Binary Software Component Analysis Method Based on Heuristic Search

Abstract

The present invention relates to the field of data processing technology, and in particular to a binary software component analysis method based on heuristic search, the method comprising: obtaining a data sample for binary software component analysis; constructing a component version number recognition model to be trained based on the data sample; using the component version number recognition model to be trained to recognize the data sample and obtain a training component version number; training the component version number recognition model to be trained based on the training component version number and the label of the data sample to obtain a trained component version number recognition model; using the trained component version number recognition model to perform binary software component analysis on a software file to be analyzed and obtain a target component version number of the software file to be analyzed. The method can improve the accuracy of obtaining the target component version number of the software file to be analyzed.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a binary software component analysis method based on heuristic search in the technical field of data processing. Background Art

[0002] With the widespread use of open source software, modern applications often rely on a large number of open source libraries and components. These open source components bring convenience to software development, but also introduce potential security risks. For example, by implanting malicious code into open source components, all software that uses these components can be affected. By performing component analysis on the software, the emergence of such risks can be effectively reduced. Many software products are ultimately distributed in binary form, especially in embedded systems, mobile applications, and desktop software. Therefore, by performing binary software composition analysis (BSCA) on the software, the security level can be greatly improved.

[0003] With the development of artificial intelligence (AI) technology, BSCA tools increasingly use machine learning algorithms to improve the accuracy and efficiency of analysis, especially in identifying complex binary dependencies and vulnerability patterns. By using existing information to evaluate each branch of the search, the search process is guided in a more promising direction, thus achieving heuristic search for binary software component analysis.

[0004] In the process of binary software component analysis, the heuristic search method in the related technology relies too much on preset rules or pattern matching to identify components and version numbers. If the rules are not comprehensive enough or the pattern matching is not accurate enough, it may lead to false positives or negatives, that is, misidentifying non-target components as target components or failing to identify the true target components. Summary of the invention

[0005] In order to solve the technical problem that the heuristic search method in the related art is prone to false positives or false negatives when performing binary software component analysis, the purpose of the present invention is to provide a binary software component analysis method based on heuristic search, and the technical solution adopted is as follows:

[0006] In a first aspect, an embodiment of the present invention provides a binary software component analysis method based on heuristic search, the method comprising:

[0007] Obtaining data samples for binary software composition analysis;

[0008] Based on the data sample, construct a component version number recognition model to be trained;

[0009] Using the component version number recognition model to be trained, the data sample is recognized to obtain a training component version number;

[0010] Based on the training component version number and the label of the data sample, the component version number recognition model to be trained is trained to obtain a trained component version number recognition model;

[0011] The trained component version number recognition model is used to perform binary software component analysis on the software file to be analyzed to obtain the target component version number of the software file to be analyzed.

[0012] In combination with the first aspect above, in some possible implementations, constructing a component version number recognition model to be trained based on the data sample includes:

[0013] Based on the data sample, determining a target format string;

[0014] Based on the target format character string, the component version number recognition model to be trained is constructed.

[0015] In the above manner, the component version number recognition model to be trained is constructed by using a target format character string with rich formats, so that the component version number recognition model to be trained can be more comprehensive and have higher recognition accuracy.

[0016] In combination with the first aspect, in some possible implementations, determining a target format character string based on the data sample includes:

[0017] Get the heuristic rules for searching component version numbers;

[0018] Based on the heuristic rule, a character string search is performed on the training set in the data sample to obtain the target format character string.

[0019] In the above method, a string search is performed in the training set according to the set heuristic rules, so that a target format string with rich formats can be obtained.

[0020] In combination with the first aspect, in some possible implementations, constructing the component version number recognition model to be trained based on the target format string includes:

[0021] Determine a target segment of each target format string in the data sample;

[0022] Performing language processing on the target paragraph to obtain vocabulary in the target paragraph;

[0023] Matching the vocabulary with preset keywords to obtain a matching score;

[0024] Based on the matching score, determining a likelihood score of each target format string as a component version number of the current data sample;

[0025] Based on the probability score of each target format character string being the component version number of the current data sample, the component version number recognition model to be trained is constructed.

[0026] In the above method, by analyzing the matching scores between the words in the target paragraph and the preset keywords, the probability score of the target format string as the component version number of the current data sample can be calculated, and then a recognition model capable of identifying various component version numbers can be constructed based on the probability score.

