Similar code search method and system

Abstract

The present invention provides a similar code search method and system, the method comprising: obtaining the similarity between a target function in a target code file and each function in a search object based on a function set corresponding to a plurality of code files, wherein the plurality of code files include a target code file and a search object, and the search object includes one or more code files, and the similarity is determined based on a first semantic embedding of the target function and a second semantic embedding of each function in the search object, wherein the first semantic embedding is determined based on an external semantic embedding and an internal semantic embedding of the target function, and the second semantic embedding is determined based on an external semantic embedding and an internal semantic embedding of each function in the search object; and based on the similarity, filtering out code files similar to the target code file from the search object. The system executes the method. The present invention can accurately recall the code file most similar to the target code file from a large number of code files.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a similar code search method and system. Background Art

[0002] In the field of code (e.g., binary code) similarity detection, various techniques have been proposed to address the challenge of identifying similarities between binary codes.

[0003] Previous research has largely focused on analyzing the internal semantic information of binary code snippets to detect similarities. These methods primarily rely on techniques such as textual semantics, control flow graphs, or abstract syntax trees. For example, textual semantics-based methods can treat programming languages ​​as text and use natural language processing techniques to calculate similarity. Alternatively, control flow graphs can be used to extract structural features from code files and measure similarity. Function matching can also be performed using abstract syntax trees rather than control flow graphs. While these methods have shown promising results in some cases, they often fail to capture the full semantic context of the binary code, limiting their effectiveness.

[0004] Recognizing the limitations of methods based on internal semantic information, recent research has explored integrating external semantic information, particularly function call graphs, to improve the accuracy of binary code similarity detection. For example, the entry and exit degrees of each node on the function call graph are used as a two-dimensional vector to represent function features. Alternatively, function call relationships are used to rearrange internal semantic features extracted from binary code snippets. By considering the call relationships between functions, higher accuracy is achieved in identifying similar code. Alternatively, an enhanced representation of code is constructed by combining control flow graphs, data flow graphs, and function call graphs. By capturing both the structure and behavior of the code, it demonstrates superior performance in identifying different code similarities.

[0005] Using neural networks to convert the internal semantic information of code files (such as assembly code, control flow graphs, etc.) into a high-dimensional embedding vector has been proven to be very effective. However, as the scale of code files to be compared increases, it is impossible to accurately recall the code files that are most similar to the target code file. Summary of the Invention

[0006] The similar code search method and system provided by the present invention are used to solve the problem in the prior art that as the scale of code file comparison increases, the code file most similar to the target code file cannot be accurately recalled.

[0007] The present invention provides a similar code search method, comprising:

[0008] Obtaining, based on function sets corresponding to a plurality of code files, a similarity between a target function in a target code file and each function in a search object, the plurality of code files including the target code file and the search object, the search object including one or more code files, the similarity being determined based on a first semantic embedding of the target function and a second semantic embedding of each function in the search object, the first semantic embedding being determined based on an external semantic embedding and an internal semantic embedding of the target function, and the second semantic embedding being determined based on an external semantic embedding and an internal semantic embedding of each function in the search object;

[0009] According to the similarity, code files similar to the target code file are screened out from the search objects.

[0010] According to a similar code search method provided by the present invention, obtaining the similarity between a target function in a target code file and each function in the search object based on a function set corresponding to a plurality of code files includes:

[0011] Obtaining a cosine similarity between the first semantic embedding and the second semantic embedding;

[0012] Obtaining the Jaccard distance between the robust feature of the target function and the robust features of each function in the search object;

[0013] The similarity is determined according to the cosine similarity and the Jaccard distance.

