An open source software identification method and device

Abstract

The application discloses an open source software identification method and device. The method comprises the following steps: obtaining target code to be identified; matching feature information of open source software in an open source software feature library with the target code to determine target feature information matched with the target code, wherein the feature information comprises at least one of the following: endpoint feature information, fork point feature information and invalid feature information; the endpoint feature information comprises file information corresponding to an initial version of the open source software and / or file information newly added to a non-initial version of the open source software relative to a previous version; the fork point feature information comprises file information modified by the non-initial version of the open source software relative to the previous version; and the invalid feature information comprises file information not modified from the initial version to the current latest version of the open source software; determining open source software information corresponding to the target code according to the target feature information; and the open source software information comprises a version number, a name, a file directory, a file size or a hash value of the open source software.

Description

[0001] This application is a divisional application, the original application's application number is 201711463010.9, the original application date is December 28, 2017, and the entire contents of the original application are incorporated herein by reference. TECHNICAL FIELD

[0002] The present application relates to the field of computer applications, and in particular to an open source software identification method and device. BACKGROUND

[0003] Open source software has played an increasingly important role in cloud computing and has become a key to cloud computing network security. Accurate identification of open source software and its version is the key to ensuring the effective closed loop of open source component vulnerabilities. There are mature network security vulnerability libraries in the industry, and the premise of these open source software vulnerability closed loops is to accurately identify which open source software and its version are used in the product code. However, due to the characteristics of open source software, such as open source, modifiable, and distributable, there are many versions of open source software, making it difficult to identify.

[0004] Currently, the industry mainly uses file comparison technology to identify open source software and its version used in the code. The main feature of file comparison is to collect as much information as possible about the hash value, file size, file directory, and other attributes of the open source file, and perform full comparison, that is, compare all the collected open source file information with the code, and according to the comparison result, identify the open source software and its version with the highest similarity.

[0005] Due to the large number of open source software files, identifying open source software through full file comparison will consume a lot of time and is relatively inefficient. SUMMARY

[0006] The embodiments of the present application provide an open source software identification method and device for quickly identifying open source software and its version used in product code and improving identification efficiency.

[0007] Therefore, the first aspect of the present application provides an open source software identification method, which comprises: an identification device acquiring target code that needs to be identified for open source software, then matching the feature information in the open source software feature library with the target code, identifying the target feature information matched with the target code, and determining the open source software information corresponding to the target code according to the target feature information;

[0008] The feature information includes at least one of endpoint feature information, fork point feature information and invalid feature information. The endpoint feature information includes file information corresponding to an initial version of the open source software and / or file information newly added to a non-initial version of the open source software relative to a previous version. The fork point feature information includes file information modified by a non-initial version of the open source software relative to a previous version. The invalid feature information includes file information that is not modified from an initial version to a current latest version of the open source software.

[0009] In the implementation, the recognition device can recognize the open source software and the version thereof used by the target code according to the feature information, without full comparison, thereby improving the recognition efficiency.

[0010] In a first implementation of the first aspect, the recognition device can determine the target feature information in the following manner: the recognition device determines target file information corresponding to the target code, and obtains endpoint feature information of each open source software in the open source software feature library, and then determines whether there is target endpoint feature information matched with the target file information in the endpoint feature information, and if so, the target endpoint feature information is the target feature information matched with the target code.

[0011] Correspondingly, the recognition device can determine the open source software information corresponding to the target code in the following manner: information of an open source software (a first open source software) to which the target endpoint feature information belongs is determined as the open source software information corresponding to the target code.

[0012] In the implementation, the recognition device provides a manner of recognizing open source software information, thereby improving the realizability of the scheme.

[0013] In the second implementation of the first aspect, after the recognition device determines the target endpoint feature information, the recognition device can further perform the following process: the recognition device determines version numbers of the first open source software corresponding to each endpoint feature information in the target endpoint feature information, determines a highest version number in the version numbers as a target version number, and then obtains fork point feature information corresponding to the target version number and version numbers after the target version number of the first open source software in the open source software feature library, determines whether there is target fork point feature information matched with the target file information in the fork point feature information, and if so, a version number corresponding to the target fork point feature information is the version number of the open source software corresponding to the target code.

[0014] In the implementation, the recognition device can accurately recognize the version number of the open source software corresponding to the target code through the fork point feature information, thereby improving the recognition accuracy.

[0015] In a third implementation manner of the first aspect of the present application, in combination with the first or second implementation manner of the first aspect of the present application, after the device for identifying determines the target endpoint feature information, the device for identifying can further perform the following process: the device for identifying acquires invalid feature information of the first open source software in the open source software feature library, judges whether there is target invalid feature information matching the target file information in the invalid feature information of the first open source software, and if so, determines that the invalid feature information of the first open source software other than the target invalid feature information is modified in the target code.

[0016] In the implementation manner, after the device for identifying identifies the open source software information corresponding to the target code, the device for identifying can further identify which part of the open source software is modified by the target code, thereby improving the flexibility of the scheme.

[0017] In combination with the first aspect of the present application, in a fourth implementation manner of the first aspect, the device for identifying can determine the target feature information in the following manner: the device for identifying determines target file information corresponding to the target code, and acquires fork point feature information of each open source software in the open source software feature library, judges whether there is target fork point feature information matching the target file information in the fork point feature information, and if so, the target fork point information is the target feature information matching the target code.

[0018] Correspondingly, the device for identifying can determine the open source software information corresponding to the target code in the following manner: the device for identifying determines the first open source software to which the target fork point feature information belongs and the version number of the first open source software corresponding to the target fork point feature information, and the target code corresponds to the first open source software, and the open source software version number corresponding to the target corresponds to the version number corresponding to the target fork point information.

[0019] In the implementation manner, the device for identifying provides another way to identify open source software information, thereby improving the flexibility of the scheme.

[0020] In a fifth implementation manner of the first aspect of the present application, in combination with the first implementation manner of the first aspect of the present application, when the device for identifying determines that there is no target feature information, the device for identifying can acquire fork point feature information of each open source software in the open source software feature library, judge whether there is target fork point feature information matching the target file information in the fork point feature information, and if so, the target fork point information is the target feature information matching the target code.

[0021] Correspondingly, the identification device can determine the open source software information corresponding to the target code by determining that the target code corresponds to the first open source software to which the target fork point feature information belongs and the version number of the first open source software corresponding to the target fork point feature information, that is, the open source software corresponding to the target code is the first open source software, and the open source software version number corresponding to the target code is the version number corresponding to the target fork point information.

[0022] In the implementation mode, the identification device provides another way of identifying open source software information, and improves the flexibility of the scheme.

[0023] The second aspect of the present application provides an identification device, which comprises a first acquisition module, a first determination module and a second determination module; wherein the first acquisition module is used to acquire target code to be identified; the first determination module is used to match the feature information of the open source software in the open source software feature library with the target code, to determine the target feature information matched with the target code; and the second determination module is used to determine the open source software information corresponding to the target code according to the target feature information.

