Software package detection method, medium and electronic equipment

Abstract

The invention is applied to the technical field of computers, and provides a software package detection method, a medium and electronic device.The method comprises the steps that a to-be-detected software package and feature information of the to-be-detected software package are obtained, and the feature information comprises programming language features and release information; according to the programming language features, running the to-be-tested software package in a running environment corresponding to the programming language features; acquiring a behavior log and a release file of the running process of the to-be-tested software package output by the running environment in the running environment; based on the fact that at least one of the behavior log, the release file and the software package statistical information meets a preset condition, the type of the to-be-tested software package is determined, and the software package statistical information is determined at least based on the published information. Therefore, the electronic equipment can run the software package in the corresponding running environment by calling the code and detect whether the software package is the malicious software package, so that the software package detection efficiency is improved, and the situation that the software package is misjudged or missed to be judged as the malicious software package due to inconsistent running environments or lack of a dependent package is also avoided.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a software package detection method, a medium and an electronic device. Background Art

[0002] Currently, open source websites can provide users with a variety of open source software codes, which can also be called open source software packages. Figure 1 As shown, the open source website server 10 can receive software packages uploaded by user devices, such as software packages uploaded by user devices A and B. However, hackers can also upload malicious software packages to the open source website server, such as user device C uploading malicious software packages to the open source website server 10. When user device D needs to download a software package on the open source website, it may mistakenly download a malicious software package, causing user device D to be attacked by the malicious software package.

[0003] In addition, due to the excessive number of software packages on open source websites, the technical staff of open source websites cannot identify the security of software packages one by one, resulting in the existence of many malicious software packages on open source websites. Malware packages attack user devices, which can easily cause user information leakage, user devices being remotely controlled, and other hazards. Summary of the invention

[0004] The present application provides a software package detection method, medium, and electronic device, which can be installed in a corresponding operating environment and run the software package by calling code to detect whether the software package has malicious behavior. There is no need to manually install and run the software package in sequence, thereby improving the detection efficiency of the software package.

[0005] In a first aspect, a software package detection method is provided, which is applied to an electronic device, and includes: obtaining a software package to be tested and feature information of the software package to be tested, the feature information including programming language features and release information; running the software package to be tested in a running environment corresponding to the programming language features according to the programming language features; obtaining a behavior log and a release file of a running process of the software package to be tested in the running environment output by the running environment; and determining a type of the software package to be tested based on whether at least one of the behavior log, the release file, and the software package statistical information meets a preset condition, the software package statistical information being determined at least based on the release information.

[0006] In the above scheme, the electronic device can install the software package in the corresponding operating environment and run the software package by calling the code to detect whether the software package has malicious behavior, without manually installing and running the software package in sequence, thereby improving the detection efficiency of the software package. The electronic device can also determine whether the software package is a malicious software package through software package statistical information such as publisher information, download count information, and user complaint information. In addition, the electronic device can accurately parse the metadata information and software package statistical information of the software package to be tested by identifying the language of the software package to be tested. The obtained post-operation behavior log and release file are obtained in the operating environment adapted to the software package to be tested, so the behavior log and release file can accurately represent the type of the software package to be tested, with high accuracy and reliability. It avoids the problem that the malicious behavior of the software package is not triggered and cannot be detected when the software package is not running, and also avoids the situation where the software package is misjudged or missed as a malicious software package due to inconsistent operating environment or missing dependent packages.

[0007] In combination with the first aspect, in some implementations, the types of the software package to be tested include executable software packages and inoperable software packages; the method further includes: determining that the software package to be tested is an inoperable software package based on at least one of the behavior log, the release file, and the software package statistical information meeting a preset condition.

[0008] In combination with the first aspect, in some implementations, the preset condition includes one or more of the following: the behavior log includes one or more of the following: the software package to be tested connects to the network, the software package to be tested writes or reads data to folders other than the folder to which the software package to be tested belongs, and the background service is started or shut down; the release file includes preset code features; the software package statistics include one or more of the following: the number of software package downloads is greater than a first threshold, the number of user complaints is greater than a second threshold, and the publisher has published a software package of a type that is not executable.

[0009] In the above scheme, the post-run behavior log includes the process, memory, network, file, registry and other behavior information generated by the software package to be tested, such as whether it is connected to the Internet, whether it reads or writes data to other folders. The release file can be a binary file, and whether the software package to be tested is a malicious software package can be determined by judging whether there are malicious code features in the binary file. The software package statistics include publisher information, number of downloads, number of user complaints and user ratings. The above content can detect whether the software package is a malicious software package, which improves the detection efficiency of the software package.

[0010] In conjunction with the first aspect, in some implementations, the release information comes from statistical information of an open source website server to which the software package to be tested belongs, and the software package statistical information also includes information of the data package to be tested parsed according to programming language features.