[0027] In combination with the first aspect, in some possible implementations, determining, based on the matching score, a likelihood score of each target format string as a component version number of the current data sample includes:

[0028] In the data sample, determining the position information of each target format character string;

[0029] Based on the position information, determining the similarity between the candidate string and each of the target format strings in the data sample; wherein the candidate string has the same content as each of the target format strings;

[0030] Based on the similarity, determining a repeatability score of each target format character string;

[0031] The repeatability score and the matching score are merged to obtain a probability score of each target format string being a component version number of the current data sample.

[0032] In the above method, the probability score of the target format string as the component version number of the current data sample is calculated by multiplying the repeatability score and the matching score, so that the component version number of the current data sample can be selected from multiple target format strings according to the probability score to improve the accuracy of determining the component version number of the current data sample.

[0033] In combination with the first aspect, in some possible implementations, using the component version number recognition model to be trained to recognize the data sample to obtain the training component version number includes:

[0034] Using the component version number recognition model to be trained, the data sample is recognized to obtain a probability score of the training character string in the data sample being the component version number of the current data sample;

[0035] The training component version number is determined based on the likelihood score of the training string as the component version number of the current data sample.

[0036] In combination with the first aspect above, in some possible implementations, determining the training component version number based on the likelihood score of the training string being the component version number of the current data sample includes:

[0037] Finding the maximum likelihood score among the likelihood scores of the training string being the component version number of the current data sample;

[0038] The training character string corresponding to the maximum likelihood score is used as the training component version number.

[0039] In the above method, by analyzing the likelihood scores of the training character strings as the component version numbers of the current data samples, character strings with larger likelihood scores are selected as the training component version numbers, thereby improving the accuracy of the training component version numbers.

[0040] In combination with the first aspect above, in some possible implementations, the training of the component version number recognition model to be trained based on the training component version number and the label of the data sample to obtain the trained component version number recognition model includes:

[0041] Determining a consistency ratio between the training component version number and the label of the data sample;

[0042] The component version number recognition model to be trained is verified and trained based on the consistency rate to obtain the trained component version number recognition model.

[0043] In the above method, by analyzing the consistency rate between the training component version number and the label of the data sample, the component version number recognition model to be trained is verified and trained, which can make the recognition accuracy of the trained component version number recognition model higher.

[0044] In combination with the first aspect above, in some possible implementations, verifying and training the component version number recognition model to be trained based on the consistency rate to obtain the trained component version number recognition model includes:

[0045] If the consistency rate is less than a preset threshold, it is determined that the component version number recognition model to be trained has failed verification;

[0046] The component version number recognition model to be trained is trained based on the training component version number to obtain the trained component version number recognition model.

[0047] In combination with the first aspect above, in some possible implementations, verifying and training the component version number recognition model to be trained based on the consistency rate to obtain the trained component version number recognition model includes:

[0048] If the consistency rate is greater than or equal to a preset threshold, it is determined that the component version number recognition model to be trained has passed verification;

[0049] The component version number identification model to be trained that has passed verification is determined as the trained component version number identification model.

[0050] In the above method, by judging whether the consistency rate between the training component version number and the label of the data sample is greater than a preset threshold, it is possible to determine whether the trained component version number recognition model has passed the verification, thereby improving the recognition accuracy of the trained component version number recognition model.

[0051] In a second aspect, a binary software component analysis device based on heuristic search is provided, the device comprising:

[0052] An acquisition module, used for acquiring data samples for binary software component analysis;

[0053] A construction module, used to construct a component version number recognition model to be trained based on the data sample;

[0054] An identification module, used to identify the data sample using the component version number identification model to be trained to obtain a training component version number;

[0055] A training module, used for training the component version number recognition model to be trained based on the training component version number and the label of the data sample to obtain a trained component version number recognition model;

[0056] The analysis module is used to perform binary software component analysis on the software file to be analyzed using the trained component version number recognition model to obtain the target component version number of the software file to be analyzed.

[0057] According to a third aspect, a computer program product is provided, comprising: a computer program code, which, when executed on a computer, enables the computer to execute the method according to the first aspect or any possible implementation of the first aspect.

[0058] In a fourth aspect, a computer-readable storage medium is provided, which stores a computer program code. When the computer program code runs on a computer, the computer executes the method in the above-mentioned first aspect or any possible implementation manner of the first aspect.

