A function similarity detection method, device and equipment and readable storage medium

Abstract

The application provides a function similarity detection method and device, equipment and a readable storage medium. The method comprises: obtaining first characteristic information of a target function in a source code file; wherein the first characteristic information comprises first variable information and a first hash value of an array of called sub-function information; matching the first characteristic information with a data packet corresponding to a preset sample function; wherein the data packet comprises second characteristic information of the preset sample function; determining a similarity state of the target function and the preset sample function according to a matching result; wherein the similarity state comprises any one of the following: similar, dissimilar, and possibly similar. Through the implementation of the application, only the first characteristic information of the target function is matched with the data packet corresponding to the preset sample, and the similarity state of the two functions can be determined according to the matching result, thereby effectively improving the detection efficiency and facilitating storage due to the small amount of characteristic information.

Description

Technical Field

[0001] This application relates to the field of electronic technology, and in particular to a function similarity detection method, apparatus, device, and readable storage medium. Background Technology

[0002] Currently, related industries often use methods such as generating syntax trees for comparison and AI-based training and recognition to determine whether functions in different source code files are similar.

[0003] The scheme for generating syntax trees requires generating an Abstract Syntax Tree (AST) based on compiler principles. This AST uses a complex tree structure to describe the code's hierarchical structure, call relationships, etc. Then, by comparing the features (tree structure, key nodes, etc.) of the syntax trees of two functions, the two functions are considered similar if their features are similar. The AI-based training and recognition algorithm requires deployment operations, including model finding, model transformation, and model optimization, followed by model training, and finally, its formal use for detection.

[0004] However, the method of comparison by generating syntax trees has the following problems: Complex construction; although existing libraries can be used, both the learning cost and the code complexity are high, resulting in a high barrier to entry; Time-consuming; because building a syntax tree is a very tedious and complex process, each function requires a considerable amount of time to generate its syntax tree (relative to the normal execution speed of a function); Difficult storage; because the generated syntax tree has a large amount of data and is stored in memory as a tree structure, it is difficult to store it as a file. Moreover, since its data volume far exceeds the function itself to be computed, the storage cost is high. Therefore, feature extraction and hash calculation are generally used to condense information, but this results in the loss of a lot of information. AI-based training and recognition algorithms have the following problems: from data preparation to training to detection, it is a tedious and complex process with a high barrier to entry; not lightweight enough, complex to deploy; not flexible enough; and high cost. Summary of the Invention

[0005] The main objective of this application is to provide a function similarity detection method, apparatus, device, and readable storage medium, which can at least solve the problems that the methods for detecting function similarity in related technologies are relatively complex and feature information is not easy to store.

[0006] To achieve the above objectives, the first aspect of this application provides a function similarity detection method, which includes:

[0007] Obtain the first feature information of the target function in the source code file; wherein, the first feature information includes: first variable information and the first hash value of the array of called sub-function information;

[0008] The first feature information is matched with the data packet corresponding to the preset sample function; wherein, the data packet includes the second feature information of the preset sample function;

[0009] The similarity state between the target function and the preset sample function is determined based on the matching results; wherein the similarity state includes any one of the following: similar, dissimilar, or possibly similar.

[0010] A second aspect of this application provides a function similarity detection device, comprising:

[0011] The acquisition module is used to acquire the first feature information of the target function in the source code file; wherein, the feature information includes: first variable information and the first hash value of the array of called sub-function information;

[0012] A matching module is used to match the first feature information with a data packet corresponding to a preset sample function; wherein the data packet is used to store the second feature information of the preset sample function;

[0013] The determination module is used to determine the similarity state between the target function and the preset sample function based on the matching result; wherein the similarity state includes any one of the following: similar, dissimilar, or possibly similar.

[0014] The third aspect of this application provides an electronic device, including a memory and a processor, wherein the processor is used to execute a computer program stored in the memory, and when the processor executes the computer program, it implements the steps of the function similarity detection method provided in the first aspect of this application.

