Automatic evidence obtaining method and system for software copyright infringement

Abstract

The invention provides an automatic evidence obtaining method and system for software copyright infringement. The method comprises the following steps: firstly, acquiring a multi-language interface calling sequence based on a target software running process to form unified semantic expression data; meanwhile, recording a sound signal of the mainboard of the electronic equipment by using a high-sensitivity sound sensor, and generating an equipment sound feature; performing joint coding on the semantic data and the sound features through a cross-modal alignment mechanism to generate multi-modal associated data; a memory enhancement unit and a machine learning technology are used to automatically learn a corresponding relation between a multi-language interface and sound features, and a cross-modal mapping relation is established; finally, cross-language plagiarism behaviors are matched based on the mapping relation, and software similarity relation data are automatically output. According to the method, code semantic analysis and hardware voiceprint features are combined, so that the cross-language software plagiarism behavior is automatically and accurately detected.

Description

Technical Field

[0001] This application relates to the technical field of software intellectual property protection, and particularly to an automated evidence collection method and system for software copyright infringement. Background Art

[0002] With the globalization of software development, cross-language programming and code reuse have become increasingly common. Plagiarists often convert source code into other programming languages to avoid traditional detection. This cross-language plagiarism behavior poses new challenges to software copyright protection, and there is an urgent need for automated detection technologies that can identify semantic equivalence between different programming languages.

[0003] Currently, there are cross-language plagiarism detection schemes based on abstract syntax tree conversion. This method converts the source code of different languages into a unified intermediate representation form, and determines plagiarism behavior by comparing the structural similarity of the intermediate representation. This scheme adopts syntax tree parsing and normalization processing technologies, which can eliminate the syntax differences between programming languages to a certain extent and extract comparable semantic features.

[0004] However, the existing scheme has obvious deficiencies. Some language-specific semantic information will be lost during the conversion process, making it difficult to accurately identify obfuscated code. At the same time, the analysis depth of the code function behavior of this scheme is limited, and it cannot effectively distinguish between reasonable reuse and malicious plagiarism, resulting in a high false positive rate. In addition, the existing method lacks the correlation analysis of hardware execution characteristics and is difficult to cope with deliberately designed anti-detection means. Summary of the Invention

[0005] Embodiments of this application provide an automated evidence collection method and system for software copyright infringement to solve the problem of insufficient automation accuracy in the prior art.

[0006] In a first aspect, embodiments of this application provide an automated evidence collection method for software copyright infringement, including: Based on the running process of the target software, collect and process the multi-language interface call sequence to form unified semantic expression data; Use the high-sensitivity sound sensor of the target software to record and process the sound signal generated by the motherboard of the electronic device running the target software to generate device sound characteristics; Through a cross-modal alignment mechanism, perform joint encoding processing on the unified semantic expression data and the device sound characteristics to generate multi-modal association data; Use the memory enhancement unit in the technical module of the target software to automatically learn the corresponding relationship between the multi-language interface and the sound characteristics in the multi-modal association data in combination with machine learning technology to generate a cross-modal mapping relationship; Based on the cross-modal mapping relationship, match cross-language plagiarism behaviors and automatically output software similarity relationship data.

[0007] Optionally, through a cross-modal alignment mechanism, jointly encode the unified semantic expression data and the device sound characteristics to generate multi-modal association data, including: Based on the energy distribution of the device sound characteristics and the call frequency of the unified semantic expression data, perform dynamic duration segmentation processing on the sound signal to generate adaptable sound segments; Utilize the timestamp information in the unified semantic expression data to perform two-way timing verification processing on the adaptable sound segments and the corresponding interface call segments to obtain verified data pairs; Through a preset symbol mapping rule, perform vectorization conversion processing on the interface call segments in the verified data pairs to generate a numerical vector sequence; Through a frequency domain transformation method, perform feature extraction processing on the adaptable sound segments in the verified data pairs to generate a frequency domain vector sequence; Based on the time alignment relationship between the numerical vector sequence and the frequency domain vector sequence, perform fusion processing through a two-channel encoding network with adjustable weights to generate multi-modal association data.

[0008] Optionally, utilize the memory enhancement unit in the technical module of the target software, and combine machine learning techniques to perform automated learning processing on the corresponding relationship between multi-language interfaces and sound characteristics in the multi-modal association data, generating a cross-modal mapping relationship, including: Perform segmentation processing on the numerical vector sequence and the frequency domain vector sequence in the multi-modal association data according to a fixed time window to generate multiple data chunks; Assign a unique identifier to each data chunk, and store the data chunk and its identifier in a dynamic memory storage area; When a new numerical vector sequence is input, perform similarity retrieval processing in the dynamic memory storage area to find historical data chunks with similar call characteristics; Extract the historical frequency domain vectors and weight information stored in the historical data chunks; Perform feature superposition processing on the historical frequency domain vectors and the frequency domain vectors, and adjust the superposition ratio according to the weight information to obtain a fused feature; Perform joint encoding processing on the fused feature and the new numerical vector sequence to generate a cross-modal mapping relationship representing the corresponding relationship between multi-language interfaces and sound characteristics.

[0009] Optionally, based on the running process of the target software, collect the call order of multi-language interfaces to form unified semantic expression data, including: By monitoring and capturing the interface call events when the target software is running, the call time, interface identifier and parameter characteristics of each interface call event are recorded to generate an original call record; Performing language type identification on the original call record, and classifying and storing interface calls in different languages according to the identification result to obtain classified call information; Inputting the classified call information into a preset mapping rule library, converting different language interfaces of the same function into a unified function code through the mapping rule library to obtain a standard call; Sorting the standard calls according to the calling time to generate a standardized calling sequence; Based on the call frequency change of the standardized call sequence, dynamically adjust the analysis window size to perform segmented processing to obtain segmented calls; Perform dependency analysis on the segmented calls, mark the order of the calls, and obtain a marked call list; The tag call column is combined with the corresponding time metadata to form unified semantic expression data.

[0010] Optionally, based on the time alignment relationship between the numerical vector sequence and the frequency domain vector sequence, a fusion process is performed through a dual-channel encoding network with adjustable weights to generate multimodal associated data, including: Performing synchronous segmentation processing on the numerical vector sequence and the frequency domain vector sequence to generate time-aligned vector segment groups, each group comprising a numerical vector segment and a corresponding frequency domain vector segment; Analyze the interface call features in each of the numerical vector segments, and calculate the dynamic fusion weight according to the call density and type distribution of the numerical vector segments; Extracting the call semantic features of the numerical vector segment and the voiceprint pattern features of the frequency domain vector segment respectively through a dual-channel processing architecture; At the feature fusion node, the call semantic features are proportionally adjusted and combined with the voiceprint pattern features according to the dynamic fusion weight to obtain a fusion feature group; The fused feature groups are spliced in original time sequence to generate multimodal associated data.

[0011] Optionally, the historical frequency domain vector and the frequency domain vector are subjected to feature superposition processing, and a superposition ratio is adjusted according to the weight information to obtain a fusion feature, including: Performing a timeliness check on the historical frequency domain vectors, retaining valid historical frequency domain vectors, and removing expired historical frequency domain vectors; Arranging the valid historical frequency domain vectors in chronological order to form a historical frequency domain vector sequence; Extract the feature points of the real-time frequency domain vector, calculate the matching degree with the historical frequency domain vectors in the historical frequency domain vector sequence, and obtain the matching degree calculation result; Determine the superposition ratio of each historical frequency domain vector according to the weight information and the matching degree calculation result; Accumulatively calculate the historical frequency domain vector and the real-time frequency domain vector according to the superposition ratio, obtain the accumulative calculation result, and truncate the values exceeding the range; Perform format conversion on the accumulative calculation result to obtain the fusion feature.

