Open source software version identification method and device, electronic equipment and storage medium

Abstract

The application provides a version identification method of open source software, an electronic device and a storage medium. The method comprises the following steps: obtaining a target binary file of an open source software to be identified; extracting a target version feature of the open source software to be identified according to the target binary file; performing coarse screening on the target version feature to obtain a candidate version set; comparing a candidate version in the candidate version set with the target binary file to obtain a target version of the open source software to be identified. The application can identify the fine-grained change difference between adjacent versions while effectively avoiding the influence of redundant noise features on version difference identification by comparing the version difference features. Moreover, the coarse screening is performed first and then the careful comparison is performed, so that the accuracy and efficiency of identification are considered.

Description

Technical Field

[0001] This invention relates to the field of software development technology, and in particular to a method for identifying open-source software versions, an electronic device, and a storage medium. Background Technology

[0002] To reduce development costs and improve software iteration efficiency, developers of commercial software often use existing open-source software (OSS) to implement related functions. However, while OSS offers development convenience, it also introduces many vulnerabilities into commercial software, inadvertently exposing users to attackers. Users, lacking the source code of commercial software, cannot confirm whether their software is affected by indirectly introduced OSS vulnerabilities. Therefore, checking the OSS version in software can help users determine if they are affected by known vulnerabilities, allowing for early patching and preventing exploitation by attackers, thus avoiding financial losses.

[0003] In existing technologies, recognition software such as VES, OSSPolice, and LibDB are generally used to detect OSS versions. VES does not require dynamic software execution, enabling large-scale static version analysis, but it heavily relies on version strings to identify versions. In actual development, OSS may not contain version strings or version printing functions, causing this method to fail. OSSPolice also relies on version-related strings to distinguish versions, making it unable to handle OSS versions lacking version strings. Furthermore, due to the reusability of OSS versions, strings may contain other version strings, causing confusion in the identification of the true OSS version and reducing the accuracy of version recognition. LibDB, on the other hand, introduces too many redundant noise features when identifying versions, causing fine-grained version changes to be masked and unable to be distinguished.

[0004] In conclusion, existing technologies still cannot accurately and effectively identify defects in open-source software versions. Summary of the Invention

[0005] This invention provides a method, electronic device, and storage medium for identifying open-source software versions, in order to address the shortcomings of existing technologies that cannot accurately identify open-source software versions.

[0006] This invention provides a method for identifying the version of open-source software, comprising:

[0007] Obtain the target binary file of the open-source software to be identified;

[0008] Based on the target binary file, extract the target version features of the open-source software to be identified;

[0009] Based on the target version characteristics, a coarse version screening is performed to obtain a candidate version set;

[0010] The candidate versions in the candidate version set are compared with the target binary file to obtain the target version of the open source software to be identified.

[0011] According to the present invention, a method for identifying open-source software versions, wherein the step of performing coarse version screening based on the target version characteristics to obtain a candidate version set includes:

[0012] By matching open-source software code libraries with the target version characteristics, a set of versions containing the target version characteristics is determined.

[0013] Based on the target version characteristics, the version set is filtered to obtain a first candidate version set;

[0014] Based on the open-source software codebase, a version spacing table between various versions of the open-source software is obtained;

[0015] Based on the target version characteristics, the target feature distance of the open-source software to be identified is obtained;

[0016] Based on the target feature distance, a second candidate version set is obtained;

[0017] A candidate version set is obtained based on the first candidate version set and the second candidate version set.

[0018] According to a method for identifying open-source software versions provided by the present invention, the step of matching the open-source software codebase with the target version features to determine a set of versions containing the target version features includes:

[0019] Parse the version-sensitive functions in the open-source software code library;

[0020] Based on the version sensitivity function contained in the target version feature, determine the set of versions containing the target version feature.

[0021] According to the method for identifying open-source software versions provided by the present invention, the step of filtering the version set according to the target version characteristics to obtain a first candidate version set includes:

[0022] Construct a mapping relationship between the target version features and the version set;

[0023] Based on the target version characteristics and the mapping relationship, the version set is filtered to obtain a first candidate version set.

[0024] According to a method for identifying open-source software versions provided by the present invention, obtaining a version spacing table between various versions of the open-source software based on the open-source software code repository includes:

[0025] Obtain feature information for each version from the aforementioned open-source software code repository;

[0026] Based on the aforementioned feature information, obtain the feature distance between any two versions;

[0027] Based on the aforementioned feature distances, a version spacing table is obtained.