[0059] The present invention has the following beneficial effects: after obtaining a data sample, first, a component version number recognition model to be trained is constructed through the data sample; then, the data sample is recognized through the component version number recognition model to be trained to obtain the training component version number; in this way, training component version numbers in different formats can be obtained to enrich the training component version number, thereby avoiding false positives and false negatives caused by the lack of comprehensiveness of a single rule. Then, based on the training component version number and the label of the data sample, the component version number recognition model to be trained is trained, thereby obtaining a trained component version number recognition model with high recognition accuracy. Finally, the trained component version number recognition model is used to perform binary software component analysis on the software file to be analyzed, and the target component version number of the software file to be analyzed can be obtained, so as to improve the accuracy of obtaining the target component version number of the software file to be analyzed. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0061] Figure 1 It is a schematic diagram of the implementation flow of the binary software component analysis method based on heuristic search provided by an embodiment of the present invention;

[0062] Figure 2 It is another implementation flow diagram of the binary software component analysis method based on heuristic search provided by an embodiment of the present invention;

[0063] Figure 3 It is another implementation flow diagram of the binary software component analysis method based on heuristic search provided by an embodiment of the present invention;

[0064] Figure 4 It is another implementation flow diagram of the binary software component analysis method based on heuristic search provided by an embodiment of the present invention;

[0065] Figure 5 It is another implementation flow diagram of the binary software component analysis method based on heuristic search provided by an embodiment of the present invention;

[0066] Figure 6 It is a structural schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0067] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of the specific implementation method, structure, features and effects of a binary software component analysis method based on heuristic search proposed by the present invention in combination with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0068] Among them, in the description of the embodiments of the present invention, unless otherwise specified, " / " means or, for example, A / B can mean A or B: "and / or" in the text is only a way to describe the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present invention, "multiple" refers to two or more than two.

[0069] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.

[0070] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0071] In the process of binary software component analysis, the heuristic search method in the related art relies too much on preset rules or pattern matching to identify components and version numbers. If the rules are not comprehensive enough or the pattern matching is not accurate enough, it may cause false positives or false negatives. For example: if the heuristic search rule only matches version numbers in a specific format (such as major version number, minor version number, revision number), then component version numbers that use non-standard naming or formats (such as using a date or timestamp as a version identifier) ​​may not be correctly identified. Based on this, an embodiment of the present invention provides a binary software component analysis method based on heuristic search. Figure 1 As shown, the method includes:

[0072] 101, collect data samples.

[0073] 102, determine the string search format.

[0074] 103, obtain all target format strings in the data sample.

[0075] 104, setting the weight of the keyword of the paragraph where the string is located.

[0076] 105, analyzing the matching degree of the context information of the character string.

[0077] 106, perform repeatability analysis on the string.

[0078] 107, obtain the probability score that the string is the current component version number.

[0079] 108, repeatedly obtain the possibility scores corresponding to other character strings.

[0080] 109, based on the possibility score, determine the target component version number.

[0081] Here, based on the likelihood scores corresponding to the character strings, the target component version number of the software file to be analyzed is determined.

[0082] In an embodiment of the present invention, a component version number recognition model to be trained is constructed, the possibility of different format strings in the data sample as component version numbers is analyzed, and the final component version number format is determined according to the different possibilities. The possibility of false alarms and missed alarms is reduced by analyzing the format.

[0083] The following is a detailed description of the specific scheme of the binary software component analysis method based on heuristic search provided by the present invention in conjunction with the accompanying drawings. Figure 2 , which shows a flowchart of a binary software component analysis method based on heuristic search provided by an embodiment of the present invention, the method comprising:

[0084] 201, obtain data samples for binary software component analysis.

[0085] Here, data samples for binary software component analysis used to build the recognition model are collected. The data samples include: training set and validation set. The data samples are binary data samples containing component version numbers. As many binary data samples containing component version numbers in different formats as possible are collected to ensure the effect of model training.

[0086] In some possible implementations, the data sample may be obtained through the following process:

[0087] First, collect binary data samples from various sources, such as open source projects, software repositories, or legal software testing libraries. It should be noted that the collection process ensures compliance with laws, regulations and copyright policies.

[0088] Secondly, the obtained binary data samples are preprocessed to convert binary numbers into common characters.

[0089] Again, the collected binary data samples are annotated with the version information (i.e., labels) contained therein, that is, the corresponding component version number of each sample, especially those strings in non-standard formats.

[0090] Again, features are extracted from the binary data sample, including but not limited to compilation timestamp, string information, file size, header file information, etc.

[0091] Again, the collected samples and the features corresponding to the samples are stored in the same data set.

[0092] Finally, the prepared data set is divided into a training set and a validation set to complete the collection of the required data samples and obtain the data samples.

[0093] 202. Construct a component version number recognition model to be trained based on the data sample.

