Software component analysis method, device and equipment

Abstract

The invention provides a software component analysis method, device and equipment, relates to the technical field of computers, and is used for improving the accuracy of software component analysis. The software component analysis method comprises the steps that in the operation process of target software, class file information which is being loaded in the target software is monitored and collected; extracting N open source components used in the operation process of the target software and component information of the N open source components from the class file information; according to the component information of the N open source components and a preset component library, first component information of the target software is determined, the component library comprises a corresponding relation between the open source components and unique identifiers, the first component information comprises the N open source components, the unique identifiers of the N open source components and the component information, and N is a positive integer; and determining software component information of the target software according to the first component information.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device and equipment for analyzing software components. Background Art

[0002] With the development of Internet technology, software plays an important role in various fields. The complexity of software development is increasing. In order to improve the efficiency of software development, third-party components or open source components are introduced into software development. These third-party components often have potential security vulnerabilities and risks. Therefore, before the software is released, it is necessary to analyze the software components and perform security tests based on the software components to ensure the security of the software.

[0003] However, the current software component analysis technology determines the open source components that the software relies on by statically scanning the source code files of the software. However, in actual applications, the software components detected by this method may be misdetected or missed, and the accuracy of software component analysis is low. Summary of the invention

[0004] The present application provides a software component analysis method, device and equipment for improving the accuracy of software component analysis.

[0005] In a first aspect, an embodiment of the present application provides a software component analysis method, comprising: during the operation of a target software, monitoring and collecting class file information being loaded in the target software; extracting N open source components used by the target software during the operation and component information of the N open source components from the class file information; determining first component information of the target software based on the component information of the N open source components and a preset component library, the component library including a correspondence between open source components and unique identifiers, the first component information including N open source components, unique identifiers of the N open source components and component information, where N is a positive integer; determining the software component information of the target software based on the first component information.

[0006] In the embodiment of the present application, since the open source components implement corresponding functions in the target software by loading class files, by monitoring the class file information being loaded in the target software during the operation of the target software, N open source components used by the target software during the operation can be extracted from the class file information. Compared with the static detection method in the prior art, the dynamic monitoring method in the embodiment of the present application can accurately monitor the open source components used by the target software during the operation, thereby improving the accuracy of software component analysis.

[0007] In a possible implementation, the component library includes a first component library and a second component library, the first component library is a reference metadata library of open source components, and the second component library is a reference five-tuple information library of open source components; determining the first component information of the target software according to the component information of the N open source components and the preset component library, including: matching the component information of each open source component in the N open source components with the first component library, recording the unique identifier of the open source component that successfully matches the first component library among the N open source components, and determining the open source component that fails to successfully match the first component library among the N open source components as an unknown open source component; determining the unique identifier of the unknown open source component according to the five-tuple information of the unknown open source component in the target software and the second component library.

[0008] In a possible implementation, the quintuple information includes the class name, method name, parameter information, class path information and imported dependency information corresponding to the unknown open source component; determining the unique identifier of the unknown open source component according to the quintuple information of the unknown open source component in the target software and the second component library, including: determining whether there is a candidate open source component in the second component library according to the class name, the method name and the parameter information, and the candidate open source component has the same class name, method name and parameter information as the unknown open source component; if the candidate open source component exists, determining the unique identifier of the unknown open source component according to the class path information, the imported dependency information and the quintuple information of the candidate open source component; if the candidate open source component does not exist, determining the unique identifier matching the unknown open source component from the second component library according to the class directory structure information, method return value type, number of parameters and parameter type of the unknown open source component in the target software.

[0009] In a possible implementation, determining the software component information of the target software according to the first component information includes: determining whether the open source components included in the first component information and the second component information are the same according to the unique identifier of each open source component, the second component information is obtained by statically detecting the target software, the second component information includes M open source components, component information and unique identifiers of the M open source components, and M is a positive integer; if they are the same, then the N open source components, the component information and unique identifiers of the N open source components are merged with the component information of the M open source components to determine them as the software component information of the target software; if they are not the same, then determining the target open source component that matches the N open source components among the M open source components according to the unique identifier of each open source component, and merging the component information of the target open source component in the second component information with the first component information to determine them as the software component information of the target software.

[0010] In a possible implementation, the method further includes: statically scanning the source code files and executable files of the target software to obtain the second component information of the target software.

