Software detection method and device

Abstract

The present application provides a software detection method and device, which belongs to the field of computer technology. The solution provided by the present application can divide the extracted multiple features of the tested software into multiple feature groups according to the correlation relationship, and can perform feature matching with the feature group as the granularity. Thus, it can be ensured that in the process of feature matching, not only the information of the feature itself can be considered, but also the correlation between the features can be considered, thereby effectively improving the accuracy of feature matching, that is, improving the accuracy of the detected target open source software.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a software detection method and device. Background Art

[0002] Open source software (OSS) refers to software whose source code can be used by the public, and the use, modification and distribution of the open source software are not restricted by the license. For software developed based on open source software, in order to analyze the security performance of the software, it is necessary to detect the open source software referenced by the software.

[0003] In the related art, the software composition analysis (SCA) method is generally used to detect the name and version number of the open source software referenced by a certain software. The SCA method can extract the features of the software to be detected, and match the extracted features with the features of each open source software stored in the feature library, and then determine the open source software referenced by the software to be detected based on the result of feature matching.

[0004] However, since different open source software may have the same or similar features, multiple open source software matching the software to be detected may be determined based on the SCA method, and the detection accuracy is low. Summary of the invention

[0005] The present application provides a software detection method and device, which can solve the technical problem of low accuracy of software detection methods in related technologies.

[0006] On the one hand, a software detection method is provided, which can extract multiple features from the code of the software under test, and divide the multiple features into multiple feature groups, wherein each feature group includes at least two of the features with an associated relationship; if the proportion of feature groups matching the feature template group of the target open source software in the multiple feature groups is greater than a ratio threshold, it can be determined that the software under test references the target open source software; wherein the target open source software includes multiple feature template groups, and each feature template group includes at least two feature templates with an associated relationship.

[0007] In the software detection method provided in the present application, since the extracted multiple features can be divided into multiple feature groups according to the correlation relationship, and feature matching is performed with the feature group as the granularity, the matching accuracy can be effectively improved, thereby improving the accuracy of the detected target open source software.

[0008] Optionally, the code of the software under test includes multiple function call chains, each function call chain includes at least one function with a dependency relationship; then the process of dividing the multiple features into multiple feature groups may include: dividing at least two features called by the functions included in each function call chain into one feature group, so as to obtain multiple feature groups.

[0009] By grouping based on the function call chain, it can be ensured that the multiple features in each feature group after grouping can reflect the dependency relationship between functions. This can further ensure that after feature matching based on the feature group, the target open source software referenced by the tested software can be accurately identified.

[0010] Optionally, the process of dividing the multiple features into multiple feature groups may also include: determining the storage address of the instruction that calls each feature in the code of the software under test; dividing the determined storage addresses of each instruction into multiple non-overlapping address ranges; and dividing at least two features called by instructions whose storage addresses are within the same address range into one feature group to obtain multiple feature groups.

[0011] By grouping multiple features based on the storage address of the instruction that calls the feature, it can be ensured that the multiple features in each feature group after grouping are called by instructions whose storage addresses are within the same address range. In other words, the multiple feature groups divided can reflect the relative positional relationship between the instructions that call the feature. Therefore, it can also be ensured that after feature matching based on the feature group, the target open source software referenced by the software under test can be accurately identified.

[0012] Optionally, the method may also include: for each feature group in the multiple feature groups, determining a first similarity between the feature group and each feature template group of the target open source software; if the first similarity between the feature group and any feature template group of the target open source software is greater than a first similarity threshold, determining that the feature group matches any feature template group.

[0013] Among them, the first similarity between a feature group and a feature template group of the target open source software may refer to: the number of features in the multiple features included in the feature group that match the feature template in the feature template group, and the proportion of the multiple features included in the feature group.

[0014] Optionally, before matching the feature group with the feature template group, the method may further include: determining a second similarity between the multiple features and a plurality of feature templates included in each open source software in a feature library, wherein the feature library includes a plurality of feature templates included in each of the multiple open source software; determining at least one candidate open source software from the multiple open source software, the second similarities between the multiple features and the plurality of feature templates included in each candidate open source software are both greater than a second similarity threshold, and the at least one candidate open source software includes the target open source software; determining the number of feature groups in the multiple feature groups that match any feature template group of each candidate open source software.

[0015] The method provided by the present application can also first perform feature matching based on features as granularity, so as to screen out at least one candidate open source software from multiple open source software included in the feature library. Afterwards, the target open source software is further determined from the at least one candidate open source software. In this way, the efficiency of software detection can be effectively improved while ensuring the accuracy of the determined target open source software.

