Binary executable file dependency library analysis method, device, electronic device and storage medium

Abstract

The embodiment of the present invention discloses a method, device and electronic device for analyzing a binary executable file dependency library, and relates to the field of network security technology. The method comprises: extracting features of the binary executable file to be analyzed to obtain feature information of the binary executable file; matching the feature information of the binary executable file with a fingerprint feature database to determine the corresponding dependency library fingerprint feature; the fingerprint feature database stores fingerprint features for identifying dependency library attribute information; and determining the corresponding dependency library attribute information according to the dependency library fingerprint feature. Through the above method steps, the present invention can simply and conveniently identify the dependency library information used by the binary executable file from the binary executable file efficiently without providing any source code information, thereby facilitating the analysis of the dependency library information used by the binary executable file.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a binary executable file dependency library analysis method, device, electronic device and storage medium. Background Art

[0002] In the process of software development, the use of open source code improves software development efficiency and reduces development costs, but there are a large number of defects in open source software, and even security vulnerabilities are introduced, which brings huge risks to the software. By analyzing the composition of binary executable files, it is possible to identify the dependent libraries and corresponding versions used, and thus discover dependent libraries with security vulnerabilities.

[0003] The inventors discovered during the process of implementing the present invention that most of the source code information will be lost after the high-level language is compiled into a binary executable file, making it difficult to analyze the dependent libraries used. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a method, device and electronic device for analyzing a binary executable file dependency library, which are convenient for analyzing the dependency library information used by the binary executable file.

[0005] In order to achieve the above-mentioned invention object, the following technical scheme is adopted:

[0006] In a first aspect, an embodiment of the present invention provides a method for analyzing a binary executable file dependency library, the method comprising the steps of:

[0007] Performing feature extraction on the binary executable file to be analyzed to obtain feature information of the binary executable file;

[0008] According to the feature information of the binary executable file, the fingerprint feature database is matched to determine the corresponding dependent library fingerprint feature; the fingerprint feature database stores the fingerprint feature for identifying the dependent library attribute information;

[0009] The corresponding dependency library attribute information is determined according to the dependency library fingerprint feature.

[0010] In combination with the first aspect, in a first implementation of the first aspect, the characteristic information of the binary executable file includes: one or more;

[0011] The matching of the feature information of the binary executable file with the fingerprint feature database to determine the corresponding dependent library fingerprint feature includes: performing global matching of any feature information of the binary executable file with the fingerprint features in the fingerprint feature database;

[0012] If the matching degree between any feature information of the binary executable file and the first fingerprint feature in the fingerprint feature database reaches a preset global matching degree threshold, the first fingerprint feature is determined as the dependency library fingerprint feature corresponding to the binary executable file.

[0013] In combination with the first aspect and the first implementation of the first aspect, in the second implementation of the first aspect, the feature information of the binary executable file and the fingerprint features in the fingerprint feature database respectively include: export information, visible character strings and / or intermediate language sequences.

[0014] In combination with the first aspect, the first and second implementations of the first aspect, in a third implementation of the first aspect, determining the corresponding dependency library attribute information according to the dependency library fingerprint feature includes:

[0015] Determine the corresponding dependency library name identifier according to the dependency library fingerprint feature.

[0016] In combination with the first aspect, the first, second and third implementation manners of the first aspect, in a fourth implementation manner of the first aspect, the feature information includes: a visible character string;

[0017] The method of determining the corresponding dependency library attribute information according to the dependency library fingerprint feature also includes: after determining the corresponding dependency library library name identifier according to the dependency library fingerprint feature, matching the visible string with the version information table of the corresponding dependency library to determine the dependency library version information corresponding to the dependency library library name identifier; wherein the dependency library version information table is preset with the dependency library name identifier and the corresponding relationship between the visible string and the dependency library version information.

[0018] In combination with the first aspect, the first, second, third and fourth implementations of the first aspect, in a fifth implementation of the first aspect, before extracting features from the binary executable file to be analyzed, the method further includes: obtaining a file header of the binary executable file to be analyzed;

[0019] The type of the binary executable file to be analyzed is determined according to the file header.

