Legitimate software detection processing method and system based on big data analysis

Abstract

The invention discloses a genuine software detection processing method and system based on big data analysis, and relates to the technical field of software management, and the method comprises the steps: obtaining installation source information of each piece of installation software in to-be-detected client equipment; verifying the installation source information of each piece of installation software based on the software installation authorization library to identify whether each piece of installation software has a potential piracy risk or not; aiming at each identified risk installation software with the potential piracy risk, obtaining an online service log of the risk installation software, and extracting a multi-dimensional risk feature from the online service log; the multi-dimensional risk features of all the risk installation software are input into a piracy recognition model so as to correspondingly determine whether piracy risks exist or not, and the piracy recognition model adopts a deep learning model. Therefore, through comprehensive application of big data analysis and a deep learning model, automatic detection of genuine copy of various installation software in the equipment is realized.

Description

Technical Field

[0001] The present application relates to the field of software management technology, and in particular to a method and system for detecting and processing genuine software based on big data analysis. Background Art

[0002] In response to the problem of software piracy, governments and software companies are actively taking measures to promote the use of genuine software. Currently, in the field of software legalization management, some tools based on manual review and simple scanning have been applied to the market to assist organizations and enterprises in managing the installation and use of software.

[0003] At present, the detection and management of genuine software is mainly achieved through the following steps: first, collect the software installation status on the terminal device through manual recording or automatic scanning; then conduct manual analysis to confirm the legality and authorization status of the software; finally output a report for the managers of the enterprise or organization to conduct further compliance inspections. Therefore, manual operation occupies a very important part; whether it is the input and classification of software information or the verification of authorization status, it relies on a large amount of manual participation, which not only increases management costs, but also greatly reduces the efficiency of inspections. However, in large enterprises or government agencies, thousands of computer terminals need to be checked one by one, and manual detection and management methods are often unable to cope with it, which is prone to data omissions or errors.

[0004] In addition, the functions of current genuine software checking tools are relatively simple, mainly focusing on simple scanning and data comparison, relying on hard-coded rules to determine authorization status, lacking in-depth analysis and understanding of software usage behavior, and seriously lacking flexibility and intelligence, resulting in detection results that are often unsatisfactory.

[0005] In response to the above problems, the industry has not yet proposed a better technical solution. Summary of the invention

[0006] The present application provides a method, system, storage medium, computer program product and electronic device for detecting and processing genuine software based on big data analysis, which is used to at least solve the problems of cumbersome manual operation, poor detection flexibility and low efficiency in the current related technologies, and can efficiently, accurately and intelligently perform genuine software detection and management.

[0007] In the first aspect, an embodiment of the present application provides a genuine software detection and processing method based on big data analysis, including: obtaining the installation source information of each installed software in a client device to be detected; verifying the installation source information of each installed software based on a software installation authorization library to identify whether each installed software has a potential piracy risk; the software authorization library contains multiple authorized genuine software names and corresponding software authorized installation channels; for each risky installed software identified as having a potential piracy risk, obtaining the online service log of the risky installed software, and extracting multi-dimensional risk features from the online service log; the multi-dimensional risk features include software online update response frequency, software function module usage frequency, software plug-in loading information and software user behavior information; inputting the multi-dimensional risk features of each risky installed software into a piracy identification model to determine whether there is a piracy risk accordingly; the piracy identification model adopts a deep learning model.

[0008] In the second aspect, the embodiment of the present application provides a genuine software detection and processing system based on big data analysis, including: an installation source acquisition unit, used to obtain the installation source information of each installation software in the client device to be detected; a piracy risk initial identification unit, used to verify the installation source information of each installation software based on the software installation authorization library, so as to identify whether each installation software has a potential piracy risk; the software authorization library contains multiple authorized genuine software names and corresponding software authorized installation channels; a service log acquisition unit, used to obtain the online service log of the risky installation software for each risky installation software identified as having a potential piracy risk, and extract multi-dimensional risk features from the online service log; the multi-dimensional risk features include the software online update response frequency, the software function module usage frequency, the software plug-in loading information and the software user behavior information; a piracy risk determination unit, used to input the multi-dimensional risk features of each risky installation software into a piracy identification model, so as to determine whether there is a piracy risk accordingly; the piracy identification model adopts a deep learning model.

[0009] According to a third aspect, an electronic device is provided, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the steps of the genuine software detection and processing method based on big data analysis of any embodiment of the present application.

[0010] In a fourth aspect, an embodiment of the present application provides a storage medium on which a computer program is stored, characterized in that when the program is executed by a processor, the steps of the genuine software detection and processing method based on big data analysis of any embodiment of the present application are implemented.

[0011] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the genuine software detection and processing method based on big data analysis of any embodiment of the present application.

[0012] The method and system for detecting and processing genuine software based on big data analysis provided by this application can produce at least the following technical effects:

[0013] (1) Through big data analysis and deep learning technology, traditional manual inspection and simple rule judgment are transformed into automated multi-dimensional data analysis. The software installation source information is initially verified using the software installation authorization library, and the piracy risk of potential risk software is further automatically identified based on deep learning, which greatly reduces the reliance on manual review. It is particularly suitable for the management of massive terminal devices in large enterprises and institutions, thereby effectively improving management efficiency and avoiding missed detection and misjudgment problems in manual operations.

[0014] (2) In this technical solution, we not only rely on traditional simple scanning and hard-coded rules to determine the authorization status of the software, but also introduce a piracy identification model based on deep learning. By extracting the multi-dimensional risk characteristics of the software (such as online update response frequency, function module usage frequency, plug-in loading information, etc.) through online service logs, we can conduct in-depth analysis of the software usage behavior, and can flexibly respond to various complex software usage scenarios, significantly improving the intelligence and flexibility of detection, and avoiding the limitations of single rule detection.