[0011] In a second aspect, an embodiment of the present application provides a software component analysis device, comprising: a monitoring module, used to monitor and collect class file information being loaded in the target software during the operation of the target software; an extraction module, used to extract N open source components used by the target software during the operation and component information of the N open source components from the class file information; a determination module, used to determine first component information of the target software based on the component information of the N open source components and a preset component library, the component library including a correspondence between open source components and unique identifiers, the first component information including N open source components, unique identifiers of the N open source components and component information, where N is a positive integer; the determination module is also used to determine the software component information of the target software based on the first component information.

[0012] In a possible implementation, the component library includes a first component library and a second component library, the first component library is a reference metadata library of open source components, and the second component library is a reference five-tuple information library of open source components; the determination module is specifically used to: match the component information of each of the N open source components with the first component library, record the unique identifier of the open source components that successfully match the first component library among the N open source components, and determine the open source components that fail to successfully match the first component library among the N open source components as unknown open source components; determine the unique identifier of the unknown open source component based on the five-tuple information of the unknown open source component in the target software and the second component library.

[0013] In a possible implementation, the quintuple information includes the class name, method name, parameter information, class path information and imported dependency information corresponding to the unknown open source component; the determination module is specifically used to: determine whether there is a candidate open source component in the second component library based on the class name, the method name and the parameter information, and the candidate open source component has the same class name, method name and parameter information as the unknown open source component; if the candidate open source component exists, determine the unique identifier of the unknown open source component based on the class path information, the imported dependency information and the quintuple information of the candidate open source component; if the candidate open source component does not exist, determine the unique identifier that matches the unknown open source component from the second component library based on the class directory structure information, method return value type, number of parameters and parameter type of the unknown open source component in the target software.

[0014] In a possible implementation, the determination module is specifically used to: determine whether the open source components included in the first component information and the second component information are the same according to the unique identifier of each open source component, the second component information is obtained by statically detecting the target software, and the second component information includes M open source components, component information and unique identifiers of the M open source components, where M is a positive integer; if they are the same, then the N open source components, the component information and unique identifiers of the N open source components are merged with the component information of the M open source components to determine them as the software component information of the target software; if they are not the same, then the target open source component that matches the N open source components among the M open source components is determined according to the unique identifier of each open source component, and the component information of the target open source component in the second component information is merged with the first component information to determine them as the software component information of the target software.

[0015] In a possible implementation, the software component device further includes a static detection module, which is used to statically scan the source code files and executable files of the target software to obtain the second component information of the target software.

[0016] In a third aspect, an embodiment of the present application provides a software component analysis device, comprising: at least one processor, and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the at least one processor implements the method described in the first aspect and any possible implementation manner by executing the instructions stored in the memory.

[0017] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions. When the computer instructions are executed on a computer, the computer executes the method described in the first aspect and any possible implementation manner.

[0018] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising computer instructions, which, when executed on a computer, enables the method described in the first aspect and any possible implementation method to be implemented.

[0019] The beneficial effects of the second to fifth aspects can be referred to the contents described in the first aspect above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 A schematic diagram of an application scenario of a software component analysis method provided in an embodiment of the present application;

[0021] Figure 2 A schematic diagram of a software component analysis method provided in an embodiment of the present application Figure 1 ;

[0022] Figure 3 A schematic diagram of a software component analysis method provided in an embodiment of the present application Figure 2 ;

[0023] Figure 4 A schematic diagram of the structure of a software component analysis device provided in an embodiment of the present application;

[0024] Figure 5 A schematic diagram of the structure of a software component analysis device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to better understand the technical solution provided by the embodiments of the present application, it will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0026] Please refer to Figure 1 , is a schematic diagram of an application scenario of a software component analysis method provided in an embodiment of the present application. Figure 1 As shown, the schematic diagram includes a device 110 and a software component analysis apparatus 120, and the target software 111 is deployed in the device 110. The device 110 and the software component analysis apparatus 120 can perform wired or wireless communication.

[0027] Device 110 refers to a device configured with an environment that supports the operation of target software 111. The environment configured in device 110 may be a test environment or a formal environment, which is not limited in the present embodiment. Device 110 is specifically, for example, a terminal device or a server, wherein the terminal device includes but is not limited to a mobile phone, a personal computer (PC), a tablet computer, a notebook computer, a PDA, a mobile internet device (MID), etc. Software component analysis device 120 refers to a device or device with data processing capability. In the case where software component analysis device 120 is a device with data processing capability, software component analysis device 120 may be a functional module in device 110, or a functional module in other devices, which is not limited in the present embodiment. Target software 110 may be a variety of applications, including but not limited to office software, entertainment software, financial software, payment software, etc.

