Third-party library reuse detection method and device, electronic equipment and storage medium

Abstract

This invention relates to the field of data processing technology, and provides a method, apparatus, electronic device, and storage medium for third-party library reuse detection. The method includes: performing anchor point detection on the binary file to be detected and candidate libraries to obtain multiple anchor points; performing anchor point enhancement on each anchor point to obtain candidate reuse regions for each anchor point; adjusting the candidate reuse regions; determining the candidate reuse region with the highest reuse score based on the adjustment results; and using the candidate reuse region with the highest reuse score as the reuse region of the third-party library. This invention transforms the third-party library reuse detection task into a third-party library reuse region detection task. Based on constant features and function features, it further explores regions at the function call graph granularity to reduce the impact of different compilation options and architectures, while simultaneously exploring the true reuse range. This solves the problems of traditional single feature and granularity mismatch, reduces false negatives and false positives, and improves the accuracy of third-party library reuse detection.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method, apparatus, electronic device, and storage medium for detecting third-party library reuse. Background Technology

[0002] Third-party libraries are an essential component of modern software systems. They are frequently reused during software development, and vulnerabilities in these libraries can be introduced into downstream software, seriously jeopardizing its security. Third-party library reuse detection technology aims to detect reused third-party library code in target software, thereby identifying the vulnerabilities introduced by this reuse, promptly patching these vulnerabilities in downstream software, and ensuring the security of the software supply chain.

[0003] Because C / C++ code can exhibit significant differences due to different compilation options or compilation into binaries with different architectures, detecting third-party library reuse in C / C++ binaries has become a pressing issue. Currently, third-party library reuse detection methods include B2SFinder and techniques using binary function similarity matching. However, both methods suffer from limitations in feature simplification and granularity, leading to false negatives and false negatives, thus reducing the accuracy of third-party library reuse detection. Summary of the Invention

[0004] This invention provides a method, apparatus, electronic device, and storage medium for third-party library reuse detection, aiming to solve the problem of third-party library reuse detection. By transforming the third-party library reuse detection task into a third-party library reuse region exploration task, based on constant features and function features, it further explores regions at the function call graph granularity to reduce the impact of different compilation options and architectures, while exploring the true reuse range. This solves the problems of traditional single feature and granularity mismatch, reduces false negatives and false positives, and improves the accuracy of third-party library reuse detection.

[0005] This invention provides a method for detecting third-party library reuse, comprising:

[0006] Anchor point detection is performed on the binary file to be detected and the candidate library to obtain multiple anchor points;

[0007] Anchor point enhancement is performed on each anchor point to obtain a candidate reuse region for each anchor point;

[0008] The candidate reuse regions are adjusted, and the candidate reuse region with the highest reuse score is determined based on the adjustment results. The candidate reuse region with the highest reuse score is then used as the reuse region of the third-party library.

[0009] In one embodiment, the anchor point enhancement includes anchor point alignment and anchor point expansion;

[0010] The step of enhancing each anchor point to obtain a candidate reuse region for each anchor point includes:

[0011] An anchor point alignment algorithm is used to align each anchor point.

[0012] The aligned anchor points are expanded to obtain the candidate reuse area for each aligned anchor point.

[0013] In one embodiment, the anchor point alignment algorithm is used to align each anchor point, including:

[0014] The anchor point alignment algorithm is used to traverse each anchor point;

[0015] Based on the traversal results, each anchor point is added to the anchor point sequence in the anchor point list;

[0016] Anchor sequence sequences with similarity greater than a set value are merged to determine the longest anchor sequence for each anchor, and the longest anchor sequence for each anchor is used as the alignment result for each anchor.

[0017] In one embodiment, the step of expanding the aligned anchor points to obtain a candidate reuse region for each aligned anchor point includes:

[0018] Determine the sub-functions corresponding to the reuse functions of the candidate reuse regions;

[0019] Based on the sub-functions corresponding to the reuse function, the aligned anchor points are expanded to obtain the candidate reuse region for each aligned anchor point.

