Software identification method and device, computer readable storage medium and electronic device

Abstract

The application discloses a software identification method and device, a computer readable storage medium and an electronic device. The method comprises the following steps: obtaining an executable file of target software; identifying the file content of the executable file to obtain at least one first feature of the executable file; executing the executable file, and extracting at least one second feature of the executable file based on the execution process of the executable file; and identifying the target abnormal type of the target software based on the at least one first feature and the at least one second feature of the executable file. The application solves the technical problem of low identification accuracy of malicious software in the related art.

Description

Technical Field

[0001] This invention relates to the Internet field, and more specifically, to a software identification method, apparatus, computer-readable storage medium, and electronic device. Background Technology

[0002] With the development of the internet, the problem of rampant computer malware has become increasingly serious, posing a huge threat to individuals, businesses, and even national security.

[0003] The number of malware programs is currently exploding, and traditional malware classification techniques are struggling to meet the evolving needs. Traditional malware sample classification relies on static characteristics, using signature codes (such as specific bytes) and rule-based methods derived from manual analysis of malware samples by security researchers. However, malware authors often employ techniques like "morphing," "packing," "polymorphism," and "obfuscation" to hide signature codes already known to researchers, attempting to evade detection and analysis by security software or analysts. This results in low accuracy for malware identification methods that rely on static characteristics.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This invention provides a software identification method, apparatus, computer-readable storage medium, and electronic device to at least solve the technical problem of low accuracy in identifying malicious software in related technologies.

[0006] According to one aspect of the present invention, a software identification method is provided, comprising: obtaining an executable file of a target software; identifying the file content of the executable file to obtain at least one first feature of the executable file; executing the executable file and extracting at least one second feature of the executable file based on the execution process of the executable file; and identifying a target anomaly type of the target software based on the at least one first feature and the at least one second feature of the executable file.

[0007] Furthermore, the software identification method also includes: matching each first feature with the attack strategies and attack operations in the target information based on a preset first mapping relationship to obtain a matching result for each first feature, wherein the target information consists of multiple attack strategies and at least one attack operation corresponding to each attack strategy; matching each second feature with the attack strategies and attack operations in the target information based on a preset second mapping relationship and the target information to obtain a matching result for each second feature; and identifying the target software's target anomaly type based on the matching results of each first feature and each second feature.

[0008] Furthermore, the software identification method also includes: constructing a first feature matrix based on the matching results of each first feature and each second feature; obtaining a second feature matrix matching each anomaly type among multiple anomaly types; calculating the similarity between the first feature matrix and each second feature matrix; and identifying the target anomaly type of the target software based on the similarity between the first feature matrix and each second feature matrix.

[0009] Furthermore, the software identification method also includes: obtaining a preset zero matrix, wherein different columns of the zero matrix represent different attack strategies, and different rows in the same column of the zero matrix represent different attack operations corresponding to the attack strategies; assigning values ​​to the elements in the zero matrix based on the matching results of each first feature to obtain a first initial feature matrix; assigning values ​​to the elements in the zero matrix based on the matching results of each second feature to obtain a second initial feature matrix; and determining the first feature matrix based on the first initial feature matrix and the second initial feature matrix.

[0010] Furthermore, the software recognition method also includes: obtaining a first weight matrix corresponding to the first initial feature matrix, and obtaining a second weight matrix corresponding to the second initial feature matrix, wherein the first weight matrix characterizes the degree of influence of the first initial feature matrix on the recognition of the target anomaly type, and the second weight matrix characterizes the degree of influence of the second initial feature matrix on the recognition of the target anomaly type; calculating the product of the first weight matrix and the first initial feature matrix to obtain a third initial feature matrix; calculating the product of the second weight matrix and the second initial feature matrix to obtain a fourth initial feature matrix; and adding the third initial feature matrix and the fourth initial feature matrix to obtain a first feature matrix.

[0011] Furthermore, the software identification method also includes: comparing the similarity between the first feature matrix and each second feature matrix with a preset threshold to obtain the comparison result of each second feature matrix; based on the comparison result of each second feature matrix, determining whether a target feature matrix exists among the multiple second feature matrices; if no target feature matrix exists, determining that the target anomaly type of the target software is no anomaly; if a target feature matrix exists, determining that the anomaly type matched by the target feature matrix is ​​the target anomaly type.

[0012] Furthermore, the software identification method also includes: comparing the similarity between the first feature matrix and each second feature matrix with a preset threshold to obtain the comparison result of each second feature matrix; based on the comparison result of each second feature matrix, determining whether a target feature matrix exists among the multiple second feature matrices; if no target feature matrix exists, determining that the target anomaly type of the target software is no anomaly; if a target feature matrix exists, determining that the anomaly type matched by the target feature matrix is ​​the target anomaly type.

[0013] According to another aspect of the present invention, a software identification device is also provided, comprising: an acquisition module for acquiring an executable file of a target software; a first identification module for identifying the file content of the executable file to obtain at least one first feature of the executable file; an extraction module for executing the executable file and extracting at least one second feature of the executable file based on the execution process of the executable file; and a second identification module for identifying a target anomaly type of the target software based on at least one first feature and at least one second feature of the executable file.

[0014] According to another aspect of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored in the computer-readable storage medium, and the computer program is configured to execute the above-described software identification method at runtime.

[0015] According to another aspect of the present invention, an electronic device is also provided, the electronic device including one or more processors; a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors are configured to run the programs, wherein the programs are configured to execute the above-described software identification method during runtime.

[0016] In this embodiment of the invention, the method of determining the anomaly type of the target software by combining the static and dynamic features of the executable file is adopted. The executable file of the target software is obtained, and then the file content of the executable file is identified to obtain at least one first feature of the executable file. Then the executable file is executed, and at least one second feature of the executable file is extracted based on the execution process of the executable file. Thus, the target anomaly type of the target software is identified based on at least one first feature and at least one second feature of the executable file.