[0016] Optionally, the process of dividing the multiple features into multiple feature groups may also include: dividing the multiple features into multiple initial groups, each initial group includes one feature, or includes at least two features with an associated relationship; determining multiple feature groups from the multiple initial groups, the number of features included in each feature group is greater than a number threshold, and the number threshold is greater than 1.

[0017] If the number of features included in the feature group is small, then in the subsequent feature matching process, the feature group may match with the feature template group of more open source software in the feature library, resulting in more interference items and affecting the efficiency of feature matching. In the method provided in the present application, since only the initial grouping with a large number of features can be retained as the feature group, the efficiency of subsequent feature matching can be ensured to be high.

[0018] On the other hand, a software detection device is provided. The device may include at least one module, and the at least one module may be used to implement the software detection method provided by the above aspect.

[0019] On the other hand, a software detection device is provided, which may include: a memory, a processor, and a computer program stored in the memory and executable on the processor, and when the processor executes the computer program, it implements the software detection method provided in any of the above aspects.

[0020] On the other hand, a computer-readable storage medium is provided, in which instructions are stored. The instructions are executed by a processor to implement the software detection method provided in any of the above aspects.

[0021] In yet another aspect, a computer program product comprising instructions is provided. When the computer program product is run on a computer, the computer is enabled to execute the software detection method provided in any one of the above aspects.

[0022] In summary, the present application provides a software detection method and device, which can divide the extracted multiple features of the tested software into multiple feature groups according to the association relationship, and can perform feature matching with the feature group as the granularity. Thus, it can be ensured that in the process of feature matching, not only the similarity between the features of the tested software and the feature template of the open source software can be considered, but also the correlation between the features of the tested software and the similarity of the correlation between the feature template of the open source software can be considered, thereby effectively improving the accuracy of feature matching, that is, improving the accuracy of the detected target open source software. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a schematic diagram of an implementation environment of a software detection method provided in an embodiment of the present application;

[0024] Figure 2 is a flow chart of a software detection method provided in an embodiment of the present application;

[0025] Figure 3 It is a function call graph provided by an embodiment of the present application;

[0026] Figure 4 It is a schematic diagram of a storage location of an instruction for calling a feature provided in an embodiment of the present application;

[0027] Figure 5 is a schematic diagram of a software detection process provided by an embodiment of the present application;

[0028] Figure 6 It is a structural schematic diagram of a software detection device provided in an embodiment of the present application;

[0029] Figure 7 is a structural diagram of another software detection device provided in an embodiment of the present application;

[0030] Figure 8 It is a structural diagram of another software detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0031] The software detection method and device provided in the embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0032] Figure 1 Schematic diagram of an implementation environment of a software detection method provided in an embodiment of the present application. Figure 1As shown, the implementation environment may include a server 01 and at least one client 02. For example, Figure 1 Only one client 01 is schematically shown. Each client 02 can establish a communication connection with the server 01 via a wired or wireless network. Each client 02 can send the code of the software under test to the server 01. A software detection device is deployed in the server 01, and the software detection device can determine the open source software referenced by the software under test based on the received code of the software under test. Among them, the server 01 can also be called a software detection platform, and the server 01 can be a server, or a server cluster composed of several servers, or it can also be a cloud computing center. The client 02 can be a computer device, for example, it can be a desktop computer, or a mobile terminal such as a laptop computer, a tablet computer or a mobile phone.

[0033] Figure 2 is a flowchart of a software detection method provided in an embodiment of the present application. The method can be applied to a software detection device, for example, Figure 1 Server 01 is shown. Figure 2 , the method may include:

[0034] Step 101: extract multiple features from the code of the software under test.

[0035] In an embodiment of the present application, the software detection device may receive the code of the software under test uploaded by the client, and perform feature extraction (extract signature) on the code of the software under test to obtain multiple features of the software under test. For example, the software detection device may extract the code of the software under test based on a pre-configured feature extraction algorithm.

[0036] Optionally, the code of the tested software uploaded by the client may be an object code, which refers to the code generated after compiling the source code. The object code may also be referred to as a binary code or a binary program. In an embodiment of the present application, the software detection device may perform a decompilation process on the object code to obtain the assembly code of the tested software. Afterwards, the software detection device may extract multiple features from the assembly code.

[0037] Alternatively, the code uploaded by the client may also be the source code of the software under test. After receiving the source code, the software detection device may directly perform feature extraction on the source code.