[0014] According to a similar code search method provided by the present invention, before obtaining the cosine similarity between the first semantic embedding and the second semantic embedding, the method further includes:

[0015] Determining external semantic graphs of the target function and each function in the search object based on the extracted robust features of the target function, the robust features of each function in the search object, and the function set;

[0016] Determining string nodes and function nodes in the external semantic graph based on the function set, the extracted readable static strings and external functions in the robust features of the target function, and the readable static strings and external functions in the robust features of each function in the search object;

[0017] Construct an edge between a first function node and a target function node in the external semantic graph, wherein the first function node is a node corresponding to a function that has a call relationship with the target function among the functions in the search object, and the target function node is a node corresponding to the target function;

[0018] Constructing an edge between a second function node in the external semantic graph and the target function node, where the second function node is a node corresponding to a function in the external functions corresponding to each function in the search object that uses the same global data as the target function, where the global data is determined based on the extracted robust features of the target function and each function in the search object;

[0019] Constructing an edge between a third function node in the external semantic graph and the target function node, wherein the third function node is a node corresponding to a function that has an address dependency relationship with the target function among the functions corresponding to the functions in the search object;

[0020] An edge is constructed between a function node and a target string node in the external semantic graph, where the target string node is a string node in a string corresponding to the string node that is the same as the string used by the function node.

[0021] According to a similar code search method provided by the present invention, a method for obtaining the first semantic embedding and the second semantic embedding includes:

[0022] Determining external semantic embeddings of the target function and each function of the search object based on the vector representation of the external semantic graph;

[0023] Determining internal semantic embeddings of the target function and each function of the search object using an internal semantic learning method;

[0024] Determining the first semantic embedding according to the external semantic embedding of the target function and the internal semantic embedding of the target function;

[0025] The second semantic embedding is determined according to the external semantic embedding of each function of the search object and the internal semantic embedding of each function of the search object.

[0026] According to a similar code search method provided by the present invention, the method of screening out code files similar to the target code file from the search object according to the similarity comprises:

[0027] Filtering out one or more similar functions from the functions in the search object, the similarity between which and the target function is greater than or equal to a preset value;

[0028] Determining, from the search object, the code files where the one or more similar functions are located;

[0029] According to the code files where the one or more similar functions are located, a code file similar to the target code file is determined.

[0030] According to a similar code search method provided by the present invention, before obtaining the similarity between the target function in the target code file and each function in the search object based on the function sets corresponding to the multiple code files, the method further includes:

[0031] The multiple code files are disassembled to obtain the function sets corresponding to the multiple code files.

[0032] The present invention also provides a similar code search system, comprising: an acquisition module and a search module;

[0033] The acquisition module is configured to acquire, based on function sets corresponding to a plurality of code files, a similarity between a target function in a target code file and each function in a search object, the plurality of code files including the target code file and the search object, the search object including one or more code files, the similarity being determined based on a first semantic embedding of the target function and a second semantic embedding of each function in the search object, the first semantic embedding being determined based on an external semantic embedding and an internal semantic embedding of the target function, and the second semantic embedding being determined based on an external semantic embedding and an internal semantic embedding of each function in the search object;

[0034] The search module is configured to filter out code files similar to the target code file from the search objects according to the similarity.

[0035] The present invention also provides an electronic device, comprising a processor and a memory storing a computer program, wherein when the processor executes the program, any of the similar code search methods described above is implemented.

[0036] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which implements any of the similar code search methods described above when executed by a processor.

[0037] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the similar code search method described above is implemented.

[0038] The similar code search method and system provided by the present invention, when faced with large-scale code file comparison, fully utilize the internal semantic embedding and external semantic embedding of the target code file and the code file in the search object, calculate the similarity between the target function of the target code file and the various functions of the code file in the search object, and based on the similarity, accurately recall the code file (i.e., the same source code) that is most similar to the target code file in the large-scale code file. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0040] Figure 1 This is one of the flow charts of the similar code search method provided by the present invention;

[0041] Figure 2 This is the second flow chart of the similar code search method provided by the present invention;

[0042] Figure 3 It is a structural diagram of the similar code search system provided by the present invention;