[0012] Optionally, based on the change in the call frequency of the standardized call sequence, dynamically adjust the analysis window size for segmentation processing to obtain segmented calls, including: Continuously monitor the change in the call frequency of the standardized call sequence. When the call frequency is continuously higher than the preset first threshold, reduce the analysis window. When the call frequency is continuously lower than the preset second threshold, increase the analysis window. In other cases, keep the analysis window unchanged to obtain the adjusted window duration; According to the adjusted window duration, segment the standardized call sequence into multiple time-equal segmented calls.

[0013] In a second aspect, an embodiment of the present application provides an automated forensics system for software copyright infringement, including: An acquisition module that, based on the running process of the target software, collects and processes the call order of multi-language interfaces to form unified semantic expression data; A recording module that uses the high-sensitivity sound sensor of the target software to record and process the sound signal generated by the motherboard of the electronic device running the target software to generate device sound characteristics; An encoding module that, through a cross-modal alignment mechanism, jointly encodes the unified semantic expression data and the device sound characteristics to generate multi-modal association data; A learning module that uses the memory enhancement unit in the technical module of the target software to automatically learn and process the correspondence between multi-language interfaces and sound characteristics in the multi-modal association data in combination with machine learning technology to generate a cross-modal mapping relationship; A matching module that, based on the cross-modal mapping relationship, matches cross-language plagiarism behaviors and automatically outputs software similarity relationship data.

[0014] In a third aspect, an embodiment of the present application provides a computing device, including a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement an automated forensics method for software copyright infringement as described in the first aspect above.

[0015] In a fourth aspect, an embodiment of the present application provides a computer storage medium storing a computer program, which when executed by a computer, implements an automated evidence collection method for software copyright infringement as described in the first aspect.

[0016] In an embodiment of the present application, based on the running process of a target software, the call order of multi-language interfaces is collected and processed to form unified semantic expression data; a high-sensitivity sound sensor of the target software is used to record and process the sound signal generated by the motherboard of the electronic device running the target software to generate device sound characteristics; through a cross-modal alignment mechanism, the unified semantic expression data and the device sound characteristics are jointly encoded to generate multi-modal associated data; a memory enhancement unit in the technical module of the target software is used to automatically learn the corresponding relationship between multi-language interfaces and sound characteristics in the multi-modal associated data in combination with machine learning technology to generate a cross-modal mapping relationship; based on the cross-modal mapping relationship, cross-language plagiarism behavior is matched, and software similarity relationship data is automatically output.

[0017] The technical solution of the present application has the following beneficial effects: Collecting and processing the call order of multi-language interfaces can break through the limitations of programming language syntax differences and extract semantic features representing the essence of software functions; recording the motherboard sound signal with a high-sensitivity sound sensor can obtain unique features at the hardware execution level and provide auxiliary evidence at the physical level for plagiarism detection; cross-modal joint encoding processing realizes the deep association between code semantics and hardware voiceprint, and constructs a dual verification mechanism for software functions and hardware execution; the memory enhancement unit combined with machine learning technology can automatically learn the complex mapping relationship between cross-language interfaces and voiceprint features and establish an intelligent plagiarism recognition model; the matching mechanism based on the cross-modal mapping relationship can accurately identify plagiarism behaviors after language conversion and code obfuscation and output an objective similarity analysis result.

[0018] Further, the method first dynamically segments the sound signal according to energy distribution and call frequency to generate adaptable sound segments; then uses timestamp information for two-way time sequence verification to ensure the strict correspondence between interface calls and sound segments; then generates numerical vectors and frequency domain vectors through symbol mapping and frequency domain transformation respectively; finally, feature fusion is achieved through a dual-channel encoding network with adjustable weights to generate multi-modal associated data. The technical effect of this process is to ensure the precise alignment of cross-modal data through dynamic segmentation and time sequence verification, and the dual-channel encoding network realizes the complementary advantages of semantic features and voiceprint features, providing high-quality multi-modal feature representations for subsequent plagiarism recognition.

[0019] These aspects or other aspects of the present application will be more clearly understood in the following description of the embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] To more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the accompanying drawings required for the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other accompanying drawings can be obtained based on these drawings.

[0021] Figure 1 It shows a flowchart of an automated evidence collection method for software copyright infringement provided by the present application; Figure 2 It shows a schematic structural diagram of an automated evidence collection system for software copyright infringement provided by the present application; Figure 3 It shows a schematic structural diagram of a computing device provided by the present application. Detailed implementation manners

[0022] In order to enable those skilled in the art of the present technology to better understand the solutions of the present application, the following will clearly and completely describe the technical solutions in the embodiments of the present application in conjunction with the accompanying drawings in the embodiments of the present application.

[0023] In some processes described in the specification, claims and the above accompanying drawings of the present application, there are multiple operations that appear in a specific order. However, it should be clearly understood that these operations may not be executed in the order in which they appear herein or may be executed in parallel. The operation numbers such as 101 and 102 are only used to distinguish different operations, and the numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions such as "first" and "second" in this article are used to distinguish different messages, devices, modules, etc., and do not represent a sequence, nor do they limit that "first" and "second" are of different types.

[0024] Research has found that in the field of cross - language software plagiarism detection, the existing technical solutions based on abstract syntax tree conversion have significant limitations: their single - dependence on code structure similarity analysis mode is difficult to cope with the increasingly complex plagiarism means. Especially when the plagiarist performs a deep semantic - preserving conversion on the code, key functional features will be lost during the syntax tree conversion process; at the same time, this solution completely ignores the behavioral characteristics at the hardware execution level, enabling the plagiarist to deliberately create execution differences by modifying compiler optimization options and other means, resulting in misjudgments by the detection system. The root cause of this defect lies in that the existing technology's understanding of software plagiarism still remains at the pure code level, lacking the design of a "functional semantics and hardware behavior" collaborative verification mechanism.

[0025] In view of the above problems, the present invention proposes an automated evidence collection method for software copyright infringement. Specifically, by synchronously collecting multi-language interface call sequences and motherboard voiceprint features, using dynamic segmentation and bidirectional time series verification to ensure accurate data alignment, then realizing deep feature fusion through a dual-channel coding network with adjustable weights, and finally establishing an intelligent mapping relationship between cross-language interfaces and voiceprint features by a memory enhancement unit. This method breaks through the limitations of traditional pure code analysis. Through a dual verification mechanism of "software behavior features + hardware execution fingerprints", it can not only identify semantically equivalent plagiarism after language conversion, but also detect deliberate differences created by means such as compiler optimization, effectively solving the core defects of high misjudgment rate and weak anti-evasion ability in the prior art, and providing a more reliable evidence collection means for software intellectual property protection.

[0026] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative efforts belong to the scope of protection of the present application.

[0027] Figure 1 The flowchart of an automated evidence collection method for software copyright infringement provided by an embodiment of the present application is as Figure 1 shown, and the method includes: 101. Based on the running process of the target software, collect and process the multi-language interface call order to form unified semantic expression data; In this step, the multi-language interface call order refers to the call relationship sequence between different programming languages during the running process of the software; The unified semantic expression data refers to the function description data that converts different language interfaces into a unified format.

[0028] In the embodiment of the present application, first, when the target software is running, all cross-language interface call events are captured in real time through a system monitoring mechanism, and the occurrence time, call party information, and called interface features of each call event are recorded. Secondly, the language types of the captured call events are identified to distinguish the interface calls implemented in different programming languages. Then, the identified call events are input into a preset semantic conversion rule library to map interfaces with the same function but different languages to a unified function coding system. Then, according to the time sequence of call occurrence, the converted function codes are organized into a time sequence call sequence. Finally, the time sequence is normalized to ensure that the function codes after different language conversions have a consistent expression format, and the final unified semantic expression data is generated.

[0029] In a practical case, taking software containing two programming languages as an example, first monitor the cross-language call behavior during software operation; secondly record the time when the call occurs and the interface characteristics; then map the interfaces of different languages to a unified function classification system; finally generate a function call sequence sorted by time.