[0028] Exemplarily, the target software 111 in the device 110 is software that has not been officially released. Before the target software 111 is officially released, it is necessary to perform software component analysis on the target software 111. Based on this, the software component analysis device 120 can control the start of the target software 111, and during the operation of the target software 111, monitor and collect the class file information being loaded in the target software, determine the first component information of the target software, and thus determine the software component information of the target software 111. The specific method of the software component analysis device 120 to determine the software component information of the target software 111 will be described in detail below.

[0029] Please refer to Figure 2 , which is a flowchart of a software component analysis method provided in an embodiment of the present application Figure 1 The following is performed by the analysis device Figure 2 The steps shown are described in detail, and the analysis device is, for example, Figure 1 The software component analysis device 120 is shown. Figure 2 The target software involved is, for example, Figure 1 Target software 111 is shown.

[0030] S201, during the running of the target software, monitoring and collecting class file information being loaded in the target software.

[0031] Among them, the class file information may include the class name being loaded, Package, and the related class information it depends on; as well as all method information contained in the class being loaded, the method information includes the method name, the number and type of input and output parameters, and the return value type; as well as the component package (generally a file) being or already loaded and its meta-information, the meta-information includes: the hash value of the package file and the loading path of the package file, among which the hash value of the package file can be used for component identification and anti-tampering verification.

[0032] The analysis device monitors and collects the class file information being loaded in the target software, which can be specifically executed through the monitoring logic code pre-written by the developer. Taking Java as an example, by modifying the bytecode related to class loading, all the method classes loaded during the current Java runtime and the package information of the method classes can be obtained. In this way, the analysis device can inject the monitoring logic code into the application of the target software through the code injection technology. When the target software starts running, the monitoring logic code is run to realize the monitoring and collection of the class file information being loaded in the target software.

[0033] In order to improve the convenience of monitoring and collecting file information, the pre-written monitoring logic code can also be encapsulated as a monitoring tool or other form, and directly called when used. The embodiments of the present application are not limited to this.

[0034] S202: extracting N open source components used by the target software during operation and component information of the N open source components from the class file information.

[0035] Since the open source components in the target software implement corresponding functions through class files, when the target software is running, the open source components used by the target software during operation can be determined by detecting the class file information being loaded in the target software.

[0036] Based on this, the analysis device can also extract N open source components used by the target software during operation and component information of the N open source components from the class file information. Among them, the component information of the N open source components described in the embodiment of the present application includes the component information of each open source component in the N open source components. The component information of each open source component may include the meta information of each open source component, wherein the meta information may include the hash value of the component package where the component is located, the package name, the alias of the component, etc.

[0037] S203, determining first component information of the target software according to component information of N open source components and a preset component library, wherein the first component information includes N open source components, unique identifiers of the N open source components, and component information, where N is a positive integer.

[0038] The component library may include a correspondence between multiple open source components and unique identifiers. The unique identifier of the open source component is, for example, a package uniform resource locator (PURL).

[0039] In a possible implementation, the component library may specifically include a first component library and a second component library. Among them, the first component library is a reference metadata library of open source components, and the second component library is a reference five-tuple information library of open source components. In layman's terms, the first component library includes the correspondence between open source components and reference metadata. For example, the first component library may be an officially provided open source component library, such as a Maven repository. The second component library includes the correspondence between open source components and five-tuple information. The second component library may be pre-built based on historical software or all publicly available open source components. Historical software may refer to software programs that have been officially put into operation or have passed security risk detection. The two construction methods of the second component library are described below.

[0040] Construction method 1: Build the second component library based on historical software.

[0041] Under this construction method, the analysis device can monitor all open source components in the historical software and the five-tuple information corresponding to all open source components from the program of the historical software, establish a corresponding relationship between each open source component and its corresponding five-tuple information, and generate a second component library.

[0042] Construction method 2: Build a second component library based on all publicly available open source components.

[0043] Under this construction method, the analysis device can obtain all currently disclosed open source components and their corresponding five-tuple information through network query, establish a corresponding relationship between the open source components and the five-tuple information, and generate a second component library.