[0015] The fourth aspect of this application provides a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it implements the steps of the function similarity detection method provided in the first aspect of this application.

[0016] As can be seen from the above, according to the function similarity detection method, apparatus, device, and readable storage medium provided in this application, the first feature information of the target function in the source code file is obtained; wherein, the first feature information includes: first variable information and the first hash value of the array of called sub-function information; the first feature information is matched with the data packet corresponding to the preset sample function; wherein, the data packet includes the second feature information of the preset sample function; the similarity state between the target function and the preset sample function is determined according to the matching result; wherein, the similarity state includes any one of the following: similar, dissimilar, or possibly similar. Through the implementation of this application, it is only necessary to match the first feature information of the target function with the data packet corresponding to the preset sample, and the similarity state of the two functions can be determined according to the matching result, thereby effectively improving the detection efficiency, and the feature information is small and easy to store. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a schematic diagram of the basic flowchart of the function similarity detection method provided in the first embodiment of this application;

[0019] Figure 2 This is a schematic diagram of a function similarity detection device provided in the second embodiment of this application; Figure 3 A schematic diagram of the structure of an electronic device provided in the third embodiment of this application. Detailed Implementation

[0020] To make the inventive objectives, features, and advantages of this application more apparent and understandable, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0021] In the description of the embodiments of this application, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0022] To address the issues of complexity and difficulty in storing feature information in existing function similarity detection methods, the first embodiment of this application provides a function similarity detection method applied to C language source code files, such as... Figure 1 This is a basic flowchart illustrating the function similarity detection method provided in this embodiment. The function similarity detection method includes the following steps:

[0023] Step 101: Obtain the first feature information of the target function in the source code file.

[0024] Specifically, in this embodiment, the first feature information includes: first variable information and the first hash value of the array of called sub-function information. It should be noted that, generally, the functionality of a function is dominated by its called sub-functions. When the called sub-functions are essentially the same, the functions are essentially the same, and the similarity is higher. Conversely, when the called sub-functions differ significantly, the functions are very different, and the similarity is low. Therefore, this embodiment attempts to determine the similarity of functions based on sub-function calls, by acquiring information surrounding the sub-functions and variable information to determine whether two functions are similar. Because this embodiment is mainly designed for the similarity determination of functions with multiple sub-function calls, the identification effect is poor for functions without sub-function calls.

[0025] In some embodiments of this example, before obtaining the first feature information of the target function in the source code file, the method further includes: obtaining the name of the sub-function, the number of parameters called by the sub-function, and the hierarchical information of the sub-function in the target function after identification processing; generating sub-function information array elements based on the sub-function name, the number of parameters, and the hierarchical information; and storing all sub-function information array elements sequentially to obtain the sub-function information array.

[0026] Specifically, in this embodiment, the sub-function information array elements include the sub-function name, the number of parameters called by the sub-function, and the sub-function's hierarchy information. By storing all sub-function information array elements in chronological order, the sub-function information array will include the sub-function name, the number of parameters called by the sub-function, the sub-function's hierarchy information, and the sub-function's order. The C language source code file in this embodiment contains multiple target functions. These target functions are separated, and then the first feature information of each target function is extracted. The separation method can be using regular expressions, tools such as ctags, or a method of manually reading the file for determination. This embodiment optionally uses the method of manually reading the file for determination. For example, ideally, the hierarchy can be divided based on curly braces {}. Let the hierarchy start from 0. Each { increments the hierarchy by 1, and each} decrements the hierarchy by 1. When the hierarchy returns to 0, it is considered the end of a function, thus obtaining the function's scope and allowing extraction of the function body information. For example, the source code file content is:

[0027] #include "stdio.h"

[0028] int add( int a, int b )

[0029] {

[0030] return a+b;

[0031] }

[0032] int main( void )

[0033] {

[0034] int sum = add(5, 6);

[0035] printf("sum = %d\n",sum);