[0094] Here, the component version number recognition model to be trained is used to recognize the component version number of the software file to be analyzed. A rich target format string is obtained from the training set of the data sample to construct the component version number recognition model to be trained through the target format string. In some possible implementations, the above step 202 can be performed by Figure 3 The steps shown achieve:

[0095] 301. Determine a target format character string based on the data sample.

[0096] Here, the target format string is obtained by obtaining a heuristic rule for searching the component version number and performing a string search on the training set in the data sample based on the heuristic rule. In this way, according to the set heuristic rule, a string search is performed in the training set, so that a target format string with rich format can be obtained.

[0097] In some possible implementations, since the component version number format can be designed according to the ideas or needs of the author or developer team, during the heuristic search (i.e., component version number identification), the formats of some component version numbers obtained may be highly similar to some strings in the data sample. In order to increase the probability of discovering the actual version number and reduce missed reports and false positives, various strings that may contain version information are collected by utilizing heuristic search.

[0098] First, specify the version number that needs to be identified. Here, we take the component version number in date format as an example.

[0099] It should be noted that component version numbers with non-standard formats or names are not of a single type, and their determination process usually depends on multiple factors, including but not limited to team preferences, compatibility with existing version control systems, etc. Therefore, different string recognition methods need to be designed according to the recognition requirements of different formats or names.

[0100] Second, define a set of heuristic rules for searching for specific component version numbers. (including specific patterns, keywords, formats, etc.). For example: a string used to identify the date format of YYYYMMDD (20240627), \b(19|20)\d{2}(0[1-9]|1[0-2])(0[1-9]|

[12] [0-9]|3

[01] )\b;

[0101] Again, according to the heuristic rule Get the target format string for the samples in the training set and get the samples No. target format string ;

[0102] Finally, traverse all data samples in the training set and get all target format strings for each sample , to complete the acquisition of the target format string.

[0103] 302. Construct the component version number recognition model to be trained based on the target format character string.

[0104] Here, the component version number recognition model to be trained is constructed by using a target format character string with rich formats, so that the component version number recognition model to be trained can be more comprehensive and have higher recognition accuracy.

[0105] In some possible implementations, the above step 302 may be implemented by the following process:

[0106] The first step is to determine the target paragraph of each target format string in the data sample.

[0107] The second step is to perform language processing on the target paragraph to obtain the vocabulary in the target paragraph; and thirdly, match the vocabulary with preset keywords to obtain a matching score.

[0108] In the third step, based on the matching score, a probability score of each target format string being a component version number of the current data sample is determined.

[0109] Here, the repetitiveness score of the target format string is calculated and multiplied by the matching score to obtain the probability score of the target format string being the component version number of the current data sample.

[0110] In some possible implementations, first, in the data sample, the location information of each target format string is determined; that is, the location of the target format string in the data sample. Secondly, based on the location information, the degree of similarity between the candidate string and each target format string is determined in the data sample; wherein the content of the candidate string is the same as that of each target format string; thirdly, based on the degree of similarity, the repeatability score of each target format string is determined; finally, the repeatability score and the matching score are merged to obtain the probability score of each target format string as the component version number of the current data sample. In this way, by multiplying the repeatability score and the matching score, the probability score of the target format string as the component version number of the current data sample is calculated, so that the component version number of the current data sample can be selected from multiple target format strings according to the probability score, so as to improve the accuracy of determining the component version number of the current data sample.

[0111] In some possible implementations, component version numbers of different formats and names have their own special features, such as string length, contextual relationship, etc.; by extracting relevant features of the target format string in the data sample and combining the contextual relationship when it appears, the suspicious score value of each string is obtained. The higher the suspicious score value, the more likely it is that it is the string of the sample component version number of the current data sample.

[0112] When the string type obtained through heuristic search appears at different positions in the data sample, the meaning it expresses may be different. For example, when the target format string 20120304 appears in the string 1532012030415, it may be only a part of another string of characters and does not represent the component version number.

[0113] Analyze the context information of the string's position. The more important the position of a string is, and the more keywords related to version control appear in its context information, the greater its context relevance score is, and the more likely the string is the component version number. This can be achieved through the following process:

[0114] First, determine the The position of the target format string in the data sample (i.e. the location information of the target format string), i.e. .

[0115] Secondly, we cut out the data sample The nearby paragraph (i.e., the target paragraph) is input into the Natural Language Processing Toolkit (NLTK) model to obtain the vocabulary contained in the paragraph.

[0116] Again, match the obtained vocabulary with preset keywords related to version control (such as #include, #define, version, release, etc.) to calculate the target format string In Location With keywords Matching score , as shown in formula (1):

[0117] (1);

[0118] in, Indicates the target paragraph and keywords The total number of words that have completed the match, Indicates the total number of words in the target paragraph; Indicates the shortest distance between the words in the target paragraph and the matched keywords. The shorter the distance, the better the matching effect.