[0044] In the above two construction methods, the data sources used are different, which can be applied to different software component analysis scenarios. For example, in actual applications, if software component analysis is performed on target software within a fixed business scope, all historical software within the fixed business scope can be used as data sources to construct a second component library, thereby reducing the amount of calculation for constructing the second component library and improving the efficiency of querying the second component library. If software component analysis is performed on different types of software, construction method 2 can be used to include all publicly available open source components on the market into the second component library, thereby expanding the coverage of the second component library for open source components.

[0045] Furthermore, as the demand for software development continues to increase, open source components are also constantly updated. Therefore, the analysis device can iteratively update the second component library based on newly added or version-updated open source components at preset time intervals.

[0046] In addition, in order to improve the accuracy of determining the open source component, other information of the open source component may also be stored in the second component library, such as the version number of the open source component, the brand information or manufacturer information of the open source component, etc.

[0047] It should be understood that, in this implementation, both the first component library and the second component library also include the correspondence between the open source components and the unique identifiers.

[0048] Based on the correspondence between the open source components and the unique identifiers in the component library, the analysis device can determine the first component information of the target software according to the component information of the N open source components and the component library. Specifically, the analysis device can match the component information of each open source component in the N open source components with all the open source components in the component library, thereby determining the unique identifier corresponding to each open source component in the N open source components.

[0049] Exemplarily, taking open source component A among N open source components as an example, the component information of open source component A includes the hash value of the component package where the component is located, the component package name where the component is located, the alias of the component, etc. Therefore, the analysis device can determine the open source component with the same hash value from the component library based on at least one of the above component information (such as the hash value), and determine the unique identifier corresponding to the open source component with the same hash value as the unique identifier of component A.

[0050] In a possible implementation, when the analysis device monitors and collects class file information, the component meta information included in the class file information may be missing, that is, the analysis device only extracts part of the meta information of the open source component from the class file information. In this case, the analysis device may not be able to directly match and obtain a unique identifier from the component library based on the partial meta information. For example, some construction tools will uniformly package all the open source components used in the target software, and erase the original component metadata files to obtain a software product that cannot be directly identified. Construction tools such as Apachemaven assembly plugin and Apache maven shade plugin. However, these construction tools will not affect the directory structure of dependent components when packaging, nor will they modify the logical code of dependent components (part of the package path code may be modified). Therefore, an embodiment of the present application provides a component library, which may include a first component library and a second component library. Among them, the relevant contents of the first component library and the second component library can correspond to the contents described above, and will not be repeated here.

[0051] Under this implementation, the analysis device may match the component information of each of the N open source components with the first component library, record the unique identifier of the open source component that successfully matches the first component library among the N open source components, and determine the open source components that fail to successfully match the first component library among the N open source components as unknown open source components.

[0052] Further, the analysis device obtains the quintuple information of the unknown open source component in the target software. For example, the analysis device can further extract the quintuple information of the unknown open source component from the class file information, wherein the quintuple information of the unknown open source component includes the class name, method name, parameter information, class path information and introduced dependency information corresponding to the unknown open source component. Then, the analysis device can determine the unique identifier of the unknown open source component based on the quintuple information of the unknown open source component and the second component library.

[0053] In order to improve the matching efficiency of the quintuple information of the unknown open source component and the second component library, the analysis device can first determine whether there is a candidate open source component in the second component library that has the same class name, method name and parameter information as the unknown open source component based on the class name, method name and parameter information of the unknown open source component.

[0054] If there are candidate open source components, since there may be multiple candidate open source components in the second component library that have the same class name, method name and parameter information as the unknown open source component, in order to improve the accuracy of determining the match, the analysis device may further perform multiple matches based on the class path information and introduced dependency information of the unknown open source component and the class path information and introduced dependency information of the candidate open source component to determine the unique identifier of the unknown open source component.