[0020] In combination with the first aspect, any one of the first to fifth implementation modes of the first aspect, in a sixth implementation mode of the first aspect, extracting features from the binary executable file to be analyzed to obtain feature information of the binary executable file includes:

[0021] Parsing data segments and / or code segments, export information, and processor architecture information of the binary executable file according to the type of the binary executable file;

[0022] If the data segment is obtained by parsing, feature extraction is performed on the data segment to obtain a visible character string and / or export information;

[0023] If the code segment is obtained by parsing, the code segment is disassembled according to the processor architecture information to obtain assembly instructions; the assembly instructions include: assembly code;

[0024] Translating the assembly code into an intermediate language that is independent of the processor architecture;

[0025] Establishing a control flow graph based on the intermediate language;

[0026] Static program analysis is performed on the control flow graph to obtain an intermediate language sequence.

[0027] In combination with the first aspect, any one of the first to sixth implementation modes of the first aspect, in a seventh implementation mode of the first aspect, the method further comprises: analyzing the obtained open source software libraries of different versions as sample files;

[0028] Extracting fingerprint features from the sample file;

[0029] A fingerprint feature database is established according to the fingerprint features in the sample file; the fingerprint features include: derived information, visible character strings and / or intermediate language.

[0030] In combination with the first aspect, any one of the first to seventh implementation modes of the first aspect, in an eighth implementation mode of the first aspect, establishing a fingerprint feature database according to the fingerprint features in the sample files includes: performing similarity calculation on the same type of fingerprint features in different sample files based on a dimensionality reduction algorithm to obtain fingerprint feature values ​​of the same type shared by different sample files;

[0031] The same type of fingerprint feature values ​​common to different sample files are stored to form the fingerprint feature database.

[0032] In the second aspect, the binary executable file dependency library analysis device provided by the embodiment of the present invention includes: an extraction program module, which is used to extract features of the binary executable file to be analyzed and obtain feature information of the binary executable file; a matching program module, which is used to match the feature information of the binary executable file with a fingerprint feature database to determine the corresponding dependency library fingerprint feature; the fingerprint feature database stores fingerprint features for identifying dependency library attribute information; and a determination program module, which is used to determine the corresponding dependency library attribute information based on the dependency library fingerprint feature.

[0033] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: one or more processors; a memory; one or more executable programs are stored in the memory, and the one or more processors read the executable program code stored in the memory to run the program corresponding to the executable program code, so as to execute the binary executable file dependency library analysis method described in any one of the first aspects.

[0034] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the binary executable file dependency library analysis method described in any one of the first aspects.

[0035] The embodiment of the present invention provides a method, device, electronic device and storage medium for analyzing a binary executable file dependency library, the method comprising: extracting features from a binary executable file to be analyzed to obtain feature information of the binary executable file; matching the feature information of the binary executable file with a fingerprint feature database to determine the corresponding dependency library fingerprint feature; the fingerprint feature database stores fingerprint features for identifying dependency library attribute information; and determining the corresponding dependency library attribute information according to the dependency library fingerprint feature. Through the above method steps, without providing any source code information, the dependency library information used by the binary executable file can be simply and conveniently identified from the binary executable file efficiently. Therefore, the technical solution provided by the present invention facilitates the analysis of the dependency library information used by the binary executable file. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0037] Figure 1 It is a flowchart of an embodiment of a method for analyzing a binary executable file dependency library according to the present invention;

[0038] Figure 2 It is a flowchart of another embodiment of the binary executable file dependency library analysis method of the present invention;

[0039] Figure 3 A schematic diagram of a flow chart of another embodiment of a method for analyzing a binary executable file dependency library according to the present invention;

[0040] Figure 4It is a schematic block diagram of the architecture of an embodiment of a binary executable file dependency library analysis device of the present invention;

[0041] Figure 5 It is a schematic block diagram of another embodiment of the binary executable file dependency library analysis device of the present invention;

[0042] Figure 6 It is a schematic block diagram of the architecture of another embodiment of the binary executable file dependency library analysis device of the present invention;

[0043] Figure 7 The figure is a schematic diagram of the structure of an embodiment of the electronic device of the present invention. DETAILED DESCRIPTION

[0044] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0045] It should be clear that the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] Figure 1 FIG. 1 is a flow chart of an embodiment of a method for analyzing a binary executable file dependency library according to the present invention; Figure 1 As shown, the binary executable file dependency library analysis method provided by the embodiment of the present invention can be applied to dependency library analysis scenarios, and can also be used to discover dependency libraries with security vulnerabilities, thereby improving the security of the developed software to a certain extent; the dependency library refers to the dependent open source library. It should be noted that the method can be solidified in a manufactured product in the form of software, and when the user uses the product, the method flow of the present application can be reproduced.

