Software sample management method and device, electronic equipment and storage medium

Abstract

The application provides a software sample management method, and related embodiments can be applied to various scenes such as cloud technology, cloud security, and intelligent transportation. The software sample management method comprises the following steps: extracting a first address set containing all code repository addresses; obtaining a second address set containing all code repository addresses in a first database, and calculating the difference between the first address set and the second address set to obtain a third address set; saving the code repository addresses and initialization information in the third address set in the first database; and performing data cleaning processing on the obtained target type software sample to realize management of the target type software sample. The application also provides a computer program product, a device electronic equipment, and a storage medium, which can accurately identify the changes of the code repository and whether the software sample is a new sample, reduce the invalid and repetitive software sample management process in the sample collection process, and improve the efficiency of software sample management.

Description

Technical Field

[0001] This invention relates to software sample management technology, and more particularly to software sample management methods, computer program products, devices, systems, equipment, and storage media. Background Technology

[0002] In related technologies, malware detection methods typically employ static and dynamic analysis. With the continuous development of internet technology, software developers constantly update and iterate their software, resulting in a large number of malware families belonging to different categories constantly appearing in application markets and other channels. Traditional software sample management methods merely collect existing malware samples from security client sample libraries or public security forums. This collection speed is slow, and it is easy to collect duplicate malware samples, increasing the difficulty of sample collection. More importantly, these traditional sample collection methods cannot collect newly emerging malware samples in a timely manner, which is not conducive to timely detection of intrusion prevention systems using the latest malware samples to ensure the security of users' terminal operations. Summary of the Invention

[0003] In view of this, embodiments of the present invention provide a software sample management method, computer program product, device, electronic device, and storage medium, which can accurately identify changes in the code repository and whether the software sample is a new sample, reduce invalid and repetitive software sample management processes during sample collection, and improve the efficiency of software sample management.

[0004] The technical solution of this invention is implemented as follows:

[0005] This invention provides a software sample management method, including:

[0006] Determine the keywords of the target type software sample, and configure a query request that matches the target type software sample based on the keywords;

[0007] In response to the query request, the code hosting platform searches for standard format data that matches the query request in the code information stored on the code hosting platform.

[0008] Based on the standard format data, extract the first set of addresses containing all code repository addresses;

[0009] Obtain a second set of addresses containing all code repository addresses from the first database, and calculate the difference between the first set of addresses and the second set of addresses to obtain a third set of addresses;

[0010] The code repository addresses and initialization information in the third address set are stored in the first database;

[0011] Based on the information list of all code repository addresses in the first database, each code repository address is traversed and processed.

[0012] Based on the traversal results of each code repository address, the obtained target type software samples are cleaned to achieve management of the target type software samples.

[0013] This invention also provides a software sample management device, comprising:

[0014] The information transmission module is used to determine the keywords of the target type software sample and configure a query request that matches the target type software sample based on the keywords;

[0015] The information processing module is used by the code hosting platform to respond to the query request and search for standard format data that matches the query request in the code information stored on the code hosting platform.

[0016] The information processing module is used to extract a first set of addresses containing all code repository addresses based on the standard format data.

[0017] The information processing module is used to obtain a second address set containing all code repository addresses from a first database, and calculate the difference between the first address set and the second address set to obtain a third address set;

[0018] The information processing module is used to store the code repository addresses and initialization information in the third address set in the first database;

[0019] The information processing module is used to traverse and process each code repository address based on the information list of all code repository addresses in the first database.

[0020] The information processing module is used to perform data cleaning processing on the obtained target type software samples based on the traversal processing results of each code repository address, so as to realize the management of the target type software samples.

[0021] In the above scheme,

[0022] The information processing module is used to determine pagination conditions that match the target type software sample based on the keywords of the target type software sample;

[0023] The information processing module is used to determine the sorting conditions that match the target type software sample based on the keywords of the target type software sample;

[0024] The information processing module is used to determine the standard format information of the query request from the code hosting platform;

[0025] The information processing module is used to configure a query request that matches the target type software sample based on the standard format information of the query request, the pagination conditions, and the sorting conditions.

[0026] In the above scheme,

[0027] The information processing module is used to send the obtained target type software sample to the corresponding software sample processing engine when each code repository address has been traversed.

[0028] The information processing module is used to perform deduplication processing on the acquired target type software samples through the software sample processing engine.

[0029] The information processing module is used to classify the target type software samples after deduplication through the software sample processing engine, and to store the classification results in different target type software sample databases.

[0030] In the above scheme,

[0031] The information processing module is used to extract each code repository address sequentially based on the information list of all code repository addresses in the first database when each code repository address has not been traversed.

[0032] The information processing module is used to configure a Uniform Resource Locator (URL) for downloading compressed code files that conforms to the specifications of the code hosting platform, based on each code repository address.

[0033] The information processing module is used to detect the validity of the Uniform Resource Locator (URL) address of the downloaded compressed code file.

[0034] The information processing module is used to determine the completion progress of each code repository address by using the calculated value of the information digest algorithm of the downloaded compressed code file when it is determined that the Uniform Resource Locator address of the downloaded compressed code file is valid.

[0035] In the above scheme,

[0036] The information processing module is used to obtain the download compressed format code file using an automatic download tool when it is determined that the Uniform Resource Locator address of the download compressed format code file is valid, and to save the obtained download compressed format code file in a temporary file processing area.

[0037] The information processing module is used to determine whether the downloaded compressed code file in the temporary file processing area has been successfully downloaded. When the download of the downloaded compressed code file in the temporary file processing area fails, it continues to process each code repository address based on the information list of all code repository addresses in the first database.

[0038] The information processing module is used to calculate the information digest algorithm value of the downloaded compressed format code file when the downloaded compressed format code file in the temporary file processing area is successfully downloaded;

[0039] The information processing module is used to compare the calculated value of the information digest algorithm of the downloaded compressed code file with the calculated value of the information digest algorithm of the corresponding code repository address in the first database.

[0040] The information processing module is used to continue traversing and processing the remaining code repository addresses when the calculated value of the information digest algorithm of the downloaded compressed code file is consistent with the calculated value of the information digest algorithm of the corresponding code repository address in the first database, until each code repository address in the information list of all code repository addresses in the first database is completed.

[0041] In the above scheme,

[0042] The information processing module is configured to, when it is determined that the Uniform Resource Locator (URL) address of the downloaded compressed code file is invalid, save the URL address of the downloaded compressed code file to a list of invalid URL addresses.