[0038] Optionally, each feature extracted by the software detection device from the code of the tested software can be a constant, and the constant can be a string. That is, each feature extracted by the software detection device can be a constant string (constant string), or can also be called a string constant.

[0039] Step 102: Divide the multiple features into multiple feature groups, each feature group including at least two features having an associated relationship.

[0040] In the embodiment of the present application, the software detection device may divide the multiple features into multiple feature groups according to a pre-configured grouping method, wherein each feature group includes at least two features having an associated relationship.

[0041] As an optional implementation, since the code of the software under test usually includes multiple function call chains, the software detection device can group the multiple features according to the function call chains of the software under test. The grouping process is as follows:

[0042] First, the software detection device determines multiple function call chains included in the code of the tested software based on the dependency relationship between multiple functions included in the code of the tested software. For example, the software detection device can generate a function call graph (CG) of the tested software, which is a directed graph that can reflect multiple function call chains of the tested software. Each function call chain has a dependency relationship between each function from the entry function to the exit function.

[0043] For example, it is assumed that the function call graph of the software under test generated by the software detection device based on the code of the software under test is as follows: Figure 3 As shown. Figure 3 It can be seen that the code of the tested software includes 10 functions from f0 to f9, among which function f0 can be the main function. There are 6 different function call chains in the 10 functions:

[0044] 1. f0→f1→f4→f6→f9;

[0045] 2. f0→f1→f4→f7→f9;

[0046] 3. f0→f2→f4→f6→f9;

[0047] 4. f0→f2→f4→f7→f9;

[0048] 5. f0→f3→f5→f7→f9;

[0049] 6. f0→f3→f5→f8→f9.

[0050] Afterwards, the software detection device can divide at least two features called (also referred to as references) by at least one function included in each function call chain into a feature group, thereby obtaining multiple feature groups. For example, in the above step 101, the software detection device can first identify multiple functions included in the code of the software under test, and each function can also be referred to as a function body. Then the software detection device performs feature extraction on each function respectively, thereby extracting one or more features called by the function from each function. Accordingly, after determining the multiple function call chains included in the software under test, the software detection device can group the multiple features based on the functions referenced by each feature.

[0051] For example, Figure 3 As shown in the function call graph, the software detection device can divide multiple features of the tested software into 6 feature groups based on the 6 function call chains.

[0052] The above-mentioned grouping method based on function call chains can ensure that multiple features in each feature group after grouping can reflect the dependency relationship between functions. Furthermore, it can ensure that after feature matching based on the feature group, the target open source software referenced by the tested software can be accurately identified.

[0053] As another optional implementation, the software detection device can also group the multiple features according to the address range of the storage address of the instruction that calls each feature to obtain multiple feature groups. The instruction is part of the function, that is, each function includes one or more instructions. The process of grouping based on the storage address of the instruction is as follows:

[0054] First, the software detection device can determine the storage address of the instruction that calls each feature in the code of the tested software in the memory. Then, the software detection device can sort the determined storage addresses of each instruction in order from large to small or from small to large. After that, the software detection device can divide the determined storage addresses into multiple non-overlapping address ranges, and divide at least two features called by instructions whose storage addresses are located in the same address range into one feature group. That is, the software detection device can divide multiple features called by several instructions with adjacent or similar storage locations into one feature group.

[0055] Example, reference Figure 4, assuming that the distribution ranges of the storage addresses of the multiple instructions that call each feature determined by the software detection device in the memory are: A0 to A1 address segment, A2 to A3 address segment, and A4 to A5 address segment. Then the software detection device can classify the features called by the instructions whose storage addresses are located in the A0 to A1 address segment into feature group 1, the features called by the instructions whose storage addresses are located in the A2 to A3 address segment into feature group 2, and the features called by the instructions whose storage addresses are located in the A4 to A5 address segment into feature group 3. Figure 4 As shown, if the features called by the instruction whose storage address is located in the address segment A2 to A3 include: features S1 to S5, the software detection device can classify the five features S1 to S5 into feature group 2.

[0056] Since the source code engineering of the software under test may include multiple different source code files, and the storage addresses of instructions in different source code files are far apart, and the storage addresses of instructions in the same source code file are relatively close. Therefore, by grouping multiple features based on the storage addresses of instructions, it can be achieved that multiple features in each feature group after grouping are called by instructions in the same source code file. That is, the multiple feature groups divided can reflect the relative positional relationship between the instructions that call the multiple features. Therefore, it can also be ensured that after feature matching based on the feature group, the target open source software referenced by the software under test can be accurately identified.