[0011] In conjunction with the first aspect, in some implementations, the software package statistical information is determined based on the release information and information corresponding to the software provided by a third-party platform.

[0012] In the above solution, the electronic device can obtain the information of the software package from the open source website server or other third-party platform to obtain the software package publisher information, download count information, user complaint information and other software package statistics information. The software package statistics information can also be in the source code of the software package to be tested, and can be obtained by parsing the source code.

[0013] In combination with the first aspect, in some implementations, the method further includes: parsing a definition file of the software package to be tested according to programming language characteristics, the definition file including the operating system version, programming software version and dependent package information corresponding to the software package to be tested; determining an operating environment corresponding to the software package to be tested according to the definition file, the operating environment including an operating system, programming software and dependent packages corresponding to the information in the definition file; and running the software package to be tested in the operating environment.

[0014] In the above scheme, the operating environment corresponding to the software package to be tested can be obtained by parsing the metadata information of the software package to be tested, so that the software package is detected in the normal operating environment. It avoids the situation where the software package is misjudged or missed as a malicious software package due to inconsistent operating environment or missing dependent packages. For example, due to the lack of dependent packages, the software package to be tested cannot run normally, making it impossible to determine whether the software package to be tested is a malicious software package. Alternatively, the software package to be tested may automatically connect to the Internet or call a background program to obtain the missing dependent packages, and the behavior of the software package to be tested automatically connecting to the Internet or calling a background program may cause the software package to be tested to be misjudged as a malicious software package.

[0015] In combination with the first aspect, in some implementations, the method further includes: parsing the declaration code or declaration file that references the dependent package in the software package to be tested according to the programming language characteristics; and downloading the dependent package referenced in the declaration code or declaration file in the running environment according to the declaration code or declaration file.

[0016] In the above scheme, the declaration code and / or declaration file in the source code file of the software package to be tested is obtained and analyzed to obtain the dependent packages referenced in the declaration code or declaration file. Then, the dependent packages not identified in the metadata information can be supplemented. This avoids the situation where the software package is misjudged or missed as a malware package due to the missing dependent packages.

[0017] In combination with the first aspect, in some implementations, the method further includes: parsing at least one function contained in the software package to be tested according to programming language features; generating at least one calling instruction corresponding to the function according to the at least one function; and running at least one function of the software package to be tested based on the calling instruction corresponding to the at least one function.

[0018] In the above scheme, the electronic device will identify each function of the software package to be tested, determine the entry function of the software package to be tested, generate a code for calling the entry function, and execute the calling code, so that the electronic device can simulate the user's operation of starting the software package to be tested, and then can run the software package to be tested. In addition, the electronic device obtains all the entry functions of the software package to be tested, and then can run all the function bodies contained in the software package to be tested, so that the software package to be tested can execute all defined behaviors as much as possible, avoiding the situation where some functions in the software package to be tested are not triggered and are missed as malicious software packages.

[0019] In combination with the first aspect, in some implementations, the method further includes: based on the software package to be tested being an inoperable software package, alerting a user of the type of the software package to be tested or notifying an open source website to which the software package to be tested belongs to delete the software package to be tested.

[0020] In the above scheme, if the software package to be tested is determined to be a malicious software package, an alert will be given to the user or the software package will be deleted from the website to prevent the user from downloading and running the software package, which may lead to information leakage on the user's electronic device, or cause the electronic device to be remotely controlled and implanted with backdoor programs, etc.

[0021] In a second aspect, the present application provides an electronic device, characterized in that it includes a processor and a memory, the memory is used to store instructions, and the processor is used to execute instructions. When the processor executes the instructions, the method described in the first aspect is performed.

[0022] In a third aspect, the present application provides a computer-readable storage medium, characterized in that instructions are stored in the computer-readable storage medium, and when the instructions are run on a computing device, the method described in the first aspect is executed.

[0023] In a fourth aspect, the present application provides a computer program product, characterized in that the computer program product includes computer instructions, and when the computer program product is executed by a computing device, the computing device executes the method described in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for describing the embodiments are briefly introduced below.

[0025] Figure 1 It is a structural diagram of an open source website system provided by an embodiment of the present application;

[0026] Figure 2 It is a structural diagram of a software package detection system provided in an embodiment of the present application;

[0027] Figure 3 is a structural diagram of another software package detection system provided in an embodiment of the present application;

[0028] Figure 4 It is a flowchart of a software package detection method provided in an embodiment of the present application;

[0029] Figure 5 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0030] Illustrative embodiments of the present application include, but are not limited to, software package detection methods, media, and electronic devices.

[0031] As mentioned above, there are many malware packages on open source websites, which can usually attack users' electronic devices through dependency package registration and obfuscation attacks. Malware packages may cause information leakage on users' electronic devices, or cause electronic devices to be remotely controlled and implanted with backdoor programs.