[0015] (3) Deep learning models can capture complex patterns and associations in large-scale data and effectively identify potential risks that are difficult to detect with rule-based judgments. By learning the correlation and regularity of various risk characteristics, the model can autonomously optimize its recognition capabilities when faced with unknown software environments or ever-changing software usage behaviors, thereby improving the overall detection effect. Therefore, through this technical solution, it is possible to achieve stronger dynamic adaptability, timely identify new piracy methods and technologies, thereby effectively responding to the ever-changing pirated software environment and maintaining a high recognition accuracy and robustness.

[0016] Through this technical solution, through the application of big data analysis and deep learning models, massive data can be quickly analyzed and processed, and automatic detection of the authenticity of installed software can be achieved, which greatly reduces the involvement of manual operations and can help enterprises or institutions significantly reduce labor costs. In addition, this detection system framework has good scalability and can adapt to the complex software environment requirements of large enterprises or government agencies. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 A flowchart showing an example of a genuine software detection and processing method based on big data analysis according to an embodiment of the present application is shown;

[0019] Figure 2 A schematic diagram showing a structural connection of an example of a piracy identification model according to an embodiment of the present application is shown;

[0020] Figure 3 An operation flow chart of an example of extracting a time series feature matrix according to an embodiment of the present application is shown;

[0021] Figure 4 An operation flow chart of an example of adaptively determining the convolution kernel scale weight based on the information entropy weight calculation method according to an embodiment of the present application is shown;

[0022] Figure 5 A structural block diagram of an example of a genuine software detection and processing system based on big data analysis according to an embodiment of the present application is shown;

[0023] Figure 6 It is a schematic structural diagram of an embodiment of an electronic device of the present application. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0025] In the technical solution of this application, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved shall comply with the provisions of relevant laws and regulations and shall not violate public order and good morals.

[0026] Figure 1 A flowchart of an example of a genuine software detection and processing method based on big data analysis according to an embodiment of the present application is shown.

[0027] Regarding the executor of the method of the embodiment of the present application, it can be any controller or processor with computing or processing capabilities. Through the introduction of big data analysis, multi-dimensional risk feature extraction and deep learning models, a set of intelligent and efficient genuine software detection and processing methods are formed, which can effectively improve detection accuracy, reduce manual intervention and reduce management costs.

[0028] In some examples, it may be integrated and configured in an electronic device or terminal by means of software, hardware, or a combination of software and hardware, and the type of the terminal or electronic device may be diverse, such as a mobile phone, a tablet computer, or a desktop computer, etc.

[0029] like Figure 1 As shown, in step S110, the installation source information of each installed software in the client device to be detected is obtained.

[0030] In some embodiments, the detection system (or detection tool) can first obtain the relevant information of the installed software on the client device, especially the installation source information of the software, in an automated manner using a scanning tool (such as API call, system log analysis or registry parsing). The types of installation source information can be diverse, such as download channels (such as official website download, third-party site download, USB installation, network sharing, etc.), installation time, installation path, etc. Here, it is necessary to accurately sample and scan the source information of each installed software in the client device to ensure that all installed software can be fully covered, which can avoid mistakes or omissions in manual records and improve the efficiency and accuracy of detection.

[0031] In step S120, the installation source information of each installation software is verified based on the software installation authorization library to identify whether each installation software has a potential piracy risk.

[0032] It should be noted that the software authorization library contains multiple authorized genuine software names and corresponding software authorized installation channels. The software authorization library pre-stores a list of legal software, including genuine software names and their corresponding legal installation channels. In addition, system administrators can also regularly update and maintain the software authorization library to ensure that the genuine software information in it is up to date and covers a wide range of authorized channels (such as official websites, trusted app stores, etc.).

[0033] Here, the data in the software authorization library is used to compare the installation source information of each software. The authorization library contains the name of the legally authorized software and the corresponding installation channel. By comparing the software name and the installation channel, it is determined whether the software is genuinely authorized. For example, if a software is installed through an unauthorized third-party channel, the software will be marked as risky installation software with potential piracy risks. Therefore, through the comparison of the authorization library, software with potential piracy risks can be quickly screened out with high accuracy and reduced false positives, and it also avoids the subsequent piracy risk analysis process for all installed software, which improves the efficiency of piracy detection while also reducing resource consumption.

[0034] In step S130, for each risky installation software identified as having a potential piracy risk, an online service log of the risky installation software is obtained, and a multi-dimensional risk feature is extracted from the online service log.

[0035] Here, for the potential pirated software with irregular installation sources, its online service log is obtained through the network interface. The online service log includes the communication record between the software and the server during use, update response log, plug-in loading log, etc. Then, multi-dimensional risk features are extracted from these logs, which include the software online update response frequency, software function module usage frequency, software plug-in loading information and software user behavior information.

[0036] The description of the online update response frequency can be used to determine whether the software is frequently updated and whether the updates are consistent with the update cycle of genuine software. Specifically, genuine software usually has regular update pushes, and users will upgrade according to the update frequency released by the manufacturer. Pirated software may lack such update services, or have abnormal update response behavior (such as skipping updates from time to time or failing to update). Therefore, analyzing the user's update response behavior helps identify software piracy risks.

[0037] The description of the frequency of use of functional modules can analyze the frequency of use of the core functions of the software and determine whether it matches the normal use behavior of genuine software. Specifically, the functional modules of genuine software usually operate stably and comprehensively, and users can access and use all functional modules. Pirated software may have some missing functions or unstable operation. By recording the number of calls to the software functional modules, the operation success rate and other data, it can be detected whether the user lacks access to advanced functions for a long time or whether there are frequent abnormal behaviors such as crashes and errors.