[0043] Figure 4 It is a schematic diagram of the physical structure of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0044] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0045] The similar code search method provided by the present invention can be applied to large-scale code files such as binary code files, and focuses on searching for binary code files that are most similar to target binary code files in large-scale binary code files, that is, the same source code. The present invention proposes an enhancement framework, which uses the external semantic information of the code file to enhance the internal semantic embedding representation of the code. In order to fully learn the rich external semantic information of the code, a novel external semantic graph is designed, which models the external semantic information of the code file through call dependency, data dependency, address dependency and string dependency. These external semantic information can cover all code files, and by adding external semantic information, it makes up for the problem of low specificity of binary code using only internal semantic learning methods, and can better detect the same source code in large-scale application scenarios. Finally, the present invention also proposes a similarity combination method, which combines some robust feature similarities in binary code with semantic embedding similarities to obtain the final similarity between code files. The specific implementation is as follows:

[0046] Figure 1 This is one of the flow charts of the similar code search method provided by the present invention, such as Figure 1 As shown, the method includes:

[0047] Step 110, according to the function sets corresponding to multiple code files, obtain the similarity between the target function in the target code file and each function in the search object. The multiple code files include the target code file and the search object. The search object includes one or more code files. The similarity is determined according to the first semantic embedding of the target function and the second semantic embeddings of each function in the search object. The first semantic embedding is determined according to the external semantic embedding and the internal semantic embedding of the target function. The second semantic embedding is determined according to the external semantic embedding and the internal semantic embedding of each function in the search object.

[0048] Step 120, according to the similarity, screen out the code files similar to the target code file from the search object.

[0049] It should be noted that the execution subject of the above method can be a computer device.

[0050] Optionally, in view of the problem that the internal semantic learning model cannot well handle the recall of homologous code in large-scale code files, the present invention designs an enhanced framework that uses external semantics to enhance the internal semantic embedding representation, and uses the enhanced semantic embedding to achieve accurate recall of homologous code in large-scale code sets. The code file can specifically be a binary code file.

[0051] Obtain the function sets corresponding to multiple code files in the large-scale code files. The function set can specifically be a set composed of the functions called in the code files.

[0052] Optionally, the multiple code files (assuming N code files) can specifically include the target code file and the search object. The target code file can be any one or more of the N code files (for example, M, M < N). The search object is the code files other than the target code file among the N code files, and it can specifically include one or more code files (for example, P).

[0053] Optionally, according to the function sets corresponding to the obtained N code files, obtain the similarity between the target function in the target code file of the N code files and each function in the search object. The similarity can be used as the similarity between the target code file and each code file in the search object. Among them, the target function is the function called in the target code file.

[0054] Optionally, the similarity can be specifically determined based on a first semantic embedding of the target function and a second semantic embedding of each function in the search object, where the first semantic embedding can specifically include the external semantic embedding of the target function and its internal semantic embedding, and the second semantic embedding can specifically include the external semantic embedding of each function in the search object and its internal semantic embedding.

[0055] Based on the calculated similarity, the code file most similar to the target code file is found from the code files included in the search object. For example, a preset number of code files with high similarity rankings can be used as the code files most similar to the target code file, or a preset number of code files with similarity greater than a preset threshold can be used as the code files most similar to the target code file. The preset number can be specifically set to one or more.

[0056] The similar code search method provided by the present invention fully utilizes the internal semantic embedding and external semantic embedding of the target code file and the code file in the search object when facing large-scale code file comparison, calculates the similarity between the target function of the target code file and the various functions of the code file in the search object, and accurately recalls the code file (i.e., the same source code) that is most similar to the target code file in the large-scale code file based on the similarity.

[0057] Furthermore, in one embodiment, obtaining the similarity between the target function in the target code file and each function in the search object based on the function sets corresponding to the multiple code files may specifically include:

[0058] Obtaining a cosine similarity between the first semantic embedding and the second semantic embedding;

[0059] Obtaining the Jaccard distance between the robust feature of the target function and the robust features of each function in the search object;

[0060] The similarity is determined according to the cosine similarity and the Jaccard distance.