[0055] The multiple matching can be specifically as follows: Step 1, matching the class path information and introduced dependency information of the unknown open source component with the class path information and introduced dependency information of the candidate open source component, excluding the unmatched candidate open source components, and obtaining the remaining candidate open source components. Step 2, the analysis device matches the class path information of the unknown open source component with the class path information of other classes in the same directory of the remaining open source components. If the class path information of other classes is different from the class path information of the unknown open source component, the candidate open source component is excluded. If the class path information of other classes in the same directory of a candidate open source component is the same as the class path information of the unknown open source component, the unique identifier of the candidate open source component is determined as the unique identifier of the unknown open source component. In order to avoid accidental situations, the analysis device can repeat steps 1 and 2 for multiple matching. If the number of times the same candidate open source component is successfully matched exceeds a preset threshold during multiple matching processes, the unique identifier of the same candidate open source component is determined as the unique identifier of the unknown open source component. Among them, the preset threshold can be set according to actual needs, for example, 2, and the embodiment of the present application does not limit this.

[0056] In another case, if the class path information and introduced dependency information of the unknown open source component do not match the class path information and introduced dependency information of the candidate open source component, it may be that the target software has made some modifications to the unknown open source component, resulting in the analysis device being unable to directly match the unknown open source component based on the class path information and introduced dependency information to obtain the unique identifier of the unknown open source component. In this case, the analysis device can determine the unique identifier of the unknown open source component from the candidate open source component based on the class directory structure information, method return value type, number of parameters and parameter type of the unknown open source component. Specifically, the analysis device can first match the pending open source component with the same class directory structure information as the unknown open source component from the second component library based on the class directory structure information of the unknown open source component; then further match the pending open source component based on the method return value type, number of parameters and parameter type of the unknown open source component, and determine the unique identifier of the pending open source component in the pending open source component that is the same as the class directory structure information, method return value type, number of parameters and parameter type of the unknown open source component as the unique identifier of the unknown open source component.

[0057] Exemplarily, the class directory structure of the open source component can be represented as including X classes and Y methods, Q parameters, the parameter type of each of the Q parameters, and the return value type of each of the Y methods under the class path.

[0058] If there is no candidate open source component, a unique identifier that matches the unknown open source component is determined from the second component library based on the class directory structure information, method return value type, number of parameters and parameter type of the unknown open source component in the target software. Among them, the specific manner in which the analysis device determines the unique identifier that matches the unknown open source component from the second component library based on the class directory structure information, method return value type, number of parameters and parameter type of the unknown open source component in the target software can be referred to the content described above, and will not be repeated here. In a possible implementation, after the analysis device determines the unique identifier of each of the N open source components, it can be determined whether there are duplicate open source components in the N open source components based on the unique identifier. If so, the component information of the duplicate open source components is merged and regarded as one open source component.

[0059] S204: Determine software component information of the target software according to the first component information.

[0060] The first component information includes N open source components, component information and unique identifiers of the N open source components.

[0061] The analysis device can directly determine the N open source components, the component information and the unique identifiers of the N open source components as the software component information of the target software.

[0062] In a possible implementation, in order to improve the accuracy of the software component analysis of the target software, the target software may also be statically detected to obtain second component information, the second component information including M open source components, component information of the M open source components and a unique identifier, where M is a positive integer. Specifically, the analysis device may obtain the second component information by statically scanning the source code file and / or executable file of the target software. When the target software statically scans the source code file or the executable file, the software component information obtained by the scan is the second component information. When the target software statically scans the source code file and the executable file, the software component information scanned from the source code file and the software component information scanned from the executable file constitute the second component information. Among them, the executable file can be understood as a file obtained by compiling the source code file of the target software.

[0063] Since the target software uses different programming languages, the component information obtained by static detection is different, and the component information obtained by static detection of the source code file and the executable file of the same software is also different. Therefore, in the embodiment of the present application, in order to improve the accuracy of the second component information, more accurate second component information can be obtained by scanning the source code file and the executable file.

[0064] Exemplarily, the analysis device may perform static detection on the target software through a preconfigured static scanning tool, such as a software composition analysis (SCA) tool. In this example, the analysis device scans the source code file and / or executable file of the target software through the SCA tool to obtain a software bill of materials (SBOM). The software bill of materials is the second component information.

[0065] In this implementation, in actual applications, the second component information obtained by static scanning may have false detections or missed detections, wherein a false detection refers to the presence of the second component information but not the first component information. The absence of the first component information indicates that the open source component is not a component component that the target software depends on (i.e., it is used by the target software during operation), but it is detected by static scanning, so it is a false detection. A missed detection refers to the presence of the second component information but the presence of the first component information. The presence of the first component information indicates that the open source component is a component component that the target software depends on, but it is not detected by static scanning, indicating a missed detection. Therefore, the accuracy of the M open source components obtained from the second component information needs to be verified. However, static detection can also obtain component information that dynamic monitoring cannot obtain, such as version number information and manufacturer information of open source components.