[0043] The information processing module is used to save the Uniform Resource Locator (URL) address of the downloaded compressed code file to the list of failed download URLs when the download of the compressed code file in the temporary file processing area fails.

[0044] In the above scheme,

[0045] The information processing module is configured to handle situations where the calculated value of the information digest algorithm for the downloaded compressed code file is inconsistent with the calculated value of the information digest algorithm for the corresponding code repository address in the first database.

[0046] The information processing module is used to decompress the downloaded compressed code file and perform specific type file filtering on the downloaded compressed code file.

[0047] The information processing module is used to calculate the information digest algorithm value of the downloaded compressed format code file after it has been filtered for a specific type of file;

[0048] The information processing module is used to update the information list of all code repository addresses in the first database based on the calculated value of the information digest algorithm of the downloaded compressed code file that has been filtered for a specific type of file.

[0049] In the above scheme,

[0050] The information processing module is used to obtain a fourth set containing all code repository addresses from the second database;

[0051] The information processing module is used to compare the downloaded compressed format code file with the target type software sample corresponding to the fourth set.

[0052] The information processing module is used to save the download compression format code file that does not appear in the fourth set to the second database based on the comparison processing result between the download compression format code file and the target type software sample corresponding to the fourth set;

[0053] The information processing module is used to adjust the name of the downloaded compressed format code file.

[0054] In the above scheme,

[0055] The information processing module is used when the target type software sample is a software sample containing attack information.

[0056] The information processing module is used to receive attack information and decompose the attack information;

[0057] The information processing module is used to match the decomposed attack information with software samples in the database of the software sample processing engine based on the regular expression, so as to realize the detection of the received software samples through the software sample processing engine.

[0058] In the above scheme,

[0059] The information processing module is used to determine the database server address that matches the software sample processing engine based on the service specifications of the software sample, through the database component of the software sample processing engine, according to the target type of the software sample.

[0060] The information processing module is used to associate the software sample processing engine with a corresponding database based on the database server address; or

[0061] The information processing module is used to create a corresponding database based on the database server address and associate it with the software sample processing engine.

[0062] In the above scheme,

[0063] The information processing module is used to store the target type software sample after data cleaning and processing in the cloud server network;

[0064] The information processing module is used to receive data synchronization requests from other nodes in the cloud server network;

[0065] The information processing module is used to verify the permissions of the other nodes in response to the data synchronization request.

[0066] The information processing module is used to control the current node to synchronize data with the other nodes when the permissions of the other nodes are verified, so as to enable the other nodes to obtain the target type software sample.

[0067] This invention also provides an electronic device, the electronic device comprising:

[0068] Memory, used to store executable instructions;

[0069] The processor, when executing executable instructions stored in the memory, implements the preceding software sample management method, or implements the aforementioned software sample management method.

[0070] This invention also provides a computer-readable storage medium storing executable instructions, which, when executed by a processor, implement a preceding software sample management method, or implement a preceding software sample management method.

[0071] The embodiments of the present invention have the following beneficial effects:

[0072] This invention, through its embodiments, determines keywords for target type software samples and configures query requests matching those keywords. The code hosting platform responds to these query requests by searching its stored code information for standard format data matching the query request. Based on this standard format data, a first address set containing all code repository addresses is extracted. A second address set containing all code repository addresses is obtained from a first database, and the difference between the first and second address sets is calculated to obtain a third address set. The code repository addresses and initialization information in the third address set are stored in the first database. Each code repository address is traversed and processed based on its information list in the first database. Based on the traversal results for each code repository address, the acquired target type software samples are cleaned to achieve management of these samples. This enables accurate identification of code repository changes and determination of whether a software sample is new, reducing the collection of invalid or duplicate software samples, lowering the difficulty of software sample collection, facilitating software sample management, and improving the efficiency of software sample management. Attached Figure Description

[0073] Figure 1 This is a schematic diagram of the usage environment of the software sample management method provided in the embodiments of the present invention;

[0074] Figure 2 This is a schematic diagram of the composition structure of the software sample management device provided in an embodiment of the present invention;

[0075] Figure 3 An optional flowchart illustrating the software sample management method provided in an embodiment of the present invention;

[0076] Figure 4 An optional flowchart illustrating the software sample management method provided in an embodiment of the present invention;

[0077] Figure 5 This is a schematic diagram illustrating a usage scenario of the navigation information generation method provided in an embodiment of the present invention;

[0078] Figure 6 This is an optional flowchart illustrating the software sample management method provided in an embodiment of the present invention. Detailed Implementation

[0079] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on the present invention. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0080] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0081] Before providing a further detailed description of the embodiments of the present invention, the nouns and terms involved in the embodiments of the present invention will be explained, and the nouns and terms involved in the embodiments of the present invention shall be interpreted as follows.

[0082] 1) In response to, used to indicate the conditions or states on which the operation performed depends. When the conditions or states on which it depends are met, one or more operations performed may be performed in real time or with a set delay. Unless otherwise specified, there is no restriction on the order in which the multiple operations are performed.

[0083] 2) Terminals, including but not limited to: ordinary terminals and dedicated terminals, wherein the ordinary terminals maintain a long connection and / or a short connection with the transmission channel, and the dedicated terminals maintain a long connection with the transmission channel.

[0084] 3) Client: The carrier that implements specific functions in the terminal. For example, a mobile client (APP) is a carrier of specific functions in a mobile terminal, such as performing payment and consumption functions or purchasing financial products.

[0085] 4) Web Application Firewall (WAF): Also known as a website application-level intrusion prevention system, it blocks malicious attack requests by detecting characteristics in Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol over Secure Socket Layer (HTTPS) messages.

[0086] 5) API: Short for Application Programming Interface, it refers to a set of predefined functions or conventions for the interaction between different components of a software system. Its purpose is to provide applications and developers with the ability to access a set of routines based on certain software or hardware, without needing to access the source code or understand the details of the internal workings.

[0087] 6) MD5 Message-Digest Algorithm: A widely used cryptographic hash function that produces a 128-bit (16-byte) hash value to ensure the integrity and consistency of transmitted information.