[0036] return 0;

[0037] }

[0038] The contents of each objective function are obtained after separation processing:

[0039] The content of the add function is:

[0040] int add( int a, int b )

[0041] {

[0042] return a+b;

[0043] }

[0044] The main function contains the following:

[0045] int main( void )

[0046] {

[0047] int sum = add(5, 6);

[0048] printf("sum = %d\n",sum);

[0049] return 0;

[0050] }

[0051] Furthermore, in some embodiments of this example, before the steps of obtaining the names of sub-functions, the number of parameters called by the sub-functions, and the hierarchical information of the sub-functions in the target function after identification processing, the method further includes: obtaining the statement types of the function body in the target function; wherein, the statement types include: hierarchical statements and non-hierarchical statements; and identifying different statement types according to preset statement type identifier characters to obtain the target function after identification processing.

[0052] Specifically, this embodiment uses specific characters to identify various statement types within a function, simplifying and distinguishing the statement content. First, the statements in the function body are divided into hierarchical and non-hierarchical statements. Hierarchical statements can include if, else, switch, do, while, and for statements. Non-hierarchical statements can include statements with sub-function calls, expression statements, continue, break, return, declaration statements, and other statements. Pre-defined identifiers can be used to identify different statements within different statement types. For example, 'i' represents if and else statements, 's' represents switch statements, 'w' represents do and while statements, 'f' represents for statements, 'c' represents statements with sub-function calls, and 'e' represents expression statements, continue, break, return, and declaration statements. Each statement is represented by a single character. It should be noted that this classification method is not based on C language syntax but is a classification method specific to this embodiment. After identifying the functions within the function body, the target function representing the function body content using the identifier characters is obtained. For example, the original function is:

[0053] int fun( void )

[0054] {int a=0;

[0055] int b = printf("1");

[0056] if( a>1 )

[0057] printf("2");

[0058] if ( a==0 )

[0059] {printf("3");}

[0060] else

[0061] printf("4 =%d\n",a );

[0062] switch( GetLastError() )

[0063] {

[0064] case 0:

[0065] printf("OK");

[0066] break;

[0067] default:

[0068] if( a!=0 )

[0069] {

[0070] printf("ERR");

[0071] break;

[0072] }

[0073] }

[0074] for( int i=0;i<10;i++ )

[0075] {

[0076] printf("5");}

[0077] {a++;}

[0078] printf("lasterr=%d\n", GetLastError());

[0079] return a;},

[0080] In this context, "int a=0;" represents the remaining statements, denoted by 'e'; "int b = printf("1");" represents a statement with a sub-function call, denoted by 'c'; "if( a>1 )" represents an 'if' statement, denoted by 'i'; "printf("2");" represents a statement with a sub-function call, denoted by 'c'; "if( a==0 )" represents an 'if' statement, denoted by 'i'; "printf("3");" represents a statement with a sub-function call, denoted by 'c'; "else" is similar to an 'if' statement, denoted by 'i'; "printf("4 =%d\n", a );" represents a statement with a sub-function call, denoted by 'c'; "switch( GetLastError() )" is a 'switch' statement with a sub-function call, denoted by 's' and 'c'; "printf("OK");" represents a statement with a sub-function call, denoted by 'c'; "break;" represents the remaining statements, denoted by 'e'; "if( a!=0 ")" represents an if statement, denoted by i; "printf("ERR");" represents a statement with a sub-function call, denoted by c; "break;" represents the remaining statements, denoted by e; "for( int i=0; i<10; i++ )" represents a for statement, denoted by f; "printf("5");" represents a statement with a sub-function call, denoted by c; "a++;" represents the remaining statements, denoted by e; "printf("lasterr=%d\n", GetLastError())" represents a statement with two sub-function calls, each denoted by c; "return a;" represents the remaining statements, denoted by e; Therefore, the target function after the flag processing only contains the statement information represented by the flag characters.