[0066] Based on this, after obtaining the first component information and the second component information, the first component information and the second component information cannot be directly merged. The analysis device needs to determine whether the open source components included in the first component information and the second component information are the same based on the unique identifier of each open source component, that is, determine whether the N open source components are consistent with the M open source components.

[0067] If they are the same, the N open source components, the component information and unique identifiers of the N open source components are merged with the component information of the M open source components to determine the software component information of the target software. If they are not the same, the target open source component that matches the N open source components among the M open source components is determined based on the unique identifier of each open source component, and the component information of the target open source component in the second component information is merged with the first component information to determine the software component information of the target software. It should be understood that the fusion here refers to the fusion of the component information of the open source components with the same unique identifier.

[0068] Exemplarily, taking the example that the first component information includes three open source components A, B, and C, and the second component information includes three open source components A, C, and D, the specific method for the analysis device to determine the software component information of the target software is illustrated.

[0069] The analysis device compares the three open source components A, B, and C in the first component information with the three open source components A, C, and D in the second component information, and determines that the A and C components in the first component information are the same as the A and C components in the second component information, that is, the target open source components. If the second component information does not include the B open source component, it is determined that the B open source component was missed during the static detection process. If the first component information does not include the D open source component, but the second component information includes the D open source component, it is determined that the D open source component was misdetected during the static detection process. Therefore, the analysis device can merge the three open source components A, B, and C in the first component information and their corresponding component information and unique identifiers with the component information of the A and C components in the second component information to obtain the software component information of the target software.

[0070] In the software component analysis method provided in the embodiment of the present application, according to the unique identifier of the open source component, M open source components are matched with N open source components to determine the open source components that are misdetected or missed in static detection. After excluding the component information of the misdetected open source components, the component information of the target open source components of the M open source components and the N open source components in the second component information can be merged with the first component information to obtain richer software component information. In addition, since dynamic monitoring monitors the open source components loaded and used by the target software during its operation, it is more accurate than static detection.

[0071] In order to more clearly understand the process of the software component analysis method provided in the embodiment of the present application, Figure 3 The process diagram of the software component analysis method shown in FIG. Figure 2 Provide explanation.

[0072] like Figure 3 As shown, the product life cycle of the target software is: the target source code file is obtained through software development, the target source code file is compiled and constructed to obtain the target software product, and the target software product is deployed to obtain the executable target software. When performing software component analysis on the target software, the target source code file and / or the target software product can be statically detected to obtain the second component information, wherein the specific implementation method of static detection to obtain the second component information can correspond to the content described in the previous text, and will not be repeated here. Then, the target software product is deployed in the operating environment, the target software is started, and the first component information is obtained by dynamic monitoring, wherein the specific implementation method of dynamic monitoring to obtain the first component information can correspond to the content described in S201-S203 above, and will not be repeated here. Finally, the software component information of the target software can be determined based on the first component information and the second component information, wherein the specific implementation method of determining the software component information of the target software based on the first component information and the second component information can correspond to the content described in step S204 above, and will not be repeated here.

[0073] It should be noted that in Figure 3 In the illustrated process, static detection is optional. Furthermore, if both static detection and dynamic monitoring are performed, the static detection and dynamic monitoring can be performed simultaneously or sequentially, and the embodiment of the present application does not limit the execution order.

[0074] Based on the same inventive concept, an embodiment of the present application provides a software component analysis device, which is used to implement any of the above-mentioned software component analysis methods, for example, Figure 2 The software component analysis method shown in the figure can also realize the functions of the analysis device mentioned above.

[0075] Please refer to Figure 4 , is a schematic diagram of the structure of a software component analysis device provided in an embodiment of the present application. Figure 4 As shown, the software component analysis device 400 includes a monitoring module 401, an extraction module 402, and a determination module 403. Optionally, the software component analysis device 400 may further include a static detection module 403.

[0076] Exemplarily, the monitoring module 401 is used to monitor and collect the class file information being loaded in the target software during the operation of the target software; the extraction module 402 is used to extract N open source components used by the target software during the operation and the component information of the N open source components from the class file information; the determination module 403 is used to determine the first component information of the target software based on the component information of the N open source components and a preset component library, the component library including the correspondence between the open source components and the unique identifiers, the first component information including the N open source components, the unique identifiers of the N open source components and the component information, and N is a positive integer; the determination module 403 is also used to determine the software component information of the target software based on the first component information.