[0047] For example, the binary executable file dependency library analysis method provided in this embodiment is installed on electronic devices such as computers and mobile phones in the form of application software. When the user triggers the product to run on the computer or mobile phone, the method previously solidified in the electronic product is mechanically reproduced to execute the method steps of the binary executable file dependency library analysis in this implementation.

[0048] The binary executable file dependency library analysis method may include:

[0049] Step 110: extract features from the binary executable file to be analyzed to obtain feature information of the binary executable file.

[0050] The characteristic information of the binary executable file includes: export information, visible strings and / or intermediate language sequences. Among them, the intermediate language sequence includes one or more intermediate languages. Intermediate language (IL) is a term in computer technology. Simply put, it is an equivalent internal representation code between the source language (high-level language, such as C#, VB, F#, etc.) and the target language (computer executable machine language, such as binary executable files) that is easy to translate into the target program. The intermediate language plays a bridging role in the compilation process. The export information includes: export functions, etc.

[0051] 120. Match the feature information of the binary executable file with a fingerprint feature database to determine the corresponding dependent library fingerprint feature; the fingerprint feature database stores fingerprint features for identifying dependent library attribute information.

[0052] The fingerprint feature here is not a biological fingerprint, but is used to identify the object type, such as feature information of dependency library attribute information. The dependency library attribute information may include: dependency library name (which can determine the type of dependency library) and / or dependency library version information.

[0053] 130. Determine corresponding dependency library attribute information according to the dependency library fingerprint feature.

[0054] The binary executable file dependency library analysis method provided in an embodiment of the present invention can easily and conveniently identify the dependency library information used by the binary executable file from the binary executable file through the above-mentioned method steps 110 to 130 without providing any source code information. Therefore, the technical solution provided by the present invention is convenient for analyzing the dependency library information used by the binary executable file.

[0055] In some embodiments, the characteristic information of the binary executable file includes: one or more;

[0056] See also Figure 2 As shown, the matching of the feature information of the binary executable file with the fingerprint feature database to determine the corresponding dependent library fingerprint feature (step 120) includes the following steps: 121. Global matching of any feature information of the binary executable file with the fingerprint features in the fingerprint feature database; 122. If the matching degree between any feature information of the binary executable file and the first fingerprint feature in the fingerprint feature database reaches a preset global matching degree threshold, the first fingerprint feature is determined as the dependent library fingerprint feature corresponding to the binary executable file.

[0057] The fingerprint features in the fingerprint feature database respectively include: derived information, visible character strings and / or intermediate language sequences.

[0058] Specifically, the preset global matching degree threshold is 30%, 40%, 50%, 60%, 70%, 80%, 90% or 100%.

[0059] Exemplarily, the preset global matching threshold is 30%. If 30% of a certain feature information to be detected matches the corresponding fingerprint feature of a third-party open source library, it can be determined that the binary executable file to be detected uses the third-party open source library, thereby directly analyzing the used dependent library from the binary executable file.

[0060] Specifically, in the case where the feature information obtained by parsing a binary executable file is export information, the export information can be matched with the fingerprint features in the fingerprint feature database according to the above-mentioned matching method. If the export information of the binary executable file to be analyzed matches the fingerprint features of the export information in the fingerprint feature database of the previous open source library, it can be determined that the binary executable file to be detected uses the open source library.

[0061] Similarly, in the case where the feature information obtained by parsing a binary executable file is a visible string, the visible string of the binary executable file to be checked is matched with the fingerprint feature in the fingerprint feature database. If it matches the visible string fingerprint feature of the previous open source library, it can be determined that the binary executable file to be detected uses the open source library.

[0062] In the case where the feature information obtained by parsing a binary executable file is an intermediate language sequence, the intermediate language sequence may include one or more intermediate languages. If the intermediate language sequence of the binary executable file to be analyzed has a 30% match with the intermediate language sequence class fingerprint feature in the fingerprint feature database, it is determined that it matches the intermediate language sequence class fingerprint feature of an open source library, and it is determined that the binary executable file to be detected uses the open source library.

[0063] For the above-mentioned types of feature information, if a certain type of feature information is not parsed out from the binary executable file, for example, if the binary executable file does not parse out the export information, then the step of matching the feature information based on the export information with the fingerprint feature database is skipped; if the binary executable file does not parse out the visible string, then the step of matching the feature information with the fingerprint feature database is skipped; if the binary executable file does not parse out the intermediate language sequence, then the step of matching the feature information with the fingerprint feature database is skipped. In this way, the matching detection efficiency can be improved.