[0030] 102. Use the high-sensitivity sound sensor of the target software to record and process the sound signals generated by the motherboard of the electronic device running the target software, and generate device sound characteristics. In this step, the high-sensitivity sound sensor refers to a dedicated device capable of collecting the operating sounds of an electronic device. Device sound characteristics refer to the sound characteristic data reflecting the hardware working state during software operation.

[0031] In the embodiments of the present application, first select the key chip positions on the motherboard of the target device and deploy a high-sensitivity sound sensor array. Secondly, configure the sound acquisition parameters, including the sampling rate, gain, and filtering range, to ensure that the unique electromagnetic sound pattern characteristics during software operation can be captured. Then, during the operation of the target software, synchronously start the sound signal acquisition and record the sound wave signals within the complete operation cycle. Then, preprocess the collected original sound wave signals to remove environmental noise and interference in irrelevant frequency bands. Finally, analyze the spectral characteristics of the sound wave signals through a feature extraction algorithm, extract the frequency-domain energy distribution pattern that can characterize the software operation characteristics, and generate device sound characteristic data.

[0032] Continue to monitor the operation of the above software. First, install a sound sensor at the key position on the motherboard; secondly, set the acquisition parameters according to the software operation characteristics; then record the sound signals during the software execution process; finally, extract the distinguishable sound characteristics.

[0033] 103. Through a cross-modal alignment mechanism, perform joint encoding processing on the unified semantic expression data and the device sound characteristics to generate multi-modal associated data. In this step, the cross-modal alignment mechanism refers to a processing method for coordinating the time relationships of different types of data. Joint encoding processing refers to the process of converting data from different sources into associated features.

[0034] In the embodiments of the present application, first, the call time distribution characteristics in the unified semantic expression data are analyzed to determine the key call dense areas and stable areas. Second, the segmentation strategy of the voice signal is dynamically adjusted according to the change of call density, and a finer time window is adopted in the call dense area. Then, using the accurate timestamp information, the semantic call segments are strictly matched with the corresponding voice signal segments to establish cross-modal data pairs. Then, through the feature transformation method, the matched semantic call segments are converted into numerical vectors, and the voice signal segments are converted into frequency domain feature vectors. Finally, a dual-channel processing architecture is designed to perform feature interaction and fusion at a specific level while maintaining the independence of the two types of features, generating multi-modal data containing semantic and voiceprint correlation information.

[0035] Continuing to process the above case, first, analyze the time correspondence between function calls and voice signals; second, establish matching pairs of call segments and voice segments; then, convert the matched data into features in a unified format; finally, generate feature data containing the association between functions and voices.

[0036] 104. Use the memory enhancement unit in the technical module of the target software to automatically learn and process the correspondence between multi-language interfaces and voice features in the multi-modal association data in combination with machine learning technology to generate a cross-modal mapping relationship; In this step, the memory enhancement unit refers to a computing module with information storage and processing capabilities; The cross-modal mapping relationship refers to an association model established between different data.

[0037] In the embodiments of the present application, first, a processing architecture with a memory storage mechanism is constructed, and a dynamic memory matrix is designed to save typical feature patterns. Second, the multi-modal association data is input into the processing architecture, and the association rules between semantic calls and voiceprint features are learned through the training process. Then, during the training process, the memory unit automatically identifies and stores the repeatedly occurring feature combination patterns to establish long-term memory. Then, through the online learning mechanism, the content stored in the memory is continuously updated to adapt to new feature changes. Finally, at the output layer of the processing architecture, a cross-modal mapping model that can accurately reflect the correspondence between multi-language interfaces and voiceprint features is generated.

[0038] Continuing the above case, first, construct a processing architecture with a memory function; second, input the association data of functions and voices for training; then, store the typical feature correspondence patterns; finally, generate a mapping model that can recognize the association between functions and voices.

[0039] 105. Based on the cross-modal mapping relationship, match cross-language plagiarism behaviors and automatically output software similarity relationship data.

[0040] In this step, cross-language plagiarism behavior refers to code plagiarism behavior achieved by converting programming languages; Similarity relationship data refers to the result data reflecting the similarity degree of software functions.

[0041] In the embodiments of the present application, first, load the trained cross-modal mapping model, and initialize the comparison parameters and threshold settings. Second, input the semantic expression data and device sound features of the software to be detected, and convert them into representations in a unified feature space through the mapping model. Then, calculate the similarity metric between the software to be detected and the target software in the feature space, and evaluate the similarity degree of the two in function implementation. Next, comprehensively analyze the matching results in the two dimensions of semantics and voiceprint to eliminate possible misjudgments in a single dimension. Finally, generate an appraisal report containing the overall similarity evaluation and detailed comparison results, and automatically output the software similarity relationship data.

[0042] To complete the above case, first load the trained function and sound association model; second, input the feature data of the software to be detected; then calculate the similarity with the target software through the model; finally, output the result report including the plagiarism judgment.

[0043] In summary, steps 101 to 105 construct a complete software infringement evidence collection process. Through the multi-modal analysis of function calls and hardware sounds, it realizes the effective identification of cross-language plagiarism behavior and solves the detection problem of traditional methods in language conversion scenarios.

[0044] In order to further improve the efficiency and accuracy of cross-modal feature learning, in some embodiments, in step 103, through a cross-modal alignment mechanism, joint encoding processing is performed on the unified semantic expression data and the device sound features to generate multi-modal association data, including: 201. Perform dynamic duration segmentation processing on the sound signal based on the energy distribution of the device sound features and the call frequency of the unified semantic expression data to generate adaptable sound segments; In step 201, the energy distribution refers to the intensity characteristics of the sound signal in different frequency bands; The call frequency refers to the number of interface calls per unit time; The adaptable sound segment refers to the sound signal segmentation with the duration dynamically adjusted according to the call characteristics.

[0045] In the embodiments of the present application, first analyze the spectral energy distribution characteristics of the device sound signal to identify the energy concentration region; second, count the change law of the interface call frequency in the unified semantic expression data; then dynamically adjust the sound segmentation duration according to the high or low call frequency, with shorter segments in the high-frequency call region and longer segments in the low-frequency region; finally, generate adaptable sound segments matching the interface call characteristics.

[0046] 202. Utilize the timestamp information in the unified semantic expression data to perform two-way timing verification processing on the adapted sound segment and the corresponding interface call segment, obtaining a pair of verified data. In step 202, the timestamp information refers to the data recording the occurrence moment of the interface call. Two-way timing verification means verifying the data correspondence relationship from two dimensions of time and event. The pair of verified data refers to the combination of the interface call segment and the sound segment that has passed the verification.

[0047] In the embodiment of the present application, first, extract the timestamp information of the interface call segment; second, locate the corresponding time interval in the adapted sound segment; then verify from the time dimension whether the sound segment completely covers the call period; then verify the relevance between the call behavior and the sound characteristics from the event dimension; finally, combine the call segment and the sound segment that have passed the verification into a pair of verified data.

[0048] 203. Through a preset symbol mapping rule, perform vectorization conversion processing on the interface call segment in the pair of verified data to generate a numerical vector sequence. In step 203, the symbol mapping rule refers to the corresponding relationship that converts the interface function symbol into a numerical value. The numerical vector sequence refers to the digital representation of the interface function characteristics.

[0049] In the embodiment of the present application, first, load a preset interface function symbol mapping table; second, convert the interface call symbol in the pair of verified data into a function code; then generate a numerical vector according to the semantic relationship of the function code; finally, arrange the conversion results in chronological order to form a numerical vector sequence.

[0050] 204. Through a frequency domain transformation method, perform feature extraction processing on the adapted sound segment in the pair of verified data to generate a frequency domain vector sequence. In step 204, the frequency domain transformation refers to the method of converting the time domain sound signal into a frequency domain representation. The frequency domain vector sequence refers to the digital representation of the sound signal spectrum characteristics.