[0024] The feature information comprises at least one of the following: endpoint feature information, fork point feature information and invalid feature information; the endpoint feature information comprises file information corresponding to the initial version of the open source software and / or file information newly added to the non-initial version of the open source software relative to the previous version; the fork point feature information comprises file information modified by the non-initial version of the open source software relative to the previous version; and the invalid feature information comprises file information not modified from the initial version to the current latest version of the open source software.

[0025] In the first implementation mode of the second aspect of the present application, the first determination module comprises a first acquisition unit, a first determination unit, a first judgment unit and a second determination unit; and the second module comprises a third determination unit.

[0026] The first acquisition unit is used to acquire the endpoint feature information of each open source software in the open source software feature library; the first determination unit is used to determine the target file information corresponding to the target code; the first judgment unit is used to determine whether the target endpoint feature information of the first open source software corresponding to the target file information exists in the open source software feature library; the second determination unit is used to determine that the target endpoint feature information matches the target code when the first judgment unit determines that the target endpoint feature information exists; and the third determination unit is used to determine that the information of the first open source software corresponding to the target endpoint feature information is the open source software information corresponding to the target code.

[0027] In a first implementation manner of the second aspect of the present application, the apparatus further includes a third determining module, a fourth determining module, a second obtaining module, a first judging module, and a fifth determining module.

[0028] The third determining module is configured to determine the version number of the first open source software corresponding to each endpoint feature information in the target endpoint feature information. The fourth determining module is configured to determine a target version number in the version number of the first open source software, and the target version number is the highest version number in the version number of the first open source software. The fourth determining module is further configured to determine whether the target version number is the highest version number in all version numbers of the first open source software in the open source software feature library. If yes, the fourth determining module is further configured to determine that the target version number is the version number of the open source software corresponding to the target code. The second obtaining module is configured to, if the target version number is not the highest version number in all version numbers of the first open source software in the open source software feature library, obtain the fork point feature information corresponding to the target version number and the version numbers after the target version number of the first open source software in the open source software feature library. The first judging module is configured to determine whether there is target fork point feature information matching the target file information in the fork point feature information corresponding to the target version number and the version numbers after the target version number of the first open source software. The fifth determining module is configured to, when the first judging module determines that there is the target fork point feature information, determine that the version number of the first open source software corresponding to the target fork point feature information is the version number of the open source software corresponding to the target code.

[0029] In a third implementation manner of the second aspect of the present application, the identification apparatus further includes a third obtaining module, a second judging module, and a sixth determining module.

[0030] The third obtaining module is configured to obtain the invalid feature information of the first open source software in the open source software feature library. The second judging module is configured to determine whether there is target invalid feature information matching the target file information in the invalid feature information of the first open source software. The sixth determining module is configured to, when the second judging module determines that there is the target invalid feature information, determine that other invalid feature information except the target invalid feature information in the invalid feature information of the first open source software is modified in the target code.

[0031] In a fourth implementation manner of the second aspect of the present application, the first determining module includes a second obtaining unit, a fourth determining unit, a second judging unit, and a fifth determining unit. The second determining module includes a sixth determining unit.

[0032] The second acquisition unit is configured to acquire the fork point feature information of each open source software in the open source software feature library; the fourth determination unit is configured to determine target file information corresponding to the target code; the second judgment unit is configured to determine whether the fork point feature information of each open source software includes target fork point feature information matching the target file information; the fifth determination unit is configured to determine that the target fork point feature information matches the target code when the second judgment unit determines that the target fork point feature information exists; and the sixth determination unit is configured to determine a first open source software corresponding to the target fork point feature information and a version number of the first open source software corresponding to the target fork point feature information and corresponding to the target code.

[0033] The third aspect of the present application provides an identification device, which comprises a processor and a memory.

[0034] The memory is configured to store a program, and the processor is configured to execute the program, specifically including the following steps: acquiring target code that needs to be identified by open source software, then matching feature information in an open source software feature library with the target code, identifying target feature information matching the target code, and determining open source software information corresponding to the target code according to the target feature information.

[0035] The feature information includes at least one of the following: endpoint feature information, fork point feature information, and invalid feature information; the endpoint feature information includes file information corresponding to an initial version of the open source software and / or file information newly added to a non-initial version of the open source software relative to a previous version; the fork point feature information includes file information modified by a non-initial version of the open source software relative to a previous version; and the invalid feature information includes file information that has not been modified from an initial version to a current latest version of the open source software.

[0036] In the first implementation manner of the third aspect of the present application, the processor identifies the target feature information matching the target code, specifically including the following steps: determining target file information corresponding to the target code, acquiring endpoint feature information of each open source software in the open source software feature library, and then determining whether there is target endpoint feature information matching the target file information in the endpoint feature information, and if so, the target endpoint feature information is the target feature information matching the target code.

[0037] Correspondingly, the processor determines the open source software information corresponding to the target code, specifically including the following steps: determining information of an open source software (first open source software) to which the target endpoint feature information belongs as the open source software information corresponding to the target code.

[0038] In a second implementation manner of the third aspect of the present application, in combination with the first implementation manner of the third aspect of the present application, after the processor determines the target endpoint feature, the processor further specifically performs the following steps: determining the version number of the first open source software corresponding to each endpoint feature information in the target endpoint feature information, determining the highest version number in the version numbers as the target version number, and then acquiring the fork point feature information corresponding to the target version number and the version numbers after the target version number of the first open source software in the open source software feature library, and judging whether the target fork point feature information matched with the target file information exists in the fork point feature information, and if so, the version number corresponding to the target fork point feature information is the version number of the open source software corresponding to the target code.

[0039] In a third implementation manner of the third aspect of the present application, in combination with the first or second implementation manner of the third aspect of the present application, after the processor determines the target endpoint feature information, the processor further specifically performs the following steps: acquiring the invalid feature information of the first open source software in the open source software feature library, judging whether the target invalid feature information matched with the target file information exists in the invalid feature information of the first open source software, and if so, determining that the other invalid feature information except the target invalid feature information in the invalid feature information of the first open source software is modified in the target code.

[0040] In a fourth implementation manner of the third aspect of the present application, in combination with the third aspect of the present application, the step of identifying the target endpoint feature information by the processor can specifically include: determining the target file information corresponding to the target code, and acquiring the fork point feature information of each open source software in the open source software feature library, judging whether the target fork point feature information matched with the target file information exists in the fork point feature information, and if so, the target fork point information is the target feature information matched with the target code.

[0041] Correspondingly, the step of determining the open source software information corresponding to the target code by the processor can specifically include: determining the first open source software to which the target fork point feature information belongs and the version number of the first open source software corresponding to the target fork point feature information, and the target code corresponds to the first open source software, and the open source software version number corresponding to the target corresponds to the version number corresponding to the target fork point information.

[0042] The fourth aspect of the present application provides a computer readable storage medium, wherein instructions are stored in the computer readable storage medium, and when the instructions are run on a computer, the computer executes the method of the first aspect, any one of the first to fifth implementation manners of the first aspect.