[0020] In one embodiment, adjusting the candidate reuse region includes:

[0021] Determine the boundary nodes of the candidate reuse region;

[0022] The candidate reuse region is adjusted based on the boundary nodes.

[0023] In one embodiment, determining the candidate reuse region with the highest reuse score based on the adjustment result includes:

[0024] Based on the adjustment results, the adjusted target candidate reuse region is obtained;

[0025] Based on the similarity of the target candidate reuse regions, the candidate reuse region with the highest reuse score is determined.

[0026] In one embodiment, determining the similarity of the target candidate reuse regions includes:

[0027] The structural similarity between the two target candidate reuse regions is determined based on a graph neural network.

[0028] The similarity of the target candidate reuse region is determined by using the structural similarity, alignment coefficient, function call graph size coefficient, and function call graph difference coefficient.

[0029] The present invention also provides a third-party library reuse detection device, comprising:

[0030] The anchor point detection module is used to perform anchor point detection on the binary file to be detected and the candidate library to obtain multiple anchor points;

[0031] An anchor point enhancement module is used to enhance each anchor point to obtain a candidate reuse region for each anchor point;

[0032] The region adjustment module is used to adjust the candidate reuse regions, determine the candidate reuse region with the highest reuse score based on the adjustment results, and use the candidate reuse region with the highest reuse score as the reuse region of the third-party library.

[0033] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the third-party library reuse detection method as described above.

[0034] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the third-party library reuse detection method as described above.

[0035] The present invention provides a method, apparatus, electronic device, and storage medium for third-party library reuse detection. This method involves anchor point detection of the binary file to be detected and candidate libraries to obtain multiple anchor points; anchor point enhancement is performed on each anchor point to obtain candidate reuse regions for each anchor point; the candidate reuse regions are adjusted, and based on the adjustment results, the candidate reuse region with the highest reuse score is determined and used as the reuse region of the third-party library. This invention transforms the third-party library reuse detection task into a third-party library reuse region detection task. Based on constant features and function features, it further explores regions at the function call graph granularity to reduce the impact of different compilation options and architectures, while simultaneously exploring the true reuse range. This solves the problems of traditional single feature and granularity mismatch, reduces false negatives and false positives, and improves the accuracy of third-party library reuse detection. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0037] Figure 1 This is one of the flowcharts of the third-party library reuse detection method provided by the present invention;

[0038] Figure 2 This is a flowchart illustrating the region adjustment algorithm provided by the present invention;

[0039] Figure 3 This is a flowchart illustrating the anchor point alignment algorithm provided by the present invention;

[0040] Figure 4 This is the second flowchart of the third-party library reuse detection method provided by the present invention;

[0041] Figure 5 This is a schematic diagram of the structure of the third-party library reuse detection device provided by the present invention;

[0042] Figure 6 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0044] The following is combined with Figures 1-6 The present invention describes a third-party library reuse detection method, apparatus, electronic device, and storage medium.

[0045] Specifically, this invention provides a method for detecting the reuse of third-party libraries, referring to... Figure 1 , Figure 1 This is one of the flowcharts of the third-party library reuse detection method provided by the present invention.

[0046] The third-party library reuse detection method provided in this embodiment of the invention includes:

[0047] Step 100: Perform anchor point detection on the binary file to be detected and the candidate library to obtain multiple anchor points;

[0048] It should be noted that this embodiment of the invention proposes a region detection technique, which transforms the task of detecting third-party library reuse into a task of detecting the region of third-party library reuse. Based on constant features and function features, it further explores regions at the function call graph granularity to reduce the impact of different compilation options and architectures, while exploring the true reuse range, solving the problems of single features and mismatched granularity, and improving the accuracy of detecting code reuse in third-party libraries.

[0049] The third-party library reuse detection method provided in this embodiment of the invention mainly includes three processes: anchor point detection, anchor point enhancement, and region detection.