[0081] Furthermore, in some other embodiments of this example, after the step of identifying different statement types according to preset statement type identifier characters to obtain the identified target function, the method further includes: when there is a sub-function call statement in the identified target function, obtaining the name of the called sub-function and the number of parameters called by the sub-function; when the statement of the identified target function is in the structure of a hierarchical class statement, adding a preset number of indentation characters before the identifier character corresponding to the statement.

[0082] Specifically, in this embodiment, after identifying the statement types in the function body of the target function, when there is a sub-function call statement in the target function, the name of the called sub-function and the number of parameters of the sub-function call statement are obtained; when the statement in the function body is within the control scope of the hierarchical class statement, that is, the statement is located at a deeper level, one or more indentation characters are added between the identifier characters representing the statement to indicate the level of the statement, so multiple statements in the function body can be divided into multiple levels. For example, in the original function above, "int b = printf("1");" is a statement with a sub-function call. Obtaining the sub-function name and the number of arguments yields c: printf, 1; The statement "printf("2");" is also a statement with a sub-function call and is controlled by an if statement. Adding an indentation character (\t) before the identifier c yields c: printf, 1; "if( a!=0 )" is an if statement and is controlled by a switch statement. Adding an indentation character before the identifier i corresponding to this statement; "printf("ERR");" is a statement with a sub-function call and is controlled by both a switch and if statement, therefore two indentation characters are needed, i.e., two indentation characters are added before c. Following this method, the original function above, after identification processing, becomes:

[0083] int fun( void )

[0084] e

[0085] c: printf, 1

[0086] i

[0087] c: printf, 1

[0088] i

[0089] c: printf, 1

[0090] i

[0091] c: printf, 2

[0092] sc:GetLastError, 0

[0093] c: printf, 1

[0094] e

[0095] i

[0096] c: printf, 1

[0097] e

[0098] f

[0099] c: printf, 1

[0100] e

[0101] c: printf, 1 c: GetLastError, 0

[0102] e

[0103] Therefore, the above sub-function information array can be:

[0104] int fun( void )

[0105] :printf,1

[0106] i: printf, 1

[0107] i: printf, 1

[0108] i: printf, 2

[0109] GetLastError, 0

[0110] s: printf, 1

[0111] si: printf, 1

[0112] f: printf, 1

[0113] :printf,1

[0114] GetLastError, 0

[0115] In other words, the elements in the subfunction information array include the subfunction name, the number of parameters called by the subfunction, and the subfunction's hierarchy information, such as the element "i: printf, 1". In this embodiment, statements without subfunction calls and the identifier character 'c' of subfunction call statements are ignored; only the subfunction name and the number of parameters called by the subfunction are retained. This is because the array contains only subfunction call statements, all of which have the identifier character 'c', making 'c' a fixed identifier that can be ignored. The identifier character before the colon indicates the hierarchy to which the subfunction statement belongs. Since it may belong to multiple hierarchies, there can be multiple identifier characters, representing multiple nested hierarchies. Furthermore, since the hierarchy information of all subfunctions has been obtained, the indentation before the identifier characters can be removed, and the corresponding identifier characters can be merged into the same column.

[0116] Furthermore, in some embodiments of this example, after the step of storing all sub-function information array elements sequentially to obtain the sub-function information array, the method further includes: obtaining a list of sub-function names to be ignored in the configuration text; deleting sub-function information corresponding to the list of sub-function names based on the list of sub-function names to be ignored; and performing a hash operation on the sub-function information array after deletion to obtain a first hash value.

[0117] Specifically, in this embodiment, a text file can be created to store the names of the sub-functions to be ignored. Each line in this text file can contain one sub-function name, and the content of the text file can be:

[0118] printf

[0119] perror

[0120] Based on the list of sub-function names that should be ignored, the sub-functions that should be ignored are deleted from the sub-function information array obtained by each function. The remaining sub-function information array is then hashed to obtain the first hash value.