[0032] Among them, dependency package preemptive registration refers to attackers preemptively registering the dependency packages required by users in open source software and inserting malicious programs into the dependency packages. For example, the PyTorch framework using the Python language requires the torchtriton dependency package when it is built, and the attacker preemptively registered the torchtriton dependency package on the open source website. The torchtriton dependency package delivered by the attacker carries malicious programs. When users need to install the PyTorch framework, they will download and install the torchtriton dependency package from the open source website. At this time, they may download the torchtriton dependency package containing malicious programs.

[0033] Obfuscation attack is when the attacker uploads a malicious software package with a similar name to a registered dependent package. For example, the test tool selenium is a test software package for the World Wide Web (web). The attacker posted a malicious software package selenuim with a similar name to selenium on the open source software. When users need to download selenium, they may mistakenly download selenuim.

[0034] Malicious software packages can be identified by static feature analysis or binary feature code matching. Among them, the static feature analysis method parses the code file of the software package to obtain the static features of the software package, and then matches the static features of the software package with the pre-set malicious code features. If the software package is matched and the malicious code features exist, it means that the software package is a malicious software package. The static feature analysis method also includes comparing the package name of the software package with the pre-stored known package name for similarity. If the package name of the software package is similar to the package name of another known software package, it means that the software package is a malicious software package of the obfuscation attack type. The binary feature matching method is mainly used for software packages that are binary format files such as executable files (executablefile, EXE). The binary feature code matching method also pre-stores a number of malicious binary features. If the binary features of the software package match the malicious binary features, it means that the software package is a malicious software package.

[0035] However, there are many types of malware packages, and the programming languages ​​used are also different. The preset malicious code features and malicious binary features cannot cover all types of malicious code. In addition, attackers can easily process malicious code through obfuscation, encryption or other programming methods to make it inconsistent with the pre-stored malicious code features, resulting in the inability to identify malicious software packages by static feature analysis or binary feature code matching.

[0036] In addition, the malicious behavior of most malware packages can only be triggered after installation and running. Static feature analysis or binary feature code matching cannot effectively detect software packages with malicious behavior. Due to the large number of types and quantities of malware packages, a software package may also rely on multiple dependent packages. If the technicians of the open source website install the dependent packages one by one, run the software package, and check whether the software package has malicious behavior, it will waste a lot of time and manpower.

[0037] In order to solve the problem that it takes a lot of time and manpower to detect malicious software packages, the present application provides a software package detection method, which can be applied to the above-mentioned open source website server 10 to detect open source software packages, and can also be applied to software package development and testing, as well as other scenarios such as supply chain security detection and dynamic sandbox, and the present application does not make specific restrictions on this. The electronic device 100 can determine the programming language used by the software package to be tested by obtaining the programming language features of the code in the software package to be tested. Then, according to the grammatical rules of the programming language used by the software package to be tested, the relevant definition files in the software package to be tested are parsed to obtain the package name of the software package to be tested, the version of the programming language required at runtime, the operating system version, and the metadata information of the software package to be tested, wherein the dependent packages are other external software packages that the software package to be tested depends on.

[0038] The electronic device 100 will determine a more accurate operating environment of the software package to be tested according to the above-mentioned software package information to be tested. The electronic device 100 can also parse the package name and source code of the software package to be tested, and generate a calling code that can be used to run the software package to be tested. Then install the software package in the operating environment and import the installed software package to be tested according to the calling code, call the entry function of the software package to be tested, and then run the software package to be tested. The software package to be tested is detected in the expected corresponding operating environment, avoiding the situation where the software package is misjudged or missed as a malicious software package due to inconsistent operating environment or missing dependent packages. In addition, the electronic device 100 can run the software package to be tested according to the calling code, and can effectively detect software packages with malicious behavior, avoiding the problem that the malicious behavior of the software package is not triggered and cannot be detected when the software package is not running.

[0039] The electronic device 100 will also monitor whether there are malicious behaviors during the operation of the software package to be tested and / or whether the released files contain preset malicious code features. For example, the functions of the software package to be tested do not require networking, but the software package to be tested performs networking operations, or the software package to be tested performs data reading or writing operations in other folders outside the folder to which it belongs, etc. If the software package to be tested has malicious behaviors or the released files have malicious code features, the software package to be tested can be considered to be a malicious software package, that is, a software package that users cannot download and run (also called an inoperable software package).

[0040] Optionally, the electronic device 100 can also obtain the publisher information, download count information, user complaint information and other software package statistics of the software package to be tested by parsing the definition file of the software package to be tested, or by obtaining the information of the software package to be tested imported from an open source website or other third-party platform, and judge whether the software package to be tested is a malicious software package through the software package statistics. For example, if the publisher of the software package to be tested has published a malicious software package, the electronic device 100 can also identify all software packages subsequently uploaded by the publisher as malicious software packages. If the number of downloads of the software package to be tested is large, and no user complaint information about the software package to be tested is received, it can be determined that the software package to be tested is not a malicious software package, and the software package may not be tested.