[0017] In the above process, by identifying the contents of the executable file, the static features of the executable file are effectively extracted. By executing the executable file and extracting features based on the execution process, the dynamic features that cannot be shown in the contents of the executable file are effectively extracted. Furthermore, based on at least one first feature and at least one second feature of the executable file, the target anomaly type of the target software is identified. This achieves the analysis of the anomaly type of the target software by combining the static and dynamic features of the executable file, thereby effectively improving the accuracy of malware identification.

[0018] Therefore, the solution provided in this application achieves the goal of determining the anomaly type of the target software by combining the static and dynamic characteristics of the executable file, thereby improving the technical effect of identifying malicious software and solving the technical problem of low accuracy in identifying malicious software in related technologies. Attached Figure Description

[0019] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0020] Figure 1 This is a schematic diagram of an optional software identification method according to an embodiment of the present invention;

[0021] Figure 2 This is a schematic diagram of the operation of an optional identification system according to an embodiment of the present invention;

[0022] Figure 3 This is a flowchart of an optional software identification method according to an embodiment of the present invention;

[0023] Figure 4 This is a schematic diagram of an optional software identification device according to an embodiment of the present invention;

[0024] Figure 5 This is a schematic diagram of an optional electronic device according to an embodiment of the present invention. Detailed Implementation

[0025] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0026] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0027] Example 1

[0028] According to an embodiment of the present invention, an embodiment of a software identification method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0029] Figure 1 This is a schematic diagram of an optional software identification method according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0030] Step S101: Obtain the executable file of the target software.

[0031] Optionally, the executable file of the target software can be obtained through electronic devices, application systems, servers, or other similar devices. Figure 2 This is a schematic diagram of the operation of an optional identification system according to an embodiment of the present invention, such as... Figure 2 As shown, the recognition system includes a static feature mapping module, a dynamic feature mapping module, a vector generation module, and a feature comparison module. In this embodiment, the executable file of the target software is obtained through the aforementioned recognition system. The executable file corresponding to the target software includes the relevant programs required for the target software to run.

[0032] Step S102: Identify the file content of the executable file to obtain at least one first feature of the executable file.

[0033] The first feature is a feature that can be directly obtained from the file content of the executable file, which is equivalent to the static feature of the executable file. The first feature can be functions required by the executable file at runtime, feature bytes in the executable file, etc.

[0034] It should be noted that by identifying the contents of the executable file, the static features of the executable file can be effectively extracted.

[0035] Step S103: Execute the executable file and extract at least one second feature of the executable file based on the execution process of the executable file.

[0036] The second feature is one that cannot be directly obtained from the executable file's content. It needs to be extracted by analyzing the execution process of the executable file, essentially representing the dynamic characteristics of the executable file. The second feature can be the behavior exhibited by the executable file during execution. Optionally, the identification system can monitor the execution process of the executable file, obtain monitoring data, and analyze the monitoring data and the execution results of the executable file to extract the second feature.

[0037] It should be noted that by executing the executable file and extracting features based on the execution process, dynamic features that cannot be shown in the content of the executable file can be effectively extracted.

[0038] Step S104: Identify the target anomaly type of the target software based on at least one first feature and at least one second feature of the executable file.

[0039] In step S104, as Figure 2 As shown, the identification system can perform similarity calculations between at least one first feature and at least one second feature of an executable file and a feature set that matches a known anomaly type, thereby identifying the target anomaly type of the target software based on the similarity result. Optionally, the identification system can also first map at least one first feature and at least one second feature of the executable file to attack strategies and attack methods, and then perform similarity calculations between the mapping result and the mapping result that matches a known anomaly type, thereby identifying the target anomaly type of the target software based on the similarity result. The target anomaly type can be no anomaly or at least one of multiple anomaly types that represent the presence of anomalies.

[0040] It should be noted that by identifying the target anomaly type of the target software based on at least one first feature and at least one second feature of the executable file, the analysis of the target software is achieved by combining the static and dynamic features of the executable file, thereby effectively improving the accuracy of software identification.

[0041] Based on the scheme defined in steps S101 to S104 above, it can be understood that in this embodiment of the invention, the method of determining the anomaly type of the target software by combining the static and dynamic features of the executable file is adopted. This involves obtaining the executable file of the target software, identifying the file content of the executable file to obtain at least one first feature of the executable file, then executing the executable file, and extracting at least one second feature of the executable file based on the execution process of the executable file. Thus, the target anomaly type of the target software is identified based on at least one first feature and at least one second feature of the executable file.

[0042] It is noteworthy that, in the above process, by identifying the contents of the executable file, the static features of the executable file are effectively extracted. By executing the executable file and extracting features based on the execution process, the dynamic features that cannot be shown in the contents of the executable file are effectively extracted. Furthermore, based on at least one first feature and at least one second feature of the executable file, the target anomaly type of the target software is identified. This achieves the analysis of the anomaly type of the target software by combining the static and dynamic features of the executable file, thereby effectively improving the accuracy of malware identification.

[0043] Therefore, the solution provided in this application achieves the goal of determining the anomaly type of the target software by combining the static and dynamic characteristics of the executable file, thereby improving the technical effect of identifying malicious software and solving the technical problem of low accuracy in identifying malicious software in related technologies.

[0044] In one optional embodiment, during the process of identifying the target anomaly type of the target software based on at least one first feature and at least one second feature of the executable file, the identification system can match each first feature with the attack strategies and attack operations in the target information based on a preset first mapping relationship to obtain a matching result for each first feature. Then, based on a preset second mapping relationship and the target information, each second feature is matched with the attack strategies and attack operations in the target information to obtain a matching result for each second feature. Thus, based on the matching results of each first feature and each second feature, the target anomaly type of the target software is identified. The target information consists of multiple attack strategies and at least one attack operation corresponding to each attack strategy.

[0045] Optionally, in this embodiment, a preset first mapping relationship is stored through a first type of knowledge base. The first mapping relationship is a mapping relationship from static features (i.e., the first feature) to the ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) matrix. The ATT&CK matrix is ​​a publicly available knowledge base of adversarial tactics and techniques based on attack vectors observed in the real world. The ATT&CK matrix represents the aforementioned target information, which consists of multiple attack strategies and at least one attack operation corresponding to each attack strategy. The attack strategy represents the strategy used by the attacker to achieve the attack objective, and the attack operation represents the operation used by the attacker to achieve the attack strategy.