[0057] As another optional implementation, the software detection device can also group the multiple feature groups using the above two methods respectively, and then obtain the union of the multiple feature groups obtained by the division. That is, the software detection device can group the multiple features according to the function call chain of the tested software to obtain multiple feature groups. In addition, the multiple features can be grouped according to the address range of the storage address of the instruction that calls each feature to obtain multiple feature groups. Afterwards, the multiple feature groups obtained by the two grouping methods are deduplicated to obtain multiple feature groups for subsequent feature matching.

[0058] Combining the above two grouping methods can ensure that the multiple feature groups finally obtained can not only reflect the dependency relationship between the functions that call the features, but also reflect the relative position relationship between the instructions that call the features, thereby further improving the accuracy of feature matching and further improving the accuracy of the identified target open source software.

[0059] Optionally, in an embodiment of the present application, the software detection device may further divide the multiple features into multiple initial groups based on the above-mentioned grouping method. Each initial group includes one feature, or includes at least two features with an associated relationship. Afterwards, the software detection device determines multiple feature groups from the multiple initial groups, and the number of features included in each feature group is greater than a number threshold. The number threshold may be greater than 1. In other words, the software detection device may delete the initial groupings that include a smaller number of features, and only retain the initial groupings that include a larger number of features as feature groups, that is, the software detection device may prune the initial groupings that include a smaller number of features.

[0060] The number threshold may be a fixed value pre-configured in the software detection device, and the size of the number threshold may be configured by operation and maintenance personnel according to application scenarios.

[0061] Since the initial grouping with a small number of features may match the feature template group of open source software with a large number of features in the feature library during the subsequent feature matching process, resulting in more interference items, the efficiency of feature matching will be affected. In the embodiment of the present application, since only the initial grouping with a large number of features can be retained as the feature group, the efficiency of subsequent feature matching can be ensured.

[0062] Step 103: Determine a second similarity between the plurality of features and a plurality of feature templates included in each open source software in the feature library.

[0063] In an embodiment of the present application, a feature library may be stored in a software detection device, in which a plurality of feature template groups included in each of a plurality of open source software are recorded, and each feature template group includes at least two feature templates with an associated relationship. The plurality of feature template groups of each open source software may also be obtained by pre-extracting features and grouping features of the open source software. Moreover, each feature template may also be a constant in the source code of the open source software. The process of extracting features from the open source software may refer to the relevant description of step 101 above, and the process of grouping features of the features of the open source software may refer to the relevant description of step 102 above.

[0064] When performing feature matching (match signature), the software detection device can compare the multiple features of the tested software with each open source software in the feature library one by one to calculate the second similarity between the multiple features of the tested software and the multiple feature templates included in each open source software. The second similarity between the multiple features and the multiple feature templates included in a certain open source software can be expressed as: n / N, where N refers to the total number of the multiple features, and N is an integer greater than 1, and n refers to the number of features in the multiple features that are the same as any feature template included in the open source software. The second similarity can also be called the coverage of the features of the tested software.

[0065] Example, reference Figure 5 , assuming that the software detection device extracts 12 features from the tested software ( Figure 5 The rectangle and triangle in the figure each represent a feature), and the 12 features are divided into two feature groups, Z1 and Z2. Then the software detection device can first calculate the second similarity between the 12 features and the multiple feature templates included in each open source software in the feature library. Figure 5 As shown, since each of the 12 features matches one of the 12 feature templates included in the open source software 1, the software detection device can determine that the second similarity between the multiple features and the 12 feature templates included in the open source software 1 is 1.

[0066] Step 104: Based on the second similarity, determine at least one candidate open source software from the plurality of open source software included in the feature library.

[0067] The second similarities between the multiple features and the multiple feature templates included in each candidate open source software are all greater than the second similarity threshold. That is, the software detection device can first preliminarily screen out at least one candidate open source software that is relatively similar to the software under test from the feature library based on the second similarity. Afterwards, continue to accurately determine the target open source software referenced by the software under test from the at least one candidate open source software. Since the method provided in the embodiment of the present application can first screen out at least one candidate open source software based on coarse-grained feature matching, and then perform fine-grained feature matching, the efficiency of software detection can be effectively improved.

[0068] The second similarity threshold may be a fixed value pre-stored in the software detection device, and the second similarity threshold may also be configured by the operation and maintenance personnel according to the application scenario. For example, the second similarity threshold may be 0.7.

[0069] Optionally, if the software detection device does not detect candidate open source software that meets the above conditions from the feature library, it can be determined that there is no open source software matching the tested software in the feature library, that is, the tested software fails to match. In addition, the software detection device can send a prompt message to the client indicating that the open source software fails to match.