[0038] Regarding the description of plug-in loading information, it can monitor whether the software has loaded unauthorized plug-ins or extension modules. Specifically, some pirated software may bypass the security mechanism of genuine software through plug-ins, illegal patches or cracking tools. These tools often tamper with the file structure of the software or load illegal plug-ins, causing the software to behave differently from the genuine software when it is started or running. By analyzing the file structure, memory usage, and plug-in loading status, the characteristics of illegal plug-in use can be extracted.

[0039] Regarding the description of software user behavior information, it can record user operation behavior and be used to evaluate whether there are abnormal operations or abnormal usage patterns. Specifically, the operation habits of genuine users are relatively fixed, such as frequency of use, operation time period, etc. The behavior of pirated users may be more abnormal, such as frequent switching of devices, cross-region use, abnormal operation time period, etc. By modeling the time and frequency of user operation behavior, it is helpful to discover the risk of pirated software that does not match the behavior pattern of genuine users.

[0040] Therefore, the introduction of multi-dimensional risk features designed with the above-mentioned feature dimensions can better understand the software's operating mode and the user's usage behavior, further improve the accuracy of piracy identification, and help identify software that appears to be genuine but may actually contain pirated features.

[0041] In step S140, the multi-dimensional risk features of each risky installed software are respectively input into a piracy identification model to determine whether there is a piracy risk. The piracy identification model adopts a deep learning model.

[0042] Here, the piracy identification model can be pre-trained using a data sample set containing a large amount of historical data and annotation information, so that it can accurately distinguish the behavior patterns of genuine software and pirated software.

[0043] In some implementations, during the inference phase, the piracy identification model can analyze the input multi-dimensional risk features and generate a piracy risk score or piracy risk probability value. If the probability value exceeds a preset threshold, the software is judged to be pirated. In addition, the deep learning model can continuously optimize itself and be updated with new data to improve its judgment accuracy and generalization ability.

[0044] Through the embodiments of the present application, the whole process from data collection to risk identification is highly automated, greatly improving the detection efficiency. First, the installation source information is used for global screening and verification to identify risky installed software in the client, and then the deep learning model is combined with multi-dimensional feature analysis to conduct in-depth analysis of each risky installed software to identify potential pirated software, which can effectively improve the detection accuracy. In addition, by continuously training the deep learning model and updating the software authorization library, the detection system can quickly adapt to new software and piracy methods that appear on the market, while supporting the expansion needs of large-scale enterprise environments.

[0045] In some examples of the embodiments of the present application, the piracy identification model is a multimodal neural network that comprehensively utilizes various types of risk features, specifically performing comprehensive analysis from two aspects: static features of temporal relationships and nonlinear relationships, to predict the final risk probability value of pirated software.

[0046] Figure 2 A schematic diagram of the structural connection of an example of a piracy identification model according to an embodiment of the present application is shown.

[0047] like Figure 2 As shown, the multimodal neural network 200 includes a CNN (Convolutional Neural Network) module 210, an MLP (Multi-Layer Perceptron) module 220, a feature fusion module 230 and a classification module 240.

[0048] The CNN module 210 is used to extract the local dependency between the software online update response frequency and the software functional module usage frequency in the multi-dimensional risk characteristics to generate corresponding timing pattern characteristics.

[0049] Specifically, the CNN module reconstructs the timing structure of the software online update response frequency and the software functional module usage frequency to adapt them to the convolution operation. Then, multiple convolution layers are used to extract local features of the timing data. The convolution kernel captures the local correlation and frequency change pattern of the features through the sliding window, such as the periodic fluctuation of the online update response frequency, the peaks and valleys of the functional module usage frequency, etc. By superimposing the convolution layers, more advanced timing pattern features can be extracted layer by layer, and finally the timing pattern features are generated.

[0050] The MLP module 220 is used to extract the nonlinear relationship between the software plug-in loading information and the software user behavior information in the multi-dimensional risk feature to generate the corresponding static pattern feature.

[0051] Specifically, the MLP module mainly processes the static information contained in the multi-dimensional risk features, processes the plug-in loading information and user behavior information, and extracts the complex, high-dimensional nonlinear patterns between these features. Specifically, the MLP module includes an input layer, a hidden layer, and an output layer. Through the input layer, the MLP module inputs and embeds the static features into a high-dimensional space. Through the hidden layer, the multi-layer fully connected structure of the MLP module can effectively capture the nonlinear relationship between complex features. For example, plug-in loading information may have complex potential connections with user operation behavior, and the hidden layer can extract these deep-level associations layer by layer. Finally, the MLP module outputs a feature vector representing the combined pattern of the learned static features, namely the static pattern feature.

[0052] It should be noted that although software plug-in loading information and software user behavior information are static, they often imply complex software usage habits and behavior patterns. The MLP module can capture the complex nonlinear relationship between plug-in loading and user behavior, such as the combination of different plug-ins, loading order and other complex information, and enhance the ability to identify pirated software. As a result, it can better identify potential piracy risks in complex behavior patterns, especially in scenarios where plug-in loading fails and user operation behavior is abnormal. The model can accurately detect the characteristics of pirated software and reduce false positives and false negatives.

[0053] By combining the CNN module and the MLP module, it is possible to simultaneously process temporal features (such as online update response frequency, functional module usage frequency) and static features (such as plug-in loading information, user operation behavior), ensuring that local patterns and global nonlinear relationships between features can be fully mined and modeled, avoiding the problem that a single model cannot capture complex behavior patterns. As a result, deep mining enables the system to comprehensively analyze software behavior, thereby improving the accuracy of identifying pirated software, especially showing strong recognition capabilities for software with abnormal functions, abnormal update responses, and unstable plug-in loading.

