample of the data set to be tested, and extract the software gene code fragment in the sample;

[0061] S11: Input a sample and disassemble the sample to obtain the code to be processed;

[0062] S12: Obtain the location of the code that calls the system API (application programming interface) in the code to be processed, take the part between two adjacent codes that call the system API as a software code gene fragment, and cut the code to be processed into multiple software gene code fragments.

[0063] See also Figure 2 ,Based on the above embodiment, step S2: by comparing the similarity of the software gene code fragments of each sample, the samples are clustered with mixed attribute data automatically determined based on the density of the cluster center to form a plurality of clusters of different sizes;

[0064] Specifically, step S2 specifically includes:

[0065] S21: Calculating the data of the two dimensions of numerical attribute and categorical attribute of the software gene code fragment to obtain the position of each sample and the distance between any two samples;

[0066] S22: Calculate the number of clusters K and the cluster centers according to the automatic cluster center determination method and the distance;

[0067] S23: Combined with the particle swarm algorithm, the optimal stage distance of each cluster is determined;

[0068] S24: By comparing the distance between the location of each sample and each cluster center, determine to which cluster each sample specifically belongs.

[0069] Specifically, step S24 includes:

[0070] S241: Compare the distance between the sample and the cluster center of the cluster;

[0071] S242: When the distance is less than or equal to the optimal stage distance of the cluster, find out the cluster to which the sample belongs;

[0072] S243: When the distance is greater than the optimal stage distance of clustering, steps S241 and S242 are repeated until the cluster to which the sample belongs is found.

[0073] In this embodiment, the step S22 is specifically as follows: the software gene code fragment has two dimensions, including a numerical attribute r dimension 1 and a categorical attribute q dimension 1, the numerical attribute is the gene quantity contained in each sample, and the categorical attribute is the number of each gene. According to the test results of the UCI data set (a database for machine learning, currently including 335 data sets), the dominant factor α is set to 0.75, thereby analyzing that the gene data belongs to balanced mixed attribute data. Assuming that the sample gene data set is D, for any two samples X in D i and Y i The distance between them is expressed as:

[0074]

[0075] d refers to the d-dimensional attributes of each sample, and p refers to the p-th dimension of X i and X j The distance between any two samples is obtained. i Then, the cluster center C is automatically determined by using the cluster center automatic determination method. i , the cluster center automatic determination method is based on the following ideas:

[0076] The cluster center is surrounded by neighboring points with lower local density and has a relatively large distance from other data objects with higher local density;

[0077] Noise points have a large distance δ and a relatively small local density ρ. For any data object i, two quantities need to be calculated: the local density ρ of the data object i and the minimum distance δ to other points with higher local density i , local density ρ i and the minimum distance δ i The calculation depends on the preset cutoff distance parameter d c .

[0078] For any data object i, its local density ρ i The calculation method is as follows:

[0079]

[0080]

[0081] For any data object i, its minimum distance δ to other data objects with higher local density is i The definition is as follows:

[0082]

[0083] Among them, for the data point with the best local density, define δ i =max j (d ij ).

[0084] See also Figure 3 , the steps of the algorithm flow are:

[0085] According to the mixed attribute occupancy analysis results, the corresponding distance calculation method is determined for the sample gene data set D, and the ρ of each data object i is calculated using formula (2) and formula (3) i and δ i ;

[0086] Get ρ i and δ i Functional relationship According to the inverse function To fit this functional relationship and transform it into a linear relationship y=b0+b1×x', the linear regression model can be used to get the fitting curve;

[0087] b0 and b1 refer to the location of the sample in the abstract space.

[0088] Residual analysis is used to calculate the residual distribution characteristics of the fitting function, and the number of clusters K and the cluster center C are obtained. i .

[0089] See also Figure 4 ,Based on the above embodiments, S3: perform density deviation sampling based on a variable grid on each cluster to obtain a test sample, and summarize the test samples obtained in all clusters to obtain a test sample set.

[0090] Specifically, the step S3 specifically includes:

[0091] S31: sorting the data of the two dimensions of the software gene code fragments in each cluster, and dividing the sorted data into a plurality of grid units with equal depth;

[0092] S32: Calculate the density information of the grid cells, compare the similarity of the density information of adjacent grid cells in two dimensions respectively, merge grids with similar density information to form a grid space; each cluster forms a corresponding grid space, each grid space contains a different number of grids, and each grid contains a different number of samples.

[0093] S33: extract samples from each grid space.

[0094] Specifically, step S34 includes:

[0095] S341: Each grid space contains multiple grids. The number of samples contained in a grid is the density of the grid. When extracting, the sample extraction rate in the same grid is equal. The sample extraction rate in different grids is determined by their density ratio. The higher the density ratio, the more samples are extracted from the grid.

[0096] S342: The samples extracted from the grid space are test samples, and the test samples obtained in each grid space are summarized to obtain a test sample set.