[0077] In a possible implementation, the component library includes a first component library and a second component library, the first component library is a reference metadata library of open source components, and the second component library is a reference five-tuple information library of open source components; the determination module 403 is specifically used to: match the component information of each open source component among N open source components with the first component library, record the unique identifier of the open source component that successfully matches the first component library among the N open source components, and determine the open source component that fails to match the first component library among the N open source components as an unknown open source component; determine the unique identifier of the unknown open source component based on the five-tuple information of the unknown open source component in the target software and the second component library.

[0078] In one possible implementation, the quintuple information includes the class name, method name, parameter information, class path information and introduced dependency information corresponding to the unknown open source component; the determination module 403 is specifically used to: determine whether there is a candidate open source component in the second component library based on the class name, method name and parameter information, and the candidate open source component has the same class name, method name and parameter information as the unknown open source component; if there is a candidate open source component, determine the unique identifier of the unknown open source component based on the class path information, introduced dependency information and the quintuple information of the candidate open source component; if there is no candidate open source component, determine the unique identifier that matches the unknown open source component from the second component library based on the class directory structure information, method return value type, number of parameters and parameter type of the unknown open source component in the target software.

[0079] In a possible implementation, the determination module 403 is specifically used to: determine whether the open source components included in the first component information and the second component information are the same according to the unique identifier of each open source component, the second component information is obtained by statically detecting the target software, and the second component information includes M open source components, component information and unique identifiers of the M open source components, where M is a positive integer; if they are the same, then the N open source components, the component information and unique identifiers of the N open source components are merged with the component information of the M open source components to determine them as the software component information of the target software; if they are not the same, then the target open source component that matches the N open source components among the M open source components is determined according to the unique identifier of each open source component, and the component information of the target open source component in the second component information is merged with the first component information to determine them as the software component information of the target software.

[0080] In a possible implementation, the software component device further includes a static detection module 404 for statically scanning the source code files and executable files of the target software to obtain the second component information of the target software.

[0081] Based on the same inventive concept, the embodiment of the present application provides a software component analysis device, which is used to implement any of the above-mentioned software component analysis methods, for example, Figure 2 The software component analysis method shown in the figure can also realize the function of the software component analysis device mentioned above.

[0082] Please refer to Figure 5 , is a schematic diagram of the structure of a software component analysis device provided in an embodiment of the present application. Figure 5 As shown, the software component analysis device 500 includes at least one processor 501 and a memory 502 communicatively connected to the at least one processor 501 .

[0083] The processor 501 may be a general-purpose processor or a dedicated processor. The processor 501 may include, for example, a baseband processor or a central processing unit. The baseband processor may be used to process the communication protocol and the communication data. The central processing unit may be used to control the software component analysis device 500, execute the software program and / or process the data. Different processors may be independent devices or may be arranged in one or more processing circuits, for example, integrated in one or more dedicated integrated circuits.

[0084] In one embodiment, the memory 502 stores instructions that can be executed by at least one processor 501. The at least one processor 501 implements the functions of the software component analysis device as described above by executing the instructions stored in the memory 502. Accordingly, the steps performed by the software component analysis device as described above can also be implemented.

[0085] In this embodiment, the software component analysis device 500 can also implement the functions of the previous software component analysis device 400, and at least one processor 501 in the software component analysis device 500 can also implement the functions of the previous monitoring module 401, the extraction module 402, the determination module 403 and the static detection module 404.

[0086] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes any of the software component analysis methods described above, for example, Figure 2 The software component analysis method shown.

[0087] Based on the same inventive concept, an embodiment of the present application provides a computer program product, comprising computer instructions, which, when executed on a computer, enables any of the software component analysis methods described above, for example, Figure 2 The software component analysis method shown is implemented.

[0088] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0089] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0090] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0091] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0092] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A software component analysis method, characterized in that: include: During the operation of the target software, monitoring and collecting class file information being loaded in the target software; Extracting N open source components used by the target software during operation and component information of the N open source components from the class file information; Determining first component information of the target software according to component information of the N open source components and a preset component library, wherein the component library includes a correspondence between open source components and unique identifiers, and the first component information includes N open source components, unique identifiers of the N open source components, and component information, where N is a positive integer; The software component information of the target software is determined according to the first component information.