[0061] Optionally, the cosine similarity between the first semantic embedding of the target function and the second semantic embedding of each function in the search object is calculated.

[0062] Robust features of the target function and each function in the search object are extracted. The robust features may specifically include readable static strings, external functions, and global data (such as variables) in the code file.

[0063] Calculate the Jaccard distance between the robust features of the target function and the robust features of each function in the search object.

[0064] The similarity is obtained based on the cosine similarity and the Jaccard distance.

[0065] Furthermore, in one embodiment, the first semantic embedding and the second semantic embedding are obtained by:

[0066] Determining external semantic embeddings of the target function and each function of the search object based on the vector representation of the external semantic graph;

[0067] Determining internal semantic embeddings of the target function and each function of the search object using an internal semantic learning method;

[0068] Determining the first semantic embedding according to the external semantic embedding of the target function and the internal semantic embedding of the target function;

[0069] The second semantic embedding is determined according to the external semantic embedding of each function of the search object and the internal semantic embedding of each function of the search object.

[0070] Optionally, the similar code search method adopted by the present invention is divided into two major steps: training and prediction. The training process uses code files compiled from the same source code to perform model training. In the inference stage, the trained model is used to generate semantic embeddings of functions to obtain homologous functions of the target function. Based on the code files in the search object where the homologous functions are located, the code files that are most similar to the target code files are determined. Figure 2 This is the second flow chart of the similar code search method provided by the present invention. Figure 2 As shown, during the training process, the input binary file is first disassembled to obtain the function set in the binary file. Robust features are extracted for the target function and each function in the search object. Three types of robust features are designed: readable static strings, external functions, and global data (such as variables). After extracting the robust features, an external semantic graph is constructed based on the disassembled function set and the extracted robust features. The external semantic graph is used to model the external semantic information of the function. Here, the nodes in the external semantic graph of each function (including function nodes and string nodes) are replaced by text information. For example, function nodes are replaced by function description information, and string nodes are replaced by string description information. The external semantic graph has four types of edges: control dependency edges, address dependency edges, and string dependency edges.

[0071] To digitally vectorize the function's external semantic graph, the publicly available BERT model is used to encode the function's string into each string node in the external semantic graph, generating an embedding. Existing internal semantic learning methods are then used to generate the function's internal semantic embedding, assigning values ​​to the function's corresponding nodes in the external semantic graph. A trained Relational Graph Convolutional Neural Network (RGCN) model is then used to obtain a vector representation of the external semantic graph. Based on the adjacent representation of this external semantic graph, the external semantic embedding of the target function and the external semantic embeddings of each function in the search object are generated.

[0072] After the semantic learning model combines the external semantic embedding and internal semantic embedding of the function to generate the semantic embedding of the function (including the first semantic embedding of the target function and the second embedding of each function in the search object), the semantic embedding update formula of the semantic learning model is as follows:

[0073] E d =RGCN(F d )+rec_fc(Gemini(F d ));

[0074]

[0075] Among them, F d Represents the function in the function set, E d Representative function F d The sum of the external semantic embedding and internal semantic embedding, RGCN (F d ) represents the function F d External semantic embedding, rec_fc(Gemini(F d )) represents the function F d The internal semantic embedding of LeakyRelu is the activation function of the RGCN model. Represents the pointing function F i The relationship between them is a set of neighbor nodes of r, where r can be any one of control dependency, data dependency, address dependency and string dependency. i,r is a regularization constant, where C i,r The value of Linear transformation function, neighbor nodes of the same type of edge use the same parameter matrix To convert, The number of is the number of edge types in the external semantic graph, l represents the number of network layers of the RGCN model, represents the initial internal semantic embedding of the function node in the external semantic graph, and R represents a relationship set, which may specifically include control dependency, data dependency, address dependency, and string dependency.