[0046] Furthermore, each element in the first mapping relationship consists of a triple, for example: a triple is (UPX Packing, Defense Evasion, Obfuscated Files or Information), where UPX Packing is a static feature, Defense Evasion is the attack strategy that matches this feature in the ATT&CK matrix, and Obfuscated Files or Information is the attack operation that matches this feature in the ATT&CK matrix.

[0047] Furthermore, Figure 3 This is a flowchart of an optional software identification method according to an embodiment of the present invention, such as... Figure 3 As shown, the static feature mapping module can match each first feature with the attack strategy and attack operation in the target information based on the element content of the first mapping relationship in the first type of knowledge base, and obtain the matching result of each first feature. For each first feature, the matching result is the attack strategy and attack operation that matches the first feature (that is, the matching result is the triplet element that matches the first feature in the first mapping relationship), or the matching result is the attack strategy and attack operation that does not match the first feature.

[0048] Optionally, in this embodiment, a preset second mapping relationship is stored through a second type of knowledge base. The second mapping relationship is a mapping relationship from dynamic features (i.e., second features) to the ATT&CK matrix. Each element in the second mapping relationship consists of a triple, for example: (Query Registry, Discovery, Query Registry), where Query Registry is a dynamic feature, Discovery is the attack strategy matched by this feature in the ATT&CK matrix, and Query Registry is the attack operation matched by this feature in the ATT&CK matrix. It should be noted that in this embodiment, the first mapping relationship and the second mapping relationship use the same ATT&CK matrix.

[0049] Furthermore, such as Figure 3 As shown, the dynamic feature mapping module can match each second feature with the attack strategy and attack operation in the target information based on the element content in the second mapping relationship, and obtain the matching result of each second feature. For each second feature, the matching result is the attack strategy and attack operation that matches the second feature (that is, the matching result is the triplet element that matches the second feature in the second mapping relationship), or the matching result is the attack strategy and attack operation that does not match the first feature.

[0050] Furthermore, the identification system can identify the target anomaly type of the target software based on the matching results of each first feature and each second feature.

[0051] It should be noted that by matching each first feature and second feature with the attack strategy and attack operation in the target information, the attack methods associated with the first feature and second feature can be determined, thereby further improving the accuracy of identification.

[0052] In an optional embodiment, during the process of identifying the target anomaly type of the target software based on the matching results of each first feature and each second feature, the identification system can construct a first feature matrix based on the matching results of each first feature and each second feature, then obtain the second feature matrix matching each anomaly type among multiple anomaly types, and then calculate the similarity between the first feature matrix and each second feature matrix, thereby identifying the target anomaly type of the target software based on the similarity between the first feature matrix and each second feature matrix.

[0053] Optional, such as Figure 3As shown, the static feature extraction module can construct a first initial feature matrix based on the matching result of each first feature, so as to represent the matching result of all first features through the first initial feature matrix. The dynamic feature extraction module can construct a second initial feature matrix based on the matching result of each second feature, so as to represent the matching result of all second features through the first initial feature matrix.

[0054] Furthermore, such as Figure 3 As shown, the vector generation module can combine the first initial feature matrix with the second initial feature matrix to obtain the first feature matrix, then obtain the feature matrix of the executable file with known exception type, and determine the feature matrix matching the executable file with known exception type as the second feature matrix matching the exception type.

[0055] Furthermore, such as Figure 2 , Figure 3 As shown, the feature comparison module can calculate the similarity between the first feature matrix and each second feature matrix, and then determine the anomaly type of the second feature matrix with the highest similarity and a similarity greater than a preset threshold as the target anomaly type. Optionally, the recognition system can also select an anomaly type from the anomaly types of the second feature matrix with a similarity greater than a preset threshold by combining other information and determine it as the target anomaly type.

[0056] It should be noted that by constructing a first feature matrix based on the matching results of each first feature and second feature, and then using the method of calculating similarity to identify the target software's target anomaly type, more effective identification of target anomaly types is achieved.

[0057] In one optional embodiment, during the process of constructing the first feature matrix based on the matching results of each first feature and each second feature, the recognition system can obtain a preset zero matrix. Then, based on the matching results of each first feature, it assigns values ​​to the elements in the zero matrix to obtain a first initial feature matrix. Next, based on the matching results of each second feature, it assigns values ​​to the elements in the zero matrix to obtain a second initial feature matrix. Thus, based on the first and second initial feature matrices, the first feature matrix is ​​determined. Different columns of the zero matrix represent different attack strategies, and different rows in the same column of the zero matrix represent different attack operations corresponding to the attack strategies.

[0058] Optionally, the static feature mapping module can initialize an m-row, n-column zero matrix O1, as shown below:

[0059]

[0060] Here, the number of columns n is the same as the number of attack strategies in the target information, and the number of rows m is Max(Count_tenc_i), where Count_tenc_i refers to the number of attack operations corresponding to the i-th attack strategy. That is, the number of rows m is the same as the number of attack operations of the attack strategy with the most attack operations among all attack strategies.

[0061] Subsequently, the static feature mapping module, based on the matching result of a certain first feature, determines that the first feature matches the attack operation in the j-th row of the attack strategy in the i-th column of the zero matrix O1. If so, the element at the j-th position of the i-th column of the zero matrix O1 is set to 1. Conversely, if a first feature does not have a matching attack strategy or attack operation, no processing of the zero matrix O1 is required. Thus, by traversing the matching results of each first feature and assigning values ​​to the elements in the zero matrix O1, the first initial feature matrix is ​​obtained.

[0062] Furthermore, the dynamic feature mapping module can also initialize an m-row, n-column zero matrix O2. Then, based on the matching result of a certain second feature, if it is determined that the second feature matches the attack operation in the j-th row of the attack strategy in the i-th column of the zero matrix O2, the element at the j-th position of the i-th column of the zero matrix O2 is set to 1. Thus, by traversing the matching result of each second feature and assigning values ​​to the elements in the zero matrix O2, a second initial feature matrix is ​​obtained. The zero matrices initialized by the static feature mapping module and the dynamic feature mapping module have the same dimensions and the same row and column representation.