[0041] In this way, the electronic device 100 can detect whether the software package has malicious behavior by installing the software package in the corresponding operating environment and running the software package by calling the code, without manually installing and running the software package in sequence, thereby improving the detection efficiency of the software package. In addition, the electronic device 100 determines whether it is a malicious software package by detecting the behavior after the software package is run, and can effectively detect the software package with malicious behavior, avoiding the problem that the malicious behavior is not triggered and cannot be detected when the software package is not running. The electronic device 100 can also determine the operating environment corresponding to the software package by parsing the software package, so that the software package is detected in the normal operating environment, avoiding the situation where the software package is misjudged or missed as a malicious software package due to inconsistent operating environment or missing dependent packages. For example, due to the lack of dependent packages, the software package to be tested cannot run normally, making it impossible to determine whether the software package to be tested is a malicious software package. In addition, due to the lack of dependent packages, the software package to be tested may automatically connect to the Internet or call the background program to obtain the missing dependent packages, and the behavior of the software package to be tested automatically connecting to the Internet or calling the background program may cause the software package to be tested to be misjudged as a malicious software package.

[0042] The electronic device 100 may be a mobile phone, a tablet computer, a wearable device, an in-vehicle device, an augmented reality (AR) / virtual reality (VR) device, a laptop computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA) or a special camera (such as a SLR camera, a card camera) and other terminal devices. The electronic device 100 may also be a physical server or a cloud device, such as an X86 server, an ARM server, etc., or a virtual machine (VM) based on a general physical server combined with network function virtualization (NFV) technology. A virtual machine refers to a complete computer system with complete hardware system functions simulated by software and running in a completely isolated environment. This application does not impose any restrictions on the specific type of the electronic device 100.

[0043] The software package detection system 1000 provided by the present application is described in detail below. The software package detection system 1000 can be applied to the above-mentioned electronic device 100. Figure 2 As shown, the software package detection system 1000 may include a software package analyzing device 1010 , a software package detecting device 1020 and a detection result analyzing device 1030 .

[0044] The software package analysis device 1010 is used to download the software package to be tested from the open source website server 10 or the mirror repository, obtain the programming language features of the software package to be tested, and determine the programming language used by the software package to be tested. Among them, the programming language features can be the naming of the language package manager definition file or the file suffix type. The software package analysis device 1010 will also parse the package name of the software package to be tested, the version of the programming language required at runtime, the operating system version, the dependent package, and other metadata information of the software package to be tested according to the grammatical rules of the programming language used by the software package to be tested. The software package analysis device 1010 will also send the obtained metadata information of the software package to be tested to the software package detection device 1020.

[0045] Optionally, the software package analysis device 1010 can also obtain software package statistics such as publisher information, download count information, and user complaint information of the software package by parsing the definition file of the software package to be tested, or by obtaining information of the software package from an open source website, and send the software package statistics to the detection result analysis device 1030.

[0046] The software package detection device 1020 will download and install the dependent package according to the dependent package information corresponding to the software package to be tested. And determine the operating environment of the software package according to the version of the programming language and the operating system version corresponding to the software package to be tested. The software package detection device 1020 will also parse the source code and package name of the software package to be tested, determine the entry function of the software package to be tested, and generate the corresponding calling code for calling the entry function, and then import the installed software package to be tested in the corresponding operating environment according to the calling code, and call the entry function of the software package to be tested, so that the software package to be tested can be run, and then obtain the running result of the software package to be tested. The running result will be output to the detection result analysis device 1030.

[0047] The detection result analysis device 1030 is used to monitor the behavior of the software package to be tested after it is run based on the output received from the software package detection device 1020. Based on the monitored behavior, it is determined whether the behavior of the software package to be tested is malicious, for example, a software package that does not need to be connected to the Internet performs an Internet operation, or a software package performs an operation of reading or writing data in other folders, etc. If the software package has malicious behavior, the detection result analysis device 1030 can consider the software package to be a malicious software package.

[0048] The detection result analysis device 1030 can also detect files released after the software package to be tested is run, such as binary files, to determine whether the released files contain preset code features, which are code features that are usually contained in the released files of malicious software packages. If the released files of the software package to be tested contain the preset code features, the software package to be tested can be identified as a malicious software package.

[0049] The detection result analysis device 1030 can also determine whether the software package to be tested is a malicious software package based on the software package statistics of the software package to be tested. If the publisher of the software package to be tested has published a malicious software package, the detection result analysis device 1030 can also identify all software packages subsequently uploaded by the publisher as malicious software packages. If the number of downloads of the software package to be tested is large and no user complaints are received about the software package to be tested, it can be determined that the software package is not a malicious software package, and the software package may not be tested.