[0070] Step 105: For each feature group in the plurality of feature groups, determine a first similarity between the feature group and each feature template group of each candidate open source software.

[0071] In the embodiment of the present application, after determining at least one candidate open source software, the software detection device may continue to perform fine-grained feature matching with each candidate open source software based on the feature group of the tested software. Optionally, for each feature group, the software detection device may calculate the first similarity between the feature group and each feature template group in the multiple feature template groups included in each candidate open source software.

[0072] The first similarity between a feature group and a feature template group in an alternative open source software can be expressed as: m / M, where M refers to the total number of features included in the feature group, and M is an integer greater than 1, and m refers to the number of features in the feature group that are the same as any feature template included in the feature template group. The first similarity can also be called the coverage of the feature group of the tested software.

[0073] Example, reference Figure 5 , assuming that the candidate open source software determined by the software detection device based on the above step 104 includes open source software 1, and the open source software 1 includes two feature template groups M1 and M2. Then the software detection device can respectively calculate the first similarity between the feature group Z1 of the tested software and the feature template group M1, the first similarity between the feature group Z1 and the feature template group M2, the first similarity between the feature group Z2 and the feature template group M1, and the first similarity between the feature group Z2 and the feature template group M2.

[0074] Step 106: If the similarity between the feature group and any feature template group of the candidate open source software is greater than a first similarity threshold, it is determined that the feature group matches the any feature template group.

[0075] The first similarity threshold may be a fixed value pre-stored in the software detection device, and the first similarity threshold may also be configured by the operation and maintenance personnel according to the application scenario. Furthermore, the first similarity threshold may be equal to or different from the second similarity threshold.

[0076] For example, it is assumed that the first similarity threshold is 0.8. Figure 5, 5 of the 6 features included in feature group Z1 are the same as the features in feature template group M1, and 5 of the 6 features included in feature group Z2 are the same as the features in feature template group M2. Then the software detection device can determine that the first similarity between feature group Z1 and feature template group M1, and the first similarity between feature group Z2 and feature template group M2 are both 5 / 6. Since the first similarity 5 / 6 is greater than the first similarity threshold 0.8, the software detection device can determine that feature group Z1 matches feature template group M1, and feature group Z2 matches feature template group M2.

[0077] Step 107: Detect whether the proportion of feature groups matching the feature template group of each candidate open source software among the multiple feature groups is greater than a ratio threshold.

[0078] In an embodiment of the present application, for each candidate open source software, the software detection device can count the proportion of feature groups that match the feature template group of the candidate open source software in the multiple feature groups (the proportion can also be called coverage or confidence), and detect whether the proportion is greater than a ratio threshold. The ratio threshold can be a fixed value pre-configured in the software detection device, and the size of the ratio threshold can be configured by the operation and maintenance personnel according to the application scenario. For example, the ratio threshold can be 80%.

[0079] If the proportion of feature groups matching the feature template group of any candidate open source software among the multiple feature groups is greater than the ratio threshold, step 108 is executed; if the proportion of feature groups matching the feature template group of each candidate open source software among the multiple feature groups is not greater than the ratio threshold, step 109 is executed.

[0080] Step 108: Determine that the candidate open source software is the target open source software referenced by the software under test.

[0081] If the proportion of feature groups matching the feature template group of any candidate open source software among the multiple feature groups of the tested software is greater than the ratio threshold, the software detection device can determine the any candidate open source software as the target open source software referenced by the tested software. The reference of the target open source software by the tested software can refer to the code of the tested software containing the code of the target open source software. In the embodiment of the present application, the number of target open source software determined by the software detection device can be 1 or greater than 1.

[0082] For example, assume that the ratio threshold is 2, and if Figure 5 As shown, the two feature groups Z1 and Z2 included in the tested software are respectively matched with a feature template group in the open source software 1, and the software detection device can determine the open source software 1 as the target open source software referenced by the tested software.

[0083] In an embodiment of the present application, after determining the target open source software referenced by the software under test, the software detection device may also send relevant information of the target open source software to the client. The relevant information may include information such as the name and version number of the target open source software. After the client obtains the relevant information of the target open source software, it can monitor and maintain the security performance of the software under test based on the known vulnerabilities of the target open source software.

[0084] Step 109: Determine that the software under test does not reference the candidate open source software.