[0054] The feature fusion module 230 is used to fuse the temporal pattern features and the static pattern features to generate corresponding fused features.

[0055] Here, the feature fusion module can use various non-restricted methods to fuse the temporal pattern features and the static pattern features, such as simple feature concatenation or weighted fusion, so that the fused features can contain comprehensive information from different dimensions and different time levels, providing richer contextual feature data. By effectively fusing the temporal pattern features with the static pattern features, the comprehensive utilization of multimodal information is achieved, and a comprehensive understanding of software behavior is achieved, which can effectively deal with different types of pirated software and user behavior patterns.

[0056] The classification module 240 is used to classify the fused features through a fully connected layer to output a risk probability value that the risky installed software is pirated software.

[0057] Here, the classification module can use a typical fully connected layer network to classify the fused features. Specifically, the high-dimensional fused features of the fully connected layer network are processed through several layers, and the Sigmoid activation function is used in the last layer to generate a risk probability value that the risky installed software is pirated software. Then, according to the level of the risk probability value, it is judged whether the corresponding software is pirated. Therefore, the classification process based on deep learning can maintain high efficiency when processing large amounts of data, quickly generate piracy detection results, and provide real-time pirated software detection services for enterprises and users.

[0058] Through the embodiments of the present application, a multimodal neural network structure is adopted, and the system can be expanded according to the increase or change of feature dimensions (such as adding new behavioral features or plug-in loading modes). At the same time, through the continuous training mechanism of deep learning, the model can adapt to the changes in software behavior in different usage scenarios. As a result, the detection system has good scalability and adaptability, and can be continuously optimized and upgraded as the software market and user behavior change, effectively responding to the detection needs of new pirated software.

[0059] In some examples of the embodiments of the present application, the feature fusion module 230 adopts a feature fusion module based on a self-attention mechanism. By introducing the self-attention mechanism, the feature fusion module can perform fine-grained interactive analysis of temporal features and static features, so that feature fusion is no longer a simple linear combination, but dynamically captures the complex relationship between the features through the attention mechanism.

[0060] Specifically, the timing pattern features and static pattern features corresponding to the first risky installed software are received, and the feature matrix of the timing pattern features is: T is the total number of time steps, F 1 is the dimension of the time series feature, and the feature matrix of the static pattern feature is F 2 is the dimension of the static feature.

[0061] The temporal pattern features and static pattern features are projected separately through the linear transformation matrix to generate the corresponding query vector, key vector and value vector:

[0062]

[0063] In the formula, is the linear transformation weight matrix of the query, key, and value of the time series feature; is the linear transformation weight matrix of the query, key, and value of the static feature, d is the dimension of the potential feature, which is used to unify the representation of all input features; Qs ,K s ,V s They represent the query vector, key vector, and value vector corresponding to the time series features, respectively. p ,K p ,V p They represent the query vector, key vector and value vector corresponding to the static features respectively.

[0064] For the interaction between temporal features and static features, attention calculations are performed separately:

[0065] Z s =Attention(Q s ,K s ,V s ), formula (3)

[0066] Z p =Attention(Q p ,K p ,V p ), formula (4)

[0067]

[0068] Where Attention(·) represents the dot product attention calculation mechanism; is a scaling factor to prevent the dot product value from being too large and affecting the gradient calculation; softmax represents the softmax activation function, which converts the correlation value into a weight coefficient through the Softmax activation operation. The weight coefficient is used to perform a weighted summation on V to generate the fused feature representation; K T represents the transpose of the key vector K; Z s is the temporal feature self-attention representation; Z p It is the static feature self-attention representation.

[0069] Here, through the self-attention mechanism, weights can be automatically assigned to each feature according to its importance in the current scenario. For features with a strong risk of piracy, such as abnormal patterns in the frequency of online software updates, the model can assign higher weights to the feature to ensure that these key features have a greater impact on the final judgment. In addition, the dynamic weight adjustment of the self-attention mechanism ensures that the model is more sensitive to key features. For example, if a software has not been updated normally for a long time or the user operation frequency is abnormally high, the model will focus on these features through an adaptive mechanism, thereby improving the accuracy of piracy detection.

[0070] By mixing the query vector and key vector of temporal features and static features, we can further capture the interaction between them:

[0071] Z sp=Attention(Q s ,K p ,V p ), formula (6)

[0072] Z ps =Attention(Q p ,K s ,V s ), formula (7)

[0073] In the formula, Z sp Represents the first interactive attention feature of temporal features to static features, Z ps Represents the second interactive attention feature of static features on temporal features.

[0074] It should be noted that in multimodal features, the interaction complexity of temporal features and static features is usually very high. Through the self-attention mechanism, the model can establish deep associations between temporal and static features and capture potential interaction patterns between them. For example, fluctuations in the frequency of online updates may be related to plug-in loading failures or frequent user operations. Therefore, the collaborative analysis between temporal features and static features using the self-attention mechanism helps the model better understand the logic behind certain complex behavior patterns. For example, when the plug-in fails to load and the update frequency is abnormal, the detection system can capture the deep association of this behavior pattern, and the possibility of determining it as pirated software is greatly increased.

[0075] The temporal feature self-attention representation, the static feature self-attention representation, the first interactive attention feature and the second interactive attention feature are combined:

[0076] Z final =Z s +Z p +Z sp +Z ps , formula (8)

[0077] In the formula, Z final Indicates the fusion feature corresponding to the first risky installed software.