[0028] According to a method for identifying open-source software versions provided by the present invention, the feature distance includes a first feature distance and a second feature distance, and the step of obtaining the target feature distance of the open-source software to be identified based on the target version features includes:

[0029] Based on the target version characteristics, the distance from the target binary file to the first preset version is calculated to obtain the first feature distance;

[0030] Based on the target version characteristics, the distance from the target binary file to the second preset version is calculated to obtain the second feature distance;

[0031] The feature distance of the open-source software to be identified is obtained based on the first feature distance and the second feature distance.

[0032] According to a method for identifying open-source software versions provided by the present invention, the step of comparing candidate versions in the candidate version set with the target binary file to obtain the target version of the open-source software to be identified includes:

[0033] The candidate versions are compared with the target binary file to obtain the feature distance from each candidate version to the target binary file;

[0034] Sort the candidate versions according to their feature distances to the target binary file;

[0035] The candidate version with the smallest feature distance is selected as the target version of the open-source software to be identified.

[0036] This invention also provides a version identification device for open-source software, comprising:

[0037] The file acquisition unit is used to acquire the target binary file of the open-source software to be identified.

[0038] The feature extraction unit is used to extract the target version features of the open-source software to be identified based on the target binary file.

[0039] The version coarse selection unit is used to perform coarse version screening based on the target version characteristics to obtain a candidate version set;

[0040] The version selection unit is used to compare the candidate versions in the candidate version set with the target binary file to obtain the target version of the open source software to be identified.

[0041] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the version identification method of any of the above-described open-source software.

[0042] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the version identification method of open-source software as described above.

[0043] This invention provides a method, electronic device, and storage medium for identifying open-source software versions. The method involves: acquiring a target binary file of the open-source software to be identified; extracting target version features from the target binary file; performing a coarse version screening based on the target version features to obtain a candidate version set; and comparing the candidate versions in the candidate version set with the target binary file to obtain the target version of the open-source software. This invention, by comparing version difference features, effectively avoids the influence of redundant noise features on version difference identification while identifying fine-grained changes between adjacent versions. Furthermore, by employing a method of first performing coarse screening and then careful comparison, it balances accuracy and efficiency in identification. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0045] Figure 1 This is one of the flowcharts illustrating the open-source software version identification method provided by this invention;

[0046] Figure 2 This is the second flowchart illustrating the open-source software version identification method provided by this invention;

[0047] Figure 3 This is the third flowchart illustrating the open-source software version identification method provided by this invention;

[0048] Figure 4 This is the fourth flowchart illustrating the open-source software version identification method provided by this invention;

[0049] Figure 5 This is a schematic diagram of the open-source software version identification device provided by the present invention;

[0050] Figure 6 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0052] To prevent users from being affected by vulnerabilities in open-source software, it is necessary to identify the OSS version of open-source software to patch vulnerabilities and prevent exploitation by attackers. Existing OSS version identification methods can be divided into dynamic and static methods. Dynamic methods simulate the software's runtime environment, directly running the software to output or view the corresponding version information. However, this method heavily relies on the runtime environment and can only be executed on a single executable file, failing to obtain the OSS version existing in the software as a dynamic link library, and thus cannot be scaled up for large-scale software data. Static methods identify the OSS version by recognizing version-specific information (such as version strings) or version-specific characteristics within the software. However, existing identification software is imperfect and suffers from various problems.

[0053] To address the shortcomings of existing technologies in accurately identifying open-source software versions, this invention proposes a method for identifying open-source software versions. This method, as follows: Figure 1 As shown, including but not limited to the following steps:

[0054] Step 110: Obtain the target binary file of the open-source software to be identified.

[0055] In step 110, the target binary file refers to a binary file storing data of the open-source software to be identified. Specifically, in this embodiment, there are no restrictions on the acquisition channel of the target binary file. The target binary file can be obtained directly from the open-source software to be identified by the identification software, or it can be obtained from other electronic devices and computer systems through data transmission interfaces or remote communication transmission. The binary file is a file directly based on binary representation.

[0056] Step 120: Extract the target version features of the open-source software to be identified based on the target binary file.