[0064] Specifically, for the case where the dependent library attribute information includes the dependent library name, see Figure 3As shown, the step of determining the corresponding dependency library attribute information according to the dependency library fingerprint feature (step 130) includes: 131. Determining the corresponding dependency library name identifier according to the dependency library fingerprint feature. By determining the dependency library name identifier, the dependency library used by the binary executable file can be determined according to the dependency library name identifier.

[0065] Furthermore, the fingerprint feature database also maintains a version information table of the dependent library; the feature information includes: a visible string; the version information table of the dependent library is preset with a dependent library name identifier and a corresponding relationship between the visible string and the dependent library version information.

[0066] The step of determining the corresponding dependency library attribute information according to the dependency library fingerprint feature (step 130) also includes: step 132, after determining the corresponding dependency library library name identifier according to the dependency library fingerprint feature (step 131), matching the visible string with the version information table of the corresponding dependency library to determine the dependency library version information corresponding to the dependency library library name identifier.

[0067] In this embodiment, after the open source dependency library used by the binary executable file to be detected is determined by traversing and matching according to the above-mentioned various types of feature information, after the dependency library name identifier is determined, the corresponding version feature information is matched from the version information table of the preset dependency library according to the visible string information in the binary executable file to be detected; if a match is found, the version information of the dependency library is extracted. Thus, the present invention can directly detect the attribute information such as the library name and version of the dependency library used by the binary executable file from the binary executable file accurately and efficiently without providing any source code information.

[0068] Furthermore, after obtaining the open source dependency libraries used by the binary executable file to be tested and the corresponding versions of the open source dependency libraries, the historical vulnerability information of these open source dependency libraries can be easily queried, and then the security vulnerabilities that may exist in the execution process of the current binary executable file can be discovered, and corresponding countermeasures can be taken to improve the security of the software.

[0069] It is understandable that the files have different naming formats depending on the system or platform where the target file runs. For example, for Microsoft Windows operating system, it is generally a PE (Portable Executable) format file; while for Unix and X86-64 Linux, it is an ELF (Executable and Linkable Format, ELF) format file.

[0070] Therefore, in order to more accurately analyze the dependent libraries used by the binary executable file, in some embodiments, before performing feature extraction on the binary executable file to be analyzed (step 110), the method also includes: obtaining the file header of the binary executable file to be analyzed; and determining the type of the binary executable file to be analyzed based on the file header.

[0071] In this embodiment, the third-party compilation library libmagic can be called to identify whether the binary executable is a PE file or an ELF file.

[0072] Specifically, the step of extracting features from the binary executable file to be analyzed to obtain feature information of the binary executable file (step 110) includes:

[0073] Parsing data segments and / or code segments, export information, and processor architecture information of the binary executable file according to the type of the binary executable file;

[0074] If the data segment is obtained by parsing, feature extraction is performed on the data segment to obtain visible character strings and / or export information; if the binary file does not include the data segment, this step is skipped.

[0075] The visible strings in the data segment are extracted, including Ascii strings and Usc-2 strings.

[0076] In some embodiments, the visible string carries a virtual address identifier. After obtaining the visible string, the method further includes: sorting the obtained visible string according to the virtual address; in this way, feature matching can be performed one by one with the fingerprint feature database according to the order of the visible string to obtain the open source library that the binary file depends on.

[0077] If a code segment is obtained through parsing, the code segment is disassembled according to the processor architecture information to obtain assembly instructions; the assembly instructions may include: assembly code; translating the assembly code into an intermediate language (IL) that is independent of the processor architecture; and establishing a control flow graph (CFG) based on the intermediate language.

[0078] In this embodiment, if the binary file does not contain a data segment, this step is skipped. If a code segment is obtained by parsing, the data of the code segment is used to obtain a series of assembly instructions using a disassembler according to the processor architecture. Each assembly instruction may include assembly code and its virtual address.

[0079] Static program analysis is performed on the control flow graph to obtain an intermediate language sequence.

[0080] In this embodiment, a static program analysis method is used to simplify a control flow graph based on an intermediate language to obtain an optimized intermediate language sequence; the intermediate language sequence includes one or more intermediate languages.

[0081] In order to implement the above-mentioned dependency library analysis method, in some embodiments, the method also includes: constructing a fingerprint feature database, which may include: an export information feature data table, a visible string feature information table, an intermediate language sequence feature information table, and a dependency library version information table, etc.