[0078] Through the embodiment of the present application, the self-attention mechanism is used to give the feature fusion module a higher adaptive ability, which can automatically adjust the importance of features as the data changes dynamically, so that the model has higher robustness and scalability when facing diverse software usage scenarios. In addition, because more accurate feature information can be captured through dynamic weighting and multi-dimensional interaction, the output after feature fusion has higher information density and relevance, making the piracy detection results have higher accuracy and lower false alarm rate.

[0079] In some examples of the embodiments of the present application, the CNN module adopts a multi-scale convolutional network module, in which multiple convolution kernels of different scales are introduced to simultaneously capture short-term fine-grained and long-term coarse-grained feature behavior patterns.

[0080] Specifically, convolution kernels of different scales act on the input feature matrix to generate multiple different feature maps that reflect short-term and long-term behavior patterns. For example, smaller convolution kernels can better capture feature changes in a short period of time, while larger convolution kernels can capture features over a long period of time.

[0081]

[0082] In the formula, F i is through a size of k i ×k i The feature matrix generated by the convolution kernel is Indicates the scale is k i ×k i The convolution kernel weight matrix, X t represents the input time series feature matrix, Conv(·) represents the convolution process; N is the total number of convolution kernels, α i is scale k i ×k i The convolution kernel scale weight corresponding to the convolution kernel.

[0083] Here, the features at different scales are fused through the summation operation, and the convolution kernel scale weight α is used i Controlling the influence of each scale in the final fused features enables the model to flexibly adjust the importance of each scale, thereby better capturing the behavioral patterns of pirated software.

[0084] It should be noted that there are various ways to determine the convolution kernel scale weight. On the one hand, it can be pre-set by user input parameters. On the other hand, it can be used as a learnable parameter and adjusted during the model training iteration process, and all of them are within the scope of implementation of the embodiments of the present application.

[0085] Through the embodiment of the present application, a multi-scale convolutional network module is used for multi-scale convolution and feature fusion, which can capture multi-level behavior patterns from short-term anomalies to long-term stagnation behaviors, and can simultaneously identify behavioral features of different time granularities, thereby improving the model's ability to detect complex behavior patterns, especially being more sensitive to subtle anomalies exhibited by pirated software at different times. In addition, through the convolution kernel scale weight, the model can automatically adjust the importance of different convolution kernel scales according to the actual scenario, enhancing the adaptability of feature expression.

[0086] Figure 3An operational flowchart of an example of extracting a time series feature matrix according to an embodiment of the present application is shown.

[0087] In step S310, time series analysis is performed on the online service log according to a preset time window size to extract a time series feature group.

[0088] Here, the timing feature group contains timing features corresponding to a preset number of time windows. The timing features include the software online update response frequency and the frequency of use of software functional modules. Therefore, a feature batch is constructed through multiple time windows to provide a data basis for subsequent dependency analysis.

[0089] In step S320, the standard deviation of each time series feature and the covariance between different time series features are calculated based on the time series feature group to analyze the mutual dependence between different time series features.

[0090] Here, the Pearson Correlation Coefficient (PCC) is used to measure the correlation between each feature to define the dependency between different features.

[0091]

[0092] In the formula, Cov(f u ,f v ) is the time series feature f u With the timing characteristics f v The covariance between and Respectively represent f u The standard deviation and f v The standard deviation of uv represents f u With f v The degree of interdependence between

[0093] Here, the standard deviation is used to measure the volatility of each feature in the sample set, reflecting whether the feature has significant changes. Features with large standard deviations indicate that their values ​​change dramatically, may contain richer information, and should be given greater weights in the feature fusion process. Covariance is used to measure the common change trend of two features in the sample set. If two feature values ​​increase or decrease at the same time, they are positively correlated; if one increases and the other decreases, they are negatively correlated. Through covariance, those features with strong correlations can be identified, and the common changes of these features may be an important criterion for the piracy behavior pattern. For example, if the update frequency and the frequency of use of functional modules change in coordination, it may be a specific type of pirated software behavior.

[0094] Therefore, through the Pearson correlation coefficient, the potential relationship between the temporal features and the static features can be identified, so that those features with strong correlation in piracy detection can get higher weights.

[0095] In step S330, a correction weight of each time series feature is calculated according to the correlation between different time series features.

[0096] The weight of each feature is dynamically adjusted based on its dependency on other features. u The weight β u It can be determined by normalizing the weighted sum of its correlation with other features:

[0097]

[0098] In the formula, β u is the feature f u The weight of , S is the total number of features;

[0099] It should be noted that features in different time periods may have different influences, and dynamically adjusting weights enables the model to adapt to changes in time series features, especially in pirated software detection scenarios with complex behavior patterns. In this embodiment, unlike static weight allocation, by considering the interdependence between features, a dynamic weighting mechanism is used, so that features that are highly correlated with other features have higher weights, which can show their importance.

[0100] In step S340, weighted correction is performed on the corresponding time series features based on the respective correction weights to obtain a time series feature matrix.

[0101] Finally, all features are fused by weighted summation to obtain the final fused time series feature matrix:

[0102]

[0103] Through the embodiments of the present application, by calculating the standard deviation and covariance, specific behavior patterns within certain time periods can be identified. When multiple timing features (such as the frequency of use and update frequency of functional modules) change together in different time periods, the interaction patterns between these complex timing features can be identified, further improving the comprehensiveness of the detection. Thus, based on covariance and correlation analysis, the timing features are no longer simply weighted when fused, but by calculating their dependence on other features, the weight distribution in the fusion process is dynamically adjusted, ensuring the rationality of the timing features in the entire feature fusion, and improving the responsiveness of the detection system to dynamic behavior.