[0088] Figure 1 This is a schematic diagram illustrating a use case of the software sample management method provided in an embodiment of the present invention. (See attached diagram.) Figure 1 The terminals (including terminals 10-1 and 10-2) are equipped with corresponding clients capable of performing different functions. The clients are the terminals (including terminals 10-1 and 10-2) that obtain different information from the corresponding servers 200 through network 300 for browsing. The terminals connect to the servers 200 through network 300, which can be a wide area network, a local area network, or a combination of both, using a wireless link to achieve data transmission. During the information interaction between the terminals and the network, they may be attacked by malicious software. Therefore, a software sample processing engine, such as a Web Application Firewall (WAF), can be deployed to handle malicious software.

[0089] As an example, server 200 is used to deploy a software sample processing engine. Before deploying the engine, software samples need to be collected accurately and efficiently. In related technologies, malware detection methods generally include static analysis and dynamic analysis. Static analysis is a technique that analyzes malware without running malicious code. This type of method typically involves decompressing and decompiling the APK, which is faster than dynamic analysis. However, whether using static or dynamic analysis, simply collecting existing malware samples from security client sample libraries or public security forums is slow, prone to collecting duplicate malware samples, increasing the difficulty of sample collection, and failing to collect the latest malware samples, making the protection system unable to protect against the newest malware.

[0090] The structure of the software sample management device according to an embodiment of the present invention will be described in detail below. The software sample management device can be implemented in various forms, such as a dedicated terminal with software sample management device processing function, or a server or server group equipped with software sample management device processing function, such as a honeypot system or firewall system deployed in the target system, for example, a preceding... Figure 1 Server 200 in the middle. Figure 2 This is a schematic diagram of the composition structure of the software sample management device provided in an embodiment of the present invention. It can be understood that... Figure 2The diagram shows only an exemplary structure of the software sample management device, not the entire structure; implementation is possible as needed. Figure 2 The structure shown may be part or all of the structure.

[0091] The software sample management device provided in this embodiment of the invention includes at least one processor 201, a memory 202, a user interface 203, and at least one network interface 204. The various components in the software sample management device are coupled together via a bus system 205. It can be understood that the bus system 205 is used to implement communication between these components. In addition to a data bus, the bus system 205 also includes a power bus, a control bus, and a status signal bus. However, for clarity, ... Figure 2 The general labeled all buses as Bus System 205.

[0092] The user interface 203 may include a monitor, keyboard, mouse, trackball, click wheel, buttons, touchpad, or touch screen.

[0093] It is understood that memory 202 can be volatile memory or non-volatile memory, or both. In this embodiment of the invention, memory 202 is capable of storing data to support the operation of a terminal (such as 10-1). Examples of this data include any computer programs used to operate on the terminal (such as 10-1), such as operating systems and applications. The operating system includes various system programs, such as the framework layer, core library layer, driver layer, etc., used to implement various basic services and handle hardware-based tasks. Applications can include various applications.

[0094] In some embodiments, the software sample management device provided in this invention can be implemented using a combination of hardware and software. For example, the software sample management device provided in this invention can be a processor in the form of a hardware decoding processor, which is programmed to execute the malware attack information processing method provided in this invention. For instance, the processor in the form of a hardware decoding processor can employ one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0095] As an example of the software sample management device provided in this embodiment of the invention, which is implemented by combining software and hardware, the software sample management device provided in this embodiment of the invention can be directly embodied as a combination of software modules executed by processor 201. The software modules can be located in a storage medium, which is located in memory 202. Processor 201 reads the executable instructions included in the software modules in memory 202 and combines them with necessary hardware (e.g., including processor 201 and other components connected to bus 205) to complete the malicious software attack information processing method provided in this embodiment of the invention.

[0096] As an example, processor 201 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., wherein the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0097] As an example of the hardware implementation of the software sample management device provided in this embodiment of the invention, the device provided in this embodiment of the invention can be directly executed by a processor 201 in the form of a hardware decoding processor. For example, it can be executed by one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components to implement the malicious software attack information processing method provided in this embodiment of the invention.

[0098] In this embodiment of the invention, the memory 202 is used to store various types of data to support the operation of the software sample management device. Examples of such data include: any executable instructions for operation on the software sample management device, such as executable instructions that implement the malware attack information processing method of this embodiment of the invention, which may be included in the executable instructions.

[0099] In other embodiments, the software sample management device provided in this invention can be implemented in software. Figure 2A software sample management device stored in memory 202 is shown. This device can be software in the form of programs and plugins, and includes a series of modules. As an example of a program stored in memory 202, it may include a software sample management device. The software sample management device includes a software module information transmission module 2081 and an information processing module 2082. When a software module in the software sample management device is read into RAM and executed by processor 201, the malware attack information processing method provided in this embodiment of the invention will be implemented. The functions of each software module in the software sample management device include:

[0100] The information transmission module 2081 is used to determine the keywords of the target type software sample and configure a query request that matches the target type software sample according to the keywords;

[0101] Information processing module 2082 is used by the code hosting platform to respond to the query request and query standard format data that matches the query request from the code information stored on the code hosting platform;

[0102] The information processing module 2082 is used to extract a first address set containing all code repository addresses based on the standard format data.

[0103] The information processing module 2082 is used to obtain a second address set containing all code repository addresses from the first database, and calculate the difference between the first address set and the second address set to obtain a third address set;

[0104] The information processing module 2082 is used to store the code repository address and initialization information in the third address set in the first database;

[0105] The information processing module 2082 is used to traverse and process each code repository address based on the information list of all code repository addresses in the first database.

[0106] The information processing module 2082 is used to perform data cleaning processing on the obtained target type software samples based on the traversal processing results of each code repository address, so as to realize the management of the target type software samples.

[0107] according to Figure 2The illustrated electronic device, in one aspect of this application, also provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in various optional implementations of the software sample management method described above.

[0108] Combination Figure 2 The illustrated software sample management device illustrates the software sample management method provided in this embodiment of the invention.

[0109] See Figure 3 , Figure 3 This is an optional flowchart illustrating the software sample management method provided in an embodiment of the present invention. It can be understood that... Figure 2 The steps shown can be performed by various electronic devices running software sample management devices, such as dedicated terminals with malware detection capabilities, antivirus engine servers with malware detection capabilities, or server clusters. The following addresses... Figure 3 The steps shown are explained.

[0110] Step 301: The software sample management device determines the keywords of the target type software sample and configures a query request that matches the target type software sample based on the keywords.