[0050] Before conducting third-party library reuse detection, candidate libraries need to be built. For example, crawlers are written for different websites to crawl the source code projects and binary files of third-party libraries from open-source code hosting platforms such as Conan, GitHub, and VCPKG. For source code projects, an automatic compilation script is written to compile them according to the default configuration to obtain binary files as candidates; for projects without source code, binary files are used directly as candidates, thereby building a complete candidate library, i.e., candidate third-party libraries.

[0051] Then, anchor point detection is performed on the binary file to be detected and the candidate library to obtain multiple anchor points. Each anchor point can be understood as a function pair, which are functions that match each other from the binary file to be detected and the candidate library, respectively.

[0052] This invention employs two types of anchor points: constant feature anchor points and semantic anchor points. Anchor point detection is performed on the binary file to be detected and the candidate library based on these constant and semantic features. First, five constant features are selected as constant feature anchor points: function parameters, system call sequences, a list of string constants, a list of integer arrays, and control flow information. IDA Pro or other disassemblers are used to determine these five constant features and their call addresses from the binary file to be detected and the candidate library. Function pairs matching these constant features are then used as constant feature anchor points. For example, an IDA Python script is written to extract the five constant features—function parameters, system call sequences, a list of string constants, a list of integer arrays, and control flow information—from all binary files in the candidate library using IDA Pro 7.5. The function and call instruction addresses are obtained through IDA Pro's analysis functions. All extracted features are stored in a unified database, and an inverted index is used to accelerate the matching process.

[0053] Secondly, the Gemini cross-architecture function similarity matching method is used to extract function pairs with similarity greater than a threshold as semantic anchors. Based on the above two steps, a series of anchors are generated for the binary file to be detected.

[0054] Step 200: Perform anchor point enhancement on each anchor point to obtain a candidate reuse region for each anchor point;

[0055] It should be noted that anchor point enhancement includes anchor point alignment and anchor point expansion. Anchor point enhancement is performed on each anchor point to obtain a candidate reusable region for each anchor point. For example, anchor point alignment and anchor point expansion are performed on each anchor point to obtain a candidate reusable region for each anchor point.

[0056] Step 300: Adjust the candidate reuse region, determine the candidate reuse region with the highest reuse score based on the adjustment result, and use the candidate reuse region with the highest reuse score as the reuse region of the third-party library.

[0057] It should be noted that the embodiments of the present invention propose a region adjustment algorithm, which iteratively adjusts the boundary nodes of candidate reuse regions until the candidate reuse region with the highest reuse score is selected as the final detected candidate reuse region.

[0058] After determining the candidate reuse region for each anchor point, the candidate reuse region is adjusted. Based on the adjustment results, the candidate reuse region with the highest reuse score is determined and used as the reuse region for the third-party library.

[0059] In one embodiment, boundary nodes of candidate reuse regions are determined; the candidate reuse regions are then adjusted based on these boundary nodes. For example, for a region adjustment algorithm, such as... Figure 2 As shown, firstly, nodes with an in-degree of 0 in the function call graphs of the candidate reuse region are identified, i.e., functions without parent functions, and the nodes with an in-degree of 0 are taken as the boundary nodes of the candidate reuse region. Then, a pair of boundary nodes is subjected to 9 combinations of 3 actions: moving up, moving down, and remaining stationary. For each combination of actions, a reuse score, i.e., the RARM (Real Area Reuse Metric) score, is calculated for the new candidate reuse region. The action with the highest reuse score is selected and executed. The above adjustment is performed iteratively until the boundary nodes of both function call graphs are stationary and the highest reuse score is obtained. The two function call graphs obtained in the end are the adjusted detected reuse regions.