[0104] In some preferred implementations of the embodiments of the present application, the convolution kernel scale weight is adaptively determined by a weight calculation method based on information entropy (Entropy-based Weighting). Using the entropy weight calculation method, the model will assign weights according to the amount of information (i.e., information entropy) in the feature matrix generated by each convolution kernel scale, which can ensure that feature matrices with high information content obtain higher weights, helping the model focus on more important features.

[0105] Figure 4 An operational flowchart of an example of adaptively determining the convolution kernel scale weight based on the information entropy weight calculation method according to an embodiment of the present application is shown.

[0106] like Figure 4 As shown, in step S410, the eigenvalues ​​in each scale feature matrix are calculated to construct a probability distribution.

[0107]

[0108] In the formula, Denotes the feature matrix F i The eigenvalue of the jth element in , Represents eigenvalue The probability distribution of Represents eigenvalue The frequency of occurrence, is the feature matrix F i The total frequency of all eigenvalues ​​in .

[0109] In step S420, the information entropy of each scale feature matrix is ​​calculated.

[0110]

[0111] In the formula, H(F i ) represents the feature matrix F i Information entropy.

[0112] In step S430, the convolution kernel scale weight corresponding to each convolution kernel is calculated:

[0113]

[0114] In the formula, α i Indicates the scale is k i ×k i The convolution kernel scale weights.

[0115] In this way, the weight of each convolution kernel scale will be dynamically adjusted according to the information entropy of the feature matrix, ensuring that the feature matrix with high information entropy occupies a larger proportion in the final fusion feature. Feature matrices with high information entropy usually contain more complex behavior patterns or abnormal patterns. By assigning higher weights to these features, the model can more sensitively capture potential piracy behaviors. For example, during the use of software, the frequency of use of functional modules in certain time periods is abnormally high. The information entropy will capture the complexity of this pattern and give the convolution kernel a higher weight, thereby improving the model's sensitivity to this pattern. In addition, feature matrices with low information entropy usually contain noise or irrelevant information. By automatically assigning lower weights, the model can effectively ignore irrelevant features and reduce the interference of noise on the model. For example, features that do not change for a long time may be regarded as irrelevant behaviors or noise, but through information entropy calculation, such features will be assigned lower weights. In addition, the weight of each convolution kernel scale will change dynamically with the data, allowing the model to flexibly respond to feature changes in different scenarios and improve the model's ability to detect diverse behavior patterns.

[0116] Furthermore, in some examples of the embodiments of the present application, the loss function of the piracy identification model adopts a hybrid loss function including classification loss and regularization loss based on information entropy. Specifically, the classification loss adopts the cross entropy loss function, which is used to measure the difference between the predicted value and the true label of the model in the classification task, ensuring that the model can accurately classify pirated software and genuine software. In addition, by incorporating the information entropy regularization term, the model can dynamically adjust the weight of the convolution kernel scale according to the behavior of each sample during each training process to prevent over-reliance on certain high-weight feature dimensions. The regularization term ensures that the weights of the convolution kernels remain reasonably distributed to avoid excessive weights of some convolution kernels, which causes other feature dimensions to be ignored.

[0117] Exemplarily, the loss function of the piracy identification model is:

[0118]

[0119] Where, L total represents the loss function of the piracy identification model, represents the cross entropy loss of the mth sample, Represents the information entropy regularization loss of the mth sample; is the actual category label of the mth sample, where label value 0 represents a non-pirated software sample and label value 1 represents a pirated software sample; is the model's predicted value of the piracy risk probability for the mth sample; C is the total number of classification categories, C = 2; M is the total number of data samples in the data sample set; is the mth sample in the convolution kernel scale k q ×k q The weight under , λ represents the loss balancing hyperparameter.

[0120] Here, λ can be a preset or learnable hyperparameter. By adjusting the hyperparameter λ, the model can flexibly adjust between classification accuracy and feature weight distribution. For example, in scenarios where classification accuracy is more important, the impact of cross entropy loss can be increased; and in scenarios where feature weight distribution has a greater impact on performance, the role of the regularization term can be enhanced.

[0121] It should be noted that by introducing a regularization term based on information entropy, the model can dynamically adjust the weights of different convolution kernel scales according to the characteristics of each sample, so that the model can automatically identify which feature dimensions and time points are more important. This mechanism ensures that the model can adaptively adjust the weights according to the performance of the features when faced with complex behavior patterns (such as the frequency of software use, update response frequency, etc.). For example, when detecting pirated software, specific behavior patterns (such as abnormal plug-in loading or abnormal frequency of use of functional modules) can be given higher weights to improve recognition capabilities. At the same time, the weight adjustment process can dynamically reduce reliance on low-information or noise features, prevent the model from being misled by irrelevant features, and thus improve overall robustness and stability.

[0122] Through the loss function of the embodiment of the present application, the cross entropy loss is used to ensure the accuracy of the model in the classification task, that is, the model can accurately distinguish between pirated and genuine software. The information entropy regularization term is used to ensure the rationality of the weight distribution of the model in the multi-scale feature fusion process, avoiding the model's excessive reliance on certain features. Thus, the balance between classification performance and feature weight distribution can be flexibly adjusted. Through the balanced optimization of dual losses, each training iteration can simultaneously optimize the classification accuracy and feature weight distribution, find the best feature fusion solution more quickly, and enhance the adaptability of the model.

[0123] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of actions combined, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application. In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0124] Figure 5 A structural block diagram of an example of a genuine software detection and processing system based on big data analysis according to an embodiment of the present application is shown.