[0097] In this embodiment, according to the research results of existing relevant literature, the parameter k is usually set to a fixed value of 0.5 by default. However, since the fixed setting of the parameter k has great limitations, it is difficult to adapt to the fixed parameters of various data sets. Therefore, the density deviation sampling algorithm based on the variable grid in the present invention is to optimize the parameter k by introducing the grid density and trigonometric function, and by setting the corresponding function, under the condition that s and t remain unchanged, according to the grid density m i To adjust the parameter k, that is, the larger the grid cell density, the more samples are extracted from the grid. The modified parameter k is as follows:

[0098]

[0099] In formula (5), s is a constant, s∈[0,1]; t is a constant, t∈[0,1]; the values ​​of s and t are determined according to the simulation results; m i is the grid density and m is the number of samples.

[0100] By deducing from formula (5) and the density deviation sampling formula, the number of samples at the extraction point in D can be expressed as:

[0101]

[0102] ω(m i ) is the sampling probability of data in D.

[0103] Finally, the test samples extracted from each cluster are summarized to obtain the final test sample set.

[0104] See also Figure 5 The present invention also provides a security protection software test set automatic generation architecture based on software genes, the architecture includes a preprocessing module, a clustering analysis module and a sampling module:

[0105] An automatic generation architecture of a security protection software test set based on software genes, characterized in that the architecture includes:

[0106] Preprocessing module 01 is used to extract software gene code fragments from samples of the data set to be tested, which can be used to execute Figure 1 Step S1 described in;

[0107] The pre-processing module includes a disassembly sub-module 011 and a cutting sub-module 012.

[0108] The disassembly submodule 011 is used to disassemble the sample to obtain the code to be processed, which can be used to execute step S11;

[0109] The cutting submodule 012 is used to obtain the location of the code that calls the system API in the code to be processed, and use the part between two adjacent codes that call the system API as a software code gene fragment to cut the code to be processed into multiple software gene code fragments, which can be used to execute step S12.

[0110] Cluster analysis module 02 is used to compare the similarity of the software gene code fragments of each sample, and cluster the samples with mixed attribute data automatically determined by the density-based cluster center to form multiple clusters of different sizes, which can be used to perform Figure 1 Step S2 described in;

[0111] The cluster analysis module 02 includes a sample position calculation submodule 021, a cluster center calculation submodule 022, an optimal stage distance calculation submodule 023 and a judgment submodule 024.

[0112] The sample position calculation submodule 021 is used to calculate the data of the two dimensions of the numerical attribute and the categorical attribute of the software gene code fragment to obtain the position of each sample and the distance between any two samples, which can be used to execute Figure 2 Step S21 described in;

[0113] The cluster center calculation submodule 022 is used to calculate the number of clusters K and the cluster center according to the cluster center automatic determination method and the distance, which can be used to perform Figure 2 Step S22 described in;

[0114] The optimal stage distance calculation submodule 023 is used to combine the particle swarm algorithm to determine the optimal stage distance of each cluster, which can be used to perform Figure 2 Step S23 described in;

[0115] The judgment submodule 024 is used to judge which cluster each sample belongs to by comparing the distance between the location of each sample and each cluster center, which can be used to perform Figure 2 Step S24 described in .

[0116] Sampling module 03 is used to perform density deviation sampling based on a variable grid for each cluster to obtain a test sample, and to aggregate the test samples obtained from all clusters to obtain a test sample set, which can be used to perform Figure 1 Step S3 described in .

[0117] The sampling module 03 includes a grid unit division submodule 031, a grid unit merging submodule 032 and a sample extraction submodule 033;

[0118] The grid unit division submodule 031 is used to sort the data of the two dimensions of the software gene code fragments in each cluster, and divide the sorted data into multiple grid units with equal depth, which can be used to execute the step S31;

[0119] The grid unit merging submodule 032 is used to calculate the density information of the grid unit, compare the similarity of the density information of adjacent grid units in two dimensions respectively, and merge grids with similar density information to form a grid space; each cluster forms a corresponding grid space, each grid space contains a different number of grids, and each grid contains a different number of samples, which can be used to execute the step S32.

[0120] The sample extraction submodule 033 is used to extract samples in each grid space, and can be used to execute the step S33.

[0121] In summary, the present invention is not limited to artificial experience analysis of sample behavior characteristics to form a test sample set, and the generated test sample set has stable performance and maintains the density distribution characteristics of the original data set. Therefore, the present invention effectively overcomes various shortcomings in the prior art and has a high industrial utilization value.

[0122] The above embodiments are merely illustrative of the principles and effects of the present invention, and are not intended to limit the present invention. Anyone familiar with the art may modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by a person of ordinary skill in the art without departing from the spirit and technical concept disclosed by the present invention shall still be covered by the claims of the present invention.