[0119] Again, go through each keyword Get the corresponding matching score The total number of keywords is .

[0120] Again, set the corresponding weight of each keyword according to its importance in the document. (The weight is set according to the specific analysis situation), calculate the target format string Location The degree to which the context information matches the component version number , as shown in formula (2):

[0121] (2);

[0122] in, Indicates the total number of keywords. It should be noted that when the target format string is inside another string, its contextual relevance score with the component version number is 0.

[0123] In binary data samples, most strings or data do not appear repeatedly. When a string or a set of data appears repeatedly in a data sample, it may indicate that the string or data is an important identifier. The repeatability score of each target format string is analyzed. The higher the repeatability score, the more likely it is to be a component version number.

[0124] First, select a target format string, select a string that is consistent with the content of the target format string in the data sample, and determine the position of the target format string in the data sample. ; Secondly, using the NLTK model, the string of the same content is decomposed into words, phrases or other meaningful elements at different positions, that is, a sequence of multiple words and characters; thirdly, the similarity of the sequence is calculated (converted to vector to calculate cosine similarity) to obtain the string The degree of contextual similarity to candidate strings of the same content ; Again, set the threshold for repeated strings to obtain, that is, when the context similarity , it is considered to be a string Repeating string; Finally, calculate the target format string Frequency of occurrence , which is the target format string The repeatability score is as shown in formula (3):

[0125] (3);

[0126] in, Indicates the selected target format string The number of repeated strings, u represents the total number of strings included in the data sample. Then, the probability score of each target format string as the component version number of the current data sample is calculated by combining the repetitiveness score and the matching score. First, the target format string is calculated. and the degree of matching of the contextual information of its repeated strings The mean of the repeated target format string Contextual relevance score for component version numbers ; Secondly, combined with the target format string The repetitiveness score and the contextual relevance score for the component version number , calculate the target format string is the likelihood score of the current data sample , as shown in formula (4):

[0127] (4);

[0128] Finally, repeat the above process to get the probability score of each type of target format string as the component version number of the current data sample. , where the string with the highest probability score is the component version number of the current data sample.

[0129] The fourth step is to construct the component version number recognition model to be trained based on the probability score of each target format string being the component version number of the current data sample.

[0130] In the first to fourth steps above, by analyzing the matching scores between the vocabulary in the target paragraph and the preset keywords, the probability score of the target format string as the component version number of the current data sample can be calculated, and then a recognition model capable of identifying various component version numbers can be constructed based on the probability score.

[0131] 203 , using the component version number recognition model to be trained to recognize the data sample, and obtain the training component version number.

[0132] Here, the training component version number is screened out from the training set of data samples by using the multiple possibility scores output by the component version number recognition model to be trained. That is, the above step 203 can be performed by Figure 4 The steps shown achieve:

[0133] 401 , using the component version number recognition model to be trained to recognize the data sample, and obtaining a probability score of the training character string in the data sample being the component version number of the current data sample.

[0134] Here, the training string is the string in the training set. By inputting the training set in the sample data into the component version number recognition model to be trained, the probability score of each training string as the component version number of the current data sample is obtained.

[0135] 402 , determining the training component version number based on the likelihood score of the training string being the component version number of the current data sample.

[0136] Here, the maximum probability score is found among the probability scores of the training string as the component version number of the current data sample; and the training string corresponding to the maximum probability score is used as the training component version number. In this way, by analyzing the probability scores of the training string as the component version number of the current data sample, the string with a larger probability score is selected as the training component version number, thereby improving the accuracy of the training component version number.

[0137] In some possible implementations, the component version number corresponding to each sample can be obtained by identifying the character strings of corresponding formats in the samples through the component version number recognition model to be trained. However, it should be noted that not all samples in the training set and the actual working process use the date format as the component version number, so the character strings recognized by some samples do not contain any version number information. The training component version number of the data sample is determined by obtaining the output results of the component version number recognition models in different formats. In a specific example, first, by repeating the above process, the recognition models of different component version numbers are obtained; secondly, the samples in the training set are obtained in the format In the case of a component version number, the probability score of the obtained string as the component version number of the current data sample ; Again, compare the samples Likelihood scores for different component version number formats , get the component version number with the largest probability score; finally, use the string with the largest probability score as the component version number of the current data sample, that is, the training component version number.