[0076] After the semantic embedding is generated, the cosine similarity is used to calculate the similarity between the semantic embeddings of the functions (i.e., cosine similarity), which is then concatenated with the Jaccard distance of the robust features between the functions into a four-dimensional vector and input into the feedforward network (the semantic learning model is trained until it converges) to obtain the final similarity.

[0077] In the prediction process, multiple code files are input, and the external semantic graph of each function is constructed. The first semantic embedding of the target function and the second semantic embedding of each function in the search object are obtained using the converged semantic learning model. Then, the cosine similarity between the target function and each function in the search object, as well as the Jaccard distance between the target function and each function in the search object are calculated. The similarity is obtained based on the cosine similarity and Jaccard distance, and the similarity is sorted to output a list of the top 10 functions with the highest similarity to the target function. The code file containing the function list is regarded as a code file similar to the target code file.

[0078] The similar code search method provided by the present invention combines the similarity (such as Jaccard distance) between the target code file and some robust features (such as robust features) in the search object with the cosine similarity of the semantic embedding of the target code file and the search object as the final similarity between the two, thereby further improving the accuracy of searching for the same source code that is similar to the target code file.

[0079] Furthermore, in one embodiment, before obtaining the cosine similarity between the first semantic embedding and the second semantic embedding, the method may further specifically include:

[0080] Determining external semantic graphs of the target function and each function in the search object based on the extracted robust features of the target function, the robust features of each function in the search object, and the function set;

[0081] Determining string nodes and function nodes in the external semantic graph based on the function set, the extracted readable static strings and external functions in the robust features of the target function, and the readable static strings and external functions in the robust features of each function in the search object;

[0082] Construct an edge between a first function node and a target function node in the external semantic graph, wherein the first function node is a node corresponding to a function that has a call relationship with the target function among the functions in the search object, and the target function node is a node corresponding to the target function;

[0083] Constructing an edge between a second function node in the external semantic graph and the target function node, where the second function node is a node corresponding to a function in the external functions corresponding to each function in the search object that uses the same global data as the target function, where the global data is determined based on the extracted robust features of the target function and each function in the search object;

[0084] Constructing an edge between a third function node in the external semantic graph and the target function node, wherein the third function node is a node corresponding to a function that has an address dependency relationship with the target function among the functions corresponding to the functions in the search object;

[0085] An edge is constructed between a function node and a target string node in the external semantic graph, where the target string node is a string node in a string corresponding to the string node that is the same as the string used by the function node.

[0086] Optionally, before calculating the cosine similarity between the first semantic embedding and the second semantic embedding, an external semantic graph of each function in the function set (including the target function and each function in the search object) is constructed based on the extracted robust features of the target function, the robust features of each function in the search object, and the function set.

[0087] The external semantic graph can be specifically composed of nodes and edges. The nodes can specifically include function nodes and string nodes. The function nodes can specifically include nodes corresponding to the target function (i.e., target function nodes), each function in the search object, and nodes corresponding to external functions in the robust features of the target function. The string nodes can specifically be nodes corresponding to readable static strings in the robust features of the target function and each function in the search object.

[0088] The edges in the external semantic graph may specifically include four types: control dependency edges, data dependency edges, address dependency edges, and string dependency edges.

[0089] Among them, the control dependency edge can be specifically an edge constructed between the first function node and the target function node in the external semantic graph, and the first function node can be specifically a node corresponding to the function that has a calling relationship with the target function among the various functions in the search object.

[0090] The data dependency edge can be specifically an edge constructed between the second function node and the target function node in the external semantic graph. The second function node can be specifically a node corresponding to the function in each function in the search object that uses the same global data as the target function. The global data is determined based on the extracted robust features of the target function and each function in the search object.