[0111] Taking the Android application environment as an example, when collecting malware samples, a large number of malware families belonging to different categories and with varying modifications appear in app stores and other channels. Therefore, static or dynamic analysis methods can be used to process malware samples. Android applications are released in app stores as APKs. For static analysis, APKtool is used to decompile APK files and parse the androidmanifest.xml file to extract permissions, package names, components, environment, etc. Ida Pro can decompile APK files and parse them to obtain shared library function opcodes and a series of operational characteristics. Android applications are developed in Java. Compilers such as IntelliJ IDEA can convert Java source code into dex files, which can run on Android's Dalvik virtual machine. Dex is a file format containing compiled code written for Android, which can be interpreted by the Dalvik virtual machine but cannot be read. To convert dex files into a readable format, smali provides readable code in the smali language. Smalicode is intermediate code that interprets between Java and the Dalvik virtual machine. It can use the baksmali tool to compile class .dex files to obtain smali files, thus enabling the acquisition of control flow graphs and code functionality. Besides parsing smali code for feature extraction, it can also access Java source code files to extract features via API calls. It decompresses APK files to obtain .dex files, which can then be converted to jar files using the dex2jar tool, and finally converted to Java source files using the JD-GUI tool.

[0112] Dynamic analysis methods involve executing the entire APK file in a specific environment, such as a sandbox. These methods collect behavioral information about the Android application during runtime and convert it into characteristics. Dynamic analysis utilizes system calls, file access information, network traffic information, encryption operations, service activations, phone calls, user interactions, system components, and other obfuscated dynamic features. However, most researchers collect information about malicious behavior within a limited scope. Malware may not engage in malicious activity during this period, therefore dynamic analysis requires a considerable amount of time to analyze the software.

[0113] Depending on the technology used to track Android application behavior, dynamic analysis methods can be divided into hook-based and log-based methods. Log-based dynamic analysis executes the Android application on a real device or Android emulator to monitor its behavior using well-known logging tools. Hook-based dynamic analysis embeds monitoring points in the code to record application activities during execution. These hooks can monitor the execution of Android applications, collect information about behavior, trace executed instructions, retrieve event sequences, or monitor stored data traffic. However, traditional software sample management methods are not conducive to timely detection by intrusion prevention systems.

[0114] In some embodiments of the present invention, configuring a query request that matches the target type software sample can be achieved in the following ways:

[0115] Using the keywords of the target type software samples, pagination conditions matching the target type software samples are determined; sorting conditions matching the target type software samples are also determined; the standard format information of the query request from the code hosting platform is determined; and the query request is processed according to the standard format information, the pagination conditions, and the sorting conditions. Taking the collection of malware samples as an example, the keywords for malware samples can be "webshell" and "malware." Then, a list of search keywords is constructed based on the types of malware samples collected. A query request conforming to the API standard of the code hosting platform (GitHub) is constructed using the pagination and sorting conditions to obtain standard format data through the code hosting platform. For example, the query request format can be: https: / / api.github.com / search / repositories?q={query}&page={page}&per_page={per_page}&sort={sort}&order={asc|desc}. After executing the query request, the GitHub API will return standard JSON format data. In actual implementation, the standard format data obtained by the server is either JSON format data or string format data. In some embodiments, after the server obtains the original query, it needs to clean the standard format data and normalize it to obtain the target format standard format data. Specifically, the obtained software sample data in JSON or string format is converted into the corresponding array, and then the numerical content is aligned to obtain the uniform standard format data. Data cleaning can filter out data that is irrelevant to the code hosting platform and cannot be used for software sample management in the standard format data, and form data with a uniform format to facilitate subsequent deduplication processing.

[0116] Step 302: In response to the query request, the software sample management device code hosting platform queries the code information stored on the code hosting platform for standard format data that matches the query request.

[0117] Step 303: The software sample management device extracts a first set of addresses containing all code repository addresses based on the standard format data.

[0118] Before extracting the first set of addresses, the database server address matching the software sample processing engine can be determined based on the target type of the software sample and the service specification of the software sample through the database component of the software sample processing engine. Based on the database server address, a corresponding database is associated with the software sample processing engine; or, based on the database server address, a corresponding database is created under the database server address and associated with the software sample processing engine. A database can include one or more data tables; therefore, the data table names in the configuration information can also be one or more, without limitation. Of course, multiple databases can be included, and different data table and database correspondences can be set in the configuration information. This allows for searching for the corresponding data table in the corresponding database. If it exists, the field information of the data table can be compared for differences, such as field name, field value, and field type. Existing data tables can be automatically updated. Simultaneously, based on the database server address, a connection can be established to query whether the corresponding database name under that database server address has been created. If it is determined that it has been created, the creation process can be skipped, and the database corresponding to that database name can be determined as the database associated with the service. If it is determined that it has not been created, the creation process is executed to create a database with that database name under that database server address as the database associated with the service, so as to achieve flexible handling of software sample management.

[0119] Step 304: The software sample management device obtains a second address set containing all code repository addresses from the first database, and calculates the difference between the first address set and the second address set to obtain a third address set.

[0120] Step 305: The software sample management device saves the code repository addresses and initialization information from the third address set in the first database.

[0121] In step 303, the set of all code repository addresses (html_urls) extracted can be set A. The set of all code repository addresses retrieved from the first database storing code repository project information can be set B. The difference between set A and set B, C=AB, is calculated. Set C can be a third address set, i.e., the set of code repository addresses in set A that do not exist in the first database. The initialization information matching the code repository addresses in the third address set includes: the storage time of the code repository address, the update time of the code repository address, and the MD5 value of the code repository address.

[0122] Step 306: The software sample management device iterates through and processes each code repository address based on the information list of all code repository addresses in the first database.

[0123] Step 307: Based on the traversal processing results of each code repository address, the software sample management device performs data cleaning processing on the acquired target type software samples to achieve management of the target type software samples.

[0124] In some embodiments of the present invention, based on the traversal results of each code repository address, data cleaning processing is performed on the obtained target type software samples to achieve management of the target type software samples. This can be achieved in the following ways:

[0125] When each code repository address has been traversed, the acquired target type software samples are sent to the corresponding software sample processing engine. The software sample processing engine then performs deduplication on the acquired target type software samples. Finally, the deduplicated target type software samples are classified, and the classification results are stored in different target type software sample databases. Specifically, when collecting malware samples, the software sample processing engine can be an antivirus engine. By classifying the deduplicated target type software samples and storing the classification results in different target type software sample databases, the antivirus engine can reduce the repeated collection and classification of malware samples, thus improving its processing efficiency for malware.