[0125] like Figure 5As shown, the genuine software detection and processing system 500 based on big data analysis includes an installation source acquisition unit 510, a piracy risk initial identification unit 520, a service log acquisition unit 530 and a piracy risk determination unit 540.

[0126] The installation source acquisition unit 510 is used to acquire the installation source information of each installation software in the client device to be detected.

[0127] The piracy risk initial identification unit 520 is used to verify the installation source information of each installation software based on the software installation authorization library to identify whether each installation software has potential piracy risks; the software authorization library contains multiple authorized genuine software names and corresponding software authorized installation channels.

[0128] The service log acquisition unit 530 is used to obtain the online service log of each risky installation software that is identified to have potential piracy risk, and extract multi-dimensional risk features from the online service log; the multi-dimensional risk features include software online update response frequency, software function module usage frequency, software plug-in loading information and software user behavior information.

[0129] The piracy risk determination unit 540 is used to input the multi-dimensional risk characteristics of each of the risky installed software into the piracy identification model to determine whether there is a piracy risk; the piracy identification model adopts a deep learning model.

[0130] In some embodiments, an embodiment of the present application provides a non-volatile computer-readable storage medium, in which one or more programs including execution instructions are stored, and the execution instructions can be read and executed by an electronic device (including but not limited to a computer, a server, or a network device, etc.) to execute the steps of any of the above-mentioned methods for detecting and processing genuine software based on big data analysis in the present application.

[0131] In some embodiments, the embodiments of the present application also provide a computer program product, which includes a computer program stored on a non-volatile computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer performs any step of the above-mentioned method for detecting and processing genuine software based on big data analysis.

[0132] In some embodiments, an embodiment of the present application also provides an electronic device, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the steps of the genuine software detection and processing method based on big data analysis.

[0133] Figure 6 is a schematic diagram of the hardware structure of an electronic device for executing a genuine software detection and processing method based on big data analysis provided by another embodiment of the present application, such as Figure 6 As shown, the device includes:

[0134] One or more processors 610 and memory 620, Figure 6 A processor 610 is taken as an example.

[0135] The device for executing the genuine software detection and processing method based on big data analysis may also include: an input device 630 and an output device 640.

[0136] The processor 610, the memory 620, the input device 630 and the output device 640 may be connected via a bus or other means. Figure 6 The example of connecting through bus is taken in the following.

[0137] The memory 620, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer executable programs and modules, such as program instructions / modules corresponding to the genuine software detection and processing method based on big data analysis in the embodiment of the present application. The processor 610 executes various functional applications and data processing of the server by running the non-volatile software programs, instructions and modules stored in the memory 620, that is, the genuine software detection and processing method based on big data analysis in the above method embodiment is implemented.

[0138] The memory 620 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 620 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 620 may optionally include a memory remotely arranged relative to the processor 610, and these remote memories may be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0139] The input device 630 can receive input digital or character information and generate signals related to user settings and function control of the electronic device. The output device 640 can include a display device such as a display screen.

[0140] The one or more modules are stored in the memory 620, and when executed by the one or more processors 610, perform the genuine software detection and processing method based on big data analysis in any of the above method embodiments.

[0141] The above-mentioned product can execute the method provided in the embodiment of the present application, and has the functional modules and beneficial effects corresponding to the execution method. For technical details not fully described in this embodiment, please refer to the method provided in the embodiment of the present application.

[0142] The electronic devices of the embodiments of the present application exist in various forms, including but not limited to:

[0143] (1) Mobile communication equipment: This type of equipment is characterized by having mobile communication functions and its main purpose is to provide voice and data communications. This type of terminal includes: smart phones, multimedia phones, functional phones, and low-end phones.

[0144] (2) Ultra-mobile personal computer devices: These devices belong to the category of personal computers, have computing and processing functions, and generally also have mobile Internet access features. These terminals include: PDA, MID and UMPC devices, etc.

[0145] (3) Portable entertainment devices: These devices can display and play multimedia content. They include audio and video players, handheld game consoles, e-books, smart toys, and portable car navigation devices.

[0146] (4) Other onboard electronic devices with data interaction functions, such as on-board devices installed in vehicles.

[0147] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0148] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0149] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for detecting and processing genuine software based on big data analysis, comprising: Obtaining installation source information of each installed software in the client device to be detected; Verifying the installation source information of each installation software based on the software installation authorization library to identify whether each installation software has a potential piracy risk; the software authorization library contains multiple authorized genuine software names and corresponding software authorized installation channels; For each risky installation software identified as having a potential piracy risk, an online service log of the risky installation software is obtained, and a multi-dimensional risk feature is extracted from the online service log; The multi-dimensional risk features include software online update response frequency, software function module usage frequency, software plug-in loading information and software user behavior information; Inputting the multi-dimensional risk characteristics of each of the risky installed software into the piracy identification model to determine whether there is a piracy risk; The piracy identification model adopts a deep learning model.

2. The method according to claim 1, wherein: The piracy identification model is a multimodal neural network, which includes a CNN module, an MLP module, a feature fusion module and a classification module; The CNN module is used to extract the local dependency between the software online update response frequency and the software function module usage frequency in the multi-dimensional risk feature to generate corresponding timing pattern features; The MLP module is used to extract the nonlinear relationship between the software plug-in loading information and the software user behavior information in the multi-dimensional risk feature to generate a corresponding static pattern feature; The feature fusion module is used to fuse the temporal pattern feature and the static pattern feature to generate a corresponding fusion feature; The classification module is used to classify the fused features through a fully connected layer to output a risk probability value that the risky installed software is pirated software.