[0057] In step 120, to compare the version difference features of open-source software, feature extraction needs to be performed on the binary files. Specifically, the binary files can undergo secondary extraction: software-level feature extraction and version-level feature extraction. For software-level feature extraction, a binary function semantic feature AST and software-level features are generated and stored in the database, where the software-level features include strings and function names. For version-level extraction, the AST is pre-encoded to accelerate function matching efficiency, while version-level features are extracted. Figure 2 As shown, taking versions 1 and 3 as examples, i.e., V1 and V3, we first find all adjacent versions contained in this version pair. Each version contains a set of VSFs (Version Sensitive Functions). We then take the union of these VSF sets as all the modification functions between V1 and V3, i.e., F. v1 F V2 F V3 ...F Vn , use F Vi This represents all functions in version Vi. For each VSF, determine its modification type between versions according to the following rules: Addition (A): VSF does not exist in V1, but exists in V3; Deletion (D): VSF exists in V1, but not in V3; Update (U): VSF exists in both V1 and V3; Other (O): VSF exists in neither V1 nor V3. After determining the modification type of each VSF, the version differences between each version can be clearly understood, for example: VDiff V1→V2 VDiff represents the version differences between version 1 and version 2. V2→V3 VDiff indicates the version differences between version 2 and version 3. V1→V3 VDiff Vn-1→Vn And so on. Based on the obtained VSF set, the VSFs involved in the changes from version V1 to version Vn include Fa, Fb, Fc, Fd, Fe...Fi, Fj, and Fk. For version V1, F... V1 Including Fa and Fc, for version V3, F V3 This includes Fb, Fc, and Fe. Therefore, VDiff can be obtained. V1→V3 To add (A): Fb, Fe; to delete (D): Fa; to update (U): Fc; and for other (O): Fd. Then, the generated function-level and version-level features are stored in their respective databases.

[0058] Step 130: Perform coarse screening of versions based on the target version characteristics to obtain a candidate version set.

[0059] To balance accuracy and efficiency, this invention employs a method of initial coarse screening followed by detailed comparison for version identification. Therefore, in step 130, the version features obtained in step 120 are subjected to coarse screening to obtain a set of versions selected in one step, which is then used as a candidate version set. Coarse screening can be achieved by constructing a mapping relationship between version features and version sets, and then taking the intersection of all feature-mapped version sets as the candidate version set; alternatively, it can be achieved by calculating the feature distance between each version and determining the candidate version set based on the feature distance. Specifically, this embodiment does not limit the number of coarse screening methods; coarse screening can be performed using one or all of the above methods, and the intersection of the sets obtained by each method is used as the target candidate version set.

[0060] Step 140: Compare the candidate versions in the candidate version set with the target binary file to obtain the target version of the open source software to be identified.

[0061] In step 140, after obtaining the candidate version set, the version of the open-source software to be identified needs to be compared with each version in the candidate version set. Specifically, the feature distance between the version of the open-source software to be identified and each version in the candidate version set can be calculated, and then the candidate version with the smallest feature distance can be selected as the target version of the open-source software to be identified. Optionally, the VSFs contained in each version of the open-source software to be identified can be compared one by one to determine which version in the candidate version set has the highest VSF overlap, and the version with the highest overlap can be selected as the target version of the open-source software to be identified.

[0062] As a further optional embodiment, the step of performing coarse version screening based on the target version characteristics to obtain a candidate version set includes:

[0063] By matching open-source software code libraries with the target version characteristics, a set of versions containing the target version characteristics is determined.

[0064] Based on the target version characteristics, the version set is filtered to obtain a first candidate version set;

[0065] Based on the open-source software codebase, a version spacing table between various versions of the open-source software is obtained;

[0066] Based on the target version characteristics, the target feature distance of the open-source software to be identified is obtained;

[0067] Based on the target feature distance, a second candidate version set is obtained;

[0068] A candidate version set is obtained based on the first candidate version set and the second candidate version set.

[0069] In this embodiment, to ensure the accuracy of the coarse screening, a combination of two screening methods is used. Specifically, the candidate version list is quickly screened using software-level features. That is, for the software-level features in the target binary, the intersection of all feature-mapped version sets is taken as the first candidate version set. For example, if the target version contains features a and b, and feature a exists in versions 1 and 2, and feature b exists in versions 2 and 3, then the intersection of the two sets, i.e., version 2, is taken as the first candidate version set. Next, the version region where the target version is located is quickly located using version spacing. Version spacing quick location is a method in candidate version identification for calculating the spacing between two given versions and the target binary, used to calculate the spacing between the two given versions and the target version. The target version can be located by calculating the distance between two versions and the target version. For example, the distance from version 3 to version 1 is 2, and the distance from version 5 to version 10 is 5. If the distance from the target version to version 1 is identified as 1.8, and the distance from the target version to version 10 is identified as 4.7, then the target version can be located in versions 3, 4, and 5, and versions 3, 4, and 5 can be used as the second candidate version set. Through this embodiment, even when faced with a large amount of version data, identification can be performed quickly.