[0043] The fifth aspect of the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the method described in the first aspect and any one of the first to fifth implementations of the first aspect.

[0044] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0045] The embodiment of the present application is to match the feature information of the open source software in the open source software feature library with the target code, and then identify the open source software information corresponding to the target code based on the target feature information matched with the target code. Among them, the feature information may include at least one of the following: endpoint feature information, bifurcation feature information, and invalid feature information; endpoint feature information refers to the file information corresponding to the initial version of the open source software and the file information newly added to the initial version of the open source software relative to the previous version, bifurcation feature information refers to the file information modified by the non-initial version relative to the previous version, and invalid feature information is the file information of the open source software that has not been modified from the initial version to the current latest version. Based on these feature information, the recognition device can identify the open source software and its version used by the target code without the need for full comparison, thereby improving the recognition efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present application.

[0047] Figure 1 This is a schematic diagram of an embodiment of the open source software identification method in the embodiment of the present application;

[0048] Figure 2 This is a schematic diagram of another embodiment of the open source software identification method in the embodiment of the present application;

[0049] Figure 3 This is a schematic diagram of characteristic information in an embodiment of the present application;

[0050] Figure 4 A schematic diagram of target file information in an embodiment of the present application;

[0051] Figure 5 This is a schematic diagram of an embodiment of an identification device in an embodiment of the present application;

[0052] Figure 6 This is a schematic diagram of another embodiment of the identification device in the embodiment of the present application;

[0053] Figure 7 This is a schematic diagram of another embodiment of the identification device in the embodiment of the present application;

[0054] Figure 8 Figure 2 is a schematic diagram of another embodiment of the identification device in the embodiments of the present application. DETAILED DESCRIPTION

[0055] The technical solutions in the embodiments of the present application will be clearly and completely described in connection with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application.

[0056] The terms "first", "second", "third", "fourth" and the like (if any) in the specification and claims of the present application and the above drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to the process, method, product or device.

[0057] The embodiments of the present application provide an open source software identification method and device, which are used for quickly identifying open source software and its version used in a product code, and improving identification efficiency.

[0058] For ease of understanding, the following introduces the terms and phrases related to the present application:

[0059] Open source software: also known as open source software (open-source), which is defined as software whose source code can be used by the public, and the use, modification and distribution of the software are not limited by the license.

[0060] The following introduces the open source software identification method in the embodiments of the present application, please refer to Figure 1 One embodiment of the open source software identification method in the embodiments of the present application includes:

[0061] 101. The identification device acquires target code to be identified;

[0062] In this embodiment, the identification device determines the target code to be identified. The target code can be input by the user on the identification device, can be actively acquired by the identification device from other devices, can be sent to the identification device by other devices, or can be acquired by the identification device through other means, which is not limited here.

[0063] 102、the identification device matches the characteristic information of the open source software in the open source software characteristic library with the target code, and determines the target characteristic information matched with the target code;

[0064] After the identification device determines the target code that needs to be identified, the characteristic information of each open source software in the open source software library is matched with the target code. If the matching is successful, the characteristic information matched with the target code is taken as the target characteristic information, and step 103 is executed. If the matching is unsuccessful, the identification device can prompt the user of the identification failure or perform other operations, which are not limited here.

[0065] The characteristic information of the open source software includes at least one of the following: endpoint characteristic information of the open source software, fork point characteristic information of the open source software, or invalid characteristic information of the open source software.

[0066] In this embodiment, for any open source software in the open source software characteristic library, the endpoint characteristic information of the open source software refers to the file information corresponding to the initial version of the open source software and / or the file information newly added by the non-initial version of the open source software relative to the previous version; the fork point characteristic information of the open source software refers to the file information modified by the non-initial version of the open source software relative to the previous version; and the invalid characteristic information of the open source software refers to the file information that is not modified from the initial version to the current latest version of the open source software.

[0067] As an optional way, before the identification device matches the characteristic information of the open source software in the open source software characteristic library with the target code, the open source software characteristic library can be established. Specifically, the identification device can establish the open source software characteristic library by the following way: obtaining the software package of each open source software from the website server, parsing the software package to obtain the file information corresponding to each version of each open source software, then comparing the file information corresponding to each version of each open source software to determine the characteristic information of the open source software, and establishing the open source software characteristic library according to the characteristic information. The identification device can also establish the open source software characteristic library by other ways, which are not limited here.

[0068] As an optional way, before the identification device matches the characteristic information of the open source software in the open source software characteristic library with the target code, the open source software characteristic library can be obtained from other devices, or the identification device can call the open source software characteristic library from other devices for matching when matching is needed.

[0069] 103、the identification device determines the open source software information corresponding to the target code according to the target characteristic information.

[0070] The identification device determines the open source software information corresponding to the target code according to the target feature information. In this embodiment, the open source software information can include the version number, name, file directory, file size, hash value and the like of the open source software, and the specific application is not limited.

[0071] In this embodiment, the feature information of the open source software in the open source software feature library is matched with the target code, and then the open source software information corresponding to the target code is identified according to the target feature information matched with the target code. The feature information can include at least one of the following: endpoint feature information, fork point feature information, and invalid feature information. The endpoint feature information refers to the file information corresponding to the initial version of the open source software and the file information newly added to the initial version of the open source software relative to the previous version. The fork point feature information refers to the file information modified by the non-initial version relative to the previous version. The invalid feature information is the file information that is not modified from the initial version to the current latest version of the open source software. According to these feature information, the identification device can identify the open source software and its version used by the target code, without full comparison, thereby improving the identification efficiency.

[0072] Based on the above Figure 1 As can be known from the corresponding embodiments, the identification device can match the feature information with the target code in various ways, and some of them will be described in detail below, please refer to Figure 2 Another embodiment of the open source software identification method in this embodiment includes:

[0073] 201. The identification device acquires the target code to be identified;

[0074] In this embodiment, the identification device determines the target code to be identified. The target code can be input by a user on the identification device, can be actively acquired by the identification device from other devices, can be sent to the identification device by other devices, or can be acquired by the identification device through other ways, and the specific application is not limited.

[0075] 202. The identification device acquires the endpoint feature information of each open source software in the open source software feature library, and determines the target file information corresponding to the target code;

[0076] After the identification device determines the target code to be identified, the identification device determines the file information corresponding to the target code, and acquires the endpoint feature information of each open source software in the open source software feature library. In order to facilitate description, the file information corresponding to the target code is referred to as target file information in this embodiment.

[0077] It should be understood that, for any open source software, if only the file information corresponding to the initial version of the open source software is stored in the open source software feature library, the endpoint feature information of the open source software in the open source software library refers to the file information corresponding to the initial version of the open source software; if the file information corresponding to the initial version of the open source software and the file information corresponding to the non-initial version are stored in the open source software library, and there is at least one non-initial version corresponding to the file information that has new content compared with the file information corresponding to the initial version, then the endpoint feature information of the open source software in the open source software library refers to the file information corresponding to the initial version of the open source software and the file information of the non-initial version of the open source software that is newly added compared with the previous version; if the file information corresponding to the initial version of the open source software is not stored in the open source software library, but the file information corresponding to the non-initial version is stored, then the endpoint feature information of the open source software in the open source software library refers to the file information of the non-initial version of the open source software that is newly added compared with the previous version.