[0091] The address dependency edge can be specifically an edge constructed between the third function node and the target function node in the external semantic graph. The third function node can be specifically a node corresponding to the function that has an address dependency relationship with the target function among the functions in the search object.

[0092] The string dependency edge can be specifically an edge constructed between a function node in an external semantic graph and a target string node corresponding to the function node. The target string node can be specifically a string node in the string corresponding to the string node in the external semantic graph that is the same as the string used by the function node.

[0093] The similar code search method provided by this invention models the external semantic information of code files (such as an external semantic graph) by using call dependencies, data dependencies, address dependencies, and string dependencies. This external semantic information can cover all code files and, by incorporating it, overcomes the low code specificity of methods that rely solely on internal semantic learning. This allows for better detection of identical source code in large-scale code file comparison scenarios.

[0094] Furthermore, in one embodiment, before obtaining the similarity between the target function in the target code file and each function in the search object based on the function sets corresponding to the multiple code files, the method may further specifically include:

[0095] The multiple code files are disassembled to obtain the function sets corresponding to the multiple code files.

[0096] Optionally, multiple code files (including target code files and search objects) are disassembled, and a set consisting of functions in the target code files and code files in the search objects is used as the final function set.

[0097] Furthermore, in one embodiment, the selecting, from the search objects, code files similar to the target code file according to the similarity may specifically include:

[0098] Filtering out one or more similar functions from the functions in the search object, the similarity between which and the target function is greater than or equal to a preset value;

[0099] Determining, from the search object, the code files where the one or more similar functions are located;

[0100] According to the code files where the one or more similar functions are located, a code file similar to the target code file is determined.

[0101] Optionally, one or more functions (i.e., similar functions) whose similarity to the target function in the target code file is greater than or equal to a preset value are filtered out from the various functions in the search object, and the code file where the one or more similar functions are located is found from the search object and used as a code file similar to the target code file.

[0102] Specifically, the similarities may be sorted in descending order, and the top k similarities may be used as the preset value, wherein the value of k may be adjusted according to actual needs, for example, k is 10.

[0103] The similar code search method provided by the present invention greatly enhances the embedding representation capability of the existing most advanced internal semantic learning methods (Gemini, Asteria, TREX) in the code file similarity search task, thereby improving the accuracy and recall rate of similarity search of target code files to a certain extent, achieving the optimal SOTA effect, and is suitable for similarity search in complex situations such as large-scale, cross-compilation settings, and different function sizes.

[0104] The similar code search system provided by the present invention is described below. The similar code search system described below and the similar code search method described above can be referenced to each other.

[0105] Figure 3 This is a schematic diagram of the structure of the similar code search system provided by the present invention. Figure 3 Shown, including:

[0106] Acquisition module 310 and search module 311;

[0107] The acquisition module 310 is configured to acquire, based on a function set corresponding to a plurality of code files, a similarity between a target function in a target code file and each function in a search object, the plurality of code files including the target code file and the search object, the search object including one or more code files, the similarity being determined based on a first semantic embedding of the target function and a second semantic embedding of each function in the search object, the first semantic embedding being determined based on an external semantic embedding and an internal semantic embedding of the target function, the second semantic embedding being determined based on an external semantic embedding and an internal semantic embedding of each function in the search object;

[0108] The search module 311 is configured to filter out code files similar to the target code file from the search objects according to the similarity.

[0109] The similar code search system provided by the present invention, when faced with large-scale code file comparison, fully utilizes the internal semantic embedding and external semantic embedding of the target code file and the code file in the search object, calculates the similarity between the target function of the target code file and the various functions of the code file in the search object, and based on the similarity, accurately recalls the code file (i.e., the same source code) that is most similar to the target code file in the large-scale code file.