[0051] In the embodiment of the present application, first, perform frame division processing on the adapted sound segment; second, apply a frequency domain transformation algorithm to each frame of the signal; then extract the energy distribution parameters of the characteristic frequency band; finally, organize the characteristic parameters in chronological order into a frequency domain vector sequence.

[0052] 205. Based on the time alignment relationship between the numerical vector sequence and the frequency domain vector sequence, perform fusion processing through a two-channel coding network with adjustable weights to generate multi-modal associated data.

[0053] In step 205, the time alignment relationship refers to the time correspondence relationship between two types of vector sequences; The dual-channel encoding network refers to a neural network structure that processes two types of features in parallel.

[0054] In the embodiments of the present application, first, a time correspondence table between numerical vectors and frequency-domain vectors is established; second, a dual-encoding network architecture with independent channels is designed; then, a feature interaction mechanism is introduced in the middle layer of the network; then, the fusion weights are dynamically adjusted according to the call importance; finally, fusion data containing cross-modal correlation information is generated at the output layer of the network.

[0055] The following is a specific example: In the scenario of detecting Java and Python code plagiarism, first, the mainboard sound signal is divided into sound segments of different durations according to the density of Python extension calls; second, the matching degree of the corresponding sound segments is verified using the accurate timestamps of Java native method calls; then, Java method calls are converted into numerical vectors with unified functional encoding; at the same time, frequency-domain features are extracted from the matching sound segments; finally, the two types of features are fused through a dual-channel network to generate multi-modal correlation data that can identify cross-language plagiarism.

[0056] In summary, steps 201 to 205 ensure a fine analysis of the key call area through dynamic segmentation, strict timing verification ensures the precise correspondence of cross-modal data, dual-channel fusion realizes the deep association of semantic and voiceprint features, and finally forms a multi-modal feature representation that can effectively identify cross-language plagiarism.

[0057] In order to establish a more perfect cross-modal feature learning mechanism, in some embodiments, in step 104, a memory enhancement unit in the technical module of the target software is used to perform automated learning processing on the correspondence relationship between multi-language interfaces and voice features in the multi-modal correlation data in combination with machine learning techniques, and a cross-modal mapping relationship is generated, including: 301. The numerical vector sequence and the frequency-domain vector sequence in the multi-modal correlation data are segmented according to a fixed time window to generate multiple data chunks; In step 301, the fixed time window refers to a preset equal-length time interval for analyzing feature data, and the interval length is determined according to the typical software operation characteristics; A data chunk refers to a feature data unit containing numerical vectors and frequency-domain vectors intercepted within a fixed time window, and each data chunk maintains complete time continuity.

[0058] In the embodiments of the present application, first, the optimal time window length is determined by analyzing a large number of software operation samples, and this length needs to balance the feature extraction accuracy and the calculation efficiency; second, strict synchronous time alignment processing is performed on the input numerical vector sequence and frequency domain vector sequence to ensure that the two types of features are completely matched in the time dimension; then, the two types of feature sequences are accurately segmented according to the determined time window boundaries, and each segmentation point is smoothed to avoid feature breaks; finally, integrity verification is performed on the feature data within each time window, incomplete data units are removed, and qualified data chunks are retained for subsequent processing.

[0059] 302. Assign a unique identifier to each of the data chunks, and store the data chunks and their identifiers in the dynamic memory storage area; In step 302, the unique identifier refers to a unique identification code generated based on the feature content and time information of the data chunk, and this code includes information such as a timestamp, a feature fingerprint, and a data type; The dynamic memory storage area refers to a feature storage repository with dynamic update capabilities implemented using a specific data structure, which supports fast write, query, and update operations.

[0060] In the embodiments of the present application, first, a multi-level identifier generation algorithm is designed, which comprehensively considers factors such as the time position, feature distribution, and association relationship of the data chunks; second, a memory storage area with a cache optimization mechanism is constructed, and a hierarchical storage strategy is adopted to manage feature data with different timeliness; then, a two-way index relationship is established between the data chunks and the identifiers, which supports quickly locating the identifier through the feature content and quickly retrieving the data chunk through the identifier; finally, a dynamic maintenance mechanism for the storage area is implemented, and low-value data is periodically cleaned up while high-value feature patterns are retained.

[0061] 303. When a new numerical vector sequence is input, perform similarity retrieval processing in the dynamic memory storage area to find historical data chunks with similar call features; In step 303, the similarity retrieval refers to the process of finding historical data chunks that match the current input features in the memory storage area, and this process needs to consider the multi-dimensional similarity of the features; The call feature refers to the regular information such as the call frequency, call pattern, and parameter features shown in the interface call sequence.

[0062] In the embodiments of the present application, first, key feature indicators are extracted from the newly input numerical vector sequence, including call density, call type distribution, parameter features, etc.; second, a multi-level retrieval strategy is designed. First, a quick rough retrieval is performed in the memory storage area to screen out a set of candidate data chunks, and then a fine feature matching is carried out; then, a multi-dimensional feature similarity evaluation model is constructed, comprehensively considering the temporal features, statistical features, and structural features of the call sequence; finally, the candidate results are sorted according to the similarity score, and the most representative historical data chunk is selected for subsequent processing.

[0063] 304. Extract the historical frequency-domain vector and weight information stored in the historical data chunk; In step 304, the historical frequency-domain vector refers to the acoustic fingerprint feature data stored in the memory storage area and associated with a specific interface call pattern, and these data record the hardware acoustic features during historical software operation; The weight information refers to the quantization parameter used to characterize the importance and reliability of the data chunk, and this parameter will be dynamically adjusted during use.

[0064] In the embodiments of the present application, first, the physical location of the target historical data chunk in the memory storage area is located according to the similarity retrieval result; second, the complete frequency-domain feature vector stored in the data chunk is read, including key features such as spectral envelope and energy distribution; then, the weight parameter associated with the data chunk is obtained, and this parameter reflects the historical usage effect and feature quality; finally, the validity of the extracted historical features is verified to ensure that they can be used for the current feature fusion processing.

[0065] 305. Perform feature superposition processing on the historical frequency-domain vector and the frequency-domain vector, and adjust the superposition ratio according to the weight information to obtain a fusion feature; In step 305, feature superposition refers to the processing method of organically combining historical features and current features, and this method needs to maintain the spatio-temporal consistency of the features; The fusion feature refers to the enhanced feature representation containing historical and current information generated after superposition processing.

[0066] In the embodiments of the present application, first, time-axis alignment processing is performed on the historical frequency-domain vector and the current frequency-domain vector to eliminate temporal deviation; second, the fusion coefficient of the historical features is calculated according to the weight information, and this coefficient determines the contribution degree of the historical features in the final result; then, a feature mixing algorithm is designed to achieve smooth transition and natural fusion of the features in the frequency-domain space; finally, the quality of the fusion result is checked to generate an enhanced feature representation that meets the requirements for subsequent modeling.

[0067] 306. Perform joint coding processing on the fusion feature and the new numerical vector sequence to generate a cross-modal mapping relationship representing the corresponding relationship between the multi-language interface and the voice features.

[0068] In step 306, joint encoding refers to the process of integrating feature data from different sources and types into a unified representation. The cross-modal mapping relationship refers to a mathematical model established through machine learning that can accurately reflect the corresponding rules between a multilingual interface and a hardware voiceprint.

[0069] In the embodiments of the present application, first, a neural network architecture with multi-channel input capabilities is designed. This architecture includes independent feature processing channels and a shared feature interaction layer. Secondly, the fused voiceprint features and a new numerical vector sequence are input into the network, and the feature representations of each layer are calculated through forward propagation. Then, dedicated feature interaction nodes are set in the network to promote information exchange between features of different modalities. Finally, the network parameters are optimized through end-to-end training to output a cross-modal mapping model with strong generalization ability.