[0082] The constructing of the feature database may include: analyzing different versions of the obtained open source software libraries as sample files; extracting fingerprint features in the sample files; establishing a fingerprint feature database according to the fingerprint features in the sample files; the fingerprint features include: export information, visible character strings and / or intermediate languages.

[0083] In this embodiment, by automatically analyzing a large number of sample files of different versions, different architectures, and different compilation options of existing open source software libraries, a fingerprint feature database including an export information feature data table, a visible string feature information table, an intermediate language sequence feature information table, and a dependent library version information table is established based on feature information (fingerprint features), such as export information, visible string information, and intermediate language sequences, making it possible to analyze dependent libraries directly from binary executable files.

[0084] It is understandable that for the same open source software library, such as the openssl library, its versions are 0.9.8, 0.9.7 and 1.0.2, where 0.9.8 and 0.9.7 belong to the same major version 0.9.x series. Then the export information, visible strings or intermediate language information belonging to the same major version will have common fingerprint features. For example, the major version 0.9.x series to which 0.9.8 and 0.9.7 belong has common export information, such as the export symbol AES_cfbr_encrypt_block, but there is no such export symbol in 1.x.

[0085] Therefore, in order to improve the subsequent matching efficiency, in some embodiments, a maximum common interval can be calculated for the export information, visible string or intermediate language information belonging to the same major version according to their similarity. Each export information, visible string or intermediate language information in the common interval is shared by at least two different versions of the open source software, that is, a first mapping relationship between the corresponding fingerprint feature and the name identifier of the open source software can be established. Further, a second mapping relationship between the visible string and the open source software version can be established. Of course, if a certain type of feature information does not exist in a certain sample file, the feature information of other types can be calculated.

[0086] In order to improve the subsequent matching efficiency, the specific method of establishing a fingerprint feature database based on the fingerprint features in the sample files includes: performing similarity calculations on the same type of fingerprint features in different sample files based on a dimensionality reduction algorithm to obtain the same type of fingerprint feature values ​​shared by different sample files; and storing the same type of fingerprint feature values ​​shared by different sample files to form the fingerprint feature database.

[0087] The dimension reduction algorithm may be a minhash algorithm, and the fingerprint feature value may be a hash value. In this embodiment, the visible string information and intermediate language information obtained from the sample file may be stored in an Apache Spark (an open source processing engine or framework) engine, and the built-in minhash algorithm of the Apache Spark engine may be used to perform dimension reduction processing on the data.

[0088] For establishing the version information table, illustratively, for each open source software library, the version characteristics of the library are collected. For example, in the zlib (a library for providing data compression) library, there will be a line of string "deflate 1.2.11Copyright 1995-2017 Jean-loup Gailly and Mark Adler", and 1.2.11 is the version of the zlib library. The version information can be obtained by writing a regular expression, and the version information of each open source software library is stored in the version information table. If the open source software library does not have version information, skip this step.

[0089] In this embodiment, through the above steps, a fingerprint feature database integrating various fingerprint features (feature information) can be efficiently established, which can be applied to realize efficient and accurate analysis of dependent library information used by binary files.

[0090] According to the above description, the binary executable file dependency library analysis method provided by the embodiment of the present invention can still identify the dependency library name and corresponding version information used by the binary executable file even if no source code information is provided, and then it can be discovered whether there are known vulnerabilities in the binary executable file, preventing the computer from being at risk of being attacked when running the binary executable file, thereby ensuring the safe operation of the computer. Embodiment 2

[0091] Figure 4 FIG. 1 is a schematic block diagram of an embodiment of a binary executable file dependency library analysis device of the present invention; Figure 4 As shown, the binary executable file dependency library analysis device includes:

[0092] The extraction program module 210 is used to extract features of the binary executable file to be analyzed and obtain feature information of the binary executable file;

[0093] The matching program module 220 is used to match the feature information of the binary executable file with a fingerprint feature database to determine the corresponding dependent library fingerprint feature; the fingerprint feature database stores fingerprint features for identifying dependent library attribute information;

[0094] The determination program module 230 is used to determine the corresponding dependency library attribute information according to the dependency library fingerprint feature.

[0095] The device of this embodiment can be used to perform Figure 1 The technical solution of the method embodiment shown and the device of this embodiment have similar implementation principles and technical effects, which will not be described in detail here, and can be referenced to each other.