[0085] In an embodiment of the present application, if the proportion of feature groups that match the feature template groups of multiple feature groups of the tested software and any candidate open source software is not greater than the ratio threshold, the software detection device can determine that the tested software does not match any candidate open source software, and further determine that the tested software does not reference the candidate open source software. In other words, the software detection device can determine that there is no open source software that matches the tested software in the feature library, that is, the tested software fails to match. In addition, the software detection device can send a prompt message to the client to indicate that the open source software fails to match.

[0086] Optionally, the sequence of steps of the software detection method provided in the embodiment of the present application can be appropriately adjusted, and the steps can also be increased or decreased accordingly according to the situation. For example, step 103 and step 104 can be deleted according to the situation, that is, the software detection device can also directly match the feature group of the tested software with the feature template group of each open source software in the feature library without first determining the alternative open source software. Alternatively, step 103 and step 104 can also be performed before step 102, that is, the software detection device can first determine the alternative open source software, and then group the features. Accordingly, in this implementation, if the software detection device does not determine the alternative open source software that meets the conditions, then there is no need to perform step 102 again, so that the computing resources of the software detection device can be saved. Any technician familiar with the technical field of the present invention can easily think of the method of change within the technical scope disclosed in the present application, and should be included in the protection scope of the present application, so it is not repeated.

[0087] In summary, the embodiment of the present application provides a software detection method, which can divide the extracted multiple features of the tested software into multiple feature groups according to the association relationship, and can perform feature matching with the feature group as the granularity. Thus, it can be ensured that in the process of feature matching, not only the similarity between the features of the tested software and the feature template of the open source software can be considered, but also the correlation between the features of the tested software and the similarity of the correlation between the feature template of the open source software can be considered, thereby effectively improving the accuracy of feature matching, that is, improving the accuracy of the detected target open source software.

[0088] Figure 6 is a schematic diagram of the structure of a software detection device provided in an embodiment of the present application. The device can be used to implement the software detection method provided in the above method embodiment, and the device can be deployed in Figure 1 In the server 01 shown. Figure 6 , the device may include:

[0089] The extraction module 201 is used to extract multiple features from the code of the software under test. The function implementation of the extraction module 201 can refer to the relevant description of the above step 101.

[0090] The grouping module 202 is used to divide the multiple features into multiple feature groups, each feature group includes at least two features with an associated relationship. The functional implementation of the grouping module 202 can refer to the relevant description of the above step 102.

[0091] The first determination module 203 is used to determine that the software under test references the target open source software if the proportion of feature groups matching the feature template group of the target open source software among the multiple feature groups is greater than the ratio threshold. The function implementation of the first determination module 203 can refer to the relevant description of the above steps 107 and 108.

[0092] The target open source software includes a plurality of the feature template groups, and each feature template group includes at least two feature templates having an associated relationship.

[0093] Optionally, the code of the software under test includes multiple function call chains, each function call chain includes at least one function with a dependency relationship; the grouping module 202 can be used to: divide at least two features called by the functions included in each function call chain into a feature group to obtain multiple feature groups.

[0094] Optionally, the grouping module 202 can be used to: determine the storage address of the instruction that calls each feature in the code of the software under test; divide the determined storage address of the instruction into multiple non-overlapping address ranges; divide at least two features called by instructions whose storage addresses are within the same address range into one feature group, to obtain multiple feature groups.

[0095] Alternatively, if Figure 7 As shown, the device may also include:

[0096] The second determination module 204 is used to determine, for each feature group in the plurality of feature groups, a first similarity between the feature group and each feature template group of the target open source software. The implementation of the function of the second determination module 204 may refer to the relevant description of the above step 105.

[0097] The third determination module 205 is used to determine that the feature group matches any feature template group of the target open source software if the first similarity between the feature group and any feature template group of the target open source software is greater than the first similarity threshold. The function of the third determination module 205 can refer to the relevant description of the above step 106.

[0098] Alternatively, if Figure 7 As shown, the device may also include:

[0099] The fourth determination module 206 is used to determine the second similarity between the multiple features and the multiple feature templates included in each open source software in the feature library, wherein the feature library includes the multiple feature templates included in each open source software in the multiple open source software. The function implementation of the fourth determination module 206 can refer to the relevant description of the above step 103.

[0100] The fifth determination module 207 is used to determine at least one candidate open source software from the multiple open source software, the second similarities between the multiple features and the multiple feature templates included in each candidate open source software are all greater than the second similarity threshold, and the at least one candidate open source software includes the target open source software. The functional implementation of the fifth determination module 207 can refer to the relevant description of the above step 104.