[0121] Step 102: Match the first feature information with the data packet corresponding to the preset sample function.

[0122] Specifically, in this embodiment, the data packet includes second feature information of a preset sample function. The processing procedure for the preset sample function is the same as that for the target function. The feature information obtained after processing can be stored in the data packet, which can be a database or a file, etc. The storage format is not limited. When it is necessary to detect whether the target function in the source code file is similar to the preset sample function, it is only necessary to match it with the data packet corresponding to the preset sample function.

[0123] In some embodiments of this example, before the step of matching the first feature information with the data packet corresponding to the preset sample function, the method further includes: obtaining the function name and the position information of the function name of the preset sample function; wherein, the position information includes: the file name of the source code file and the line number in the source code file; obtaining the second variable information of the preset sample function and the second hash value of the sub-function information array called; wherein, the second variable information includes: the number of variables referenced in the declared variables and the number of variables used as sub-function parameters in the declared variables; and constructing a data packet based on the function name, the position information of the function name, the second hash value, and the second variable information.

[0124] Specifically, in this embodiment, the data packet includes second feature information of a preset sample function. This second feature information includes the function name of the preset sample function, the position information of the function name, a second hash value, and second variable information. For example, function name: proc, function name position information: 1.c, 5, second hash value: df2e015082e845879c124d7d853b2ca4, second variable information: 3, 3. The second variable information includes the number of variables referenced among the declared variables and the number of variables used as parameters of sub-functions among the declared variables. For example, in the function int proc(int a, int b)

[0125] {int c = 5;

[0126] int d = a + c;

[0127] printf("a=%d,c=%d,d=%d\n",a,c,d);

[0128] printf("d^2=%d\n", d*d);

[0129] return a;}

[0130] In this code, `int proc( int a, int b )` declares variables `a` and `b`, using zero variables; `int c = 5` declares variable `c`, using zero variables; `int d = a+c;` declares variable `d`, using two variables `a` and `c`; `printf("a=%d, c=%d, d=%d\n", a, c, d );` is a function call statement using three variables `a`, `c`, and `d` as parameters; `printf("d^2=%d\n", d*d );` is a function call statement using one variable `d` as a parameter; and `return a;` uses one variable `a`. In other words, the `proc` function declares four variables `a`, `b`, `c`, and `d`, uses three of them, and uses three of them as parameters. Therefore, the second variable information is 3, 3. This second variable information can be appended to the function name, for example: `int fun(void ) 3, 3`.

[0131] In some other embodiments of this example, the step of matching the first feature information with the data packet corresponding to the preset sample function includes: matching the first hash value with the second hash value; when the first hash value matches the second hash value, matching the first variable information with the second variable information.

[0132] Specifically, in this embodiment, when matching the first feature information of the target function with the data packet corresponding to the preset sample function, the hash value corresponding to the target function is first matched with the hash value corresponding to the preset sample function. When the hash values ​​match, the variable information is then matched. That is, this embodiment primarily uses hash value judgment and secondarily uses variable information judgment.

[0133] Step 103: Determine the similarity status between the objective function and the preset sample function based on the matching results.

[0134] Specifically, in this embodiment, the similarity state includes any of the following: similar, dissimilar, or possibly similar. When the similarity state is possibly similar, the objective function and the preset sample function have partial similarity, and the retention or rejection of the two functions can be determined as needed; when the similarity state is similar, the two functions may originate from the same function source code. Applying this detection method to fields such as code auditing and vulnerability analysis can effectively improve processing efficiency.

[0135] In some embodiments of this example, the step of determining the similarity state between the target function and the preset sample function based on the matching result includes: when the first hash value and the second hash value do not match, determining that the similarity state between the target function and the preset sample function is dissimilar; when the first variable information and the second variable information do not match, determining that the similarity state between the target function and the preset sample function is possibly similar; when the first variable information and the second variable information match, determining that the similarity state between the target function and the preset sample function is similar.