[0078] As an optional way, in the embodiment, the open source software feature library stores the file information of all versions corresponding to all open source software, the endpoint feature information of each open source software in the open source software feature library refers to the file information corresponding to the initial version of each open source software, and the file information newly added by each non-initial version of each open source software compared with the previous version, the fork point feature information of each open source software in the open source software feature library refers to the file information of the non-initial version corresponding to each open source software that is modified compared with the previous version, and the invalid feature information of each open source software in the open source software library refers to the file information of each open source software from the initial version to the current latest version that is not modified.

[0079] 203, the identification device determines whether the target endpoint feature information of the first open source software corresponding to the target file information exists in the open source software feature library, if it exists, step 204 is executed, if it does not exist, step 205 is executed;

[0080] The identification device acquires the endpoint characteristic information of each open source software, and compares each endpoint characteristic information with each target file information of the target code. If the endpoint characteristic information and the target file information that match each other can be identified, the identified endpoint characteristic information is determined as target endpoint characteristic information, and the open source software corresponding to the endpoint characteristic information is determined as the first open source software. If the endpoint characteristic information and the target file information that match each other cannot be identified, step 205 is performed. Specifically, the endpoint characteristic information of the open source software includes the hash value of the file corresponding to the initial version of the open source software and / or the hash value of the file newly added to the non-initial version of each open source software relative to the initial version. The target file information includes the hash value of the file corresponding to the target code. The identification device determines whether the target endpoint characteristic information of the first open source software corresponding to the target file information exists in the open source software characteristic library, including: comparing the hash value corresponding to each endpoint characteristic information in the open source software characteristic library with the hash value corresponding to each target file information, determining whether the endpoint characteristic information and the target file information with equal hash values exist, if they exist, the endpoint characteristic information is the target endpoint characteristic information matching the target code, and if they do not exist, step 205 is performed.

[0081] For ease of description, in the embodiment, the endpoint characteristic information that can match the target file information is referred to as target endpoint characteristic information, and the open source software to which the target endpoint characteristic information belongs is referred to as the first open source software.

[0082] It should be understood that in the embodiment, the endpoint characteristic information of the open source software can also include other file characteristics (such as file size, file directory, etc.), and the identification device can also determine the target endpoint characteristic information through other file characteristics, which is not limited in the present application.

[0083] 204. The identification device determines the information of the first open source software as the open source software information corresponding to the target code according to the target endpoint characteristic information.

[0084] After the identification device identifies the target endpoint characteristic information matching the target code, the open source software corresponding to the target endpoint characteristic information is determined as the open source software corresponding to the target code, that is, the first open source software is the open source software corresponding to the target code, and the information of the first open source software is the open source software information corresponding to the target code.

[0085] As an optional mode, in the embodiment, there are multiple target endpoint feature information matching the target code in the open source software feature library, and the multiple target endpoint feature information all belong to one open source software (the first open source software). After the identification device identifies the target endpoint feature information matching the target code, the identification device can determine the version number corresponding to each of the target endpoint feature information, if there is only one version number corresponding to the target endpoint feature information, the version number is determined as the target version number, if there are multiple version numbers corresponding to the target endpoint feature information, the highest version number in the version numbers is determined as the target version number.

[0086] If the determined target version number is already the highest version number in all version numbers corresponding to the first open source software recorded in the open source software feature library, the identification device can determine that the target version number is the version number corresponding to the target code, that is, the open source software corresponding to the target code is the first open source software, and the version number corresponding to the target code is the target version number.

[0087] If the determined target version number is not the highest version number in all version numbers corresponding to the first open source software recorded in the open source software feature library, the identification device can obtain the target version number of the first open source software and the version number corresponding to the fork point feature information after the target version number in the open source software feature library, and then determine whether there is fork point feature information matching the target file information in the target version number of the first open source software and the version number corresponding to the fork point feature information after the target version number. If not, the identification device determines whether the target version number has corresponding fork point feature information in the open source software feature library. If the target version number has no corresponding fork point feature information in the open source software feature library, the identification device can determine that the target version number is the version number corresponding to the target code. If there is, the fork point feature information matching the target code is called target fork point feature information in the embodiment for the convenience of description.

[0088] Specifically, the fork point feature information of the open source software can include the hash value of the file modified by the non-initial version of the open source software relative to the previous version. The identification device can determine the target fork point feature information by comparing the hash value corresponding to each fork point feature information obtained with the hash value corresponding to each target file information, and determining whether there is fork point feature information and target file information with equal hash values. If there is, the fork point feature information is the target fork point feature information matching the target code.

[0089] It should be understood that in the embodiment, the fork point feature information of the open source software can also include other file features (such as file size, file directory, etc.), and the identification device can also determine the target fork point feature information through other file features, which is not limited in the present application. It should be understood that the fork point feature information refers to the file information of a version of the open source software that is modified relative to the previous version. Generally, the target fork point feature information matched with the target code can identify a unique open source software version number, that is, the version number corresponding to the target fork point feature information has only one.

[0090] After the identification device identifies the target fork point feature information matched with the target code, it can be determined that the version number corresponding to the target fork point feature information is the version number corresponding to the target code, that is, the open source software corresponding to the target code is the first open source software, and the version number corresponding to the target code is the version number corresponding to the target fork point feature information.

[0091] It should also be understood that the process of determining the target version number, obtaining the fork point feature information corresponding to the target version number and the version number after the target version number of the first open source software in the open source software feature library by the identification device can be understood as determining all versions of the first open source software that can contain all identified target endpoint feature information, and obtaining the fork point feature information corresponding to these versions.

[0092] As an optional way, in the embodiment, after the identification device identifies the target endpoint feature information matched with the target code, it can obtain the invalid feature information of the first open source software in the open source software feature library, and determine whether there is invalid feature information matched with the target file information in the invalid feature information of the first open source software recorded in the open source software feature library. If yes, these invalid feature information matches the target code. In order to facilitate description, the invalid feature information matched with the target code is referred to as target invalid feature information in the embodiment.

[0093] Specifically, the invalid feature information of the open source software can include the hash value of the file that is not modified from the initial version to the current latest version. Then the identification device can determine the target invalid feature information by comparing the hash value corresponding to each invalid feature information obtained with the hash value corresponding to each target file information, and determining whether there is invalid feature information and target file information with equal hash value. If yes, this invalid feature information is the target invalid feature information matched with the target code.

[0094] It should be understood that in the embodiment, the invalid feature information of the open source software can also include other file features (such as file size, file directory, etc.), and the identification device can also determine the invalid feature information through other file features, which is not limited in the present application.