[0060] The third-party library reuse detection method provided in this invention involves anchor point detection of the binary file to be detected and candidate libraries to obtain multiple anchor points; anchor point enhancement is performed on each anchor point to obtain candidate reuse regions for each anchor point; the candidate reuse regions are adjusted, and the candidate reuse region with the highest reuse score is determined based on the adjustment results, and this candidate reuse region with the highest reuse score is used as the reuse region of the third-party library. This invention designs different types of constant features and function-level features, and uses these features as anchor points. Through anchor point enhancement and region detection, the detection region is further identified to obtain the third-party library reuse result. Compared with directly using a single feature as the third-party library reuse result, this significantly improves accuracy and recall. Simultaneously, by dynamically detecting accurate reuse regions at the granularity of the function call graph, the problem of false negatives and false positives caused by inconsistencies between the detection granularity and the reuse granularity is solved. Furthermore, through region detection technology, in addition to identifying the third-party library reuse result, the accurate reuse range can also be identified, which is beneficial for further locating and verifying vulnerabilities introduced by code reuse, thus improving the accuracy of third-party library reuse detection.

[0061] Based on the above embodiments, the step of enhancing each anchor point to obtain a candidate reuse region for each anchor point includes: using an anchor point alignment algorithm to align each anchor point; and expanding the aligned anchor points to obtain a candidate reuse region for each aligned anchor point.

[0062] This invention proposes an anchor point alignment algorithm and an anchor point expansion strategy to supplement the contextual semantics of each anchor point and use the enhanced anchor points as candidate reuse regions. Specifically, the anchor point alignment algorithm is used to align each anchor point, and then the aligned anchor points are expanded to obtain candidate reuse regions for each aligned anchor point. The anchor point alignment algorithm is used to address the anchor point overlap phenomenon in the matching between the binary file to be detected and the candidate library. The anchor point expansion strategy is used to expand the context of the anchor points to obtain candidate reuse regions.

[0063] In one embodiment, an anchor alignment algorithm is used to traverse each anchor point. Then, based on the traversal results, each anchor point is added to the anchor point sequence in the anchor point list. Finally, anchor point sequences with similarity greater than a set value are merged to determine the longest anchor point sequence for each anchor point, and the longest anchor point sequence for each anchor point is used as the alignment result for each anchor point.

[0064] For example, for anchor point alignment algorithms, such as Figure 3As shown, the anchor points in the two function call graphs overlap. One objective function may match multiple candidate functions, while other objective functions may only match one candidate function. Based on this, this embodiment of the invention proposes an anchor point alignment algorithm to generate the longest aligned anchor point sequence for each anchor point. First, an anchor point list is established, where each element is an aligned anchor point sequence. Second, all anchor points are traversed to determine if they can be added to an existing anchor point sequence in the anchor point list. If not, they are added as a new anchor point sequence to the list. Then, after traversing each anchor point, anchor point sequences with high similarity are merged to avoid an excessively large anchor point list. Finally, an anchor point list is generated for each anchor point, and the longest anchor point sequence is output as the alignment result for that anchor point.

[0065] In one embodiment, a sub-function corresponding to the reuse function of the candidate reuse region is determined, and then the aligned anchor points are expanded based on the sub-function corresponding to the reuse function to obtain the candidate reuse region of each aligned anchor point.

[0066] It should be noted that, since all sub-functions of a reused function are reused, the anchor point expansion strategy in this embodiment of the invention adds the region containing the sub-functions of each anchor point's function call to the region containing the reused function, generating a candidate reuse region for each anchor point. Specifically, the sub-functions corresponding to the reused function in the candidate reuse region are determined, and then the aligned anchor points are expanded based on the sub-functions corresponding to the reused function to obtain the candidate reuse region for each aligned anchor point. That is, the candidate reuse region consists of the region containing the reused function and the region containing the sub-functions.

[0067] This invention employs an anchor point alignment algorithm to align each anchor point, and then expands the aligned anchor points to obtain a candidate reuse region for each aligned anchor point. This avoids overlapping anchor points in two function call graphs and improves the accuracy of third-party library reuse detection.