[0070] The following is a specific example: When analyzing the plagiarism behavior of a cross-platform software, first, a 300ms analysis window is set, and the C# interface call sequence and the corresponding motherboard voiceprint features are segmented into multiple data chunks. An identifier containing time information and a feature fingerprint is generated for each chunk and stored in a memory bank with an LRU cache mechanism. When detecting suspected plagiarized Python code, the C# code chunks with similar call patterns are retrieved from the memory bank. After extracting the historical voiceprint features stored in these chunks, different weights are assigned according to their historical usage effects. These voiceprint features are fused with the voiceprint of the current Python code according to the weights to generate enhanced features. Finally, a mapping relationship between the Python interface and the voiceprint is established through a deep neural network to accurately identify the plagiarism behavior.

[0071] In summary, steps 301 to 306 ensure the quality of feature extraction through refined time window management, achieve long-term knowledge accumulation through an intelligent memory mechanism, optimize the feature fusion effect through dynamic weight adjustment, and establish a robust cross-modal association model through deep joint encoding. Finally, a plagiarism detection system that can effectively handle various code transformations and language conversions is constructed, significantly improving the accuracy and reliability of software intellectual property protection.

[0072] In order to establish a more perfect multi-language interface call analysis mechanism, in some embodiments, in step 101, based on the running process of the target software, the multi-language interface call order is collected and processed to form unified semantic expression data, including: 401. By monitoring and capturing the interface call events during the running of the target software, recording the call time, interface identifier, and parameter features of each interface call event, and generating an original call record. In step 401, an interface call event refers to the cross-language function or method call behavior that occurs during the running of the software. The call time refers to the exact time point when the call occurs; The interface identifier refers to the name or number that uniquely distinguishes different interfaces; The parameter characteristics refer to the parameter type and quantity information passed during the call; The original call record refers to the set of raw call data that has not been processed.

[0073] In the embodiments of the present application, first, a lightweight monitoring agent is deployed in the target software running environment, and the agent captures all cross-language call events through the system-level hook mechanism; second, a detailed record is generated for each captured call event, including a nanosecond-level time stamp, a complete interface path, and a summary of parameter characteristics; then, a preliminary verification is performed on the records to eliminate incomplete call events; finally, all valid records are temporarily stored in chronological order to form a structured set of original call records.

[0074] 402. Perform language type recognition on the original call record, and classify and store the interface calls in different languages according to the recognition result to obtain classified call information; In step 402, language type recognition refers to the process of determining the programming language to which the interface call belongs; The classified call information refers to the call data sorted by language.

[0075] In the embodiments of the present application, first, a multi-language feature library is constructed, including the interface naming rules and call conventions unique to each language; second, a two-level recognition strategy is designed, first determining obvious features through quick matching and then processing complex situations through in-depth analysis; then, a language type label is added to each call record; finally, the call records are grouped and stored according to language categories while maintaining the original time order unchanged.

[0076] 403. Input the classified call information into a preset mapping rule library, and convert different language interfaces with the same function into a unified function code through the mapping rule library to obtain a standard call; In step 403, the mapping rule library refers to a knowledge base that stores the corresponding relationships of multi-language interface functions; The unified function code refers to a function identifier independent of a specific language; The standard call refers to the normalized call representation after conversion.

[0077] In the embodiments of the present application, first, a hierarchical function classification system is designed to cover common software function categories; second, mapping rules from multi-language interfaces to function codes are established, considering interface semantics and parameter characteristics; then, batch conversion is performed on the classified call information to map the same function interfaces in different languages to a unified code; finally, a consistency check is performed on the conversion result to ensure semantic integrity.

[0078] 404. Sort the standard calls according to the call time to generate a standardized call sequence; In step 404, the standardized call sequence refers to a set of unified function codes sorted by time.

[0079] In the embodiment of the present application, first, extract the timestamp information of all standard calls; second, design an efficient sorting algorithm to process large-scale call data; then, check the temporal continuity of the sorting result and repair possible misalignment problems; finally, generate a standardized call sequence with a strict time order.

[0080] 405. Dynamically adjust the analysis window size for segmented processing based on the call frequency change of the standardized call sequence to obtain segmented calls; In step 405, the call frequency refers to the number of interface calls per unit time; The analysis window refers to the time interval used for segmented processing; The segmented call refers to the call subsequence within the window.

[0081] In the embodiment of the present application, first, calculate the moving frequency of the call sequence in real time; second, set multiple levels of frequency thresholds to trigger window adjustment; then, adopt a progressive adjustment strategy to avoid mutations; finally, split the call sequence according to the current window size to ensure the integrity of segmentation.

[0082] 406. Analyze the dependency relationship of the segmented calls, mark the sequence of the calls before and after, and obtain a marked call sequence; In step 406, the dependency relationship refers to the sequential execution constraint between calls; The marked call sequence refers to the call sequence with added dependency information.

[0083] In the embodiment of the present application, first, analyze the parameter passing relationship in the segmented calls; second, identify potential resource competition situations; then, mark the key sequential constraints; finally, generate a call sequence containing complete dependency information.

[0084] 407. Combine the marked call sequence with the corresponding time metadata to form unified semantic expression data.

[0085] In step 407, the time metadata refers to additional information recording time characteristics; The unified semantic expression data refers to the final generated standardized call representation.

[0086] In the embodiment of the present application, first, extract the time characteristic metadata of each segment; second, design a compact data structure to store the dependency relationship; then, associate the marked call sequence with the metadata; finally, generate unified expression data with complete semantic information.

[0087] The following is a specific example: When analyzing a cross - language e - commerce system, first monitor the API calls of Java and Python, and record the call details of the payment interface; identify that the processPayment in Java and the execute_payment in Python belong to the same type of function, and uniformly encode them as PAY; after sorting by call time, find the high - frequency call periods, and automatically narrow the analysis window; identify the verification interface dependency that must be called before payment; finally, generate call flow data with complete semantics.

[0088] In summary, steps 401 to 407 realize the accurate analysis and unified representation of multi - language interfaces through refined call collection and processing processes, provide a high - quality semantic data basis for subsequent plagiarism detection, and effectively solve the problem of cross - language code analysis.

[0089] In order to establish a more accurate and perfect multi - modal data fusion mechanism, in some embodiments, in step 205, based on the time alignment relationship between the numerical vector sequence and the frequency - domain vector sequence, fusion processing is performed through a two - channel encoding network with adjustable weights to generate multi - modal correlation data, including: 501. Perform synchronous segmentation processing on the numerical vector sequence and the frequency - domain vector sequence to generate a group of time - aligned vector segments, where each group contains a numerical vector segment and a corresponding frequency - domain vector segment; In step 501, the synchronous segmentation processing refers to the process of precisely aligning and segmenting the numerical vector sequence and the frequency - domain vector sequence in the time dimension, and it is necessary to ensure that the two types of feature data within each segment have a strict time correspondence relationship; The vector segment group refers to the paired combination of the numerical vector segment and the frequency - domain vector segment intercepted within the same time interval, and each vector segment group represents the multi - modal features within a complete time segment.

[0090] In the embodiments of the present application, first, perform high - precision time synchronization calibration on the numerical vector sequence and the frequency - domain vector sequence to establish a millisecond - level time correspondence table; secondly, design an adaptive segmentation algorithm to dynamically determine the optimal segmentation point according to the feature change rate, and adopt a finer - grained segmentation in the high - dynamic region; then, perform strictly synchronous segmentation operations on the two types of feature sequences to ensure that each segmentation interval contains a complete feature evolution process; finally, perform quality inspection and pairing verification on the numerical vectors and frequency - domain vectors within each time segment to generate a set of vector segment groups with strict time alignment relationships.

[0091] 502. Analyze the interface call characteristics in each numerical vector segment, and calculate the dynamic fusion weight according to the call density and type distribution of the numerical vector segment; In step 502, the interface call feature is the call behavior characteristic encoded in the numerical vector, including call sequence pattern, parameter passing relationship, execution context, etc.; The call density refers to the number of effective interface calls that occur within a specific time window; The type distribution refers to the proportion of calls of different functional categories in the total call volume; The dynamic fusion weight refers to the fusion ratio coefficient calculated in real time according to the feature importance and reliability.