[0070] As a further optional embodiment, the step of matching open-source software code libraries with the target version characteristics to determine the set of versions containing the target version characteristics includes:

[0071] Parse the version-sensitive functions in the open-source software code library;

[0072] Based on the version sensitivity function contained in the target version feature, determine the set of versions containing the target version feature.

[0073] In this embodiment, to determine version difference characteristics, it is necessary to first collect open-source code repositories and corresponding version binary files of the software. During the preprocessing stage, the version-sensitive function (VSF) set of adjacent versions of the target version in the code repository is parsed, and the version binary files are decompiled to extract binary function features. In the first stage of feature extraction, binary function semantic features (AST) and software-level features (strings and function names) are generated and stored in a database. In the second stage of feature extraction, the AST is pre-encoded to accelerate function matching efficiency, and version-level features are extracted. Through version feature extraction, the version features contained in each version can be clearly identified. Subsequently, based on the features included in the target version, a comparison is made with the open-source code repository to determine the set of versions containing the target version features, i.e., which versions contain the target features.

[0074] As a further optional embodiment, the step of filtering the version set according to the target version characteristics to obtain a first candidate version set includes:

[0075] Construct a mapping relationship between the target version features and the version set;

[0076] Based on the target version characteristics and the mapping relationship, the version set is filtered to obtain a first candidate version set.

[0077] In this embodiment, after clarifying the version features included in each version, a mapping relationship between the target version features and the version set can be constructed. Then, for the software-level features in the target version, the intersection of all feature-mapped version sets is taken as the candidate version. In the candidate version identification stage, firstly, all relevant features of the corresponding OSS candidate versions are extracted from the feature databases at the version level and function level, respectively, and then candidate version identification is performed. For example, as follows... Figure 3 As shown, the target version contains features 1, features 2 and features 3. After comparison, versions 2 to 5 contain features 1, versions 3 to 9 contain features 2, and versions 1 to 7 contain features 3. Taking the intersection of these three sets yields versions 3 to 5, which are then used as the first candidate version set.

[0078] As a further optional embodiment, obtaining the version spacing table between various versions of the open-source software based on the open-source software code repository includes:

[0079] Obtain feature information for each version from the aforementioned open-source software code repository;

[0080] Based on the aforementioned feature information, obtain the feature distance between any two versions;

[0081] Based on the aforementioned feature distances, a version spacing table is obtained.

[0082] In this embodiment, by obtaining the feature information of each version from the open-source software code repository, the version differences between any pair of versions can be clearly identified. The differences between version pairs can be described using rules (addition, deletion, update, and others) as described in the above embodiments. Different version distances can be set for different differences. For example, the feature distance for adding function 'a' can be set to 1, and the feature distance for deleting function 'a' can be set to -1. That is, when version 1 to version 2 only adds function 'a', the distance between version 1 and version 2 is 1; similarly, when version 1 to version 2 only deletes function 'a', the distance between version 1 and version 2 is -1. Other rules are similar and will not be elaborated further.

[0083] As a further optional embodiment, the feature distance includes a first feature distance and a second feature distance, and obtaining the target feature distance of the open-source software to be identified based on the target version features includes:

[0084] Based on the target version characteristics, the distance from the target binary file to the first preset version is calculated to obtain the first feature distance;

[0085] Based on the target version characteristics, the distance from the target binary file to the second preset version is calculated to obtain the second feature distance;

[0086] The feature distance of the open-source software to be identified is obtained based on the first feature distance and the second feature distance.

[0087] Version comparison is a method for calculating the distance between two given versions and the target version in candidate version identification. The initial version can be used as the first preset version, and the final version as the second preset version. By calculating the feature distance from the target version to the initial version (i.e., the first feature distance) and the feature distance from the target version to the final version (i.e., the second feature distance), the feature distance of the open source software to be identified can be obtained based on the two feature distances.

[0088] like Figure 4 As shown, for two given versions Vi and Vj (Vi is the old version and Vj is the new version) and the target version B, the distance between the two versions and the target binary is calculated according to the following steps.

[0089] First, initialize the distance VG from B to Vi and Vj. B→Vi ←0, VG B→Vj ←0

[0090] Then, extract the version difference function information from Vi to Vj, including all add (A), delete (D), and update (U) functions, denoted as S respectively. A S D S U .