[0063] Optionally, during the extraction of the second feature by the dynamic feature mapping module, the module can input the executable file into a sandbox for execution, thereby acquiring the dynamic characteristics of the executable file through the sandbox. In network security, a sandbox refers to a tool used in an isolated environment to test the behavior of untrusted files or applications. A sandbox is a virtual system program that allows browsers or other programs to run in an isolated environment, so changes made during execution can be subsequently deleted. It creates a sandbox-like independent operating environment where programs running within it do not have a permanent impact on the hard drive.

[0064] Furthermore, the sample vector generation module can perform linear operations on the first initial feature matrix and the second initial feature matrix to determine the first feature matrix.

[0065] It should be noted that by assigning values ​​to the elements of the zero matrix based on the matching results of each first feature or second feature, an effective transformation of the representation of the matching results is achieved.

[0066] In an optional embodiment, during the process of determining the first feature matrix based on the first and second initial feature matrices, the identification system can obtain a first weight matrix corresponding to the first initial feature matrix and a second weight matrix corresponding to the second initial feature matrix. Then, it calculates the product of the first weight matrix and the first initial feature matrix to obtain a third initial feature matrix, and calculates the product of the second weight matrix and the second initial feature matrix to obtain a fourth initial feature matrix. Finally, it adds the third and fourth initial feature matrices to obtain the first feature matrix. The first weight matrix characterizes the degree of influence of the first initial feature matrix on identifying the target anomaly type, and the second weight matrix characterizes the degree of influence of the second initial feature matrix on identifying the target anomaly type.

[0067] Optional, such as Figure 3 As shown, the vector generation module can retrieve the first weight matrix corresponding to the first initial feature matrix from a preset storage area, and retrieve the second weight matrix corresponding to the second initial feature matrix. Then, it calculates the first feature matrix based on the following formula:

[0068] MA=αM1+βM2

[0069] Where MA represents the first characteristic matrix, α represents the first weight matrix, M1 represents the first initial characteristic matrix, αM1 represents the third initial characteristic matrix, β represents the second weight matrix, M2 represents the second initial characteristic matrix, and βM2 represents the fourth initial characteristic matrix. The first and second weight matrices are related to M1. T Same type, that is, the same as M2 T They are of the same type. And each element E in the first and second weight matrices... i ∈[0,1].

[0070] It should be noted that by combining the first initial feature matrix and the second initial feature matrix with the weight matrix, the first feature matrix is ​​calculated more accurately, thus achieving a more accurate calculation of the first feature matrix.

[0071] In an optional embodiment, in the embodiment of identifying the target anomaly type of the target software based on the similarity between the first feature matrix and each second feature matrix, the similarity between the first feature matrix and each second feature matrix can be compared with a preset threshold to obtain the comparison result of each second feature matrix. Then, based on the comparison result of each second feature matrix, it is determined whether a target feature matrix exists among the multiple second feature matrices. If no target feature matrix exists, the target anomaly type of the target software is determined to be no anomaly. If a target feature matrix exists, the anomaly type matched by the target feature matrix is ​​determined to be the target anomaly type.

[0072] Optionally, in this embodiment, the second feature matrix and the mapping relationship between the second feature matrix and the anomaly type are stored in a third type of knowledge base. For example... Figure 3 As shown, the feature comparison module can obtain the second feature matrix from the third type of knowledge base and calculate the similarity between the first feature matrix and each second feature matrix. The first feature matrix and each second feature matrix have the same dimension, and each dimension represents the same meaning. Specifically, the feature comparison module can calculate the cosine similarity between the first feature matrix and each second feature matrix based on the following formula:

[0073]

[0074] Where S represents the cosine similarity between the first feature matrix and the i-th second feature matrix, S∈[-1,1], T i Let represent the i-th second characteristic matrix.

[0075] Furthermore, such as Figure 3 As shown, the feature comparison module compares the similarity between the first feature matrix and each second feature matrix with a preset threshold to obtain the comparison result of each second feature matrix. Then, based on the comparison result of each second feature matrix, it determines whether a target feature matrix exists among the multiple second feature matrices. Thus, if the target feature matrix does not exist, the target anomaly type of the target software is determined to be no anomaly. If the target feature matrix exists, the anomaly type matched by the target feature matrix is ​​determined to be the target anomaly type.

[0076] It should be noted that by comparing the similarity between the first feature matrix and each second feature matrix with a preset threshold, the target anomaly type of the target feature matrix is ​​determined, thus avoiding the erroneous judgment of software without anomalies caused by directly determining the anomaly type of the second feature matrix with the highest similarity as the target anomaly type.

[0077] In an optional embodiment, during the process of determining whether a target feature matrix exists among the multiple second feature matrices based on the comparison results of each second feature matrix, the recognition system can determine whether at least one initial target feature matrix exists among the multiple second feature matrices based on the comparison results of each second feature matrix. If at least one initial target feature matrix exists, a target feature matrix is ​​selected from the at least one initial target feature matrix; if at least one initial target feature matrix does not exist, it is determined that no target feature matrix exists. Wherein, the similarity between the first feature matrix and at least one initial target feature matrix is ​​greater than a preset threshold, and the similarity corresponding to the target feature matrix is ​​greater than or equal to the similarity corresponding to the initial target feature matrices other than the target feature matrix.

[0078] Optionally, the feature comparison module can determine whether there are any second feature matrices among the multiple second feature matrices with a similarity greater than a preset threshold. If so, these second feature matrices with similarity greater than the preset threshold are determined as initial target feature matrices, and the initial target feature matrix with the highest similarity among the initial target feature matrices is determined as the target feature matrix. Conversely, if there are no second feature matrices among the multiple second feature matrices with a similarity greater than the preset threshold, it is determined that there is no target feature matrix among the multiple second feature matrices, that is, the target anomaly type of the target software is no anomaly.