[0050] In some embodiments, Figure 3 As shown, the software package analysis device 1010 may further specifically include a language identification module 1011, a metadata extraction module 1012, and a dependency package extraction module 1013. The software package detection device 1020 may further specifically include an operating environment determination module 1021, a behavior management module 1022, a software package installation module 1023, and a software package calling module 1024. The detection result analysis device 1030 may further specifically include a behavior determination module 1031 and an alarm display module 1032.

[0051] The language identification module 1011 is used to obtain the source code of the software package to be tested, identify the programming language features of the software package to be tested according to the source code of the software package to be tested, and determine the programming language used by the software package to be tested. The language identification module 1011 also sends the identified programming language type to the metadata extraction module 1012 and the dependency package extraction module 1013. In addition, if there is no definition file defining the programming language in the software package to be tested, an instruction to use the default operating environment can be directly sent to the operating environment determination module 1021.

[0052] The metadata extraction module 1012 is used to parse the package name of the software package to be tested, the version of the programming language required for runtime, the operating system version, the dependent package and other metadata information of the software package to be tested according to the grammatical rules of the programming language used by the software package to be tested. The metadata extraction module 1012 also sends the above metadata information to the dependent package extraction module 1013. The metadata extraction module 1012 can also obtain the software package publisher information, download count information, user complaint information and other software package statistics by parsing the definition file of the software package to be tested or by obtaining the information of the software package in the open source website, and send the above software package statistics to the behavior determination module 1031.

[0053] The dependency package extraction module 1013 is used to further obtain and analyze the declaration code and / or declaration file in the source code file of the software package to be tested according to the grammatical rules of the programming language used by the software package to be tested, and obtain the dependency package referenced in the declaration code or the declaration file. Furthermore, the dependency package not identified by the metadata extraction module 1012 can be supplemented. The dependency package extraction module 1013 is also used to send the metadata information obtained by the metadata extraction module 1012 and the dependency package information obtained by the dependency package extraction module 1013 itself to the operating environment determination module 1021.

[0054] The operating environment determination module 1021 is used to determine the operating environment of the software package according to the metadata information such as the version of the programming language and the version of the operating system obtained by the metadata extraction module 1012. Among them, the electronic device 100 can pre-store and / or install multiple operating systems and programming software. The operating environment determination module 1021 can select and switch to the operating system corresponding to the software package to be tested from multiple operating systems according to the metadata information, and start the programming software of the corresponding version of the software package to be tested. The operating environment determination module 1021 can also send the determined operating environment type and the dependent package information determined by the metadata extraction module 1012 and the dependent package extraction module 1013 to the behavior management module 1022.

[0055] The behavior management module 1022 will also identify the various functions of the software package to be tested in the operating environment determined by the operating environment determination module 1021, determine the entry function of the software package to be tested, generate the code corresponding to calling the entry function, and send it to the software package calling module 1024. The behavior management module 1022 will also send the dependent package information sent by the operating environment determination module 1021 and the source code of the software package to be tested to the software package installation module 1023.

[0056] The software package installation module 1023 is used to download the dependent packages from the open source website or obtain the dependent packages from the storage device according to the dependent package information obtained by the metadata extraction module 1012 and the dependent package extraction module 1013, and install the dependent packages in the operating environment built by the operating environment determination module 1021. The software package installation module 1023 is also used to install the software package to be tested in the operating environment. It should be understood that the electronic device 100 may also store multiple dependent packages in advance, and then when the software package installation module 1023 obtains the dependent package, the dependent package can be directly obtained from the memory of the electronic device 100, saving the loading time of the dependent package.

[0057] The software package calling module 1024 is used to obtain the code for calling the entry function generated by the behavior management module 1022, and execute the calling code, so that the software package calling module 1024 can simulate the operation of the user starting the software package under test, and then the software package under test can run various functions according to the calling code. In addition, the behavior management module 1022 obtains all the entry functions of the software package under test, and then the software package calling module 1024 can run all the function bodies contained in the software package under test, so that the software package under test can execute all defined behaviors as much as possible.

[0058] The behavior determination module 1031 is used to determine whether the software package to be tested is a malicious software package through any one or more of the software package statistics information, the behavior log after running, and the released file of the software package to be tested. The behavior determination module 1031 pre-stores multiple malicious behaviors and preset code features. For example, malicious behaviors include the software package performing network operations, or the software package performing operations of reading or writing data in other folders, or the software package starting or shutting down background programs.