[0101] The sixth determination module 208 is used to determine the number of feature groups in the multiple feature groups that match any feature template group of each candidate open source software. The implementation of the function of the sixth determination module 208 can refer to the relevant description of the above step 107.

[0102] Optionally, the grouping module 202 may be used to:

[0103] Dividing the plurality of features into a plurality of initial groups, each initial group including one of the features, or including at least two of the features having an associated relationship;

[0104] A plurality of feature groups are determined from the plurality of initial groups, wherein the number of features included in each feature group is greater than a number threshold, and the number threshold is greater than 1.

[0105] In the examples of this application, refer to Figure 5 As can be seen from the above description, the software detection device is mainly used to realize the two functions of feature extraction and feature matching, so the modules included in the software detection device can be divided into a feature extraction unit and a feature matching unit. Among them, the feature extraction unit can include the extraction module 201 and the grouping module 202. The feature matching unit can include the first determination module 203 to the sixth determination module 208.

[0106] In summary, the embodiment of the present application provides a software detection device, which can divide the extracted multiple features of the tested software into multiple feature groups according to the association relationship, and can perform feature matching with the feature group as the granularity. Thus, it can be ensured that in the process of feature matching, not only the similarity between the features of the tested software and the feature template of the open source software can be considered, but also the correlation between the features of the tested software and the similarity of the correlation between the feature template of the open source software can be considered, thereby effectively improving the accuracy of feature matching, that is, improving the accuracy of the detected target open source software.

[0107] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the software detection device and each module described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0108] It should be understood that the software detection device provided in the embodiment of the present application can also be implemented by an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), and the PLD can be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof. The software detection method provided in the above method embodiment can also be implemented by software. When the software detection method provided in the above method embodiment is implemented by software, each module in the software detection device can also be a software module.

[0109] Figure 8 is a structural diagram of another software detection device provided in an embodiment of the present application. The device can implement the software detection method provided in the above method embodiment and can be applied to Figure 1 In the server 01 shown. Figure 8 , the device may include: a processor 8001, a memory 8002, a transceiver 8003 and a bus 8004. The bus 8004 is used to connect the processor 8001, the memory 8002 and the transceiver 8003. The communication connection with other devices can be realized through the transceiver 8003 (which can be wired or wireless). The memory 8002 stores a computer program, which is used to realize various application functions.

[0110] It should be understood that in the embodiment of the present application, the processor 8001 may be a central processing unit (CPU), and the processor 8001 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), graphics processing units (GPU) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0111] The memory 8002 may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories. Among them, the nonvolatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0112] In addition to the data bus, the bus 8004 may also include a power bus, a control bus, a status signal bus, etc. However, for the sake of clarity, various buses are labeled as the bus 8004 in the figure.

[0113] The processor 8001 is configured to execute a computer program stored in the memory 8002 . The processor 8001 implements the software detection method in the above method embodiment by executing the computer program.

[0114] The embodiment of the present application also provides a computer-readable storage medium, in which instructions are stored. When the computer-readable storage medium is run on a computer, the computer executes the steps in the above method embodiment.

[0115] The embodiment of the present application also provides a computer program product including instructions, and when the computer program product is run on a computer, the computer is enabled to execute the steps in the above method embodiment.

[0116] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid state drive (SSD).

[0117] It should be understood that the "at least one" mentioned herein refers to one or more, and "plurality" refers to two or more. In addition, in order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, the words "first", "second" and the like are used to distinguish the same items or similar items with substantially the same functions and effects. Those skilled in the art will understand that the words "first", "second" and the like do not limit the quantity and execution order, and the words "first", "second" and the like do not necessarily limit them to be different.

[0118] The above is only an optional implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A software detection method, characterized in that: The method comprises: Extracting multiple features from the code of the software under test, each of the multiple features is a constant string; Dividing the plurality of features into a plurality of feature groups, each of the feature groups includes at least two features having an associated relationship, and the at least two features included in each of the feature groups are called by the same function call chain, or the at least two features included in each of the feature groups are called by instructions whose storage addresses are within the same address range; If, among the multiple feature groups, the proportion of feature groups that match the feature template group of the target open source software is greater than the ratio threshold, it is determined that the software under test references the target open source software; The target open source software includes a plurality of the feature template groups, and each of the feature template groups includes at least two feature templates having an associated relationship.

2. The method according to claim 1, characterized in that The code of the software under test includes a plurality of function call chains, each of which includes at least one function having a dependency relationship; The dividing the plurality of features into a plurality of feature groups comprises: At least two of the features called by the functions included in each of the function call chains are divided into a feature group to obtain a plurality of feature groups.