[0110] Figure 4 This is a schematic diagram of the physical structure of an electronic device provided by the present invention, such as Figure 4 As shown, the electronic device may include: a processor 410, a communication interface 411, a memory 412, and a bus 413, wherein the processor 410, the communication interface 411, and the memory 412 communicate with each other via the bus 413. The processor 410 may call the logic instructions in the memory 412 to execute the following method:

[0111] Obtaining, based on function sets corresponding to a plurality of code files, a similarity between a target function in a target code file and each function in a search object, the plurality of code files including the target code file and the search object, the search object including one or more code files, the similarity being determined based on a first semantic embedding of the target function and a second semantic embedding of each function in the search object, the first semantic embedding being determined based on an external semantic embedding and an internal semantic embedding of the target function, and the second semantic embedding being determined based on an external semantic embedding and an internal semantic embedding of each function in the search object;

[0112] According to the similarity, code files similar to the target code file are screened out from the search objects.

[0113] In addition, the logic instructions in the above-mentioned memory can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer power screen (which can be a personal computer, server, or network power screen, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program code.

[0114] Furthermore, the present invention discloses a computer program product, comprising a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises program instructions. When the program instructions are executed by a computer, the computer can perform the similar code search method provided by each of the above method embodiments, for example, including:

[0115] Obtaining, based on function sets corresponding to a plurality of code files, a similarity between a target function in a target code file and each function in a search object, the plurality of code files including the target code file and the search object, the search object including one or more code files, the similarity being determined based on a first semantic embedding of the target function and a second semantic embedding of each function in the search object, the first semantic embedding being determined based on an external semantic embedding and an internal semantic embedding of the target function, and the second semantic embedding being determined based on an external semantic embedding and an internal semantic embedding of each function in the search object;

[0116] According to the similarity, code files similar to the target code file are screened out from the search objects.

[0117] On the other hand, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the similar code search method provided in each of the above embodiments is implemented, for example, including:

[0118] Obtaining, based on function sets corresponding to a plurality of code files, a similarity between a target function in a target code file and each function in a search object, the plurality of code files including the target code file and the search object, the search object including one or more code files, the similarity being determined based on a first semantic embedding of the target function and a second semantic embedding of each function in the search object, the first semantic embedding being determined based on an external semantic embedding and an internal semantic embedding of the target function, and the second semantic embedding being determined based on an external semantic embedding and an internal semantic embedding of each function in the search object;

[0119] According to the similarity, code files similar to the target code file are screened out from the search objects.

[0120] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0121] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course by hardware. Based on this understanding, the above technical solution, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product, which can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer power screen (which can be a personal computer, a server, or a network power screen, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0122] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A similar code search method, characterized in that: include: Obtaining, based on function sets corresponding to a plurality of code files, a similarity between a target function in a target code file and each function in a search object, the plurality of code files including the target code file and the search object, the search object including one or more code files, the similarity being determined based on a first semantic embedding of the target function and a second semantic embedding of each function in the search object, the first semantic embedding being determined based on an external semantic embedding and an internal semantic embedding of the target function, and the second semantic embedding being determined based on an external semantic embedding and an internal semantic embedding of each function in the search object; According to the similarity, filtering out code files similar to the target code file from the search object; The obtaining, based on the function sets corresponding to the plurality of code files, the similarity between the target function in the target code file and each function in the search object comprises: Obtaining a cosine similarity between the first semantic embedding and the second semantic embedding; Obtaining the Jaccard distance between the robust feature of the target function and the robust features of each function in the search object; Determining the similarity according to the cosine similarity and the Jaccard distance; Determining external semantic graphs of the target function and each function in the search object based on the extracted robust features of the target function, the robust features of each function in the search object, and the function set; Determining external semantic embeddings of the target function and each function of the search object based on the vector representation of the external semantic graph; An internal semantic learning method is used to determine the internal semantic embeddings of the target function and each function of the search object.