[0059] Specifically, the behavior determination module 1031 monitors the behavior of the software package to be tested after it is run. If the software package has malicious behavior, the detection result analysis device 1030 can consider the software package to be a malicious software package. The behavior determination module 1031 can also determine whether the release file contains preset code features. If the release file of the software package to be tested contains preset code features, the software package to be tested can be determined to be a malicious software package. The behavior determination module 1031 can also determine whether the software package to be tested is a malicious software package based on the basic information of the software package to be tested. For example, if the publisher of the software package to be tested has published a malicious software package, all software packages subsequently uploaded by the publisher can be identified as malicious software packages. If the number of downloads of the software package to be tested is large, and no user complaints about the software package to be tested are received or only a small number of user complaints are received, it can be determined that the software package is not a malicious software package.

[0060] The warning display module 1032 is used to warn the user that the software package to be tested is a malicious software package when the behavior determination module 1031 determines that the software package to be tested is a malicious software package, for example, by displaying a warning prompt window on the electronic device 100. When the software package to be tested is determined to be a malicious software package, the warning display module 1032 can also send the information to the open source website server 10, so that the open source website server 10 removes the software package to be tested from the open source website.

[0061] In this way, the software package detection system 1000 can detect whether the software package has malicious behavior by installing the software package in the corresponding operating environment and running the software package by calling the code, without manually installing and running the software package in sequence, thereby improving the detection efficiency of the software package and avoiding the problem that the malicious behavior of the software package is not triggered and cannot be detected when the software package is not running. The software package detection system 1000 can also determine the operating environment corresponding to the software package by parsing the software package, so that the software package is detected in the normal operating environment, avoiding the situation where the software package is misjudged or missed as a malicious software package due to inconsistent operating environment or missing dependent packages. For example, due to the missing dependent package, the software package to be tested cannot operate normally, making it impossible to determine whether the software package to be tested is a malicious software package. Alternatively, the software package to be tested may automatically connect to the Internet or call a background program to obtain the missing dependent package, and the behavior of the software package to be tested automatically connecting to the Internet or calling a background program may cause the software package to be tested to be misjudged as a malicious software package.

[0062] Combine the following Figure 4 A software package detection method provided in an embodiment of the present application is introduced. The method is applied to an electronic device 100. The electronic device 100 can detect whether the software package is a malicious software package by obtaining software package statistics information and installing and running the software package to obtain the release file and behavior of the software package to be tested, specifically including:

[0063] S410: Acquire programming language features and release information of the software package to be tested.

[0064] The electronic device 100 obtains the programming language feature of the software package to be tested, and determines the programming language used by the software package to be tested. The programming language feature may be the naming and / or file suffix type of the language package manager definition file. The electronic device 100 also obtains software package statistical information such as the publisher information, download count information, and user complaint information of the software package by obtaining information of the software package from the open source website server 10 or other third-party platform. The software package statistical information may also be in the source code of the software package to be tested, and may be obtained by parsing the source code.

[0065] Specifically, the electronic device 100 can determine the corresponding programming language based on the language package manager definition file of the software package to be tested, wherein the language package manager definition files of different programming languages ​​are named differently, such as setup.py for Python, package.json for JavaScript, or metadata for Ruby. At the same time, the electronic device 100 can also scan and count the most common file suffix types under the file directory of the software package to be tested, and make a comprehensive judgment based on the language-specific file suffixes. For example, the file suffixes of Python language are mostly ".py", and the file suffixes of JavaScript language are mostly ".json".

[0066] In some embodiments, if the electronic device 100 detects that there is no definition file defining the programming language in the software package to be tested, step S430 may be directly executed to run the software package to be tested using the default operating environment.

[0067] S420: parsing metadata information and dependent package information of the software package to be tested according to programming language features of the software package to be tested.

[0068] The electronic device 100 will parse the package name of the software package to be tested, the version of the programming language required for operation, the operating system version, the dependent packages, and other metadata information of the software package to be tested according to the grammatical rules of the programming language used by the software package to be tested. Furthermore, the electronic device 100 can accurately parse the metadata information and software package statistics of the software package to be tested by identifying the language of the software package to be tested.

[0069] In some embodiments, the definition files of some software packages to be tested also include software package statistical information such as the publisher information of the software package. The electronic device 100 will also obtain software package statistical information such as the publisher information of the software package, download count information, and user complaint information by parsing the definition files of the software package to be tested.

[0070] In some embodiments, the electronic device 100 can further obtain and analyze the declaration code and / or declaration file in the source code file of the software package to be tested, such as the "requirement.txt" declaration file in the python language, according to the grammatical rules of the programming language used by the software package to be tested, to obtain the dependent packages referenced in the declaration code or the declaration file, and then supplement the dependent packages not defined in the metadata information.

[0071] S430: Determine a corresponding operating environment according to the metadata information and dependent package information of the software package to be tested, and run the software package to be tested in the operating environment.

[0072] The electronic device 100 will also download and install the dependent package according to the dependent package information corresponding to the software package to be tested, and determine the running environment of the software package and run the software package to be tested according to the version of the programming language and the operating system version corresponding to the software package to be tested.