[0138] 204 , based on the training component version number and the label of the data sample, the component version number recognition model to be trained is trained to obtain a trained component version number recognition model.

[0139] Here, the component version number recognition model to be trained is trained and verified by training the component version number and the label of the data sample, thereby obtaining a trained component version number recognition model.

[0140] In some possible implementations, the above step 204 can be performed by Figure 5 The steps shown achieve:

[0141] 501, determine the consistency rate between the training component version number and the label of the data sample.

[0142] Here, the validation set in the data sample is input into the obtained trained component version number recognition model to obtain the component version number output results of all samples in the validation set, and the component version number of the obtained data sample is compared with the component version number label of each data sample to judge the recognition performance of the trained component version number recognition model.

[0143] 502 , verify and train the component version number recognition model to be trained based on the consistency rate to obtain the trained component version number recognition model.

[0144] In the above steps 501 and 502, by analyzing the consistency rate between the training component version number and the label of the data sample, the component version number recognition model to be trained is verified and trained, which can make the recognition accuracy of the trained component version number recognition model higher.

[0145] In some possible implementations, the above step 502 includes the following two situations:

[0146] Case 1: If the consistency rate is less than a preset threshold, it is determined that the component version number recognition model to be trained has failed verification; and the component version number recognition model to be trained is trained based on the training component version number to obtain the trained component version number recognition model.

[0147] Here, the preset threshold can be a custom threshold, for example, the preset threshold is 0.9. For example, when the consistency rate between the training component version number and the label of the data sample , it is considered that the performance of the current component version number recognition model does not meet the requirements, the learning rate of the model is set to 0.3 and the above training process is repeated until the trained component version number recognition model meets the requirements.

[0148] Case 2: If the consistency rate is greater than or equal to the preset threshold, it is determined that the component version number recognition model to be trained has passed the verification; and the component version number recognition model to be trained that has passed the verification is determined as the trained component version number recognition model.

[0149] Here, when the consistency rate between the training component version number and the label of the data sample , it is considered that the performance of the current component version number recognition model meets the requirements. In this way, by judging whether the consistency rate between the training component version number and the label of the data sample is greater than the preset threshold, it is possible to determine whether the trained component version number recognition model has passed the verification, thereby improving the recognition accuracy of the trained component version number recognition model.

[0150] 205 , using the trained component version number recognition model to perform binary software component analysis on the software file to be analyzed, to obtain a target component version number of the software file to be analyzed.

[0151] Here, after obtaining the required trained component version number recognition model, the software file to be analyzed of the binary software to be analyzed is input into the recognition model to obtain the component version number corresponding to the file, thereby completing the binary software component analysis based on heuristic search.

[0152] In an embodiment of the present invention, first, a component version number recognition model to be trained is constructed through data samples; then, the data samples are recognized through the component version number recognition model to be trained to obtain the training component version number; in this way, training component version numbers in different formats can be obtained to enrich the training component version numbers, thereby avoiding false positives and false negatives caused by the incompleteness of a single rule. Then, based on the training component version number and the label of the data sample, the component version number recognition model to be trained is trained, so that a trained component version number recognition model with high recognition accuracy can be obtained. Finally, the trained component version number recognition model is used to perform binary software component analysis on the software file to be analyzed, and the target component version number of the software file to be analyzed can be obtained, so as to improve the accuracy of obtaining the target component version number of the software file to be analyzed.

[0153] An embodiment of the present invention provides a binary software component analysis device based on heuristic search, the device comprising:

[0154] An acquisition module, used for acquiring data samples for binary software component analysis;

[0155] A construction module, used to construct a component version number recognition model to be trained based on the data sample;

[0156] An identification module, used to identify the data sample using the component version number identification model to be trained to obtain a training component version number;

[0157] A training module, used for training the component version number recognition model to be trained based on the training component version number and the label of the data sample to obtain a trained component version number recognition model;

[0158] The analysis module is used to perform binary software component analysis on the software file to be analyzed using the trained component version number recognition model to obtain the target component version number of the software file to be analyzed.

[0159] In some possible implementations, the construction module is further used to determine a target format string based on the data sample; and to construct the component version number recognition model to be trained based on the target format string.

[0160] In some possible implementations, the construction module is further used to obtain a heuristic rule for searching for a component version number; based on the heuristic rule, a string search is performed on a training set in the data sample to obtain the target format string.

[0161] In some possible implementations, the construction module is further used to determine a target paragraph for each target format string in the data sample; perform language processing on the target paragraph to obtain vocabulary in the target paragraph; match the vocabulary with preset keywords to obtain a matching score; based on the matching score, determine a likelihood score for each target format string as a component version number of the current data sample; and based on the likelihood score for each target format string as a component version number of the current data sample, construct the component version number recognition model to be trained.