[0068] Based on the above embodiments, determining the candidate reuse region with the highest reuse score based on the adjustment result includes: obtaining the adjusted target candidate reuse region based on the adjustment result; and determining the candidate reuse region with the highest reuse score based on the similarity of the target candidate reuse region.

[0069] It should be noted that, in this embodiment of the invention, a Real Area Reuse Metric (RARM) is designed to calculate the similarity of candidate reuse regions and to adjust the regions.

[0070] Specifically, the adjusted target candidate reuse regions are obtained based on the adjustment results. Then, based on the similarity of the target candidate reuse regions, the candidate reuse region with the highest reuse score is determined. For example, after moving a pair of boundary nodes up, down, and stationary, the adjusted target candidate reuse regions are obtained. Then, the similarity of each target candidate reuse region is calculated based on the reuse region similarity calculation index. Finally, based on the similarity of each target candidate reuse region, the candidate reuse region with the highest reuse score is determined. It can be understood that the similarity is directly proportional to the reuse score, that is, the higher the similarity, the higher the reuse score.

[0071] In one embodiment, the structural similarity between two target candidate reuse regions is determined based on a graph neural network. The structural similarity, alignment coefficient, function call graph size coefficient, and function call graph difference coefficient are used to determine the overall similarity of the target candidate reuse regions. For example, the structural similarity S' between the two target candidate reuse regions is calculated using a graph neural network; then, an alignment coefficient δFa is set, where the coefficient increases with the number of aligned anchor points; a function call graph size coefficient δFs is set, where the coefficient increases with the size of the reuse region; and a function call graph difference coefficient δFd is set, where the coefficient increases with the smaller the difference in the size of the reuse regions. For candidate reuse regions with a similarity S greater than a threshold, this is considered a reuse, and the candidate regions are further adjusted using a region adjustment algorithm to obtain the actual reuse region. The formula for calculating the similarity of the target candidate reuse regions is as follows:

[0072] S=S'×δFa×δFs×δFd.

[0073] This invention obtains the adjusted target candidate reuse region by adjusting the results, and then determines the candidate reuse region with the highest reuse score based on the similarity of the target candidate reuse regions. This improves the accuracy of third-party library reuse detection.

[0074] refer to Figure 4 , Figure 4 This is the second flowchart of the third-party library reuse detection method provided by the present invention.

[0075] The third-party library reuse detection method provided in this embodiment of the invention mainly includes three processes: anchor point detection, anchor point enhancement, and region detection.

[0076] Anchor point detection: Anchor point detection is performed on the target binary file and candidate binary files, including detecting function parameters, system call sequences, string constants, integer arrays, and control flow information.

[0077] Anchor point enhancement: Anchor point alignment and anchor point expansion are performed on the target function call graph and the candidate function call graph, and then CNN (Convolutional Neural Network) is nested between the target function call graph and the candidate function call graph.

[0078] Region detection: Adjust the candidate reuse regions to obtain the reuse regions.

[0079] This invention transforms the third-party library reuse detection task into a third-party library reuse region detection task. Based on constant features and function features, it further explores regions at the function call graph granularity to reduce the impact of different compilation options and architectures. At the same time, it explores the true reuse range, solves the problems of single features and granularity mismatch, and more accurately detects third-party library reuse code in target C / C++ binary files, reducing false negatives and false positives, and improving the accuracy of third-party library reuse detection.

[0080] Figure 5 This is a schematic diagram of the third-party library reuse detection device provided by the present invention, with reference to... Figure 5 The present invention provides a third-party library reuse detection device, including an anchor point detection module 501, an anchor point enhancement module 502 and a region adjustment module 503.

[0081] Anchor point detection module 501 is used to perform anchor point detection on the binary file to be detected and the candidate library to obtain multiple anchor points;

[0082] Anchor point enhancement module 502 is used to enhance each anchor point to obtain a candidate reuse area for each anchor point;

[0083] The region adjustment module 503 is used to adjust the candidate reuse region, determine the candidate reuse region with the highest reuse score based on the adjustment result, and use the candidate reuse region with the highest reuse score as the reuse region of the third-party library.