[0092] In the embodiment of the present application, first, the sliding window technology is used to analyze the call density change curve in the numerical vector segment to identify the call hot spot area; secondly, the feature decomposition method is used to extract the call type distribution feature to quantify the call ratio of various functions; then, based on the preset weight calculation model, factors such as call density, type distribution, and context relevance are comprehensively considered to calculate the initial weight; finally, a time decay factor is introduced to dynamically adjust the weight to ensure the appropriate strengthening of recent features and generate the final dynamic weight value for feature fusion.

[0093] 503. Respectively extract the call semantic feature of the numerical vector segment and the voiceprint pattern feature of the frequency domain vector segment through a dual-channel processing architecture; In step 503, the dual-channel processing architecture refers to a neural network structure with independent feature processing paths, and each path is dedicated to processing the feature data of one modality; The call semantic feature refers to the high-level abstract representation that reflects the interface function semantics extracted from the numerical vector; The voiceprint pattern feature refers to the discriminative pattern that characterizes the unique acoustic features during the operation of the hardware extracted from the frequency domain vector.

[0094] In the embodiment of the present application, first, a deep neural network architecture with two independent feature processing channels is constructed, and each channel contains a multi-layer feature transformation structure; secondly, a special feature extraction layer is designed in the first channel to gradually abstract the call semantic feature from the numerical vector and capture the functional intention and execution logic of the interface call; then, multi-scale frequency domain feature analysis is implemented in the second channel to extract the discriminative voiceprint pattern feature from the frequency domain vector to reflect the unique law of hardware execution; finally, the deeply processed semantic feature and voiceprint feature are respectively output at the high level of the two channels to provide high-quality feature representations for subsequent fusion.

[0095] 504. At the feature fusion node, perform proportional adjustment and combined processing on the call semantic feature and the voiceprint pattern feature according to the dynamic fusion weight to obtain a fusion feature group; In step 504, the feature fusion node refers to a specific functional layer specially designed in the network for multi-modal feature combination; Ratio adjustment refers to the process of precisely controlling the feature contribution degree according to the dynamic weight; combined processing refers to the algorithm for organically integrating different modality features; The fused feature group refers to the new feature representation generated after optimized combination.

[0096] In the embodiments of the present application, first, a dedicated feature fusion layer is designed in the network, which includes a complete mechanism for feature interaction and combination; second, the contribution ratio of each modality feature is calculated according to the dynamic fusion weight, and a weighted fusion strategy is adopted for precise control; then, a multi-level feature combination algorithm is implemented, with preliminary fusion in the low-dimensional space first and then deep integration in the high-dimensional space; finally, the quality of the fusion result is evaluated and optimized, and a fused feature group that retains the advantages of the original features and has new representation capabilities is output.

[0097] 505. Concatenate the fused feature groups according to the original time sequence to generate multi-modal associated data.

[0098] In step 505, the original time sequence refers to the initial time order and position relationship of the feature data; The multi-modal associated data refers to the finally generated feature sequence that contains complete time information and cross-modal associations.

[0099] In the embodiments of the present application, first, a time position index of the fused feature group is established to accurately record the time information of each feature group in the original sequence; second, a feature concatenation algorithm with time sequence preservation ability is designed to ensure that the time continuity is not damaged; then, smooth transition processing between segments is implemented to eliminate possible concatenation traces; finally, the quality of the complete multi-modal associated data is inspected and optimized to generate a final output result with strict time consistency and rich feature expressions.

[0100] The following is a specific example: When analyzing a cross-language video processing framework, first, the Java interface call features and GPU voiceprint features are accurately segmented according to the video frame processing stage; a relatively large fusion weight is calculated for the high-density calls in the special effect rendering stage; the semantic features of the special effect algorithm and the voiceprint features of GPU rendering are respectively extracted through a dual-channel network; the two types of features are organically combined according to the weight in the fusion layer; finally, the features of each processing stage are concatenated to form a complete video processing pipeline representation, and the plagiarized code rewritten in C++ but maintaining the same processing logic is successfully identified.

[0101] In summary, steps 501 to 505 build a complete cross-modal feature fusion pipeline through refined time alignment processing, intelligent dynamic weight calculation, professional dual-channel feature extraction and optimized feature fusion strategy, realize in-depth analysis and intelligent integration of multi-source heterogeneous data, provide a more comprehensive and accurate feature representation basis for software behavior recognition, and significantly improve the performance and reliability of the plagiarism detection system.

[0102] In order to establish a more accurate feature fusion mechanism, in some embodiments, in step 305, the historical frequency domain vector and the frequency domain vector are subjected to feature superposition processing, and the superposition ratio is adjusted according to the weight information to obtain a fusion feature, including: 601. Perform a timeliness check on the historical frequency domain vectors, retain valid historical frequency domain vectors, and remove expired historical frequency domain vectors; In step 601, timeliness check refers to the process of comprehensively evaluating the freshness and validity of historical feature data, which needs to consider multiple dimensions such as data collection time, usage frequency, and feature stability; Valid historical frequency domain vectors refer to voiceprint feature data that have passed time-limited inspection and have high reference value. These data should have clear collection time stamps and complete usage records. Expired historical frequency domain vectors refer to voiceprint feature data that has exceeded the validity period or does not meet quality standards. These data may lose their reference value due to software updates or hardware changes.

[0103] In the embodiment of the present application, firstly, a multi-dimensional timeliness evaluation system is established, which comprehensively considers factors such as the time attenuation law, feature drift and actual usage effect; secondly, a detailed usage file is established for each historical frequency domain vector, recording key information such as the acquisition time, number of calls and matching accuracy; then, an intelligent timeliness determination algorithm is designed to dynamically calculate the effectiveness score of each historical feature; finally, a hierarchical processing strategy is implemented to retain high-quality features for a long time, mark critical features, and eliminate expired features in a timely manner to ensure the overall quality of the feature library.

[0104] 602. Arrange the valid historical frequency domain vectors in chronological order to form a historical frequency domain vector sequence; In step 602, the historical frequency domain vector sequence refers to a set of voiceprint features that are organized in strict time order after time-effect screening, and the sequence reflects the temporal evolution law of software operation characteristics.

[0105] In the embodiments of the present application, first, an efficient feature indexing mechanism is designed to quickly locate the time positions of each valid historical frequency-domain vector; second, a stable sorting algorithm is implemented to process large-scale historical feature data; then, a time-series continuity check mechanism is established to identify and repair possible time breaks; finally, a historical feature sequence with complete time information is generated, providing a reliable basis for subsequent matching analysis.

[0106] 603. Extract feature points of the real-time frequency-domain vector, calculate the matching degree with the historical frequency-domain vectors in the historical frequency-domain vector sequence, and obtain the matching degree calculation result. In step 603, the feature point refers to the key spectral components with high distinctiveness in the frequency-domain vector, which can effectively represent the voiceprint characteristics of specific software behaviors. The matching degree calculation refers to the process of quantifying the correlation degree between real-time features and historical features through multi-dimensional similarity evaluation. The matching degree calculation result refers to the similarity score after normalization processing, with a range between 0 and 1.

[0107] In the embodiments of the present application, first, a stable set of feature points is extracted from the real-time frequency-domain vector, including key features such as peak frequency, energy distribution, and spectral envelope; second, a multi-level matching model is constructed, comprehensively considering dimensions such as spectral shape, energy distribution, and time evolution; then, an anti-interference similarity calculation algorithm is designed to eliminate the influence of environmental noise and hardware differences; finally, the calculation result is normalized and the credibility is verified, and a reliable matching degree score is output.

[0108] 604. Determine the superposition ratio of each historical frequency-domain vector according to the weight information and the matching degree calculation result. In step 604, the superposition ratio refers to the fusion weight dynamically determined according to the feature quality and matching degree, which determines the contribution degree of historical features in the final fusion result.