[0091] For S A Any function in the Vj version, obtain the binary function A from the binary. j Search for the function with the highest similarity in the target binary. and similarity If the similarity exceeds the threshold, then VG B→Vi ←VG B→Vi +1.

[0092] For S D Any function in the Vi version, obtain the binary function D from the Vi version binary. i Search for the function with the highest similarity in the target binary. and similarity If the similarity exceeds the threshold, then VG B→Vj ←VG B→Vj +1.

[0093] For S U Any function in the Vi version, obtain the binary function U from the Vi version binary. i Obtain the binary function U from the Vj version binary. j Retrieve the function with the highest similarity in the target binary. Get similarity and If the similarity exceeds the threshold, then

[0094] Finally, output the final VG. B→Vi VG B→vj That is, the distance between the target binary and version Vi, Vj. The size of the distance determines which version is more likely to be the target version.

[0095] Furthermore, a spacing threshold can be set to filter out all versions exceeding the threshold, thus obtaining a candidate version set. Even further, the original initial and final versions in the candidate version set are replaced with the original initial and final versions, and the version spacing calculation and filtering continue until the number of versions in the candidate version set no longer changes.

[0096] As a further optional embodiment, the step of comparing the candidate versions in the candidate version set with the target binary file to obtain the target version of the open-source software to be identified includes:

[0097] The candidate versions are compared with the target binary file to obtain the feature distance from each candidate version to the target binary file;

[0098] Sort the candidate versions according to their feature distances to the target binary file;

[0099] The candidate version with the smallest feature distance is selected as the target version of the open-source software to be identified.

[0100] In this embodiment, for candidate version identification, a coarsely filtered candidate version set has already been obtained in the above embodiment. Next, the version feature distance from each version in the set to the target version is calculated, and the candidate version with the smallest version feature distance is selected as the target version of the open-source software to be identified. Specifically, the oldest version Vp in the candidate version set is initialized as the identification version V. B Iterate through the remaining versions V in the candidate version set. x, with V B The composition version is related to P(V) x V B Perform a version comparison on target version B. If VG B→Vx <VG B→VB Update V B ←V x Output V B As a version for target binary recognition.

[0101] Understandably, unlike previous methods and techniques that extracted features solely from source code or binary data, this invention, for the first time, combines source code and corresponding binary data to discover fine-grained version differences. Source code contains rich raw semantic information, ensuring the discovery of version-specific changes at a fine-grained level. However, due to the cross-platform compilation characteristics of C / C++ (operating system, architecture, optimization options, and compiler), there are significant differences between the function semantics in the source code and the target binary. Furthermore, not all features in the source code are compiled into the target binary, meaning features extracted solely from the source code cannot be directly used for target binary version identification. The function semantics contained in the binary data have high similarity to the target binary; combined with existing cross-platform binary function similarity detection methods, this allows for more precise location of functions within the target binary. Since only version-sensitive features are used during identification, the influence of redundant noise features between different versions is eliminated, improving both the accuracy and efficiency of version identification.

[0102] The version identification device for open source software provided by the present invention will be described below. The version identification device for open source software described below can be referred to in correspondence with the version identification method for open source software described above.

[0103] Figure 5 An example is a schematic diagram of the structure of an open-source software version identification device, such as... Figure 5 As shown, the device includes:

[0104] File acquisition unit 510 is used to acquire the target binary file of the open source software to be identified;

[0105] The feature extraction unit 520 is used to extract the target version features of the open-source software to be identified based on the target binary file.

[0106] Version coarse selection unit 530 is used to perform coarse version screening based on the target version characteristics to obtain a candidate version set;

[0107] Version selection unit 540 is used to compare the candidate versions in the candidate version set with the target binary file to obtain the target version of the open source software to be identified.

[0108] Figure 6 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 6 As shown, the electronic device may include: a processor 610, a communications interface 620, a memory 630, and a communication bus 640, wherein the processor 610, the communications interface 620, and the memory 630 communicate with each other via the communication bus 640. The processor 610 can call logical instructions in the memory 630 to execute a version identification method for open-source software, the method including:

[0109] Obtain the target binary file of the open-source software to be identified;

[0110] Based on the target binary file, extract the target version features of the open-source software to be identified;

[0111] Based on the target version characteristics, a coarse version screening is performed to obtain a candidate version set;

[0112] The candidate versions in the candidate version set are compared with the target binary file to obtain the target version of the open source software to be identified.