[0084] The third-party library reuse detection device provided in this invention performs anchor point detection on the binary file to be detected and candidate libraries to obtain multiple anchor points; anchor point enhancement is performed on each anchor point to obtain candidate reuse regions for each anchor point; the candidate reuse regions are adjusted, and the candidate reuse region with the highest reuse score is determined based on the adjustment results, and the candidate reuse region with the highest reuse score is used as the reuse region of the third-party library. This invention designs different types of constant features and function-level features, and uses these features as anchor points. Through anchor point enhancement and region detection, the detection region is further identified to obtain the third-party library reuse result. Compared with directly using a single feature as the third-party library reuse result, this significantly improves accuracy and recall. Simultaneously, by dynamically detecting accurate reuse regions at the granularity of the function call graph, the problem of false negatives and false positives caused by the inconsistency between the detection granularity and the reuse granularity is solved. Furthermore, through region detection technology, in addition to identifying the third-party library reuse result, the accurate reuse range can also be identified, which is beneficial for further locating and verifying vulnerabilities introduced by code reuse, thus improving the accuracy of third-party library reuse detection.

[0085] The anchor point enhancement includes anchor point alignment and anchor point expansion;

[0086] In one embodiment, the anchor point enhancement module 502 is specifically used for:

[0087] An anchor point alignment algorithm is used to align each anchor point.

[0088] The aligned anchor points are expanded to obtain the candidate reuse area for each aligned anchor point.

[0089] In one embodiment, the anchor point enhancement module 502 is specifically used for:

[0090] The anchor point alignment algorithm is used to traverse each anchor point;

[0091] Based on the traversal results, each anchor point is added to the anchor point sequence in the anchor point list;

[0092] Anchor sequence sequences with similarity greater than a set value are merged to determine the longest anchor sequence for each anchor, and the longest anchor sequence for each anchor is used as the alignment result for each anchor.

[0093] In one embodiment, the anchor point enhancement module 502 is specifically used for:

[0094] Determine the sub-functions corresponding to the reuse functions of the candidate reuse regions;

[0095] Based on the sub-functions corresponding to the reuse function, the aligned anchor points are expanded to obtain the candidate reuse region for each aligned anchor point.

[0096] In one embodiment, the region adjustment module 503 is specifically used for:

[0097] Determine the boundary nodes of the candidate reuse region;

[0098] The candidate reuse region is adjusted based on the boundary nodes.

[0099] In one embodiment, the region adjustment module 503 is specifically used for:

[0100] Based on the adjustment results, the adjusted target candidate reuse region is obtained;

[0101] Based on the similarity of the target candidate reuse regions, the candidate reuse region with the highest reuse score is determined.

[0102] In one embodiment, the region adjustment module 503 is specifically used for:

[0103] The structural similarity between the two target candidate reuse regions is determined based on a graph neural network.

[0104] The similarity of the target candidate reuse region is determined by using the structural similarity, alignment coefficient, function call graph size coefficient, and function call graph difference coefficient.

[0105] Figure 6 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 6 As shown, the electronic device may include: a processor 610, a communications interface 620, a memory 630, and a communication bus 640, wherein the processor 610, the communications interface 620, and the memory 630 communicate with each other via the communication bus 640. The processor 610 can call logical instructions in the memory 630 to execute a third-party library reuse detection method, which includes:

[0106] Anchor point detection is performed on the binary file to be detected and the candidate library to obtain multiple anchor points;

[0107] Anchor point enhancement is performed on each anchor point to obtain a candidate reuse region for each anchor point;

[0108] The candidate reuse regions are adjusted, and the candidate reuse region with the highest reuse score is determined based on the adjustment results. The candidate reuse region with the highest reuse score is then used as the reuse region of the third-party library.