[0109] In the embodiments of the present application, first, a weight calculation model is established, comprehensively considering factors such as basic weight, matching degree score, and aging coefficient; second, a dynamic adjustment strategy is designed to optimize the weight parameters according to real-time feedback; then, weight normalization processing is implemented to ensure that the sum of the weights of each historical feature meets the requirements; finally, the weight credibility is verified to eliminate abnormal weight values and ensure the stability of the fusion process.

[0110] 605. Perform cumulative calculation on the historical frequency-domain vector and the real-time frequency-domain vector according to the superposition ratio to obtain the cumulative calculation result, and perform truncation processing on the values exceeding the range. In step 605, the cumulative calculation refers to the process of linearly combining historical features and real-time features according to accurate weights; the truncation processing refers to a protection mechanism for safely restricting the fusion result exceeding the normal range.

[0111] In the embodiment of the present application, a high-precision weighted fusion algorithm is first implemented to ensure the correct combination of each feature component; secondly, a progressive fusion strategy is designed to gradually adjust the fusion strength; then a real-time monitoring mechanism is established to detect abnormal values in the fusion process; finally, intelligent truncation processing is implemented to eliminate the influence of extreme values while retaining the essence of the features.

[0112] 606. Perform format conversion on the accumulated calculation result to obtain a fusion feature.

[0113] In step 606, format conversion refers to the process of adjusting the fusion result to a standard feature representation to ensure compatibility with subsequent processing steps.

[0114] In the embodiment of the present application, the format specification of the fusion result is first checked to identify the data items that need to be adjusted; secondly, necessary type conversion and range adjustment are performed; then feature standardization is performed to eliminate dimensional differences; finally, the conversion result is quality verified to generate final features that meet the requirements.

[0115] Here is a specific example: When analyzing the plagiarism behavior of a cross-platform database system, we first screened out the Oracle call voiceprint features collected within the past six months from the feature library, and eliminated the old features that became invalid due to server upgrades; strictly sorted these valid features by collection time to form a complete historical feature sequence; monitored the voiceprint features of the suspected plagiarized PostgreSQL system in real time, and extracted the feature points of its query processing stage; performed a fine match with the historical Oracle voiceprints, and found that the two were highly similar in index scanning voiceprints; based on the matching results and the preset weight model, determined the fusion ratio of Oracle voiceprints to be 0.6; weighted fused the historical Oracle voiceprints with the real-time PostgreSQL voiceprints according to this ratio, and smoothed the abnormal peaks; and finally generated enhanced fusion features, which clearly showed the similarities between the two databases in query optimizer implementation, providing solid evidence for plagiarism judgment.

[0116] In summary, steps 601 to 606 ensure feature quality through strict time management, maintain feature continuity through precise timing organization, evaluate feature correlation through intelligent matching calculation, optimize fusion effect through dynamic weight adjustment, and ensure result reliability through safe numerical processing. Finally, a complete feature fusion pipeline is constructed, which provides more accurate and reliable feature representation for software plagiarism detection and significantly improves the detection accuracy and anti-interference ability of the system.

[0117] In order to establish a more intelligent call sequence analysis method, in some embodiments, in step 405, based on the change in the call frequency of the standardized call sequence, the analysis window size is dynamically adjusted for segmentation processing to obtain segmented calls, including: 701. Continuously monitor the change in the call frequency of the standardized call sequence. When the call frequency continuously exceeds a preset first threshold, reduce the analysis window. When the call frequency continuously is lower than a preset second threshold, increase the analysis window. In other cases, keep the analysis window unchanged to obtain the adjusted window duration; In step 701, the change in call frequency refers to the dynamic fluctuation of the number of interface calls per unit time; The preset first threshold refers to the high-frequency critical value that triggers window reduction; The preset second threshold refers to the low-frequency critical value that triggers window expansion; The adjusted window duration refers to the length of the analysis interval dynamically optimized according to the call frequency.

[0118] In the embodiments of the present application, first, a real-time call frequency monitoring mechanism is established, and the sliding window technology is used to count the number of calls per unit time; second, a frequency state determination model is designed to accurately identify three states: high frequency, low frequency, and normal; then, a progressive window adjustment strategy is implemented to avoid sudden changes in the analysis window; finally, the stability of the adjustment result is verified to ensure that the window duration is suitable for the current call characteristics.

[0119] 702. According to the adjusted window duration, segment the standardized call sequence into multiple time-equal segmented calls.

[0120] In step 702, the time-equal segmented calls refer to the call subsequences divided according to a unified duration.

[0121] In the embodiments of the present application, first, the optimal segmentation scheme is calculated according to the adjusted window duration; second, a segmentation algorithm that takes into account both efficiency and accuracy is designed; then, the standardized call sequence is accurately segmented to ensure that each segment contains complete call characteristics; finally, the quality of the segmentation result is checked to correct boundary anomalies.

[0122] The following is a specific example: When analyzing the order processing flow of an e-commerce system, it is first detected that the call frequency of the payment interface suddenly increases to 50 times per second, exceeding the preset first threshold of 45 times. The system immediately reduces the analysis window from 500 milliseconds to 300 milliseconds. Subsequently, during the logistics query phase, the call frequency drops to 10 times per second, below the second threshold of 15 times, and the system expands the window to 700 milliseconds. Finally, the entire order processing flow is segmented into multiple feature segments according to the adjusted window duration. In the high-frequency payment area, fine segmentation is used to capture rapid calls, and in the low-frequency query area, broad segmentation is used to improve efficiency, achieving accurate characterization of system behavior.

[0123] In summary, steps 701 to 702 dynamically sense changes in call frequency and intelligently adjust the analysis granularity, which not only ensures fine analysis of high-frequency key calls but also takes into account the processing efficiency of low-frequency calls, providing a better analysis basis for subsequent plagiarism detection and significantly enhancing the system's adaptability to different call patterns.

[0124] Figure 2 The following is a schematic structural diagram of an automated evidence collection system for software copyright infringement provided by an embodiment of the present application. As Figure 2 shown, the system includes: A collection module 21 that collects and processes the call order of multi-language interfaces based on the running process of the target software to form unified semantic expression data; A recording module 22 that uses the high-sensitivity sound sensor of the target software to record and process the sound signals generated by the motherboard of the electronic device running the target software to generate device sound characteristics; An encoding module 23 that performs joint encoding processing on the unified semantic expression data and the device sound characteristics through a cross-modal alignment mechanism to generate multi-modal association data; A learning module 24 that uses the memory enhancement unit in the technical module of the target software to perform automated learning processing on the correspondence between multi-language interfaces and sound characteristics in the multi-modal association data through machine learning technology to generate a cross-modal mapping relationship; A matching module 25 that matches cross-language plagiarism behaviors based on the cross-modal mapping relationship and automatically outputs software similarity relationship data.

[0125] Figure 2 The described automated evidence collection system for software copyright infringement can execute Figure 1 The automated evidence collection method for software copyright infringement described in the embodiment shown. Its implementation principle and technical effects will not be elaborated further. For the automated evidence collection system for software copyright infringement in the above embodiment, the specific ways in which each module and unit perform operations have been described in detail in the embodiment related to the method, and will not be elaborated here.

[0126] In a possible design, Figure 2 An automated forensics system for software copyright infringement in the illustrated embodiment can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32; The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32.

[0127] The processing component 32 is used for Figure 1 An automated forensics method for software copyright infringement in the above-mentioned

[0128] Among them, the processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component may also be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components for executing the above method.

[0129] The storage component 31 is configured to store various types of data to support the operation of the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0130] Of course, the computing device may also necessarily include other components, such as input / output interfaces, display components, communication components, etc.

[0131] The input / output interface provides an interface between the processing component and the peripheral interface module, and the above-mentioned peripheral interface module may be an output device, an input device, etc.

[0132] The communication component is configured to facilitate wired or wireless communication between the computing device and other devices, etc.