[0096] See also Figure 5 As shown, in this embodiment, the characteristic information of the binary executable file includes: one or more;

[0097] As an optional embodiment, the device provided in this embodiment is similar to the device described in the above embodiment, except that: the matching program module 220 includes:

[0098] A matching program unit 221, configured to perform a global match between any feature information of the binary executable file and the fingerprint features in the fingerprint feature database;

[0099] The first determination program unit 222 is used to determine the first fingerprint feature as the dependency library fingerprint feature corresponding to the binary executable file if the matching degree between any feature information of the binary executable file and the first fingerprint feature in the fingerprint feature database reaches a preset global matching degree threshold.

[0100] In this embodiment, as another optional embodiment, the feature information of the binary executable file and the fingerprint features in the fingerprint feature database respectively include: export information, visible character strings and / or intermediate language sequences.

[0101] See also Figure 6 As shown, as another optional embodiment, the determination program module 230 includes: a second determination program unit 231, which is used to determine the corresponding dependency library name identifier according to the dependency library fingerprint feature.

[0102] Continue to view Figure 6 As shown, the characteristic information includes: a visible character string;

[0103] The determination program module 230 also includes: a third determination program unit 232, which is used to match the visible string with the version information table of the corresponding dependent library after determining the corresponding dependent library name identifier according to the dependent library fingerprint feature, to determine the dependent library version information corresponding to the dependent library name identifier; wherein the version information table of the dependent library is preset with the dependent library name identifier and the corresponding relationship between the visible string and the dependent library version information.

[0104] In this embodiment, as another optional embodiment, the device further includes: an identification program module, which is used to: obtain a file header of the binary executable file to be analyzed; and determine the type of the binary executable file to be analyzed according to the file header.

[0105] Specifically, the extraction program module 210 includes:

[0106] A parsing program unit, used for parsing a data segment and / or a code segment, exporting information and processor architecture information of a binary executable file according to the type of the binary executable file;

[0107] A first extraction program unit is used for, if the data segment is obtained by parsing, performing feature extraction on the data segment to obtain a visible character string and / or derived information;

[0108] A disassembler unit is used for disassembling the code segment according to the processor architecture information to obtain assembly instructions if the code segment is obtained by parsing; the assembly instructions include: assembly code;

[0109] A translation program unit, used for translating the assembly code into an intermediate language that is independent of the processor architecture;

[0110] Establishing a program unit for establishing a control flow graph based on the intermediate language;

[0111] The static analysis program unit is used to perform static program analysis on the control flow graph to obtain an intermediate language sequence; the intermediate language sequence includes: one or more intermediate languages.

[0112] In some embodiments, the apparatus further comprises: a sample analysis program module for analyzing the acquired different versions of the open source software library as sample files;

[0113] A second extraction program module 210, used to extract fingerprint features from the sample file;

[0114] The feature database building program module is used to build a fingerprint feature database according to the fingerprint features in the sample file; the fingerprint features include: export information, visible character strings and / or intermediate language.

[0115] In some further embodiments, the feature library establishment program module includes:

[0116] A dimension reduction program unit is used to perform similarity calculation on the same type of fingerprint features in different sample files based on a dimension reduction algorithm to obtain the same type of fingerprint feature values ​​shared by different sample files;

[0117] The storage program unit is used to store the same type of fingerprint feature values ​​shared by different sample files to form the fingerprint feature database.

[0118] The binary executable file dependency library analysis device provided in the embodiment of the present invention is based on the same specific technical features as the first embodiment. Without providing any source code information, it is possible to simply and conveniently and efficiently identify the dependency library information used by the binary executable file from the binary executable file. Therefore, the device is convenient for analyzing the dependency library information used by the binary executable file.

[0119] As for the various embodiments of the binary executable file dependency library analysis device provided by the present invention, since they are basically similar to the method embodiment, the relevant parts can be referred to the description of the method embodiment part.

[0120] The present invention also provides an electronic device according to an embodiment, comprising one or more processors; a memory;

[0121] The memory may store one or more executable programs, and the one or more processors read the executable program codes stored in the memory to run programs corresponding to the executable program codes, so as to execute any method described in the first embodiment.

[0122] Figure 7 FIG. 1 is a schematic diagram of the structure of an embodiment of an electronic device of the present invention, which can implement any method described in Embodiment 1 of the present invention, such as Figure 7 As shown, as an optional embodiment, the above-mentioned electronic device may include: a shell 41, a processor 42, a memory 43, a circuit board 44 and a power supply circuit 45, wherein the circuit board 44 is arranged inside the space enclosed by the shell 41, and the processor 42 and the memory 43 are arranged on the circuit board 44; the power supply circuit 45 is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory 43 is used to store executable program codes; the processor 42 runs the program corresponding to the executable program code by reading the executable program code stored in the memory 43, so as to execute the binary executable file dependency library analysis method described in any of the aforementioned embodiments one.