[0079] It should be noted that by determining the initial target feature matrix with the highest similarity as the target feature matrix under the condition that it is greater than a preset threshold, the accurate determination of the target feature matrix is ​​achieved.

[0080] Therefore, this application addresses the shortcomings of traditional static rules in identifying malware types. By introducing the ATT&CK matrix to describe the static and dynamic characteristics of malware, it facilitates efficient and automated determination of malware types in scenarios with a large number of malware instances. The solution provided in this application achieves the goal of determining the anomaly type of target software by combining the static and dynamic characteristics of executable files, thereby improving the technical accuracy of malware identification and solving the technical problem of low malware identification accuracy in related technologies.

[0081] Example 2

[0082] According to an embodiment of the present invention, a software identification device is provided, wherein, Figure 4 This is a schematic diagram of an optional software identification device according to an embodiment of the present invention, such as... Figure 4 As shown, the device includes:

[0083] The acquisition module 401 is used to acquire the executable file of the target software.

[0084] The executable file corresponding to the target software includes the relevant programs required for the target software to run.

[0085] The first identification module 402 is used to identify the file content of the executable file and obtain at least one first feature of the executable file.

[0086] The first feature is a feature that can be directly obtained from the file content of the executable file, which is equivalent to the static feature of the executable file. The first feature can be functions required by the executable file at runtime, feature bytes in the executable file, etc.

[0087] It should be noted that by identifying the contents of the executable file, the static features of the executable file can be effectively extracted.

[0088] Extraction module 403 is used to execute the executable file and extract at least one second feature of the executable file based on the execution process of the executable file.

[0089] The second feature is one that cannot be directly obtained from the executable file's content. It needs to be extracted by analyzing the execution process of the executable file, essentially representing the dynamic characteristics of the executable file. The second feature can be the behavior exhibited by the executable file during execution. Optionally, the extraction module can monitor the execution process of the executable file, obtain monitoring data, and analyze the monitoring data and the execution results of the executable file to extract the second feature.

[0090] It should be noted that by executing the executable file and extracting features based on the execution process, dynamic features that cannot be shown in the content of the executable file can be effectively extracted.

[0091] The second identification module 404 is used to identify the target anomaly type of the target software based on at least one first feature and at least one second feature of the executable file.

[0092] Optionally, the second identification module can perform similarity calculation between at least one first feature and at least one second feature of the executable file and a feature set that matches a known anomaly type, thereby identifying the target anomaly type of the target software based on the similarity result. Optionally, the second identification module can also first map at least one first feature and at least one second feature of the executable file to attack strategies and attack methods, and then perform similarity calculation between the mapping result and the mapping result that matches a known anomaly type, thereby identifying the target anomaly type of the target software based on the similarity result. The target anomaly type can be no anomaly or at least one of multiple anomaly types that represent the presence of anomalies.

[0093] It should be noted that by identifying the target anomaly type of the target software based on at least one first feature and at least one second feature of the executable file, the analysis of the target software is achieved by combining the static and dynamic features of the executable file, thereby effectively improving the accuracy of software identification.

[0094] It is noteworthy that, in the above process, by identifying the contents of the executable file, the static features of the executable file are effectively extracted. By executing the executable file and extracting features based on the execution process, the dynamic features that cannot be shown in the contents of the executable file are effectively extracted. Furthermore, based on at least one first feature and at least one second feature of the executable file, the target anomaly type of the target software is identified. This achieves the analysis of the anomaly type of the target software by combining the static and dynamic features of the executable file, thereby effectively improving the accuracy of malware identification.

[0095] Therefore, the solution provided in this application achieves the goal of determining the anomaly type of the target software by combining the static and dynamic characteristics of the executable file, thereby improving the technical effect of identifying malicious software and solving the technical problem of low accuracy in identifying malicious software in related technologies.

[0096] It should be noted that the above-mentioned acquisition module 401, first identification module 402, extraction module 403 and second identification module 404 correspond to steps S101 to S104 in the above embodiments. The four modules and the corresponding steps implement the same examples and application scenarios, but are not limited to the content disclosed in the above embodiment 1.

[0097] Optionally, the first identification module further includes: a first matching unit, configured to match each first feature with the attack strategy and attack operation in the target information based on a preset first mapping relationship, to obtain a matching result for each first feature, wherein the target information consists of multiple attack strategies and at least one attack operation corresponding to each attack strategy; a second matching unit, configured to match each second feature with the attack strategy and attack operation in the target information based on a preset second mapping relationship and the target information, to obtain a matching result for each second feature; and an identification unit, configured to identify the target anomaly type of the target software based on the matching result of each first feature and the matching result of each second feature.

[0098] Optionally, in this embodiment, a preset first mapping relationship is stored through a first type of knowledge base. The first mapping relationship is a mapping relationship from static features (i.e., the first feature) to the ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) matrix. The ATT&CK matrix is ​​a publicly available knowledge base of adversarial tactics and techniques based on attack vectors observed in the real world. The ATT&CK matrix represents the aforementioned target information, which consists of multiple attack strategies and at least one attack operation corresponding to each attack strategy. The attack strategy represents the strategy used by the attacker to achieve the attack objective, and the attack operation represents the operation used by the attacker to achieve the attack strategy.

[0099] Furthermore, each element in the first mapping relationship consists of a triple, for example: a triple is (UPX Packing, Defense Evasion, Obfuscated Files or Information), where UPX Packing is a static feature, Defense Evasion is the attack strategy that matches this feature in the ATT&CK matrix, and Obfuscated Files or Information is the attack operation that matches this feature in the ATT&CK matrix.

[0100] Furthermore, such as Figure 2 As shown, the first matching unit can match each first feature with the attack strategy and attack operation in the target information based on the element content of the first mapping relationship in the first type of knowledge base, and obtain the matching result of each first feature. For each first feature, the matching result is the attack strategy and attack operation matched with the first feature (that is, the matching result is the triplet element in the first mapping relationship that matches the first feature), or the matching result is the attack strategy and attack operation that does not match the first feature.