[0133] Among them, the computing device may be a physical device or an elastic computing host provided by a cloud computing platform, etc. At this time, the computing device may refer to a cloud server, and the above-mentioned processing component, storage component, etc. may be basic server resources leased or purchased from the cloud computing platform.

[0134] The embodiments of the present application also provide a computer storage medium storing a computer program, which when executed by a computer can implement the above-mentioned Figure 1 automated forensics method for software copyright infringement in the illustrated embodiment.

[0135] Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the above-described systems, devices, and units can refer to the corresponding processes in the foregoing method embodiments and will not be elaborated herein.

[0136] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art can understand and implement it without creative efforts.

[0137] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the essence of the above technical solution, or the part that contributes to the prior art, can be embodied in the form of a software product, which can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions for causing a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0138] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application and are not intended to limit them. Although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments or equivalently replace some of the technical features. These modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An automated forensics method for software copyright infringement, characterized in that, Including: Based on the running process of the target software, collect and process the calling order of multi-language interfaces to form unified semantic expression data; Use the high-sensitivity sound sensor of the target software to record and process the sound signals generated by the motherboard of the electronic device running the target software, and generate device sound characteristics; Through a cross-modal alignment mechanism, jointly encode the unified semantic expression data and the device sound characteristics to generate multi-modal association data; Use the memory enhancement unit in the technical module of the target software, and combine machine learning technology to automatically learn and process the correspondence between multi-language interfaces and sound characteristics in the multi-modal association data to generate a cross-modal mapping relationship; Based on the cross-modal mapping relationship, match cross-language plagiarism behaviors and automatically output software similarity relationship data.

2. The method according to claim 1, wherein Through a cross-modal alignment mechanism, jointly encode the unified semantic expression data and the device sound characteristics to generate multi-modal association data, including: Based on the energy distribution of the device sound characteristics and the calling frequency of the unified semantic expression data, perform dynamic duration segmentation processing on the sound signal to generate adaptable sound segments; Use the timestamp information in the unified semantic expression data to perform two-way timing verification processing on the adaptable sound segments and the corresponding interface call segments to obtain verified data pairs; Through a preset symbol mapping rule, perform vectorization conversion processing on the interface call segments in the verified data pairs to generate a numerical vector sequence; Through a frequency domain transformation method, perform feature extraction processing on the adaptable sound segments in the verified data pairs to generate a frequency domain vector sequence; Based on the time alignment relationship between the numerical vector sequence and the frequency domain vector sequence, perform fusion processing through a dual-channel coding network with adjustable weights to generate multi-modal association data.

3. The method according to claim 1, wherein Use the memory enhancement unit in the technical module of the target software, and combine machine learning technology to automatically learn and process the correspondence between multi-language interfaces and sound characteristics in the multi-modal association data to generate a cross-modal mapping relationship, including: Slice the numerical vector sequence and the frequency domain vector sequence in the multi-modal association data according to a fixed time window to generate multiple data chunks; Assign a unique identifier to each data chunk, and store the data chunk and its identifier in a dynamic memory storage area; When a new numerical vector sequence is input, perform similarity retrieval processing in the dynamic memory storage area to find historical data chunks with similar calling characteristics; Extract the historical frequency domain vectors and weight information stored in the historical data chunks; Perform feature superposition processing on the historical frequency domain vector and the frequency domain vector, and adjust the superposition ratio according to the weight information to obtain a fused feature; Perform joint encoding processing on the fused feature and the new numerical vector sequence to generate a cross-modal mapping relationship representing the correspondence between multi-language interfaces and sound characteristics.

4. The method according to claim 1, characterized in that, Based on the running process of the target software, collect and process the calling order of multi-language interfaces to form unified semantic expression data, including: By monitoring and capturing the interface call events when the target software is running, the call time, interface identifier and parameter characteristics of each interface call event are recorded to generate an original call record; Performing language type identification on the original call record, and classifying and storing interface calls in different languages according to the identification result to obtain classified call information; Inputting the classified call information into a preset mapping rule library, converting different language interfaces of the same function into a unified function code through the mapping rule library to obtain a standard call; Sorting the standard calls according to the calling time to generate a standardized calling sequence; Based on the call frequency change of the standardized call sequence, dynamically adjust the analysis window size to perform segmented processing to obtain segmented calls; Perform dependency analysis on the segmented calls, mark the order of the calls, and obtain a marked call list; The tag call column is combined with the corresponding time metadata to form unified semantic expression data.

5. The method according to claim 2, characterized in that, Based on the time alignment relationship between the numerical vector sequence and the frequency domain vector sequence, a fusion process is performed through a dual-channel encoding network with adjustable weights to generate multimodal associated data, including: Performing synchronous segmentation processing on the numerical vector sequence and the frequency domain vector sequence to generate time-aligned vector segment groups, each group comprising a numerical vector segment and a corresponding frequency domain vector segment; Analyze the interface call features in each of the numerical vector segments, and calculate the dynamic fusion weight according to the call density and type distribution of the numerical vector segments; Extracting the call semantic features of the numerical vector segment and the voiceprint pattern features of the frequency domain vector segment respectively through a dual-channel processing architecture; At the feature fusion node, the call semantic features are proportionally adjusted and combined with the voiceprint pattern features according to the dynamic fusion weight to obtain a fusion feature group; The fused feature groups are spliced in original time sequence to generate multimodal associated data.

6. The method according to claim 3, wherein Performing feature superposition processing on the historical frequency domain vector and the frequency domain vector, and adjusting the superposition ratio according to the weight information to obtain a fusion feature, including: Performing a timeliness check on the historical frequency domain vectors, retaining valid historical frequency domain vectors, and removing expired historical frequency domain vectors; Arranging the valid historical frequency domain vectors in chronological order to form a historical frequency domain vector sequence; Extracting feature points of the real-time frequency domain vector, and performing matching calculation with the historical frequency domain vector in the historical frequency domain vector sequence to obtain a matching calculation result; Determining the superposition ratio of each of the historical frequency domain vectors according to the weight information and the matching degree calculation result; Accumulating the historical frequency domain vector and the real-time frequency domain vector according to the superposition ratio to obtain an accumulated calculation result, and truncating the value out of the range; The format of the accumulated calculation result is converted to obtain a fusion feature.

7. The method according to claim 4, wherein Based on the call frequency change of the standardized call sequence, the analysis window size is dynamically adjusted to perform segmented processing to obtain segmented calls, including: Continuously monitor the change in the call frequency of the standardized call sequence. When the call frequency continuously exceeds a preset first threshold, reduce the analysis window. When the call frequency continuously falls below a preset second threshold, increase the analysis window. In other cases, keep the analysis window unchanged to obtain the adjusted window duration. According to the adjusted window duration, segment the standardized call sequence into multiple time-equal segmented calls.

8. An automated evidence collection system for software copyright infringement, characterized in that, Comprising: An acquisition module that, based on the running process of the target software, acquires and processes the call order of multi-language interfaces to form unified semantic expression data. A recording module that uses the high-sensitivity sound sensor of the target software to record and process the sound signals generated by the motherboard of the electronic device running the target software to generate device sound characteristics. An encoding module that, through a cross-modal alignment mechanism, performs joint encoding processing on the unified semantic expression data and the device sound characteristics to generate multi-modal associated data. A learning module that uses the memory enhancement unit in the technical module of the target software and combines machine learning techniques to automatically learn and process the corresponding relationship between multi-language interfaces and sound characteristics in the multi-modal associated data to generate a cross-modal mapping relationship. A matching module that, based on the cross-modal mapping relationship, matches cross-language plagiarism behaviors and automatically outputs software similarity relationship data.

9. A computing device, characterized in that, Comprising a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement an automated forensics method for software copyright infringement as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that, Stores a computer program, and when the computer program is executed by a computer, it implements an automated forensics method for software copyright infringement as described in any one of claims 1 to 7.

Images