[0126] To better illustrate the process of traversing and processing each code repository address in the software sample management of this application, please refer to [link / reference]. Figure 4 , Figure 4 This is an optional flowchart illustrating the software sample management method provided in an embodiment of the present invention. It can be understood that... Figure 2The steps shown can be performed by various electronic devices running software sample management devices, such as dedicated terminals with malware detection capabilities, antivirus engine servers with malware detection capabilities, or server clusters. The following addresses... Figure 4 The steps shown are explained.

[0127] Step 401: When each code repository address has not been traversed, the software sample management device extracts each code repository address sequentially according to the information list of all code repository addresses in the first database.

[0128] After extracting each code repository address, the system can also verify the validity of the repository address, the existence of the pipeline branch to be executed, and the existence of the image build configuration file. Specifically, a code repository address can be represented as: CURL https: / / address:port number -X POST -d{"scmurl": git + code repository address} –header "Content-Type:application / jsion" -k; The management end verifies the validity of the code repository address, the existence of the branch, and whether necessary configuration files such as Dockerfile match the user-input path by requesting the GitLab interface, thus preventing incorrect code repository addresses from affecting the collection of malware samples.

[0129] Step 402: The software sample management device configures a Uniform Resource Locator (URL) for downloading compressed code files that conforms to the specifications of the code hosting platform, based on each code repository address.

[0130] Taking GitHub as an example of a code hosting platform, when processing malware samples on GitHub, a malware project typically consists of multiple code files, which can be hosted by the platform. GitHub can include development branches and a master branch. The master branch is used to manage and maintain code files, not for releasing the final software project (e.g., an application). This release can be handled by a third party, such as operations personnel. A software project A generally has multiple functional modules. For each module, developers can write code belonging to that module on the development branch, creating multiple code files ready for release. Each file is then tagged. A tag uniquely identifies a code file, and its content can be customized; this example does not impose restrictions on this.

[0131] In some embodiments of the present invention, the tag and / or project version information may have a specified format, which can be customized and is not limited thereto. When validating the tag and / or project version information, the specific verification can be performed to check whether it has the specified format. If it does, the verification passes; otherwise, it fails. For example, if the project version information is "v1-2021-05-12", in this embodiment, the specified format contains the symbol "-" between the version number and the version development time, as well as between the year, month, and day numbers of the version development time. During verification, if the presence of the "-" symbol is detected, the verification passes; if the absence of the "-" symbol is detected, the verification fails. Configuring a Uniform Resource Locator (URL) for downloading compressed code files that conforms to the specifications of the code hosting platform facilitates automated management of malware samples obtained from the code hosting platform, reducing the slow update speed of the sample library caused by inconsistent malware sample formats.

[0132] Step 403: The software sample management device checks the validity of the Uniform Resource Locator (URL) address of the downloaded compressed code file.

[0133] Specifically, by checking the validity of the Uniform Resource Locator (URL) address of downloaded compressed code files, it can be ensured that all malware samples obtained during software sample management are authentic and valid. This reduces the risk of security defense systems misidentifying malware due to erroneous or empty malware samples, resulting in a better user experience.

[0134] Step 404: When the software sample management device determines that the Uniform Resource Locator address of the downloaded compressed format code file is valid, it determines the completion progress of each code repository address by using the calculated value of the information digest algorithm of the downloaded compressed format code file.

[0135] In some embodiments of the present invention, the completion progress of each code repository address is determined by calculating the value of the information digest algorithm for downloading compressed code files. This can be achieved in the following ways:

[0136] When the Uniform Resource Locator (URL) address of the downloaded compressed code file is determined to be valid, the downloaded compressed code file is obtained using an automatic download tool and saved in a temporary file processing area. It is then determined whether the downloaded compressed code file in the temporary file processing area has been successfully downloaded. If the download fails, each code repository address is processed by traversing the information list of all code repository addresses in the first database. If the download is successful, the message digest algorithm value of the downloaded compressed code file is calculated. This value is compared with the message digest algorithm value of the corresponding code repository address in the first database. If the message digest algorithm value matches the value of the corresponding code repository address in the first database, the remaining code repository addresses are processed by traversing the remaining code repository addresses until all code repository addresses in the information list of all code repository addresses in the first database have been processed.

[0137] Step 405: When the software sample management device determines that the Uniform Resource Locator (URL) address of the downloaded compressed format code file is invalid, it saves the URL address of the downloaded compressed format code file to the list of invalid URL addresses.

[0138] The process involves extracting the `html_url` of each code repository from a list of all repository addresses. Then, a URL conforming to the GitHub API standard is constructed from this `html_url` to download the zip code file. The validity of this URL is verified. If valid, the zip code file is downloaded using wget and saved to a temporary folder. If invalid, the `html_url` information is saved to an invalid URL list file, triggering a manual verification process.

[0139] Step 406: When the download of the compressed code file in the temporary file processing area fails, the software sample management device saves the Uniform Resource Locator (URL) address of the downloaded compressed code file to the list of failed download URLs.

[0140] When a compressed code file is successfully downloaded, its MD5 hash value is calculated and compared with the MD5 value of the downloaded compressed code file in the first database. If they are different, the MD5 value in the first database is updated, and the downloaded zip file is decompressed. If the MD5 value of the downloaded compressed code file in the first database is the same as the MD5 value of the downloaded zip file, the remaining code repository addresses are processed until every code repository address in the information list of all code repository addresses in the first database is processed. If the download of the compressed code file fails, the html_url information is saved to a download failure list file, triggering a manual processing step for verification.

[0141] To further verify the correctness of the downloaded compressed code file, the calculated value of the information digest algorithm for the downloaded compressed code file can be checked. When the calculated value of the information digest algorithm for the downloaded compressed code file is inconsistent with the calculated value of the information digest algorithm for the corresponding code repository address in the first database, the downloaded compressed code file is decompressed and subjected to specific type file filtering. The calculated value of the information digest algorithm for the downloaded compressed code file after specific type file filtering is calculated. Based on the calculated value of the information digest algorithm for the downloaded compressed code file after specific type file filtering, the information list of all code repository addresses in the first database is updated. By updating the information list of all code repository addresses in the first database, the timeliness of the software samples in the first database can be guaranteed. It should be noted that, in this embodiment, the file types filtered during specific type file filtering include, but are not limited to, jsp / php / cgi / asp / aspx. When the target type software sample collects software samples with financial payment functions or information collection functions, the file types filtered can be adjusted to meet the usage requirements of the target type software sample.