[0162] In some possible implementations, the construction module is further used to determine the location information of each target format string in the data sample; based on the location information, determine the degree of similarity between a candidate string and each target format string in the data sample; wherein the candidate string has the same content as each target format string; based on the degree of similarity, determine a repeatability score for each target format string; and merge the repeatability score and the matching score to obtain a probability score for each target format string as a component version number of the current data sample.

[0163] In some possible implementations, the identification module is further used to use the component version number identification model to be trained to identify the data sample, and obtain a possibility score of the training string in the data sample as the component version number of the current data sample; based on the possibility score of the training string as the component version number of the current data sample, determine the training component version number.

[0164] In some possible implementations, the identification module is further used to find the maximum likelihood score among the likelihood scores of the training string as the component version number of the current data sample; and use the training string corresponding to the maximum likelihood score as the training component version number.

[0165] In some possible implementations, the training module is also used to determine the consistency rate between the training component version number and the label of the data sample; based on the consistency rate, the component version number recognition model to be trained is verified and trained to obtain the trained component version number recognition model.

[0166] In some possible implementations, the training module is also used to determine that the component version number identification model to be trained has failed verification if the consistency rate is less than a preset threshold; and train the component version number identification model to be trained based on the training component version number to obtain the trained component version number identification model.

[0167] In some possible implementations, the training module is also used to determine that the component version number identification model to be trained has passed verification if the consistency rate is greater than or equal to a preset threshold; and determine the component version number identification model to be trained that has passed verification as the trained component version number identification model.

[0168] Optionally, the transmission medium can be a wired link (such as but not limited to coaxial cable, optical fiber and digital subscriber line (DSL)) or a wireless link (such as but not limited to wireless Fidelity (WIFI), Bluetooth and mobile device network).

[0169] It should be noted that: the device provided in the above embodiment is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the computer device is divided into different functional modules to complete all or part of the functions described above. In addition, the shopping guide device provided in the above embodiment and the image extension method embodiment belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0170] Figure 6 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. Figure 6 As shown, the electronic device 600 includes: a memory 601, a processor 602, and a computer program 603 stored in the memory 601 and running on the processor 602, wherein when the processor 602 executes the computer program 603, the device can execute any binary software component analysis method based on heuristic search described above. In addition, the embodiment of the present invention also protects a device, which may include a memory and a processor, wherein the memory stores an executable program code, and the processor is used to call and execute the executable program code to execute the binary software component analysis method based on heuristic search provided by the embodiment of the present invention.

[0171] This embodiment can divide the functional modules of the device according to the above method example. For example, it can correspond to each functional module, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware. It should be noted that the division of modules in this embodiment is schematic and is only a logical function division. There may be other division methods in actual implementation. In the case of dividing each module corresponding to each function, the device may also include a signal uploading module, a determination module, an adjustment module, etc. It should be noted that all relevant contents of each step involved in the above method embodiment can be referred to the functional description of the corresponding functional module, which will not be repeated here.

[0172] It should be understood that the device provided in this embodiment is used to perform the above-mentioned binary software component analysis method based on heuristic search, so the same effect as the above-mentioned implementation method can be achieved. In the case of an integrated unit, the device may include a processing module and a storage module. Among them, when the device is applied to a device, the processing module can be used to control and manage the actions of the device. The storage module can be used to support the device to execute mutual program codes, etc. Among them, the processing module can be a processor or a controller, which can implement or execute various exemplary logical boxes, modules and circuits described in conjunction with the disclosure of the present invention. The processor can also be a combination that implements a computing function, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, etc., and the storage module can be a memory.

[0173] In addition, the device provided in the embodiment of the present invention may be a chip, a component or a module, and the chip may include a connected processor and a memory; wherein the memory is used to store instructions, and when the processor calls and executes the instructions, the chip can execute the binary software component analysis method based on heuristic search provided in the above embodiment. This embodiment also provides a computer-readable storage medium, in which a computer program code is stored, and when the computer program code is run on a computer, the computer executes the above-mentioned related method steps to implement the binary software component analysis method based on heuristic search provided in the above embodiment.