[0101] Optionally, in this embodiment, a preset second mapping relationship is stored through a second type of knowledge base. The second mapping relationship is a mapping relationship from dynamic features (i.e., second features) to the ATT&CK matrix. Each element in the second mapping relationship consists of a triple, for example: (Query Registry, Discovery, Query Registry), where Query Registry is a dynamic feature, Discovery is the attack strategy matched by this feature in the ATT&CK matrix, and Query Registry is the attack operation matched by this feature in the ATT&CK matrix. It should be noted that in this embodiment, the first mapping relationship and the second mapping relationship use the same ATT&CK matrix.

[0102] Furthermore, such as Figure 2 As shown, the second matching unitization can match each second feature with the attack strategy and attack operation in the target information based on the element content in the second mapping relationship, to obtain the matching result of each second feature. For each second feature, the matching result is the attack strategy and attack operation that match the second feature (that is, the matching result is the triplet element that matches the second feature in the second mapping relationship), or the matching result is the attack strategy and attack operation that does not match the first feature.

[0103] Furthermore, the identification unit can identify the target anomaly type of the target software based on the matching results of each first feature and each second feature.

[0104] It should be noted that by matching each first feature and second feature with the attack strategy and attack operation in the target information, the attack methods associated with the first feature and second feature can be determined, thereby further improving the accuracy of identification.

[0105] Optionally, the identification unit further includes: a construction submodule for constructing a first feature matrix based on the matching results of each first feature and each second feature; an acquisition submodule for acquiring the second feature matrix matching each of the multiple anomaly types; a calculation submodule for calculating the similarity between the first feature matrix and each second feature matrix; and an identification submodule for identifying the target anomaly type of the target software based on the similarity between the first feature matrix and each second feature matrix.

[0106] Optional, such as Figure 3As shown, the construction submodule can construct a first initial feature matrix based on the matching result of each first feature, so as to represent the matching result of all first features through the first initial feature matrix. The construction submodule can also construct a second initial feature matrix based on the matching result of each second feature, so as to represent the matching result of all second features through the first initial feature matrix.

[0107] Furthermore, such as Figure 3 As shown, the construction submodule can combine the first initial feature matrix with the second initial feature matrix to obtain the first feature matrix. Then, the acquisition submodule obtains the feature matrix of executable files with known exception types and determines the feature matrix that matches the known exception type as the second feature matrix that matches that exception type.

[0108] Furthermore, such as Figure 3 As shown, the calculation submodule can calculate the similarity between the first feature matrix and each second feature matrix. Then, the identification submodule determines the anomaly type of the second feature matrix with the highest similarity and a similarity greater than a preset threshold as the target anomaly type. Optionally, the identification submodule can also select an anomaly type from the anomaly types of the second feature matrices with a similarity greater than a preset threshold by combining other information and determine it as the target anomaly type.

[0109] It should be noted that by constructing a first feature matrix based on the matching results of each first feature and second feature, and then using the method of calculating similarity to identify the target software's target anomaly type, more effective identification of target anomaly types is achieved.

[0110] Optionally, the construction submodule further includes: a first acquisition subunit, used to acquire a preset zero matrix, wherein different columns of the zero matrix represent different attack strategies, and different rows in the same column of the zero matrix represent different attack operations corresponding to the attack strategies; a first processing subunit, used to assign values ​​to the elements in the zero matrix based on the matching result of each first feature to obtain a first initial feature matrix; a second processing subunit, used to assign values ​​to the elements in the zero matrix based on the matching result of each second feature to obtain a second initial feature matrix; and a first determination subunit, used to determine the first feature matrix based on the first initial feature matrix and the second initial feature matrix.

[0111] Optionally, the first sub-unit can be initialized with an m-row, n-column zero matrix O1, as shown below:

[0112]

[0113] Here, the number of columns n is the same as the number of attack strategies in the target information, and the number of rows m is Max(Count_tenc_i), where Count_tenc_i refers to the number of attack operations corresponding to the i-th attack strategy. That is, the number of rows m is the same as the number of attack operations of the attack strategy with the most attack operations among all attack strategies.

[0114] Subsequently, the first processing subunit, based on the matching result of a certain first feature, determines that the first feature matches the attack operation in the j-th row of the attack strategy in the i-th column of the zero matrix O1. If so, the element at the j-th position of the i-th column of the zero matrix O1 is set to 1. Conversely, if a first feature does not have a matching attack strategy or attack operation, no processing is required on the zero matrix O1. Thus, by traversing the matching results of each first feature and assigning values ​​to the elements in the zero matrix O1, the first initial feature matrix is ​​obtained.

[0115] Furthermore, the first acquisition subunit can also initialize an m-row, n-column zero matrix O2. Then, the second processing subunit, based on the matching result of a certain second feature, determines that the second feature matches the attack operation in the j-th row of the attack strategy in the i-th column of the zero matrix O2. In this case, the element at the j-th position of the i-th column of the zero matrix O2 is set to 1. Thus, by traversing the matching result of each second feature and assigning values ​​to the elements in the zero matrix O2, a second initial feature matrix is ​​obtained. The zero matrices initialized by the first acquisition subunit have the same dimensions and the same row and column representation.

[0116] Optionally, during the extraction of the second feature, the executable file can be executed in a sandbox to obtain its dynamic characteristics. In network security, a sandbox refers to a tool used in an isolated environment to test the behavior of untrusted files or applications. A sandbox is a virtual system program that allows browsers or other programs to run in an isolated environment, so changes made during execution can be subsequently deleted. It creates a sandbox-like isolated operating environment where programs running within it do not have a permanent impact on the hard drive.

[0117] Furthermore, the first determining subunit can perform linear operations on the first initial feature matrix and the second initial feature matrix to determine the first feature matrix.

[0118] It should be noted that by assigning values ​​to the elements of the zero matrix based on the matching results of each first feature or second feature, an effective transformation of the representation of the matching results is achieved.