[0136] Specifically, this embodiment primarily uses hash value judgment, supplemented by variable information judgment. Therefore, when hash values ​​are different, they are directly determined to be dissimilar; when hash values ​​are the same, the result is similar or possibly similar, at which point further judgment is made using variable information. In other words, when both hash value and variable information are the same, they are determined to be similar; when hash values ​​are the same but variable information is different, they are considered possibly similar.

[0137] When the hash values ​​and variable information of two functions match, the names of the sub-functions called in the two functions, the number of their parameters, the order of the sub-functions called, and the level of the corresponding sub-functions are all consistent, thus determining that the two functions are similar; however, when the number of variables referenced in the declared variables and the number of variables used as parameters in the declared variables do not match, the two functions may be similar.

[0138] Compared with related technologies, the proposed solution has the advantages of simple and clear algorithm, high ease of learning, rapid deployment and verification, low threshold and low cost; it is lightweight and flexible, easy to expand and upgrade; it has a wide range of applications, and can be used as a standalone solution for calculating and determining similarity, or as a reference for other technologies. For example, when using syntax trees for determination, the proposed solution can be used as one of the solutions for extracting information and determining similarity; it does not require generating a syntax tree, but achieves some of the effects of a syntax tree, namely, extracting important information while improving detection efficiency.

[0139] Based on the technical solution of the above embodiments of this application, the first feature information of the target function in the source code file is obtained; wherein, the first feature information includes: first variable information and the first hash value of the array of called sub-function information; the first feature information is matched with the data packet corresponding to the preset sample function; wherein, the data packet includes the second feature information of the preset sample function; the similarity state between the target function and the preset sample function is determined according to the matching result; wherein, the similarity state includes any one of the following: similar, dissimilar, or possibly similar. Through the implementation of the solution of this application, it is only necessary to match the first feature information of the target function with the data packet corresponding to the preset sample, and the similarity state of the two functions can be determined according to the matching result, thereby effectively improving the detection efficiency, and the feature information is relatively small and easy to store.

[0140] Figure 2 This application provides a function similarity detection device according to a second embodiment, which can be applied to the aforementioned function similarity detection method. For example... Figure 2 As shown, the function similarity detection device mainly includes:

[0141] The acquisition module 201 is used to acquire the first feature information of the target function in the source code file; wherein, the feature information includes: the first variable information and the first hash value of the array of called sub-function information;

[0142] Matching module 202 is used to match the first feature information with the data packet corresponding to the preset sample function; wherein the data packet includes the second feature information of the preset sample function;

[0143] The determination module 203 is used to determine the similarity state between the target function and the preset sample function based on the matching results; wherein the similarity state includes any one of the following: similar, dissimilar, or possibly similar.

[0144] In some embodiments of this example, the function similarity detection device further includes: a construction module, configured to acquire the function name and the location information of the function name of a preset sample function; wherein the location information includes: the file name of the source code file and the line number in the source code file; acquire the second variable information of the preset sample function and the second hash value of the sub-function information array called; wherein the second variable information includes: the number of variables referenced in the declared variables and the number of variables used as sub-function parameters in the declared variables; and construct a data packet based on the function name, the location information of the function name, the second hash value, and the second variable information.

[0145] In some embodiments of this example, the function similarity detection device further includes: a first generation module, used to obtain the name of the sub-function, the number of parameters called by the sub-function, and the hierarchical information of the sub-function in the target function after identification processing; generate sub-function information array elements based on the sub-function name, the number of parameters, and the hierarchical information; and store all sub-function information array elements sequentially to obtain a sub-function information array.

[0146] Furthermore, in some embodiments of this example, the function similarity detection device further includes: a second generation module, used to obtain the statement types of the function body in the target function; wherein, the statement types include: hierarchical statements and non-hierarchical statements; according to preset statement type identifier characters, different statement types are identified to obtain the identified target function.