Claims

1. A method for automatically generating a security protection software test set based on software genes, characterized in that: The method comprises the following steps: S1: Prepare a sample of the data set to be tested, and extract the software gene code fragment in the sample; step S1 specifically includes: S11: Input a sample and disassemble the sample to obtain the code to be processed; S12: obtaining the position of the code that calls the system API in the code to be processed, taking the portion between two adjacent codes that call the system API as a software code gene segment, and cutting the code to be processed into multiple software gene code segments; S2: By comparing the similarity of the software gene code fragments of each sample, the samples are clustered with mixed attribute data automatically determined based on the density of the cluster center to form multiple clusters of different sizes; S3: Perform density deviation sampling based on a variable grid on each cluster to obtain a test sample, and summarize the test samples obtained from all clusters to obtain a test sample set; step S3 specifically includes: S31: sorting the data of the two dimensions of numerical attributes and categorical attributes of the software gene code fragments in each cluster, and dividing the sorted data into multiple grid units with equal depth; S32: Calculate the density information of the grid cells, compare the similarity of the density information of adjacent grid cells in two dimensions, merge grids with similar density information to form a grid space; each cluster forms a corresponding grid space, each grid space contains a different number of grids, and each grid contains a different number of samples; S33: extracting samples from each grid space; step S33 specifically includes: S331: Each grid space contains multiple grids. The number of samples contained in a grid is the density of the grid. When extracting, the sample extraction rate in the same grid is equal. The sample extraction rate in different grids is determined by their density ratio. The grid with a higher density ratio has more samples extracted. S332: The samples extracted from the grid space are test samples, and the test samples obtained in each grid space are summarized to obtain a test sample set.

2. The method for automatically generating a security protection software test set based on software genes according to claim 1, characterized in that: Step S2 specifically includes: S21: Calculating the data of the two dimensions of numerical attributes and categorical attributes of the software gene code fragment to obtain the position of each sample and the distance between any two samples; S22: Calculate the number of clusters K and the cluster centers according to the automatic cluster center determination method and the distance; S23: Combined with the particle swarm algorithm, the optimal stage distance of each cluster is determined; S24: By comparing the distance between the location of each sample and each cluster center, determine to which cluster each sample specifically belongs.

3. The method for automatically generating a security protection software test set based on software genes according to claim 2 is characterized in that: The step S24 specifically includes: S241: Compare the distance between the sample and the cluster center of the cluster; S242: When the distance is less than or equal to the optimal stage distance of the cluster, find the cluster to which the sample belongs; S243: When the distance is greater than the optimal stage distance of clustering, steps S241 and S242 are repeated until the cluster to which the sample belongs is found.

4. An automatic generation architecture of security protection software test sets based on software genes, characterized in that: The architecture includes: A preprocessing module is used to extract software gene code fragments from the sample of the data set to be detected; the preprocessing module includes a disassembly submodule and a cutting submodule, the disassembly submodule is used to disassemble the sample to obtain the code to be processed; the cutting submodule is used to obtain the location of the code that calls the system API in the code to be processed, and the part between two adjacent codes that call the system API is used as a software code gene fragment, and the code to be processed is cut into multiple software gene code fragments; The cluster analysis module is used to compare the similarity of the software gene code fragments of each sample, and to cluster the samples with mixed attribute data automatically determined by density-based cluster centers to form multiple clusters of different sizes; A sampling module is used to perform density deviation sampling based on a variable grid for each cluster to obtain a test sample, and to summarize the test samples obtained in all clusters to obtain a test sample set; the sampling module includes a grid unit division submodule, a grid unit merging submodule and a sample extraction submodule; The grid unit division submodule is used to sort the data of the two dimensions of numerical attributes and categorical attributes of the software gene code fragments in each cluster, and divide the sorted data into multiple grid units with equal depth; The grid unit merging submodule is used to calculate the density information of the grid unit, compare the similarity of the density information of adjacent grid units in two dimensions, merge grids with similar density information to form a grid space; each cluster forms a grid space correspondingly, each grid space contains a different number of grids, and each grid contains a different number of samples; The sample extraction submodule is used to extract samples in each grid space. Each grid space contains multiple grids. The number of samples contained in the grid is the grid density. When extracting, the sample extraction rate in the same grid is equal, and the sample extraction rate in different grids is determined by their density ratio. The grid with a higher density ratio has more samples extracted. The samples extracted from the grid space are test samples. The test samples obtained in each grid space are summarized to obtain a test sample set.

5. The automatic generation architecture of security protection software test set based on software gene according to claim 4 is characterized by: The cluster analysis module includes a sample position calculation submodule, a cluster center calculation submodule, an optimal stage distance calculation submodule and a judgment submodule. The sample position calculation submodule is used to calculate the data of two dimensions, namely, the numerical attribute and the categorical attribute of the software gene code fragment, to obtain the position of each sample and the distance between any two samples; The cluster center calculation submodule is used to calculate the number of clusters K and the cluster center according to the cluster center automatic determination method and the distance; The optimal stage distance calculation submodule is used to determine the optimal stage distance of each cluster in combination with the particle swarm algorithm; The judgment submodule is used to judge to which cluster each sample belongs by comparing the distance between the location of each sample and each cluster center.

Images