[0073] The electronic device 100 can automatically download and install the software package and all its dependent packages from the software warehouse by calling the software package manager command of the corresponding programming language version. If the electronic device 100 obtains the installation command failure prompting the lack of dependent packages, the electronic device 100 will also re-download the corresponding dependent packages and repeat the installation action.

[0074] In some embodiments, the electronic device 100 may pre-store and / or install multiple operating systems and programming software. The electronic device 100 may switch the language version called by the system by default by modifying the system's environment variables. For example, if the metadata information indicates that the software package to be tested corresponds to the python3.61 version, the language version called by the system by default will be modified to python3.61.

[0075] In other embodiments, the electronic device 100 may also pre-store multiple dependency packages. When the electronic device 100 obtains the dependency packages, the dependency packages may be directly obtained from the memory of the electronic device 100, thereby saving the loading time of the dependency packages.

[0076] The following describes the process of the electronic device 100 running the software package to be tested.

[0077] The electronic device 100 parses and identifies each function of the software package to be tested based on the identified language features, determines the entry function of the software package to be tested, generates a calling code for calling the entry function, and executes the calling code, so that the electronic device 100 can simulate the user's operation of starting the software package to be tested, and then the software package to be tested can run under the action of the calling code. In addition, the electronic device 100 obtains all the entry functions of the software package to be tested, and then can run all the function bodies contained in the software package to be tested, so that the software package to be tested can execute all defined behaviors as much as possible, avoiding the situation where some functions in the software package to be tested are not triggered and are missed as malicious software packages.

[0078] In this way, the electronic device 100 determines the operating environment corresponding to the software package by parsing the software package, ensuring that the operating environment is compatible with the software package to be tested, so that the software package is run and tested in the normal operating environment, avoiding inconsistent operating environments or missing dependent packages, thereby improving the accuracy of subsequent judgments on the type of the software package to be tested.

[0079] S440: Determine the type of the software package to be tested according to the behavior log, released files, and software package statistics after the software package to be tested is run.

[0080] The electronic device 100 determines whether the software package to be tested is a malicious software package through any one or more of the software package statistics information, the behavior log after running, and the release file of the software package to be tested. Among them, the behavior log after running and the release file obtained by the electronic device 100 are obtained in the running environment adapted to the software package to be tested, so the behavior log and the release file can accurately represent the type of the software package to be tested, with high accuracy and reliability.

[0081] The package statistics of the software package to be tested include the publisher information of the software package to be tested, such as whether the publisher has ever published a malicious software package, the number of downloads of the software package to be tested, and the number of user complaints or user evaluation scores of the software package to be tested. The post-run behavior log includes the process, memory, network, file, registry and other behavior information generated by the software package to be tested, such as whether it is connected to the Internet, whether it reads or writes data to other folders. The released file can be a binary file, and whether the software package to be tested is a malicious software package can be determined by judging whether there are malicious code features in the binary file.

[0082] Therefore, the electronic device 100 can determine the type of the software package to be tested by only one of the behavior log, the release file and the software package statistics information, for example, by one or more of the publisher information, the number of downloads, the number of user complaints and the user evaluation score in the software package statistics information.

[0083] The electronic device 100 may also determine the type of the software package to be tested by any combination of multiple items of the behavior log, the release file, and the software package statistics information. For example, the electronic device 100 determines the type of the software package to be tested by the behavior log and the release file, or determines the type of the software package to be tested by the behavior log and the software package statistics information, or determines the type of the software package to be tested by the release file and the software package statistics information.

[0084] Optionally, the electronic device 100 may also determine the type of the software package to be tested by any one or more items in the behavior log and the released file. For example, the type of the software package to be tested may be determined by whether the software package to be tested is connected to the Internet and whether the released file has malicious code features, or the type of the software package to be tested may be determined by whether the software package to be tested is connected to the Internet, whether data is read or written to other folders, and whether the released file has malicious code features.

[0085] Optionally, the electronic device 100 may also determine the type of the software package to be tested by any one or more items in the behavior log and one or more items in the software package statistical information summary. For example, the type of the software package to be tested may be determined by whether the software package to be tested is connected to the Internet and publisher information, or the type of the software package to be tested may be determined by whether the software package to be tested is connected to the Internet and whether data is read or written to other folders, as well as publisher information, download times, user complaint times, and user evaluation scores.

[0086] Optionally, the electronic device 100 may also determine the type of the software package to be tested by any one or more items in the software package statistics and the released file. For example, the type of the software package to be tested may be determined by publisher information and whether the released file contains malicious code features, or the type of the software package to be tested may be determined by publisher information, number of downloads, number of user complaints and user ratings, and whether the released file contains malicious code features.

[0087] The following describes in detail the method of determining the type of the software package to be tested through software package statistics, post-running behavior logs, and release files.