3. The method according to claim 2, wherein: The feature fusion module adopts a feature fusion module based on a self-attention mechanism and is used to generate fusion features by performing the following operations: Receive the time sequence pattern features and static pattern features corresponding to the first risky installed software; the feature matrix of the time sequence pattern features is T is the total number of time steps, F1 is the dimension of the time series feature; the feature matrix of the static pattern feature is F2 is the dimension of static features; The temporal pattern features and static pattern features are projected separately through the linear transformation matrix to generate the corresponding query vector, key vector and value vector: In the formula, is the linear transformation weight matrix of the query, key, and value of the time series feature; is the linear transformation weight matrix of the query, key, and value of the static feature, d is the dimension of the latent feature, which is used to unify the representation of all input features; Q s ,K s ,V s They represent the query vector, key vector, and value vector corresponding to the time series features, respectively. p ,K p ,V p Respectively represent the query vector, key vector and value vector corresponding to the static features; For the interaction between temporal features and static features, attention calculations are performed separately: Z s =Attention(Q s ,K s ,V s ), Z p =Attention(Q p ,K p ,V p ), Where Attention(·) represents the dot product attention calculation mechanism; is a scaling factor to prevent the dot product value from being too large and affecting the gradient calculation; softmax represents the softmax activation function, which converts the correlation value into a weight coefficient through the Softmax activation operation. The weight coefficient is used to perform a weighted summation on V to generate the fused feature representation; K T represents the transpose of the key vector K; Z s is the temporal feature self-attention representation; Z p It is a static feature self-attention representation; By mixing the query vector and key vector of temporal features and static features, we can further capture the interaction between them: Z sp =Attention(Q s ,K p ,V p ), Z ps =Attention(Q p ,K s ,V s ), In the formula, Z sp Represents the first interactive attention feature of temporal features to static features, Z ps A second interactive attention feature representing the static feature on the temporal feature; The temporal feature self-attention representation, the static feature self-attention representation, the first interactive attention feature and the second interactive attention feature are merged: WITH final =Z s +Z p +Z sp +Z ps , In the formula, Z final Indicates the fusion feature corresponding to the first risky installed software.

4. The method according to claim 2 or 3, wherein: The CNN module adopts a multi-scale convolutional network module; the multi-scale convolutional network module introduces multiple convolution kernels of different scales to simultaneously capture short-term fine-grained and long-term coarse-grained feature behavior patterns: In the formula, F i is through a size of k i ×k i The feature matrix generated by the convolution kernel is Indicates the scale is k i ×k i The convolution kernel weight matrix, X t represents the input time series feature matrix, Conv(·) represents the convolution process; N is the total number of convolution kernels, α i is scale k i ×k i The convolution kernel scale weight corresponding to the convolution kernel.

5. The method according to claim 4, wherein: The convolution kernel scale weight is adaptively determined by a weight calculation method based on information entropy: Calculate the eigenvalues ​​in each scale feature matrix to construct a probability distribution: In the formula, Denotes the feature matrix F i The eigenvalue of the jth element in , Represents eigenvalue The probability distribution of Represents eigenvalue The frequency of occurrence, is the feature matrix F i The total frequency of all eigenvalues ​​in ; Calculate the information entropy of each scale feature matrix: In the formula, H(F i ) represents the feature matrix F i Information entropy of Calculate the convolution kernel scale weight corresponding to each convolution kernel: In the formula, α i Indicates the scale is k i ×k i The convolution kernel scale weights.

6. The method according to claim 4, wherein: The extraction of the time series feature matrix includes: Performing time series analysis on the online service log according to a preset time window size to extract a time series feature group, wherein the time series feature group includes time series features corresponding to a preset number of time windows, and the time series features include a software online update response frequency and a software function module usage frequency; The standard deviation of each time series feature and the covariance between different time series features are calculated based on the time series feature group to analyze the mutual dependence between different time series features: In the formula, Cov(f u ,f v ) is the time series feature f u With the timing characteristics f v The covariance between and Respectively represent f u The standard deviation and f v The standard deviation of uv represents f u With f v The degree of interdependence between Calculate the modified weight of each time series feature according to the correlation between different time series features: In the formula, β u is the feature f u The weight of , S is the total number of features; Based on each of the correction weights, the corresponding time series features are weighted and corrected to obtain a time series feature matrix:

7. The method according to claim 6, wherein: The loss function of the piracy identification model is: Where, L total represents the loss function of the piracy identification model, represents the cross entropy loss of the mth sample, Represents the information entropy regularization loss of the mth sample; is the actual category label of the mth sample, where label value 0 represents a non-pirated software sample and label value 1 represents a pirated software sample; is the model's predicted value of the piracy risk probability for the mth sample; C is the total number of classification categories, C = 2; M is the total number of data samples in the data sample set; is the mth sample in the convolution kernel scale k q ×k q The weight under , λ represents the loss balancing hyperparameter.

8. A genuine software detection and processing system based on big data analysis, comprising: An installation source acquisition unit, used to acquire installation source information of each installation software in the client device to be detected; A piracy risk initial identification unit is used to verify the installation source information of each installation software based on the software installation authorization library to identify whether each installation software has a potential piracy risk; the software authorization library contains multiple authorized genuine software names and corresponding software authorized installation channels; A service log acquisition unit, for acquiring, for each risky installation software identified as having a potential piracy risk, an online service log of the risky installation software, and extracting a multi-dimensional risk feature from the online service log; The multi-dimensional risk features include software online update response frequency, software function module usage frequency, software plug-in loading information and software user behavior information; A piracy risk determination unit, used to input the multi-dimensional risk characteristics of each of the risky installed software into a piracy identification model to determine whether there is a piracy risk; The piracy identification model adopts a deep learning model.

Images