[0147] Furthermore, in some embodiments of this example, the function similarity detection device further includes: an extraction module, used to obtain the name of the called sub-function and the number of parameters called by the sub-function when there is a sub-function call statement in the target function after identification processing.

[0148] Furthermore, in some other embodiments of this example, the function similarity detection device further includes: an adding module, used to add a preset number of indentation characters before the identifier character corresponding to the statement when the statement of the target function after identification processing is in the structure of the hierarchical class statement.

[0149] In some embodiments of this example, the function similarity detection device further includes: a calculation module, used to obtain a list of sub-function names to be ignored in the configuration text; delete sub-function information corresponding to the list of sub-function names according to the list of sub-function names to be ignored; and perform a hash operation on the sub-function information array after deletion to obtain a first hash value.

[0150] In some embodiments of this example, the matching module is specifically used to: match the first hash value with the second hash value; and when the first hash value matches the second hash value, match the first variable information with the second variable information.

[0151] In some embodiments of this example, the determining module is specifically used to: determine that the similarity state between the target function and the preset sample function is dissimilar when the first hash value does not match the second hash value; determine that the similarity state between the target function and the preset sample function is possibly similar when the first variable information does not match the second variable information; and determine that the similarity state between the target function and the preset sample function is similar when the first variable information matches the second variable information.

[0152] According to the function similarity detection device provided in this embodiment, the first feature information of the target function in the source code file is obtained; wherein, the first feature information includes: first variable information and the first hash value of the array of called sub-function information; the first feature information is matched with the data packet corresponding to the preset sample function; wherein, the data packet includes the second feature information of the preset sample function; the similarity state between the target function and the preset sample function is determined according to the matching result; wherein, the similarity state includes any one of the following: similar, dissimilar, or possibly similar. Through the implementation of this application's solution, only the first feature information of the target function needs to be matched with the data packet corresponding to the preset sample, and the similarity state of the two functions can be determined according to the matching result, thereby effectively improving detection efficiency, and the feature information is relatively small and easy to store.

[0153] Figure 3 An electronic device is provided as a third embodiment of this application. This electronic device can be used to implement the function similarity detection method in the foregoing embodiments, and mainly includes:

[0154] The system includes a memory 301, a processor 302, and a computer program 303 stored on the memory 301 and executable on the processor 302. The memory 301 and the processor 302 are connected via communication. When the processor 302 executes the computer program 303, it implements the method described in Embodiment 1. The number of processors can be one or more.

[0155] The memory 301 can be a high-speed random access memory (RAM) or a non-volatile memory, such as a disk storage device. The memory 301 is used to store executable program code, and the processor 302 is coupled to the memory 301.

[0156] Furthermore, embodiments of this application also provide a computer-readable storage medium, which may be disposed in the aforementioned electronic device, and the computer-readable storage medium may be as described above. Figure 3 The memory in the illustrated embodiment.

[0157] The computer-readable storage medium stores a computer program that, when executed by a processor, implements the function similarity detection method described in the foregoing embodiments. Furthermore, the computer-readable storage medium can also be a USB flash drive, external hard drive, read-only memory (ROM), RAM, magnetic disk, or optical disk, or any other medium capable of storing program code.

[0158] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0159] The modules described as separate components may or may not be physically separate. Similarly, the components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0160] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0161] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a readable storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned readable storage medium includes various media capable of storing program code, such as USB flash drives, external hard drives, ROM, RAM, magnetic disks, or optical disks.