[0119] Optionally, the first determining subunit further includes: a second obtaining subunit, used to obtain a first weight matrix corresponding to the first initial feature matrix and a second weight matrix corresponding to the second initial feature matrix, wherein the first weight matrix characterizes the degree of influence of the first initial feature matrix on identifying the target anomaly type, and the second weight matrix characterizes the degree of influence of the second initial feature matrix on identifying the target anomaly type; a first calculation subunit, used to calculate the product of the first weight matrix and the first initial feature matrix to obtain a third initial feature matrix; a second calculation subunit, used to calculate the product of the second weight matrix and the second initial feature matrix to obtain a fourth initial feature matrix; and a third calculation subunit, used to add the third initial feature matrix and the fourth initial feature matrix to obtain the first feature matrix.

[0120] Optional, such as Figure 3 As shown, the first determining subunit can obtain a first weight matrix corresponding to the first initial feature matrix from a preset storage area, and obtain a second weight matrix corresponding to the second initial feature matrix. Then, the first feature matrix is ​​calculated based on the following formula:

[0121] MA=αM1+βM2

[0122] Where MA represents the first characteristic matrix, α represents the first weight matrix, M1 represents the first initial characteristic matrix, αM1 represents the third initial characteristic matrix, β represents the second weight matrix, M2 represents the second initial characteristic matrix, and βM2 represents the fourth initial characteristic matrix. The first and second weight matrices are related to M1. T Same type, that is, the same as M2 T They are of the same type. And each element E in the first and second weight matrices... i ∈[0,1].

[0123] It should be noted that by combining the first initial feature matrix and the second initial feature matrix with the weight matrix, the first feature matrix is ​​calculated more accurately, thus achieving a more accurate calculation of the first feature matrix.

[0124] Optionally, the identification submodule further includes: a first comparison subunit, used to compare the similarity between the first feature matrix and each second feature matrix with a preset threshold to obtain a comparison result for each second feature matrix; a second determination subunit, used to determine whether a target feature matrix exists among the multiple second feature matrices based on the comparison result of each second feature matrix; a third determination subunit, used to determine that the target anomaly type of the target software is no anomaly if no target feature matrix exists; and a fourth determination subunit, used to determine that the anomaly type matched by the target feature matrix is ​​the target anomaly type if a target feature matrix exists.

[0125] Optionally, in this embodiment, the second feature matrix and the mapping relationship between the second feature matrix and the anomaly type are stored in a third type of knowledge base. For example... Figure 3 As shown, the recognition submodule can obtain the second feature matrix from the third type of knowledge base and calculate the similarity between the first feature matrix and each second feature matrix, where the first feature matrix and each second feature matrix have the same dimension, and each dimension represents the same meaning. Specifically, the feature comparison module can calculate the cosine similarity between the first feature matrix and each second feature matrix based on the following formula:

[0126]

[0127] Where S represents the cosine similarity between the first feature matrix and the i-th second feature matrix, S∈[-1,1], T i Let represent the i-th second characteristic matrix.

[0128] Furthermore, such as Figure 3 As shown, the identification submodule compares the similarity between the first feature matrix and each second feature matrix with a preset threshold to obtain the comparison result of each second feature matrix. Then, based on the comparison result of each second feature matrix, it determines whether a target feature matrix exists among the multiple second feature matrices. Thus, if no target feature matrix exists, the target anomaly type of the target software is determined to be no anomaly. If a target feature matrix exists, the anomaly type matched by the target feature matrix is ​​determined to be the target anomaly type.

[0129] It should be noted that by comparing the similarity between the first feature matrix and each second feature matrix with a preset threshold, the target anomaly type of the target feature matrix is ​​determined, thus avoiding the erroneous judgment of software without anomalies caused by directly determining the anomaly type of the second feature matrix with the highest similarity as the target anomaly type.

[0130] Optionally, the second determining subunit further includes: a second comparison subunit, used to determine whether there is at least one initial target feature matrix among the multiple second feature matrices based on the comparison result of each second feature matrix, wherein the similarity between the first feature matrix and at least one initial target feature matrix is ​​greater than a preset threshold; a filtering subunit, used to filter out a target feature matrix from the at least one initial target feature matrix if there is at least one initial target feature matrix, wherein the similarity corresponding to the target feature matrix is ​​greater than or equal to the similarity corresponding to the initial target feature matrix other than the target feature matrix; and a fifth determining subunit, used to determine that there is no target feature matrix if there is no at least one initial target feature matrix.

[0131] Optionally, the second determining subunit can determine whether there are any second feature matrices among the multiple second feature matrices with a similarity greater than a preset threshold. If so, these second feature matrices with similarity greater than the preset threshold are determined as initial target feature matrices, and the initial target feature matrix with the highest similarity among the initial target feature matrices is determined as the target feature matrix. Conversely, if there are no second feature matrices among the multiple second feature matrices with a similarity greater than the preset threshold, it is determined that there is no target feature matrix among the multiple second feature matrices, that is, the target anomaly type of the target software is no anomaly.

[0132] It should be noted that by determining the initial target feature matrix with the highest similarity as the target feature matrix under the condition that it is greater than a preset threshold, the accurate determination of the target feature matrix is ​​achieved.

[0133] Therefore, this application addresses the shortcomings of traditional static rules in identifying malware types. By introducing the ATT&CK matrix to describe the static and dynamic characteristics of malware, it facilitates efficient and automated determination of malware types in scenarios with a large number of malware instances. The solution provided in this application achieves the goal of determining the anomaly type of target software by combining the static and dynamic characteristics of executable files, thereby improving the technical accuracy of malware identification and solving the technical problem of low malware identification accuracy in related technologies.

[0134] Example 3

[0135] According to another aspect of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored in the computer-readable storage medium, and the computer program is configured to execute the above-described software identification method at runtime.

[0136] Example 4

[0137] According to another aspect of the present invention, an electronic device is also provided, wherein, Figure 5 This is a schematic diagram of an optional electronic device according to an embodiment of the present invention, such as... Figure 5 As shown, the electronic device includes one or more processors; and a memory for storing one or more programs, which, when executed by one or more processors, enable the one or more processors to run the programs, wherein the programs are configured to execute the aforementioned software identification method during runtime.

[0138] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0139] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0140] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some interfaces; indirect couplings or communication connections between units or modules may be electrical or other forms.