[0123] The specific execution process of the processor 42 for the above steps and the steps further executed by the processor 42 by running the executable program code can be found in the description of the first embodiment of the binary executable file dependency library analysis method of the present invention, which will not be repeated here.

[0124] The electronic device exists in various forms, including but not limited to: (1) Mobile communication devices: These devices are characterized by having mobile communication functions and are mainly aimed at providing voice and data communications. Such terminals include: smart phones (such as iPhone), multimedia phones, functional phones, and low-end phones. (2) Ultra-mobile personal computer devices: These devices belong to the category of personal computers, have computing and processing functions, and generally also have mobile Internet access features. Such terminals include: PDA, MID and UMPC devices, such as iPad. (3) Portable entertainment devices: These devices can display and play multimedia content. Such devices include: audio and video playback modules (such as iPod), handheld game consoles, e-books, as well as smart toys and portable car navigation devices. (4) Servers: Devices that provide computing services. The server's composition includes processors, hard disks, memory, system buses, etc. The server is similar to the general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, manageability, etc. (5) Other electronic devices with data interaction functions.

[0125] An embodiment of the present invention also provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the binary executable file dependency library analysis method described in any of the above-mentioned embodiments.

[0126] From the above description, it can be seen that the binary executable file dependency library analysis method and device provided by the present invention can identify the dependency library name and corresponding version information used by the binary executable file from the binary executable file without providing source code information, thereby facilitating the analysis of the dependency library information used by the binary executable file.

[0127] Furthermore, based on the analyzed dependent library names and corresponding version information used by the binary executable file, it is possible to discover whether there are known vulnerabilities in the binary executable file, thereby preventing the computer from being attacked when running the binary executable file, thereby ensuring the safe operation of the computer.

[0128] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0129] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0130] For the convenience of description, the above device is described by dividing the functions into various units / modules. Of course, when implementing the present invention, the functions of each unit / module can be implemented in the same or multiple software and / or hardware.

[0131] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can also be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0132] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for analyzing a binary executable file dependency library, characterized in that: The method comprises the steps of: Performing feature extraction on the binary executable file to be analyzed to obtain feature information of the binary executable file; According to the feature information of the binary executable file, the fingerprint feature database is matched to determine the corresponding dependent library fingerprint feature; the fingerprint feature database stores the fingerprint feature for identifying the dependent library attribute information; Determine corresponding dependency library attribute information according to the dependency library fingerprint feature; Wherein, the feature information at least includes a visible character string; the determining the corresponding dependency library attribute information according to the dependency library fingerprint feature includes: determining the corresponding dependency library name identifier according to the dependency library fingerprint feature; According to the matching of the visible string with the version information table of the corresponding dependent library, the dependent library version information corresponding to the dependent library library name identifier is determined; wherein the dependent library version information table is preset with the dependent library library name identifier and the corresponding relationship between the visible string and the dependent library version information.

2. The method according to claim 1, characterized in that The characteristic information of the binary executable file includes: one or more types; The matching of the feature information of the binary executable file with the fingerprint feature database to determine the corresponding dependent library fingerprint feature includes: performing global matching of any feature information of the binary executable file with the fingerprint features in the fingerprint feature database; If the matching degree between any feature information of the binary executable file and the first fingerprint feature in the fingerprint feature database reaches a preset global matching degree threshold, the first fingerprint feature is determined as the dependency library fingerprint feature corresponding to the binary executable file.

3. The method according to claim 1 or 2, characterized in that: The feature information of the binary executable file and the fingerprint features in the fingerprint feature database respectively include: export information, visible character strings and / or intermediate language sequences.

4. The method according to claim 1, characterized in that Before extracting features from the binary executable file to be analyzed, the method further includes: Get the file header of the binary executable file to be analyzed; The type of the binary executable file to be analyzed is determined according to the file header.

5. The method according to claim 4, characterized in that The feature extraction of the binary executable file to be analyzed to obtain feature information of the binary executable file includes: Parsing data segments and / or code segments, export information, and processor architecture information of the binary executable file according to the type of the binary executable file; If the data segment is obtained by parsing, feature extraction is performed on the data segment to obtain a visible character string and / or export information; If the code segment is obtained by parsing, the code segment is disassembled according to the processor architecture information to obtain assembly instructions; the assembly instructions include: assembly code; Translating the assembly code into an intermediate language that is independent of the processor architecture; Establishing a control flow graph based on the intermediate language; Static program analysis is performed on the control flow graph to obtain an intermediate language sequence.