[0109] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0110] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the third-party library reuse detection method provided by the methods described above, the method comprising:

[0111] Anchor point detection is performed on the binary file to be detected and the candidate library to obtain multiple anchor points;

[0112] Anchor point enhancement is performed on each anchor point to obtain a candidate reuse region for each anchor point;

[0113] The candidate reuse regions are adjusted, and the candidate reuse region with the highest reuse score is determined based on the adjustment results. The candidate reuse region with the highest reuse score is then used as the reuse region of the third-party library.

[0114] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0115] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0116] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting third-party library reuse, characterized in that, include: Anchor point detection is performed on the binary file to be detected and the candidate library to obtain multiple anchor points; Anchor point enhancement is performed on each anchor point to obtain a candidate reuse region for each anchor point; The anchor point enhancement includes anchor point alignment and anchor point expansion; The candidate reuse regions are adjusted, and the candidate reuse region with the highest reuse score is determined based on the adjustment results. The candidate reuse region with the highest reuse score is then used as the reuse region of the third-party library. The step of enhancing each anchor point to obtain a candidate reuse region for each anchor point includes: An anchor point alignment algorithm is used to align each anchor point. The aligned anchor points are expanded to obtain the candidate reuse area for each aligned anchor point. The anchor point alignment algorithm is used to align each anchor point, including: The anchor point alignment algorithm is used to traverse each anchor point; Based on the traversal results, each anchor point is added to the anchor point sequence in the anchor point list; Anchor sequence sequences with similarity greater than a set value are merged to determine the longest anchor sequence for each anchor, and the longest anchor sequence for each anchor is used as the alignment result for each anchor.

2. The third-party library reuse detection method according to claim 1, characterized in that, The step of expanding the aligned anchor points to obtain a candidate reuse region for each aligned anchor point includes: Determine the sub-functions corresponding to the reuse functions of the candidate reuse regions; Based on the sub-functions corresponding to the reuse function, the aligned anchor points are expanded to obtain the candidate reuse region for each aligned anchor point.

3. The third-party library reuse detection method according to claim 1, characterized in that, The adjustment of the candidate reuse region includes: Determine the boundary nodes of the candidate reuse region; The candidate reuse region is adjusted based on the boundary nodes.

4. The third-party library reuse detection method according to claim 1, characterized in that, The process of determining the candidate reuse region with the highest reuse score based on the adjustment results includes: Based on the adjustment results, the adjusted target candidate reuse region is obtained; Based on the similarity of the target candidate reuse regions, the candidate reuse region with the highest reuse score is determined.

5. The third-party library reuse detection method according to claim 4, characterized in that, Determining the similarity of the target candidate reuse regions includes: The structural similarity between the two target candidate reuse regions is determined based on a graph neural network. The similarity of the target candidate reuse region is determined by using the structural similarity, alignment coefficient, function call graph size coefficient, and function call graph difference coefficient.

6. A third-party library reuse detection device, characterized in that, include: The anchor point detection module is used to perform anchor point detection on the binary file to be detected and the candidate library to obtain multiple anchor points; An anchor point enhancement module is used to enhance each anchor point to obtain a candidate reuse region for each anchor point; the anchor point enhancement includes anchor point alignment and anchor point expansion. The region adjustment module is used to adjust the candidate reuse regions, determine the candidate reuse region with the highest reuse score based on the adjustment results, and use the candidate reuse region with the highest reuse score as the reuse region of the third-party library. The anchor point enhancement module is further configured to use an anchor point alignment algorithm to align each anchor point; and to expand the aligned anchor points to obtain a candidate reuse area for each aligned anchor point. The anchor point enhancement module is further configured to traverse each anchor point using the anchor point alignment algorithm; Based on the traversal results, each anchor point is added to the anchor point sequence in the anchor point list; anchor point sequences with similarity greater than a set value are merged to determine the longest anchor point sequence for each anchor point, and the longest anchor point sequence for each anchor point is used as the alignment result for each anchor point.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the third-party library reuse detection method as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the third-party library reuse detection method as described in any one of claims 1 to 5.

Images