[0113] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0114] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the version identification method for open-source software provided by the methods described above, the method comprising:

[0115] Obtain the target binary file of the open-source software to be identified;

[0116] Based on the target binary file, extract the target version features of the open-source software to be identified;

[0117] Based on the target version characteristics, a coarse version screening is performed to obtain a candidate version set;

[0118] The candidate versions in the candidate version set are compared with the target binary file to obtain the target version of the open source software to be identified.

[0119] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0120] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0121] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying the version of open-source software, characterized in that, include: Obtain the target binary file of the open-source software to be identified; Based on the target binary file, extract the target version features of the open-source software to be identified; The target version characteristics include software-level characteristics and version-level characteristics, and the software-level characteristics include strings and function names; Based on the target version characteristics, a coarse version screening is performed to obtain a candidate version set; The candidate versions in the candidate version set are compared with the target binary file to obtain the target version of the open source software to be identified. The step of performing a coarse version screening based on the target version characteristics to obtain a candidate version set includes: By matching open-source software code libraries with the target version characteristics, a set of versions containing the target version characteristics is determined. Based on the target version characteristics, the version set is filtered to obtain a first candidate version set; Based on the open-source software codebase, a version spacing table between various versions of the open-source software is obtained; Based on the target version characteristics, the target feature distance of the open-source software to be identified is obtained; Based on the target feature distance, a second candidate version set is obtained; The candidate version set is obtained by the intersection of the first candidate version set and the second candidate version set; The step of matching open-source software code libraries with the target version characteristics to determine a set of versions containing the target version characteristics includes: Parse the version-sensitive functions in the open-source software code library; Based on the version sensitivity function contained in the target version feature, determine the set of versions containing the target version feature.

2. The method for identifying open-source software versions according to claim 1, characterized in that, The step of filtering the version set according to the target version characteristics to obtain a first candidate version set includes: Construct a mapping relationship between the target version features and the version set; Based on the target version characteristics and the mapping relationship, the version set is filtered to obtain a first candidate version set.

3. The method for identifying open-source software versions according to claim 2, characterized in that, The step of obtaining a version spacing table between various versions of the open-source software based on the open-source software code repository includes: Obtain feature information for each version from the aforementioned open-source software code repository; Based on the aforementioned feature information, obtain the feature distance between any two versions; Based on the aforementioned feature distances, a version spacing table is obtained.

4. The method for identifying open-source software versions according to claim 3, characterized in that, The feature distance includes a first feature distance and a second feature distance. Obtaining the target feature distance of the open-source software to be identified based on the target version features includes: Based on the target version characteristics, the distance from the target binary file to the first preset version is calculated to obtain the first feature distance; Based on the target version characteristics, the distance from the target binary file to the second preset version is calculated to obtain the second feature distance; The feature distance of the open-source software to be identified is obtained based on the first feature distance and the second feature distance.

5. The method for identifying open-source software versions according to claim 1, characterized in that, The step of comparing the candidate versions in the candidate version set with the target binary file to obtain the target version of the open-source software to be identified includes: The candidate versions are compared with the target binary file to obtain the feature distance from each candidate version to the target binary file; Sort the candidate versions according to their feature distances to the target binary file; The candidate version with the smallest feature distance is selected as the target version of the open-source software to be identified.

6. A version identification device for open-source software, characterized in that, include: The file acquisition unit is used to acquire the target binary file of the open-source software to be identified. The feature extraction unit is used to extract the target version features of the open-source software to be identified based on the target binary file; the target version features include software-level features and version-level features, and the software-level features include strings and function names; The version coarse selection unit is used to perform coarse version screening based on the target version characteristics to obtain a candidate version set; The version selection unit is used to compare the candidate versions in the candidate version set with the target binary file to obtain the target version of the open source software to be identified. The step of performing a coarse version screening based on the target version characteristics to obtain a candidate version set includes: By matching open-source software code libraries with the target version characteristics, a set of versions containing the target version characteristics is determined. Based on the target version characteristics, the version set is filtered to obtain a first candidate version set; Based on the open-source software codebase, a version spacing table between various versions of the open-source software is obtained; Based on the target version characteristics, the target feature distance of the open-source software to be identified is obtained; Based on the target feature distance, a second candidate version set is obtained; The candidate version set is obtained by the intersection of the first candidate version set and the second candidate version set; The step of matching open-source software code libraries with the target version characteristics to determine a set of versions containing the target version characteristics includes: Parse the version-sensitive functions in the open-source software code library; Based on the version sensitivity function contained in the target version feature, determine the set of versions containing the target version feature.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the version identification method for open-source software as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the version identification method for open-source software as described in any one of claims 1 to 5.

Images