[0141] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0142] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0143] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0144] The above are merely preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A software recognition method, characterized in that, include: Obtain the executable file of the target software; The file content of the executable file is identified to obtain at least one first feature of the executable file; Execute the executable file, and extract at least one second feature of the executable file based on the execution process of the executable file; Based on at least one first feature and at least one second feature of the executable file, identify the target anomaly type of the target software; Based on at least one first feature and at least one second feature of the executable file, the target anomaly type of the target software is identified, including: Based on a preset first mapping relationship, each first feature is matched with the attack strategy and attack operation in the target information to obtain the matching result of each first feature. The target information consists of multiple attack strategies and at least one attack operation corresponding to each attack strategy. Based on the preset second mapping relationship and the target information, each second feature is matched with the attack strategy and attack operation in the target information to obtain the matching result of each second feature; Based on the matching results of each first feature and the matching results of each second feature, the target anomaly type of the target software is identified; Based on the matching results of each first feature and each second feature, the target anomaly type of the target software is identified, including: Based on the matching results of each first feature and each second feature, a first feature matrix is ​​constructed; Obtain the second feature matrix matching each of the multiple exception types; Calculate the similarity between the first feature matrix and each of the second feature matrices; Based on the similarity between the first feature matrix and each of the second feature matrices, the target anomaly type of the target software is identified; Based on the matching results of each first feature and each second feature, a first feature matrix is ​​constructed, including: Obtain a preset zero matrix, wherein different columns of the zero matrix represent different attack strategies, and different rows in the same column of the zero matrix represent different attack operations corresponding to the attack strategies; Based on the matching result of each first feature, the elements in the zero matrix are assigned values ​​to obtain the first initial feature matrix; Based on the matching result of each second feature, the elements in the zero matrix are assigned values ​​to obtain the second initial feature matrix; The first feature matrix is ​​determined based on the first initial feature matrix and the second initial feature matrix.

2. The method according to claim 1, characterized in that, Determining the first feature matrix based on the first initial feature matrix and the second initial feature matrix includes: Obtain a first weight matrix corresponding to the first initial feature matrix, and obtain a second weight matrix corresponding to the second initial feature matrix, wherein the first weight matrix characterizes the degree of influence of the first initial feature matrix on identifying the target anomaly type, and the second weight matrix characterizes the degree of influence of the second initial feature matrix on identifying the target anomaly type; Calculate the product of the first weight matrix and the first initial feature matrix to obtain the third initial feature matrix; Calculate the product of the second weight matrix and the second initial feature matrix to obtain the fourth initial feature matrix; The first feature matrix is ​​obtained by adding the third initial feature matrix and the fourth initial feature matrix.

3. The method according to claim 1, characterized in that, Based on the similarity between the first feature matrix and each of the second feature matrices, the target anomaly type of the target software is identified, including: The similarity between the first feature matrix and each of the second feature matrices is compared with a preset threshold to obtain the comparison result of each second feature matrix; Based on the comparison results of each second feature matrix, it is determined whether the target feature matrix exists among the multiple second feature matrices; If the target feature matrix does not exist, then the target software's target anomaly type is determined to be no anomaly. If the target feature matrix exists, then the anomaly type matched by the target feature matrix is ​​determined to be the target anomaly type.

4. The method according to claim 3, characterized in that, Based on the comparison results of each second feature matrix, determining whether a target feature matrix exists among the multiple second feature matrices includes: Based on the comparison results of each second feature matrix, it is determined whether there is at least one initial target feature matrix among the plurality of second feature matrices, wherein the similarity between the first feature matrix and the at least one initial target feature matrix is ​​greater than a preset threshold; If at least one initial target feature matrix exists, then the target feature matrix is ​​selected from the at least one initial target feature matrix, wherein the similarity corresponding to the target feature matrix is ​​greater than or equal to the similarity corresponding to the initial target feature matrix other than the target feature matrix; If the at least one initial target feature matrix does not exist, then it is determined that the target feature matrix does not exist.

5. A software identification device, characterized in that, include: The acquisition module is used to acquire the executable file of the target software; The first identification module is used to identify the file content of the executable file and obtain at least one first feature of the executable file; An extraction module is used to execute the executable file and extract at least one second feature of the executable file based on the execution process of the executable file; The second identification module is used to identify the target anomaly type of the target software based on at least one first feature and at least one second feature of the executable file. The first identification module further includes: a first matching unit, used to match each first feature with the attack strategy and attack operation in the target information based on a preset first mapping relationship, to obtain a matching result for each first feature, wherein the target information consists of multiple attack strategies and at least one attack operation corresponding to each attack strategy; a second matching unit, used to match each second feature with the attack strategy and attack operation in the target information based on a preset second mapping relationship and the target information, to obtain a matching result for each second feature; and an identification unit, used to identify the target anomaly type of the target software based on the matching result of each first feature and the matching result of each second feature. The identification unit further includes: a construction submodule for constructing a first feature matrix based on the matching results of each first feature and each second feature; an acquisition submodule for acquiring the second feature matrix matching each of the multiple anomaly types; a calculation submodule for calculating the similarity between the first feature matrix and each second feature matrix; and an identification submodule for identifying the target anomaly type of the target software based on the similarity between the first feature matrix and each second feature matrix. The construction submodule further includes: a first acquisition subunit, used to acquire a preset zero matrix, wherein different columns of the zero matrix represent different attack strategies, and different rows in the same column of the zero matrix represent different attack operations corresponding to the attack strategies; a first processing subunit, used to assign values ​​to the elements in the zero matrix based on the matching result of each first feature to obtain a first initial feature matrix; a second processing subunit, used to assign values ​​to the elements in the zero matrix based on the matching result of each second feature to obtain a second initial feature matrix; and a first determination subunit, used to determine the first feature matrix based on the first initial feature matrix and the second initial feature matrix.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program is configured to execute the software identification method according to any one of claims 1 to 4 when it is run.

7. An electronic device, characterized in that, The electronic device includes one or more processors; A memory for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to be configured to run the programs, wherein the programs are configured to execute the software identification method according to any one of claims 1 to 4 at runtime.

Images