2. The similar code search method according to claim 1, characterized in that: Before obtaining the cosine similarity between the first semantic embedding and the second semantic embedding, the method further includes: Determining external semantic graphs of the target function and each function in the search object based on the extracted robust features of the target function, the robust features of each function in the search object, and the function set; Determining string nodes and function nodes in the external semantic graph based on the function set, the extracted readable static strings and external functions in the robust features of the target function, and the readable static strings and external functions in the robust features of each function in the search object; Construct an edge between a first function node and a target function node in the external semantic graph, wherein the first function node is a node corresponding to a function that has a call relationship with the target function among the functions in the search object, and the target function node is a node corresponding to the target function; Constructing an edge between a second function node in the external semantic graph and the target function node, where the second function node is a node corresponding to a function in the external functions corresponding to each function in the search object that uses the same global data as the target function, where the global data is determined based on the extracted robust features of the target function and each function in the search object; Constructing an edge between a third function node in the external semantic graph and the target function node, wherein the third function node is a node corresponding to a function that has an address dependency relationship with the target function among the functions corresponding to the functions in the search object; An edge is constructed between a function node and a target string node in the external semantic graph, where the target string node is a string node in a string corresponding to the string node that is the same as the string used by the function node.

3. The similar code search method according to claim 1, wherein: The method for obtaining the first semantic embedding and the second semantic embedding includes: Determining external semantic embeddings of the target function and each function of the search object based on the vector representation of the external semantic graph; Determining internal semantic embeddings of the target function and each function of the search object using an internal semantic learning method; Determining the first semantic embedding according to the external semantic embedding of the target function and the internal semantic embedding of the target function; The second semantic embedding is determined according to the external semantic embedding of each function of the search object and the internal semantic embedding of each function of the search object.

4. The similar code search method according to claim 1, wherein: The step of screening out code files similar to the target code file from the search object according to the similarity comprises: Filtering out one or more similar functions from the functions in the search object, the similarity between which and the target function is greater than or equal to a preset value; Determining, from the search object, the code files where the one or more similar functions are located; According to the code files where the one or more similar functions are located, a code file similar to the target code file is determined.

5. The similar code search method according to any one of claims 1 to 4, characterized in that: Before obtaining the similarity between the target function in the target code file and each function in the search object based on the function sets corresponding to the multiple code files, the method further includes: The multiple code files are disassembled to obtain the function sets corresponding to the multiple code files.

6. A similar code search system, characterized in that: include: Get modules and search modules; The acquisition module is configured to acquire, based on function sets corresponding to a plurality of code files, a similarity between a target function in a target code file and each function in a search object, the plurality of code files including the target code file and the search object, the search object including one or more code files, the similarity being determined based on a first semantic embedding of the target function and a second semantic embedding of each function in the search object, the first semantic embedding being determined based on an external semantic embedding and an internal semantic embedding of the target function, and the second semantic embedding being determined based on an external semantic embedding and an internal semantic embedding of each function in the search object; The search module is configured to filter out code files similar to the target code file from the search object based on the similarity; The obtaining, based on the function sets corresponding to the plurality of code files, the similarity between the target function in the target code file and each function in the search object comprises: Obtaining a cosine similarity between the first semantic embedding and the second semantic embedding; Obtaining the Jaccard distance between the robust feature of the target function and the robust features of each function in the search object; Determining the similarity according to the cosine similarity and the Jaccard distance; Determining external semantic graphs of the target function and each function in the search object based on the extracted robust features of the target function, the robust features of each function in the search object, and the function set; Determining external semantic embeddings of the target function and each function of the search object based on the vector representation of the external semantic graph; An internal semantic learning method is used to determine the internal semantic embeddings of the target function and each function of the search object.

7. An electronic device comprising a processor and a memory storing a computer program, characterized in that: When the processor executes the computer program, the similar code searching method according to any one of claims 1 to 5 is implemented.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the similar code searching method according to any one of claims 1 to 5 is implemented.

9. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the similar code searching method according to any one of claims 1 to 5 is implemented.

Images