3. The method according to claim 1, characterized in that The dividing the plurality of features into a plurality of feature groups comprises: Determine the storage address of the instruction for calling each of the features in the code of the software under test; Dividing the determined storage address of the instruction into a plurality of non-overlapping address ranges; At least two of the features called by instructions whose storage addresses are within the same address range are divided into one feature group to obtain a plurality of feature groups.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: For each of the plurality of feature groups, determining a first similarity between the feature group and each of the feature template groups of the target open source software; If the first similarity between the feature group and any feature template group of the target open source software is greater than a first similarity threshold, it is determined that the feature group matches the any feature template group.

5. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: Determine a second similarity between the plurality of features and a plurality of feature templates included in each open source software in a feature library, wherein the feature library includes a plurality of feature templates included in each of the plurality of open source software; Determine at least one candidate open source software from the plurality of open source software, wherein the second similarities between the plurality of features and the plurality of feature templates included in each of the candidate open source software are greater than a second similarity threshold, and the at least one candidate open source software includes the target open source software; Determine the number of feature groups among the multiple feature groups that match any feature template group of each of the candidate open source software.

6. The method according to any one of claims 1 to 3, characterized in that: The dividing the plurality of features into a plurality of feature groups comprises: Dividing the plurality of features into a plurality of initial groups, each of the initial groups including one of the features, or including at least two of the features having an associated relationship; A plurality of feature groups are determined from the plurality of initial groups, wherein the number of features included in each of the feature groups is greater than a number threshold, and the number threshold is greater than 1.

7. A software detection device, characterized in that: The device comprises: An extraction module, used to extract multiple features from the code of the software under test, each of the multiple features is a constant string; a grouping module, used for dividing the plurality of features into a plurality of feature groups, each of the feature groups including at least two of the features having an associated relationship, and the at least two of the features included in each of the feature groups are called by the same function call chain, or the at least two of the features included in each of the feature groups are called by instructions whose storage addresses are within the same address range; A first determination module is configured to determine that the software under test references the target open source software if, among the multiple feature groups, the proportion of feature groups that match the feature template group of the target open source software is greater than a ratio threshold; The target open source software includes a plurality of the feature template groups, and each of the feature template groups includes at least two feature templates having an associated relationship.

8. The device according to claim 7, characterized in that The code of the software under test includes a plurality of function call chains, each of which includes at least one function with a dependency relationship; the grouping module is used to: At least two of the features called by the functions included in each of the function call chains are divided into a feature group to obtain a plurality of feature groups.

9. The device according to claim 7, characterized in that The grouping module is used for: Determine the storage address of the instruction for calling each of the features in the code of the software under test; Dividing the determined storage address of the instruction into a plurality of non-overlapping address ranges; At least two of the features called by instructions whose storage addresses are within the same address range are divided into one feature group to obtain a plurality of feature groups.

10. The device according to any one of claims 7 to 9, characterized in that: The device also includes: A second determination module is configured to determine, for each of the plurality of feature groups, a first similarity between the feature group and each of the feature template groups of the target open source software; The third determination module is configured to determine that the feature group matches any feature template group of the target open source software if the first similarity between the feature group and any feature template group of the target open source software is greater than a first similarity threshold.

11. The device according to any one of claims 7 to 9, characterized in that: The device also includes: a fourth determination module, configured to determine a second similarity between the plurality of features and a plurality of feature templates included in each open source software in a feature library, wherein the feature library includes a plurality of feature templates included in each of the plurality of open source software; a fifth determination module, configured to determine at least one candidate open source software from the plurality of open source software, wherein the second similarities between the plurality of features and the plurality of feature templates included in each of the candidate open source software are all greater than a second similarity threshold, and the at least one candidate open source software includes the target open source software; The sixth determination module is used to determine the number of feature groups in the multiple feature groups that match any feature template group of each of the candidate open source software.

12. The device according to any one of claims 7 to 9, characterized in that: The grouping module is used for: Dividing the plurality of features into a plurality of initial groups, each of the initial groups including one of the features, or including at least two of the features having an associated relationship; A plurality of feature groups are determined from the plurality of initial groups, wherein the number of features included in each of the feature groups is greater than a number threshold, and the number threshold is greater than 1.

13. A software detection device, characterized in that: The device comprises: a memory, a processor and a computer program stored in the memory and capable of running on the processor, and the processor implements the method according to any one of claims 1 to 6 when executing the computer program.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and the instructions are executed by a processor to implement the method according to any one of claims 1 to 6.

Images