[0095] After the identification device identifies the target invalid feature information matching the target code, it can be determined that the other invalid feature information of the first open source software except the target invalid feature information is modified in the target code. It should be understood that after the identification device identifies the target endpoint feature information matching the target code by the foregoing manner, it can be determined that the target code corresponds to one of the versions of the first open source software, that is, the target code is obtained by editing the version of the first open source software. The invalid feature information of the first open source software refers to the file information of the first open source software that is not modified from the initial version to the current latest version, that is, the invalid feature information exists in each version of the first open source software. If there is no target invalid feature information matching the target code, it indicates that the invalid feature information part of the first open source software is modified in the process of generating the target code. If each invalid feature information of the first open source software matches the target code, it indicates that the invalid feature information part of the first open source software is not modified in the process of generating the target code. If there is part of the target invalid feature information matching the target code in the invalid feature information of the first open source software, it can be determined that the other invalid feature information of the first open source software except the target invalid feature information is modified in the process of generating the target code.

[0096] 205、The identification device performs other processes.

[0097] When the identification device determines that there is no target endpoint feature information corresponding to the target file information in the open source software feature library, the identification device can obtain the fork point feature information of each open source software in the open source software feature library, and then determine whether there is fork point feature information matching the target file information in the fork point feature information of each open source software. If there is, it is determined that these fork point feature information matches the target code. For ease of description, in this embodiment, the fork point feature information matching the target code is referred to as target fork point feature information.

[0098] It should be understood that the fork point feature information refers to the file information modified by a version of the open source software relative to the previous version. Generally, the target fork point feature information matching the target code can identify a unique open source software version number, that is, the version number corresponding to the target fork point feature information is only one.

[0099] After the identification device identifies the target fork point feature information matching the target code, it can be determined that the open source software (the first open source software) corresponding to the target fork point feature information is the open source software corresponding to the target code, and the version number corresponding to the target fork point feature information is the version number corresponding to the target code.

[0100] When the identification device determines that there is no target endpoint feature information corresponding to the target file information in the open source software feature library, the identification device can also obtain invalid feature information of each open source software in the open source software feature library, and then determine whether there is target invalid feature information matching the target file information in the invalid feature information of each open source software. If there is, it is determined that these invalid feature information matches the target code. For ease of description, in the embodiment, the invalid feature information matching the target code is referred to as target invalid feature information.

[0101] After the identification device identifies the target invalid feature information matching the target code, it can be determined that the open source software corresponding to the target invalid feature information is the open source software corresponding to the target code. The information of the open source software is the open source software information corresponding to the target code.

[0102] When the identification device determines that there is no target endpoint feature information corresponding to the target file information in the open source software feature library, the identification device can also perform other processes, which are not limited here.

[0103] In some embodiments, after the identification device obtains the target code to be identified, it can also directly obtain the fork point feature information of each open source software in the open source software feature library, and determine the target file information corresponding to the target code. Then determine whether there is target fork point feature information matching the target file information in the fork point feature information of each open source software in the open source software feature library. When it is determined that there is target fork point feature information, the open source software information corresponding to the target code can be determined according to the target fork point feature information. The open source software corresponding to the target fork point feature information is the open source software corresponding to the target code. The version number of the open source software corresponding to the target fork point feature information is the version number corresponding to the target code. When it is determined that there is no target fork point feature information, the open source software information corresponding to the target code can be determined according to the invalid feature information of each open source software in the open source software feature library. The specific process is similar to the above step 204, which will not be described here.

[0104] In some embodiments, after the identification apparatus acquires the target code to be identified, the invalid feature information of each open source software in the open source software feature library can also be directly acquired, and the target file information corresponding to the target code is determined, and then it is judged whether there is target invalid feature information matching the target file information in the invalid feature information of each open source software in the open source software feature library. When it is determined that there is target invalid feature information, the open source software information corresponding to the target code can be determined according to the target invalid feature information, and the open source software corresponding to the target invalid feature information is the open source software corresponding to the target code. When it is determined that there is no target invalid feature information, the open source software information corresponding to the target code can be determined according to the endpoint feature information and / or the fork point feature information of each open source software in the open source software feature library. The specific process is similar to steps 203 and 204 described above, and will not be described here.

[0105] The embodiments of the present application match the feature information of the open source software in the open source software feature library with the target code, and then identify the open source software information corresponding to the target code according to the target feature information matched with the target code. The feature information can include at least one of the following: endpoint feature information, fork point feature information, and invalid feature information. The endpoint feature information refers to the file information corresponding to the initial version of the open source software and the file information newly added to the initial version of the open source software relative to the previous version. The fork point feature information refers to the file information modified by the non-initial version relative to the previous version. The invalid feature information is the file information of the open source software from the initial version to the current latest version without modification. According to these feature information, the identification apparatus can identify the open source software and its version used by the target code, without full comparison, thereby improving the identification efficiency.

[0106] Secondly, the embodiments of the present application provide multiple ways to determine the open source software information corresponding to the target code according to the target feature information, thereby improving the flexibility of the scheme.

[0107] In order to facilitate understanding of the present application, the open source software identification method in the present application is described in detail below in an actual application scenario:

[0108] The identification apparatus acquires the open source software package based on the Openstack open source website, and constructs the open source software "feature library" to record the hash values of the files newly added by the non-initial version of each open source software relative to the previous version (endpoint feature information), the hash values of the files modified by the non-initial version of each open source software relative to the previous version (fork point feature information), and the hash values of the files of each open source software from the initial version to the current latest version without modification (invalid feature information), as shown in the following table: Figure 3 The figure shows the feature information of a certain open source software.

[0109] The identification device obtains the target code to be identified, and determines the hash values of each file corresponding to the target code (target file information), as shown in Figure 4 Figure 4 The storage paths of each file corresponding to the target code and the hash values of each file are shown.

[0110] The identification device obtains the hash values of the endpoint feature information of each open source software in the open source software feature library, and compares the hash values of each endpoint feature information with the hash values of each file, as shown in Figure 4 Finally, the identification device identifies that the hash value of the file name "ssl.py" corresponding to the target code is equal to the hash value of the endpoint feature (target endpoint feature information) of the murano software (first open source software) 1.0.3 version in the open source software feature library, the hash value of the file name "ext_context.py" corresponding to the target code is equal to the hash value of the endpoint feature (target endpoint feature information) of the murano software 2.0.2 version, and the version range list containing the two template endpoint feature information is identified as the murano software 2.0.2 version and later versions.

[0111] The identification device obtains the hash values of the fork point features corresponding to the murano software 2.0.2 version (target version) and later versions (i.e. the murano software 2.0.2 version and the murano software 3.0.0 version), compares the obtained hash values of the fork point features with the hash values of each file corresponding to the target code, determines that the murano software 2.0.2 version does not have corresponding fork point features, and the hash values of the fork point features of the murano software 3.0.0 version do not match the hash values of the files corresponding to the target code, and then the identification device determines that the target code corresponds to the murano software 2.0.0 version.