[0142] In some embodiments of the present invention, when the calculated value of the information digest algorithm for the downloaded compressed code file is inconsistent with the calculated value of the information digest algorithm for the corresponding code repository address in the first database, a fourth set containing all code repository addresses in the second database is obtained; the downloaded compressed code file is compared with the target type software sample corresponding to the fourth set; based on the comparison result of the downloaded compressed code file and the target type software sample corresponding to the fourth set, the downloaded compressed code file that does not appear in the fourth set is saved to the second database; and the name of the downloaded compressed code file is adjusted.

[0143] Once the malware sample management is complete, the attack information can be processed by the antivirus engine. Specifically, when the target type software sample is an attack information software sample, the attack information is received and decomposed. Based on the regular expression, the decomposed attack information is matched with software samples in the database of the software sample processing engine, so as to realize the detection of the received software samples by the software sample processing engine.

[0144] Once the software sample collection is complete, the antivirus engines deployed on different nodes can obtain more timely software samples through the cloud server network, thus maintaining the timeliness of the samples. Specifically,

[0145] The target type software sample, after data cleaning, can be stored in a cloud server network; receive data synchronization requests from other nodes in the cloud server network; in response to the data synchronization request, verify the permissions of the other nodes; when the permissions of the other nodes are verified, control the current node to synchronize data with the other nodes, so that the other nodes can obtain the target type software sample.

[0146] In this invention, embodiments can be implemented using cloud technology. Cloud technology refers to a hosting technology that unifies hardware, software, and network resources within a wide area network (WAN) or local area network (LAN) to achieve data computation, storage, processing, and sharing. It can also be understood as a general term for network technologies, information technologies, integration technologies, management platform technologies, and application technologies based on cloud computing business models. The backend services of network systems require substantial computing and storage resources, such as video websites, image websites, and many portal websites; therefore, cloud technology needs cloud computing as its support.

[0147] It's important to note that cloud computing is a computing model that distributes computing tasks across a resource pool comprised of numerous computers, enabling various application systems to access computing power, storage space, and information services as needed. The network providing these resources is called the "cloud." From the user's perspective, resources in the "cloud" are infinitely scalable, readily available, and can be used on demand, expanded at any time, and paid for based on usage. As the foundational providers of cloud computing capabilities, they establish cloud resource pool platforms, often referred to as cloud platforms or Infrastructure as a Service (IaaS). These platforms deploy various types of virtual resources within the resource pool for external customers to choose from. The cloud resource pool primarily includes: computing devices (which can be virtualized machines containing operating systems), storage devices, and network devices.

[0148] To better illustrate the processing procedure of the software sample management method provided in this application, the following example of collecting malware samples from a cloud server network will be used to explain the processing procedure of the software sample management method provided in this application. (This is in conjunction with the preceding text.) Figure 1 As shown, the software sample management method provided in this embodiment of the invention can be implemented through corresponding cloud devices. For example, terminals (including terminals 10-1 and 10-2) connect to a server 200 located in the cloud via a network 300. The network 300 can be a wide area network (WAN), a local area network (LAN), or a combination of both. It is worth noting that the server 200 can be a physical device or a virtualized device. Using an antivirus engine deployed in the cloud server, the collected software sample information is used to detect the intrusion prevention system in the cloud server. Collecting malware samples from the cloud server network can detect the intrusion prevention system of in-vehicle intelligent devices, ensuring the safe operation of the in-vehicle intelligent devices. The application environment of the navigation information generation method provided in this application is described below. Figure 5 , Figure 5 This is a schematic diagram illustrating a usage scenario of the navigation information generation method provided in an embodiment of the present invention. The software sample management method provided by the present invention can serve various types of customers as a cloud service (encapsulated in an in-vehicle terminal or in different mobile electronic devices).

[0149] Intelligent Vehicle Infrastructure Cooperative Systems (IVICS), or simply vehicle-road cooperative systems, represent a development direction for Intelligent Transportation Systems (ITS). IVICS utilizes advanced wireless communication and next-generation Internet technologies to implement comprehensive, real-time dynamic information interaction between vehicles and infrastructure. Based on the collection and fusion of dynamic traffic information across all times and spaces, it conducts active vehicle safety control and cooperative road management, fully realizing effective collaboration between people, vehicles, and roads. This ensures traffic safety, improves traffic efficiency, and ultimately forms a safe, efficient, and environmentally friendly road traffic system. Specific application scenarios are not limited in this application; user terminals include, but are not limited to, mobile phones, computers, intelligent voice interaction devices, smart home appliances, and in-vehicle terminals. Furthermore, it is provided as a cloud service to enterprise customers, helping them provide corresponding security services based on the different device usage environments of users.

[0150] See Figure 6 , Figure 6 This is an optional flowchart illustrating the software sample management method provided in an embodiment of the present invention. The following section focuses on... Figure 6 The steps shown are explained.

[0151] Step 601: Configure a keyword list for malware samples for the in-vehicle environment.

[0152] When configuring the search keyword list, at least one keyword corresponding to the target type software sample can be determined based on the type information, feature information, and application environment information of the target type software sample. Specifically, in this application, the application environment information is an in-vehicle environment, and the type information can be: attack-type malware (attacking in-vehicle system security), damage-type malware (damaging the security and control systems of the in-vehicle system), and ransomware-type malware (illegally controlling the vehicle to extort users and vehicle manufacturers), such as: Virus or Worm: self-replicating and spreading over networks; Trojan; Backdoor / Remote Access Trojan (RAT); Adware: forced advertising pop-up marketing; Botnet: a large number of bot programs waiting for attackers to execute DDoS or other malicious activities through C2 tunnels. Nginx was developed because a large number of bot programs needed to connect back to the control end. Information stealer: refers to malware that steals sensitive data such as banking data, including keyloggers, form scrapers, spyware, and sniffer. Ransomware: Encrypts data and demands ransom; Rootkit: Designed to represent a highly covert, privileged, persistent backdoor; Downloader or dropper: Similar to a scout first, then the scout releases the actual malware. Malware is deployed and delivered in stages.

[0153] Referring to Table 1, you can select at least two malicious sample types from the keyword list shown in Table 1 to create a search keyword list.

[0154]

[0155] Table 1

[0156] Step 602: Construct a query request that conforms to the Github API standard based on the keyword content and keyword sorting.