[0162] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0163] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0164] The above is a description of the function similarity detection method, apparatus, device, and readable storage medium provided in this application. For those skilled in the art, based on the ideas of the embodiments of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A function similarity detection method characterized by comprising: Applied to C language source files, including: Obtain the statement types in the function body of the target function; wherein, the statement types include: hierarchical statements and non-hierarchical statements; Based on preset statement type identifier characters, different statement types are identified to obtain the target function after identification processing; When the target function after identification processing contains a sub-function call statement, obtain the name of the called sub-function and the number of parameters called by the sub-function; When the target function statement after identification processing is in the structure of the hierarchical statement, a preset number of indentation characters are added before the identification character corresponding to the statement to indicate the statement hierarchy, and the hierarchy information of the corresponding sub-function is obtained based on the indentation characters. Obtain the names of the sub-functions in the target function after the identification process, the number of parameters called by the sub-functions, and the hierarchical information of the sub-functions; Generate sub-function information array elements based on the sub-function name, number of parameters, and hierarchy information; Store all the elements of the sub-function information array sequentially to obtain the sub-function information array; Obtain the characteristic information of the target function in the source code file; wherein, the characteristic information includes: first variable information and the first hash value of the array of called sub-function information; The first hash value is matched with the second hash value in the data packet corresponding to the preset sample function; When the first hash value matches the second hash value, the first variable information is matched with the second variable information in the data packet; The similarity state between the target function and the preset sample function is determined based on the matching results; wherein the similarity state includes any one of the following: similar, dissimilar, or possibly similar.

2. The function similarity detection method according to claim 1, characterized in that, Also includes: Obtain the function name and the location information of the preset sample function respectively; wherein, the location information includes: the file name of the source code file and the line number in the source code file; Obtain the second variable information of the preset sample function and the second hash value of the called sub-function information array; wherein, the second variable information includes: the number of variables referenced in the declared variables and the number of variables used as sub-function parameters in the declared variables; The data packet is constructed based on the function name, the location information of the function name, the second hash value, and the second variable information.

3. The function similarity detection method according to claim 1, characterized in that, After the step of storing all sub-function information array elements sequentially to obtain the sub-function information array, the method further includes: Retrieve the list of sub-function names to be ignored from the configuration text; Based on the list of sub-function names to be ignored, delete the sub-function information corresponding to the list of sub-function names; A hash operation is performed on the sub-function information array after deletion to obtain the first hash value.

4. The function similarity detection method according to any one of claims 1 to 3, characterized in that, The step of determining the similarity state between the target function and the preset sample function based on the matching result includes: When the first hash value does not match the second hash value, the similarity status between the target function and the preset sample function is determined to be dissimilar. When the first variable information does not match the second variable information, the similarity status between the objective function and the preset sample function is determined to be possibly similar. When the first variable information matches the second variable information, the similarity status between the objective function and the preset sample function is determined to be similar.

5. A function similarity detection device, characterized in that, Applied to C language source files, including: The acquisition module is used to acquire the statement types of the function body in the target function; wherein, the statement types include: hierarchical statements and non-hierarchical statements; according to preset statement type identifier characters, different statement types are identified to obtain the identified target function; when there are sub-function call statements in the identified target function, the name of the called sub-function and the number of parameters called by the sub-function are acquired; when the statement of the identified target function is in the structure of the hierarchical statement, a preset number of indentation characters are added before the identifier character corresponding to the statement to indicate the statement hierarchy, and the hierarchy information of the corresponding sub-function is obtained based on the indentation characters; the sub-function name, the number of parameters called by the sub-function, and the hierarchy information of the sub-function are acquired in the identified target function; sub-function information array elements are generated based on the sub-function name, the number of parameters, and the hierarchy information; all sub-function information array elements are stored sequentially to obtain the sub-function information array; the feature information of the target function in the source code file is acquired; wherein, the feature information includes: first variable information and the first hash value of the called sub-function information array; The matching module is used to match the first hash value with the second hash value in the data packet corresponding to the preset sample function; when the first hash value matches the second hash value, the first variable information is matched with the second variable information in the data packet. The determination module is used to determine the similarity state between the target function and the preset sample function based on the matching result; wherein the similarity state includes any one of the following: similar, dissimilar, or possibly similar.

6. An electronic device, characterized in that, Includes memory and processor, of which: The processor is used to execute computer programs stored in the memory; When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

Images