[0174] The present embodiment also provides a computer program product, when the computer program product is run on a computer, the computer executes the above-mentioned related steps to implement the binary software component analysis method based on heuristic search provided in the above embodiment. Among them, the device, computer-readable storage medium, computer program product or chip provided in the present embodiment are all used to execute the corresponding method provided above, so the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method provided above, and will not be repeated here. Through the description of the above implementation mode, the technicians in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In practical applications, the above-mentioned function allocation can be completed by different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In the embodiments provided by the present invention, it should be understood that the disclosed device and method can be implemented in other ways. For example, the device embodiment described above is only schematic, for example, the division of modules or units is only a logical function division, and there can be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, which may be electrical, mechanical or other forms.

[0175] It should be noted that the sequence of the above-mentioned embodiments of the present invention is only for description and does not represent the advantages and disadvantages of the embodiments. The process depicted in the accompanying drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multi-tasking and parallel processing are also possible or may be advantageous. The various embodiments in this specification are described in a progressive manner, and the same and similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments. The above content is only a specific implementation method of the present invention, but the protection scope of the present invention is not limited to this. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be covered within the protection scope of the present invention.

Claims

1. A binary software component analysis method based on heuristic search, characterized in that: The method comprises: Obtaining data samples for binary software composition analysis; Based on the data sample, construct a component version number recognition model to be trained; Using the component version number recognition model to be trained, the data sample is recognized to obtain a training component version number; Based on the training component version number and the label of the data sample, the component version number recognition model to be trained is trained to obtain a trained component version number recognition model; Using the trained component version number recognition model to perform binary software component analysis on the software file to be analyzed, to obtain the target component version number of the software file to be analyzed; The step of constructing a component version number recognition model to be trained based on the data sample includes: Based on the data sample, determining a target format string; Based on the target format string, construct the component version number recognition model to be trained; The step of constructing the component version number recognition model to be trained based on the target format string includes: Determine a target segment of each target format string in the data sample; Performing language processing on the target paragraph to obtain vocabulary in the target paragraph; Matching the vocabulary with preset keywords to obtain a matching score; Based on the matching score, determining a likelihood score of each target format string as a component version number of the current data sample; Based on the probability score of each target format string as the component version number of the current data sample, construct the component version number recognition model to be trained; The determining, based on the matching score, a likelihood score of each target format string as a component version number of the current data sample includes: In the data sample, determining the position information of each target format character string; Based on the position information, determining the similarity between the candidate string and each of the target format strings in the data sample; wherein the candidate string has the same content as each of the target format strings; Based on the similarity, determining a repeatability score of each target format character string; The repeatability score and the matching score are merged to obtain a probability score of each target format string being a component version number of the current data sample.

2. The binary software component analysis method based on heuristic search according to claim 1 is characterized in that: The step of determining a target format string based on the data sample includes: Get the heuristic rules for searching component version numbers; Based on the heuristic rule, a character string search is performed on the training set in the data sample to obtain the target format character string.

3. The binary software component analysis method based on heuristic search according to claim 1 is characterized in that: The adopting the component version number recognition model to be trained to recognize the data sample to obtain the training component version number includes: Using the component version number recognition model to be trained, the data sample is recognized to obtain a probability score of the training character string in the data sample being the component version number of the current data sample; The training component version number is determined based on the likelihood score of the training string as the component version number of the current data sample.

4. The binary software component analysis method based on heuristic search according to claim 3 is characterized in that: The determining the training component version number based on the likelihood score of the training string as the component version number of the current data sample comprises: Finding the maximum likelihood score among the likelihood scores of the training string being the component version number of the current data sample; The training character string corresponding to the maximum likelihood score is used as the training component version number.

5. The binary software component analysis method based on heuristic search according to claim 1 is characterized in that: The step of training the component version number recognition model to be trained based on the training component version number and the label of the data sample to obtain a trained component version number recognition model includes: Determining a consistency ratio between the training component version number and the label of the data sample; The component version number recognition model to be trained is verified and trained based on the consistency rate to obtain the trained component version number recognition model.

6. The binary software component analysis method based on heuristic search according to claim 5 is characterized in that: The verifying and training the component version number recognition model to be trained based on the consistency rate to obtain the trained component version number recognition model includes: If the consistency rate is less than a preset threshold, it is determined that the component version number recognition model to be trained has failed verification; The component version number recognition model to be trained is trained based on the training component version number to obtain the trained component version number recognition model.

7. The binary software component analysis method based on heuristic search according to claim 5 is characterized in that: The verifying and training the component version number recognition model to be trained based on the consistency rate to obtain the trained component version number recognition model includes: If the consistency rate is greater than or equal to a preset threshold, it is determined that the component version number recognition model to be trained has passed verification; The component version number identification model to be trained that has passed verification is determined as the trained component version number identification model.

Images