2. The method according to claim 1, characterized in that The component library includes a first component library and a second component library, the first component library is a reference meta information library of open source components, and the second component library is a reference quintuple information library of open source components; Determining first component information of the target software according to component information of the N open source components and a preset component library includes: Matching component information of each open source component in the N open source components with the first component library, recording unique identifiers of the open source components in the N open source components that successfully match the first component library, and determining the open source components in the N open source components that fail to successfully match the first component library as unknown open source components; Determine a unique identifier of the unknown open source component according to the quintuple information of the unknown open source component in the target software and the second component library.

3. The method according to claim 2, characterized in that The five-tuple information includes the class name, method name, parameter information, class path information and introduced dependency information corresponding to the unknown open source component; Determining a unique identifier of the unknown open source component according to the quintuple information of the unknown open source component in the target software and the second component library includes: Determine, according to the class name, the method name, and the parameter information, whether there is a candidate open source component in the second component library, the candidate open source component having the same class name, method name, and parameter information as the unknown open source component; If the candidate open source component exists, determining a unique identifier of the unknown open source component according to the class path information, the introduced dependency information, and the five-tuple information of the candidate open source component; If the candidate open source component does not exist, a unique identifier matching the unknown open source component is determined from the second component library based on the class directory structure information, method return value type, parameter number and parameter type of the unknown open source component in the target software.

4. The method according to any one of claims 1 to 3, characterized in that: Determining software component information of the target software according to the first component information includes: Determining, according to the unique identifier of each open source component, whether the open source components included in the first component information and the second component information are the same, wherein the second component information is obtained by statically detecting the target software, and the second component information includes M open source components, component information and unique identifiers of the M open source components, where M is a positive integer; If they are the same, the N open source components, the component information and unique identifiers of the N open source components, and the component information of the M open source components are merged to determine the software component information of the target software; If they are not the same, the target open source component that matches the N open source components among the M open source components is determined based on the unique identifier of each open source component, and the component information of the target open source component in the second component information is merged with the first component information to determine it as the software component information of the target software.

5. The method according to claim 4, characterized in that The method further comprises: The source code files and executable files of the target software are statically scanned to obtain the second component information of the target software.

6. A software component analysis device, characterized in that: include: A monitoring module, used to monitor and collect class file information being loaded in the target software during its operation; An extraction module, used to extract N open source components used by the target software during operation and component information of the N open source components from the class file information; a determination module, configured to determine first component information of the target software according to component information of the N open source components and a preset component library, wherein the component library includes a correspondence between open source components and unique identifiers, and the first component information includes N open source components, unique identifiers of the N open source components, and component information, where N is a positive integer; The determination module is further used to determine the software component information of the target software according to the first component information.

7. The device according to claim 6, characterized in that The component library includes a first component library and a second component library, the first component library is a reference meta information library of open source components, and the second component library is a reference quintuple information library of open source components; The determination module is specifically used for: Matching component information of each open source component in the N open source components with the first component library, recording unique identifiers of the open source components in the N open source components that successfully match the first component library, and determining the open source components in the N open source components that fail to successfully match the first component library as unknown open source components; Determine a unique identifier of the unknown open source component according to the quintuple information of the unknown open source component in the target software and the second component library.

8. The device according to claim 7, characterized in that The five-tuple information includes the class name, method name, parameter information, class path information and introduced dependency information corresponding to the unknown open source component; The determination module is specifically used for: Determine, according to the class name, the method name, and the parameter information, whether there is a candidate open source component in the second component library, the candidate open source component having the same class name, method name, and parameter information as the unknown open source component; If the candidate open source component exists, determining a unique identifier of the unknown open source component according to the class path information, the introduced dependency information, and the five-tuple information of the candidate open source component; If the candidate open source component does not exist, a unique identifier matching the unknown open source component is determined from the second component library based on the class directory structure information, method return value type, parameter number and parameter type of the unknown open source component in the target software.

9. A software component analysis device, characterized in that: include: at least one processor, and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor implements the method according to any one of claims 1 to 5 by executing the instructions stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on a computer, the computer is caused to execute the method according to any one of claims 1 to 5.

11. A computer program product, characterized in that The invention comprises computer instructions, which, when executed on a computer, enable the method according to any one of claims 1 to 5 to be implemented.

Images