[0112] The identification device obtains the hash values of the invalid features of the murano software, compares the hash values of the invalid features of the murano software with the hash values of each file corresponding to the target code, determines that the hash values of the invalid features ("context.py" and "_init_.py") of the murano software are equal to the hash values of "context.py" and "_init_.py" in the target code, i.e. all the invalid features of the murano software match the target code, and the identification device can further determine that the target code has not been modified for "context.py" and "_init_.py", and all the files corresponding to the target code completely match the murano software 2.0.0 version.

[0113] ​The open source software identification method in the embodiment is introduced above, and the identification device in the embodiment is introduced below. The identification device in the embodiment can be any computer device, such as a personal computer (PC), a laptop computer, a server providing open source software identification services, and the like. Please refer to Figure 5 One embodiment of the identification device in the embodiment of the application includes:

[0114] The first obtaining module 501 is configured to obtain target code to be identified.

[0115] The first determining module 502 is configured to match the feature information of the open source software in the open source software feature library with the target code, and determine target feature information matched with the target code.

[0116] The second determining module 503 is configured to determine open source software information corresponding to the target code according to the target feature information.

[0117] The feature information includes at least one of the following: endpoint feature information, fork point feature information, and invalid feature information. The endpoint feature information includes file information corresponding to an initial version of the open source software and / or file information newly added to a non-initial version of the open source software relative to a previous version. The fork point feature information includes file information modified by the non-initial version of the open source software relative to the previous version. The invalid feature information includes file information that has not been modified from the initial version to the current latest version of the open source software.

[0118] It should be understood that the above Figure 5 The modules in the identification device perform processes similar to the method processes described in the foregoing Figure 1 embodiments, and thus will not be described again here.

[0119] In the embodiment of the application, the first determining module 502 matches the feature information of the open source software in the open source software feature library with the target code, and then the second determining module 503 identifies the open source software information corresponding to the target code according to the target feature information matched with the target code. The feature information can include at least one of the following: endpoint feature information, fork point feature information, and invalid feature information. The endpoint feature information refers to file information corresponding to an initial version of the open source software and file information newly added to the initial version of the open source software relative to a previous version. The fork point feature information refers to file information modified by a non-initial version relative to the previous version. The invalid feature information is file information that has not been modified from the initial version to the current latest version of the open source software. According to these feature information, the identification device can identify the open source software and its version used by the target code, without full comparison, thereby improving the identification efficiency.

[0120] For the convenience of understanding, the identification device in the present application is described in detail below. Please refer to Figure 6 Another embodiment of the identification device in the present application includes:

[0121] The first acquisition module 601 is configured to acquire target code to be identified.

[0122] The first determination module 602 is configured to match the feature information of the open source software in the open source software feature library with the target code, and determine target feature information matched with the target code.

[0123] The second determination module 603 is configured to determine open source software information corresponding to the target code according to the target feature information.

[0124] The feature information includes at least one of the following: endpoint feature information, fork point feature information, and invalid feature information. The endpoint feature information includes file information corresponding to an initial version of the open source software and / or file information newly added to a non-initial version of the open source software relative to a previous version. The fork point feature information includes file information modified by a non-initial version of the open source software relative to a previous version. The invalid feature information includes file information that has not been modified from an initial version to a current latest version of the open source software.

[0125] The first determination module 602 includes:

[0126] The first acquisition unit 6021 is configured to acquire endpoint feature information of each open source software in the open source software feature library.

[0127] The first determination unit 6022 is configured to determine target file information corresponding to the target code.

[0128] The first judgment unit 6023 is configured to determine whether target endpoint feature information of a first open source software corresponding to the target file information exists in the open source software feature library.

[0129] The second determination unit 6024 is configured to determine that the target endpoint feature information matches the target code when the first judgment unit determines that the target endpoint feature information exists.

[0130] Correspondingly, the second determination module 603 includes:

[0131] The third determination unit 6031 is configured to determine that information of the first open source software corresponding to the target endpoint feature information is open source software information corresponding to the target code.

[0132] As an optional way, the identification device can further include:

[0133] The third determination module 604 is configured to determine version numbers of the first open source software corresponding to each endpoint feature information in the target endpoint feature information.

[0134] The fourth determining module 605 is configured to determine a target version number in the version numbers of the first open source software, the target version number being the highest version number in the version numbers of the first open source software; determine whether the target version number is the highest version number in all version numbers of the first open source software corresponding to the open source software feature library, and if so, determine that the target version number is the version number of the open source software corresponding to the target code.

[0135] The second obtaining module 606 is configured to, if the target version number is not the highest version number in all version numbers of the first open source software corresponding to the open source software feature library, obtain the fork point feature information corresponding to the target version number and the version numbers after the target version number of the first open source software in the open source software feature library.

[0136] The first judging module 607 is configured to determine whether there is target fork point feature information matching the target file information in the fork point feature information corresponding to the target version number and the version numbers after the target version number of the first open source software.

[0137] The fifth determining module 608 is configured to, when the first judging module determines that there is the target fork point feature information, determine that the version number of the first open source software corresponding to the target fork point feature information is the version number of the open source software corresponding to the target code.

[0138] As an optional mode, the identification device can further include:

[0139] The third obtaining module 609 is configured to obtain invalid feature information of the first open source software in the open source software feature library.

[0140] The second judging module 610 is configured to determine whether there is target invalid feature information matching the target file information in the invalid feature information of the first open source software.

[0141] The sixth determining module 611 is configured to, when the second judging module determines that there is the target invalid feature information, determine that the invalid feature information other than the target invalid feature information in the invalid feature information of the first open source software is modified in the target code.

[0142] It should be understood that the above Figure 6 The processes performed by the modules in the corresponding identification device are similar to the method processes described in the foregoing Figure 2 embodiments, and thus will not be described here again.

[0143] In the embodiment of the present application, the first determining module 602 matches the feature information of the open source software in the open source software feature library with the target code, and then the second determining module 603 identifies the open source software information corresponding to the target code according to the target feature information matched with the target code. The feature information can include at least one of the following: endpoint feature information, fork point feature information, and invalid feature information. The endpoint feature information refers to the file information corresponding to the initial version of the open source software and the file information newly added to the initial version of the open source software relative to the previous version. The fork point feature information refers to the file information modified by the non-initial version relative to the previous version. The invalid feature information is the file information that has not been modified from the initial version to the current latest version of the open source software. According to these feature information identification devices, the open source software and its version used by the target code can be identified, without the need for full comparison, thereby improving the identification efficiency.

[0144] Secondly, in the embodiment, the identification device provides a way to identify the open source software and its version corresponding to the target code, thereby improving the realizability of the scheme.

[0145] For ease of understanding, the identification device in the present application will be described in detail below. Please refer to Figure 7 Another embodiment of the identification device in the present application includes:

[0146] The first obtaining module 701 is configured to obtain target code to be identified.

[0147] The first determining module 702 is configured to match the feature information of the open source software in the open source software feature library with the target code, and determine target feature information matched with the target code.