[0157] Among them, GitHub, the code hosting platform, is currently the largest publicly available tool repository with abundant sample information. Based on the REST API provided by GitHub, Python scripts can be used to continuously collect malware samples in a simple, flexible, efficient, and comprehensive manner, achieving automated collection of malware samples and saving on sample collection costs.

[0158] Combining the keywords obtained in step 601, we can obtain malware samples that carry characteristics such as Virus or Worm, Trojan, Backdoor / Remote Access Trojan, nginx, and Information stealer from the software samples that have already appeared in the code hosting platform. Compared with the sample database of the security client and the malware samples that have already appeared in the security forum, these malware samples are more comprehensive in variety and more recent in version.

[0159] Step 603: In response to the query request, obtain the standard JSON format data returned by Github AP.

[0160] Step 604: Extract the collection A of all code repository addresses (HTML URLs) from the returned results.

[0161] Taking the collection of ransomware software samples as an example, the address of a ransomware code repository can be represented as: CURL https: / / address:port number-X POST-d{"scmurl":git+code repository address}--header"Content-Type: Ransomware / jsion"-k.

[0162] Step 605: Query and retrieve the HTML URL collection B from database 1.

[0163] Step 606: Calculate the difference CAB between set A and set B, and save the html-url and initialization information in set C to database 1.

[0164] This allows for deduplication of the database, classification of target type software samples after deduplication, and storage of the classification results in different target type software sample databases. This reduces the duplication of malware sample collection and classification by the antivirus engine, making the antivirus engine more efficient in processing malware and more effective in detecting and eliminating malware in the vehicle environment.

[0165] Step 607: Query and retrieve the list of HTML URL information in database 1, and iterate through the list of HTML URL information.

[0166] Step 608: Determine if the traversal is complete. If not, proceed to step 609. If complete, proceed to step 620.

[0167] Step 609: Construct a URL address that conforms to the Github AP standard for downloading zip code files based on the HTML URL.

[0168] Step 610: Verify that the download URL is valid. If it is valid, proceed to step 611; otherwise, proceed to step 612.

[0169] Step 611: Use the wget component to download the zip code file and save it to a temporary folder.

[0170] Step 612: Save to the list of invalid Uniform Resource Locator addresses.

[0171] Step 613: Determine if the download was successful. If successful, proceed to step 614; otherwise, proceed to step 615. Specifically, after obtaining the set A of all code repository addresses (HTML URLs), the system can further verify the validity of the URLs used to download the zip code files. If the URL is valid, the system uses the wget download tool to download the zip code files and saves them to a temporary folder. If the URL is invalid, this HTML URL information is saved to an invalid URL list file, triggering a manual verification process. This prevents the security defense system from making identification errors when processing malware due to incomplete malware sample collection.

[0172] Step 614: Calculate the MD5 value of the zip code file.

[0173] Step 615: Save to the download failure list.

[0174] Step 616: Determine if the MD5 value of the zip code file is equal to the MD5 value of the database 1html_url. If yes, proceed to step 608; otherwise, proceed to step 617.

[0175] Step 617: Decompress the zip file, filter specific file types and calculate their MD5 values, and update the information in database 1.

[0176] Since malware samples are usually identified by file hash values ​​and file names are diverse, samples collected from different channels have a high repetition rate when classified by antivirus engines. By filtering specific types of files and calculating their MD5 values ​​to update the information in database 1, the high repetition rate of malware samples can be reduced during malware sample management, making the antivirus engine's database occupy less storage space and reducing the hardware footprint on terminal devices.

[0177] Step 618: Query and obtain the sample md5 set D in database 2, and save the information of new samples that are not in set D to database 2.

[0178] Therefore, through Database 2, malware samples (including the first malware samples) that appear on the code hosting platform and carry characteristics such as Virus or Worm, Trojan, Backdoor / Remote Access Trojan, nginx, and Information Stealer can be collected completely and accurately.

[0179] Step 619: Rename the new sample to an MD5 value and save it locally. Delete the zip compressed file and other decompressed files associated with this HTML URL.

[0180] In this system, the target type software samples that have undergone data cleaning can be stored in the cloud server network in database 2; and the system can receive data synchronization requests from other nodes in the cloud server network; and control the current node to synchronize data with the other nodes so that the other nodes can obtain the target type software samples, thereby increasing the efficiency of collecting malware samples in the cloud server network.

[0181] Step 620: Connect to the antivirus engine and send the new samples of malware stored locally into the engine for deduplication, classification, and database entry to update the malware samples in the antivirus engine.

[0182] This invention, through its embodiments, determines keywords for target type software samples and configures query requests matching those keywords. The code hosting platform responds to the query requests by searching its stored code information for standard format data matching the query requests. Based on this standard format data, a first address set containing all code repository addresses is extracted. A second address set containing all code repository addresses is obtained from a first database, and the difference between the first and second address sets is calculated to obtain a third address set. The code repository addresses and initialization information in the third address set are stored in the first database. Based on the information list of all code repository addresses in the first database, each code repository address is traversed and processed. Based on the traversal processing results for each code repository address, the acquired target type software samples are cleaned to achieve management of the target type software samples. This enables accurate identification of code repository changes and whether a software sample is a new sample, reducing invalid and repetitive software sample management processes during sample collection and improving the efficiency of software sample management.

[0183] The above description is merely an embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A software sample management method characterized by comprising: The method comprises: determining keywords of a target type software sample, and configuring a query request matched with the target type software sample according to the keywords; a code hosting platform queries standard format data matched with the query request in code information saved by the code hosting platform in response to the query request; based on the standard format data, a first address set containing all code repository addresses is extracted; a second address set containing all code repository addresses is obtained in a first database, and a difference between the first address set and the second address set is calculated to obtain a third address set; code repository addresses in the third address set and initialization information are saved in the first database, wherein the initialization information includes a saving time of the code repository address, an update time of the code repository address, and an md5 value of the code repository address; based on an information list of all code repository addresses in the first database, each code repository address is processed iteratively; based on the iterative processing result of each code repository address, data cleaning processing is performed on the obtained target type software sample to realize management of the target type software sample.

2. The method of claim 1, wherein, The determination of the keywords of the target type software sample and the configuration of the query request matched with the target type software sample according to the keywords comprise: determining at least one keyword corresponding to the target type software sample according to type information, feature information, and application environment information of the target type software sample; determining a page condition matched with the target type software sample through the target type software sample keyword; determining a sorting condition matched with the target type software sample through the target type software sample keyword; determining standard format information of the query request of the code hosting platform; configuring the query request matched with the target type software sample according to the standard format information of the query request, the page condition, and the sorting condition.