6. The method according to claim 1, characterized in that The method further comprises: analyzing the obtained open source software libraries of different versions as sample files; Extracting fingerprint features from the sample file; A fingerprint feature database is established according to the fingerprint features in the sample file; the fingerprint features include: derived information, visible character strings and / or intermediate language.

7. The method according to claim 6, characterized in that The establishing of a fingerprint feature database according to the fingerprint features in the sample file comprises: Based on the dimension reduction algorithm, similarity calculation is performed on the fingerprint features of the same type in different sample files to obtain the fingerprint feature values ​​of the same type shared by different sample files; The same type of fingerprint feature values ​​common to different sample files are stored to form the fingerprint feature database.

8. A binary executable file dependency library analysis device, characterized in that: The device comprises: an extraction program module, which is used to extract features from a binary executable file to be analyzed, and obtain feature information of the binary executable file; A matching program module, used to match the feature information of the binary executable file with a fingerprint feature database to determine the corresponding dependent library fingerprint feature; the fingerprint feature database stores fingerprint features for identifying dependent library attribute information; Determine a program module, used to determine corresponding dependency library attribute information according to the dependency library fingerprint feature; Wherein, the characteristic information at least includes a visible character string; The determination program module includes: a second determination program unit, configured to determine a corresponding dependency library name identifier according to the dependency library fingerprint feature; The third determination program unit is used to match the visible string with the version information table of the corresponding dependent library to determine the dependent library version information corresponding to the dependent library library name identifier; wherein the dependent library version information table is preset with the dependent library name identifier and the corresponding relationship between the visible string and the dependent library version information.

9. The device according to claim 8, characterized in that The characteristic information of the binary executable file includes: one or more types; The matching program module includes: A matching program unit, used for globally matching the fingerprint features in the fingerprint feature database according to any feature information of the binary executable file; The first determination program unit is used to determine the first fingerprint feature as the dependent library fingerprint feature corresponding to the binary executable file if the matching degree between any feature information of the binary executable file and the first fingerprint feature in the fingerprint feature database reaches a preset global matching degree threshold.

10. The device according to claim 8 or 9, characterized in that The feature information of the binary executable file and the fingerprint features in the fingerprint feature database respectively include: export information, visible character strings and / or intermediate language sequences.

11. The device according to claim 8, characterized in that The device further comprises: an identification program module, configured to: Get the file header of the binary executable file to be analyzed; The type of the binary executable file to be analyzed is determined according to the file header.

12. The device according to claim 11, characterized in that The extractor module includes: A parsing program unit, used for parsing a data segment and / or a code segment, exporting information and processor architecture information of a binary executable file according to the type of the binary executable file; A first extraction program unit is used for, if the data segment is obtained by parsing, performing feature extraction on the data segment to obtain a visible character string and / or derived information; A disassembler unit is used for disassembling the code segment according to the processor architecture information to obtain assembly instructions if the code segment is obtained by parsing; the assembly instructions include: assembly code; A translation program unit, used for translating the assembly code into an intermediate language that is independent of the processor architecture; Establishing a program unit for establishing a control flow graph based on the intermediate language; The static analysis program unit is used to perform static program analysis on the control flow graph to obtain an intermediate language sequence; the intermediate language sequence includes: one or more intermediate languages.

13. The device according to claim 8, characterized in that The device further comprises: a sample analysis program module, which is used to analyze the obtained open source software libraries of different versions as sample files; A second extraction program module, used to extract fingerprint features from the sample file; The feature database building program module is used to build a fingerprint feature database according to the fingerprint features in the sample file; the fingerprint features include: export information, visible character strings and / or intermediate language.

14. The device according to claim 13, characterized in that The feature library establishment program module includes: A dimension reduction program unit is used to perform similarity calculation on the same type of fingerprint features in different sample files based on a dimension reduction algorithm to obtain the same type of fingerprint feature values ​​shared by different sample files; The storage program unit is used to store the same type of fingerprint feature values ​​shared by different sample files to form the fingerprint feature database.

15. An electronic device, characterized in that: include: One or more processors; Memory; The memory stores one or more executable programs, and the one or more processors read the executable program code stored in the memory to run the program corresponding to the executable program code, so as to execute the method described in any one of claims 1 to 7.

16. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method of any one of claims 1 to 7.

Images