[0148] The second determining module 703 is configured to determine the open source software information corresponding to the target code according to the target feature information.

[0149] The feature information includes at least one of the following: endpoint feature information, fork point feature information, and invalid feature information. The endpoint feature information includes file information corresponding to the initial version of the open source software and / or file information newly added to the non-initial version of the open source software relative to the previous version. The fork point feature information includes file information modified by the non-initial version of the open source software relative to the previous version. The invalid feature information includes file information that has not been modified from the initial version to the current latest version of the open source software.

[0150] The first determining module 702 includes:

[0151] The second obtaining unit 7021 is configured to obtain the fork point feature information of each open source software in the open source software feature library.

[0152] The fourth determining unit 7022 is configured to determine target file information corresponding to the target code.

[0153] The second determining unit 7023 is configured to determine whether target fork point feature information matching the target file information exists in the fork point feature information of each open source software.

[0154] The fifth determining unit 7024 is configured to determine that the target fork point feature information matches the target code when the second determining unit determines that the target fork point feature information exists.

[0155] The second determining module 703 includes:

[0156] The sixth determining unit 7031 is configured to determine that the first open source software corresponding to the target fork point feature information and the version number of the first open source software corresponding to the target fork point feature information correspond to the target code.

[0157] In the embodiment, the first determining module 702 matches the feature information of the open source software in the open source software feature library with the target code, and then the second determining module 703 identifies the open source software information corresponding to the target code according to the target feature information matching the target code. The feature information can include at least one of the following: endpoint feature information, fork point feature information, and invalid feature information. The endpoint feature information refers to the file information corresponding to the initial version of the open source software and the file information newly added to the initial version of the open source software relative to the previous version. The fork point feature information refers to the file information modified by the non-initial version relative to the previous version. The invalid feature information is the file information that is not modified from the initial version to the current latest version of the open source software. According to the feature information, the identification device can identify the open source software and its version used by the target code, without full comparison, thereby improving the identification efficiency.

[0158] Secondly, in the embodiment, the identification device provides another way to identify the open source software and its version corresponding to the target code, thereby improving the flexibility of the scheme.

[0159] The identification device in the present application is introduced from the perspective of functional modules above, and the identification device in the present application is introduced from the perspective of entity hardware below. Please refer to Figure 8 The structure diagram of the identification device in the present application. The identification device 80 can include an input device 810, an output device 820, a processor 830, and a memory 840.

[0160] The memory 840 can include a read-only memory and a random access memory, and provide instructions and data for the processor 830. A part of the memory 840 can also include a non-volatile random access memory (NVRAM).

[0161] The memory 840 stores elements, executable modules or data structures as follows, or a subset thereof, or an extended set thereof:

[0162] Operation instructions: include various operation instructions for implementing various operations.

[0163] Operating system: includes various system programs for implementing various basic services and processing hardware-based tasks.

[0164] In this embodiment, the processor 830 is configured to: acquire target code to be identified, and then match the feature information in the open source software feature library with the target code, determine target feature information matched with the target code, and determine open source software information corresponding to the target code according to the target feature information;

[0165] The feature information includes at least one of the following: endpoint feature information, fork point feature information, and invalid feature information; the endpoint feature information includes file information corresponding to an initial version of the open source software and / or file information newly added to a non-initial version of the open source software relative to a previous version; the fork point feature information includes file information modified by the non-initial version of the open source software relative to the previous version; and the invalid feature information includes file information that has not been modified from the initial version to the current latest version of the open source software.

[0166] As an optional manner, when the processor 830 is configured to determine the target feature information, the processor 830 is specifically configured to: determine target file information corresponding to the target code, and acquire endpoint feature information of each open source software in the open source software feature library, and then determine whether there is target endpoint feature information matched with the target file information in the endpoint feature information, and if so, the target endpoint feature information is the target feature information matched with the target code.

[0167] Correspondingly, when the processor 830 is configured to determine the open source software information corresponding to the target code, the processor 830 is specifically configured to: determine information of an open source software (a first open source software) to which the target endpoint feature information belongs as the open source software information corresponding to the target code.

[0168] As an optional manner, the processor 830 is further configured to: determine version numbers of the first open source software corresponding to each endpoint feature information in the target endpoint feature information, determine a highest version number in the version numbers as a target version number, and acquire fork point feature information corresponding to the target version number and version numbers after the target version number of the first open source software in the open source software feature library, and then determine whether there is target fork point feature information matched with the target file information in the fork point feature information, and if so, a version number corresponding to the target fork point feature information is the version number of the open source software corresponding to the target code.

[0169] As an optional mode, the processor 830 is further configured to: acquire invalid feature information of the first open source software in the open source software feature library, determine whether there is target invalid feature information matching the target file information in the invalid feature information of the first open source software, and if so, determine that other invalid feature information except the target invalid feature information in the invalid feature information of the first open source software is modified in the target code.

[0170] As an optional mode, when the processor 830 is configured to determine the target endpoint feature information, the processor 830 is specifically configured to: determine target file information corresponding to the target code, acquire fork point feature information of each open source software in the open source software feature library, determine whether there is target fork point feature information matching the target file information in the fork point feature information, and if so, the target fork point information is the target feature information matching the target code.

[0171] Correspondingly, when the processor 830 is configured to determine the open source software information corresponding to the target code, the processor 830 is specifically configured to: determine the first open source software to which the target fork point feature information belongs and the version number of the first open source software corresponding to the target fork point feature information, and the target code corresponds to the first open source software, and the open source software corresponding to the target corresponds to the version number corresponding to the target fork point information.

[0172] The processor 830 controls the operation of the identification device 80, and the processor 830 can also be referred to as a central processing unit (English full name: Central Processing Unit, English abbreviation: CPU). The memory 840 can include read-only memory and random access memory, and provide instructions and data for the processor 830. Part of the memory 840 can also include NVRAM. In specific applications, the various components of the identification device 80 are coupled together through a bus system 850, which can include a data bus, a power bus, a control bus, and a status signal bus, etc. However, in order to clearly illustrate, various buses are marked as bus system 850 in the figure.

[0173] The methods disclosed in the above embodiments of the present application can be applied to or implemented by the processor 830. The processor 830 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by hardware integrated logic circuits in the processor 830 or by software instructions. The above processor 830 can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The methods, steps, and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of the present application can be directly implemented as being executed by a hardware decoding processor, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in memory 840, and processor 830 reads information in memory 840 and, in conjunction with its hardware, completes the steps of the above method.

[0174] Figure 8 For a description of Figure 2 You can understand the relevant descriptions and effects in the method part, and will not go into details here.

[0175] An embodiment of the present application further provides a computer storage medium for storing computer software instructions used by the above-mentioned identification device.

[0176] The present application also provides a computer program product, which includes computer software instructions that can be loaded by a processor to implement the above Figure 1 as well as Figure 2 The process in the open source software identification method is shown.