3. The method of claim 1, wherein, The data cleaning processing of the obtained target type software sample based on the iterative processing result of each code repository address to realize the management of the target type software sample comprises: when the iterative processing of each code repository address is completed, the obtained target type software sample is sent to a corresponding software sample processing engine; de-duplication processing of the obtained target type software sample is performed through the software sample processing engine; classification processing of the target type software sample after the de-duplication processing is performed through the software sample processing engine, and a result of the classification processing is saved in different target type software sample databases.

4. The method of claim 1, wherein, The data cleaning processing of the obtained target type software sample based on the iterative processing result of each code repository address to realize the management of the target type software sample comprises: when the iterative processing of each code repository address is not completed, each code repository address is extracted in sequence according to the information list of all code repository addresses in the first database. According to each code repository address, configure a uniform resource locator address of a download compressed format code file conforming to a specification of the code hosting platform; Detect validity of the uniform resource locator address of the download compressed format code file; When it is determined that the uniform resource locator address of the download compressed format code file is valid, determine a completion progress of each code repository address through a calculation value of a message digest algorithm of the download compressed format code file.

5. The method of claim 4, wherein, The determining the completion progress of each code repository address through the calculation value of the message digest algorithm of the download compressed format code file when it is determined that the uniform resource locator address of the download compressed format code file is valid comprises: When it is determined that the uniform resource locator address of the download compressed format code file is valid, acquire the download compressed format code file by using an automatic download tool, and save the acquired download compressed format code file in a temporary file processing area; Determine whether the download compressed format code file in the temporary file processing area is downloaded successfully, and when the download compressed format code file in the temporary file processing area fails to be downloaded, continue to traverse and process each code repository address based on the information list of all code repository addresses in the first database; When the download compressed format code file in the temporary file processing area is downloaded successfully, calculate the calculation value of the message digest algorithm of the download compressed format code file; Compare the calculation value of the message digest algorithm of the download compressed format code file with a calculation value of a message digest algorithm of a corresponding code repository address in the first database; When the calculation value of the message digest algorithm of the download compressed format code file is consistent with the calculation value of the message digest algorithm of the corresponding code repository address in the first database, continue to traverse and process remaining code repository addresses until each code repository address in the information list of all code repository addresses in the first database is completed.

6. The method of claim 5, wherein, The method further comprises: When it is determined that the uniform resource locator address of the download compressed format code file is invalid, save the uniform resource locator address of the download compressed format code file in an invalid uniform resource locator address list, When the download compressed format code file in the temporary file processing area fails to be downloaded successfully, save the uniform resource locator address of the download compressed format code file in a download failure uniform resource locator address list.

7. The method of claim 4, wherein, The method further comprises: When the calculation value of the message digest algorithm of the download compressed format code file is inconsistent with the calculation value of the message digest algorithm of the corresponding code repository address in the first database, decompress the download compressed format code file, and perform specific type file filtering processing on the download compressed format code file, wherein the specific type includes but is not limited to jsp, php, cgi, asp, aspx; calculate a calculation value of a message digest algorithm of the download compressed format code file after the specific type file filtering processing; and determine a completion progress of each code repository address based on the calculation value of the message digest algorithm of the download compressed format code file. According to the calculation value of the information digest algorithm of the download compressed format code file filtered by the specific type file filtering process, the information list of all code repository addresses in the first database is updated.

8. The method of claim 7, wherein, The method further comprises: Obtaining a fourth set containing all code repository addresses in a second database; Comparing the download compressed format code file with the target type software sample corresponding to the fourth set; According to the comparison result of the download compressed format code file and the target type software sample corresponding to the fourth set, the download compressed format code file not appearing in the fourth set is saved to the second database; Adjusting the name of the download compressed format code file.

9. The method of claim 1, wherein, The method further comprises: When the target type software sample is an attack information software sample, Receiving attack information and decomposing the attack information; Based on regular expressions, the decomposed attack information is matched with software samples in the database of the software sample processing engine to realize detection of the received software sample by the software sample processing engine.

10. The method of claim 1, wherein, The method further comprises: According to the target type of the software sample, the database server address matched by the software sample processing engine is determined based on the service specification of the software sample through the database component of the software sample processing engine; Based on the database server address, the corresponding database is associated with the software sample processing engine; or Based on the database server address, the corresponding database is created under the database server address and associated with the software sample processing engine.

11. The method of claim 1, wherein, The method further comprises: Saving the target type software sample after data cleaning processing in the cloud server network; Receiving a data synchronization request of other nodes of the cloud server network; In response to the data synchronization request, the authority of the other nodes is verified; When the authority of the other nodes is verified, the current node is controlled to synchronize data with the other nodes to realize the other nodes to obtain target type software samples.

12. A software sample management apparatus characterized by comprising: The management device comprises: An information transmission module for determining the keywords of the target type software sample and configuring a query request matched with the target type software sample according to the keywords; An information processing module for the code hosting platform to query standard format data matched with the query request in the code information saved by the code hosting platform in response to the query request; The information processing module is used to extract a first address set containing all code repository addresses based on the standard format data; The information processing module is used to obtain a second address set containing all code repository addresses in a first database and calculate the difference between the first address set and the second address set to obtain a third address set; The information processing module is configured to save the code repository addresses in the third address set and initialization information in the first database, wherein the initialization information comprises a storage time of the code repository address, an update time of the code repository address, and an md5 value of the code repository address. The information processing module is configured to perform traversal processing on each code repository address based on an information list of all code repository addresses in the first database. The information processing module is configured to perform data cleaning processing on the obtained target type software sample based on a traversal processing result of each code repository address, so as to realize management of the target type software sample.

13. A computer program product comprising computer programs or instructions, characterized in that, The computer program or instruction is executed by the processor to realize the software sample management method in any one of claims 1 to 11.

14. An electronic device, comprising: The electronic device comprises: a memory configured to store executable instructions; a processor configured to execute the executable instructions stored in the memory to realize the software sample management method in any one of claims 1 to 11.

15. A computer-readable storage medium storing executable instructions, the method comprising: The executable instructions are executed by the processor to realize the software sample management method in any one of claims 1 to 11.

Images