[0177] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware, or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0178] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions described in the embodiments of the present application are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that the computer can store or be integrated into a data storage device such as a server, data center, etc. containing one or more available media sets. The available media can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)), etc.

[0179] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

[0180] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0181] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or they can be distributed on a plurality of network units. According to actual needs, some or all of the units can be selected to achieve the purpose of the embodiments.

[0182] In addition, each of the functional units in the various embodiments of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0183] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application, essentially or in part, or all or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods according to the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (English full name: Read-Only Memory, English abbreviation: ROM), a random access memory (English full name: Random Access Memory, English abbreviation: RAM), a magnetic disk or an optical disk, and various other media that can store program codes.

[0184] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements for some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An open source software identification method, characterized by, The method comprises: obtaining target code to be identified; matching feature information of open source software in an open source software feature library with the target code to determine target feature information matched with the target code, the feature information comprising at least one of the following: endpoint feature information, fork point feature information, and invalid feature information; the endpoint feature information comprising file information corresponding to an initial version of the open source software and / or file information newly added to a non-initial version of the open source software relative to a previous version; the fork point feature information comprising file information modified by the non-initial version of the open source software relative to the previous version; and the invalid feature information comprising file information not modified from the initial version to the current latest version of the open source software; determining open source software information corresponding to the target code according to the target feature information, wherein the open source software information comprises a version number, a name, a file directory, a file size, or a hash value of a file of the open source software.

2. The method of claim 1, wherein, The matching of the feature information of the open source software in the open source software feature library with the target code comprises: obtaining endpoint feature information of each open source software in the open source software feature library and determining target file information corresponding to the target code; determining whether target endpoint feature information of a first open source software corresponding to the target file information exists in the open source software feature library; if yes, determining that the target endpoint feature information matches the target code; The determination of the open source software information corresponding to the target code according to the target feature information comprises: determining information of the first open source software according to the target endpoint feature information as the open source software information corresponding to the target code.

3. The method of claim 2, wherein, After the determination that the target endpoint feature information matches the target code, the method further comprises: determining a version number of the first open source software corresponding to each endpoint feature information in the target endpoint feature information; determining a target version number in the version number of the first open source software, the target version number being a highest version number in the version number of the first open source software corresponding to each endpoint feature information in the target endpoint feature information; determining whether the target version number is a highest version number in all version numbers of the first open source software in the open source software feature library; if yes, determining that the target version number is a version number of the open source software corresponding to the target code; if no, obtaining fork point feature information corresponding to the target version number and version numbers after the target version number of the first open source software in the open source software feature library; determining whether target fork point feature information matched with the target file information exists in the fork point feature information corresponding to the target version number and the version numbers after the target version number of the first open source software; 4. The method according to claim 2 or 3, characterized in that, if yes, determining that a version number of the first open source software corresponding to the target fork point feature information is a version number of the open source software corresponding to the target code. After the determination that the target endpoint feature information matches the target code, the method further comprises: acquiring invalid feature information of the first open source software in the open source software feature library; determining whether there is target invalid feature information matching the target file information in the invalid feature information of the first open source software; if yes, determining that other invalid feature information of the first open source software except the target invalid feature information is modified in the target code.

5. The method of claim 1, wherein, The matching of the feature information of the open source software in the open source software feature library with the target code comprises: acquiring the fork point feature information of each open source software in the open source software feature library, and determining target file information corresponding to the target code; determining whether there is target fork point feature information matching the target file information in the fork point feature information of each open source software; if yes, determining that the target fork point feature information matches the target code; The determination of the open source software information corresponding to the target code according to the target feature information comprises: determining a first open source software corresponding to the target fork point feature information and a version number of the first open source software corresponding to the target fork point feature information corresponding to the target code.

6. An identification device, characterized in that comprise: a processor and a memory; the memory is used to store a program; the processor is used to execute the program, comprising the following steps: acquiring target code to be identified; matching feature information of open source software in an open source software feature library with the target code to determine target feature information matching the target code, the feature information comprising at least one of the following: endpoint feature information, fork point feature information, and invalid feature information; the endpoint feature information comprises file information corresponding to an initial version of the open source software and / or file information newly added to a non-initial version of the open source software relative to a previous version; the fork point feature information comprises file information modified by a non-initial version of the open source software relative to a previous version; and the invalid feature information comprises file information of the open source software that has not been modified from an initial version to a current latest version; determining open source software information corresponding to the target code according to the target feature information; wherein the open source software information comprises a version number, a name, a file directory, a file size, or a hash value of a file of the open source software.

7. The apparatus of claim 6, wherein, The matching of the feature information of the open source software in the open source software feature library with the target code comprises the following steps: The matching of the feature information of the open source software in the open source software feature library with the target code comprises: acquiring endpoint feature information of each open source software in the open source software feature library, and determining target file information corresponding to the target code; determining whether there is target endpoint feature information of a first open source software corresponding to the target file information in the open source software feature library; if yes, determining that the target endpoint feature information matches the target code; The determination of the open source software information corresponding to the target code according to the target feature information comprises: determining that the information of the first open source software according to the target endpoint feature information is the open source software information corresponding to the target code.

8. The apparatus of claim 7, wherein, The step of determining that the target endpoint feature information matches the target code further comprises the steps of: determining the version number of the first open source software corresponding to each endpoint feature information in the target endpoint feature information; determining a target version number in the version number of the first open source software, the target version number being the highest version number in the version number of the first open source software corresponding to each endpoint feature information in the target endpoint feature information; determining whether the target version number is the highest version number in all version numbers of the first open source software in the open source software feature library; if yes, determining that the target version number is the version number of the open source software corresponding to the target code; if no, obtaining the fork point feature information corresponding to the target version number and the version numbers after the target version number of the first open source software in the open source software feature library; determining whether there is target fork point feature information matching the target file information in the fork point feature information corresponding to the target version number and the version numbers after the target version number of the first open source software; if yes, determining that the version number of the first open source software corresponding to the target fork point feature information is the version number of the open source software corresponding to the target code. The step of determining that the target endpoint feature information matches the target code further comprises the steps of: obtaining invalid feature information of the first open source software in the open source software feature library; determining whether there is target invalid feature information matching the target file information in the invalid feature information of the first open source software; if yes, determining that other invalid feature information in the invalid feature information of the first open source software except the target invalid feature information is modified in the target code. The step of matching the feature information of the open source software in the open source software feature library with the target code comprises the steps of: obtaining fork point feature information of each open source software in the open source software feature library and determining target file information corresponding to the target code; determining whether there is target fork point feature information matching the target file information in the fork point feature information of each open source software; if yes, determining that the target fork point feature information matches the target code. The step of determining the open source software information corresponding to the target code according to the target feature information comprises the steps of: determining the first open source software corresponding to the target fork point feature information and the version number of the first open source software corresponding to the target fork point feature information corresponding to the target code. ​ ​ ​ 9. The apparatus of claim 7 or 8, wherein, ​ ​ ​ 10. The apparatus of claim 6, wherein, ​ ​ ​ ​ ​ ​

Images