[0088] The electronic device 100 determines whether the software package to be tested is a malicious software package based on the software package statistics of the software package to be tested. Specifically, if the publisher of the software package to be tested has published a malicious software package, all software packages subsequently uploaded by the publisher may also be identified as malicious software packages. If the number of downloads of the software package to be tested is large, and the number of user complaints is less than the complaint number threshold, it can be determined that the software package is not a malicious software package, and the software package may not be tested.

[0089] The electronic device 100 determines whether the software package to be tested is a malicious software package based on the behavior log of the software package to be tested. Specifically, the behavior log may include the process, memory, network, file, registry and other behaviors generated by the software package to be tested. The electronic device 100 determines whether the behavior of the software package to be tested is malicious based on the monitored behavior. If the software package has malicious behavior, the electronic device 100 may consider the software package to be a malicious software package. For example, a software package that does not need to be connected to the Internet performs an Internet connection operation, or a software package performs operations such as reading or writing data in other folders.

[0090] The electronic device 100 determines whether the software package to be tested is a malicious software package based on the release log of the software package to be tested, specifically including detecting the files released after the software package to be tested is run, such as binary files, and determining whether the release file contains preset code features, and the preset code features are code features that the release file of the malicious software package usually contains. If the release file of the software package to be tested contains the preset code features, the software package to be tested can be determined to be a malicious software package. In some embodiments, the electronic device 100 can also use a security scanning engine to scan the release file.

[0091] In some embodiments, when the electronic device 100 determines that the software package to be tested is a malicious software package, it can also warn the user, or send the information to the open source website server 10 to notify the open source website server 10 to remove or delete the software package to be tested from the open source website. For details, please refer to the relevant description of the warning display module 1032, which will not be repeated here.

[0092] In summary, the electronic device 100 can detect whether the software package has malicious behavior by installing the software package in the corresponding operating environment and running the software package by calling the code. There is no need to manually install and run the software package in sequence, which improves the detection efficiency of the software package and avoids the problem that the malicious behavior of the software package is not triggered and cannot be detected when the software package is not running. The electronic device 100 can also determine the operating environment corresponding to the software package by parsing the software package, so that the software package is detected in the normal operating environment, avoiding the situation where the software package is misjudged or missed as a malicious software package due to inconsistent operating environment or missing dependent packages. For example, due to the lack of dependent packages, the software package to be tested cannot operate normally, making it impossible to determine whether the software package to be tested is a malicious software package. Alternatively, the software package to be tested may automatically connect to the Internet or call a background program to obtain the missing dependent package, and the behavior of the software package to be tested automatically connecting to the Internet or calling a background program may cause the software package to be tested to be misjudged as a malicious software package.

[0093] The method of the embodiment of the present application is described in detail above. In order to facilitate better implementation of the above scheme of the embodiment of the present application, correspondingly, related equipment for cooperating in implementing the above scheme is also provided below.

[0094] Figure 5 1 is a schematic diagram of the structure of an electronic device 100 provided in the present application. The electronic device 100 may be the software package detection system 1000 in the aforementioned content. Figure 5 As shown, the electronic device 100 includes: a processor 110, a communication interface 120 and a memory 130. Among them, the processor 110, the communication interface 120 and the memory 130 can be connected to each other through an internal bus 140, and can also communicate through other means such as wireless transmission. In the embodiment of the present application, the connection through the bus 140 is taken as an example. The bus 140 can be a peripheral component interconnect Express (PCIe) bus, or an extended industry standard architecture (EISA) bus, a unified bus (Ubus or UB), a computer express link (CXL), a cache coherent interconnect for accelerators (CCIX), etc. The bus 140 can be divided into an address bus, a data bus, a control bus, etc. In addition to the data bus, the bus 140 can also include a power bus, a control bus, and a status signal bus. However, for the sake of clarity, various buses are marked as bus 140 in the figure.

[0095] The processor 110 may be composed of at least one general-purpose processor, such as a central processing unit (CPU), or a combination of a CPU and a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. The processor 110 executes various types of digital storage instructions, such as digital storage instructions in software or firmware programs stored in the memory 130, which enables the electronic device 100 to provide a variety of services.

[0096] The memory 130 is used to store program codes and is controlled by the processor 110 to execute the processing steps of the software package detection method in the above embodiment. The program code may include one or more software modules, which may be Figure 2 or Figure 3 The software modules provided in the embodiment, such as the software package analysis device 1010, the software package detection device 1020 and the detection result analysis device 1030: the software package analysis device 1010 is used to obtain the programming language characteristics of the software package to be tested, and determine the programming language used by the software package to be tested, and obtain the software package statistical information such as the publisher information, download count information and user complaint information of the software package. The software package detection device 1020 is used to download and install the dependent package according to the dependent package information corresponding to the software package to be tested. And according to the version of the programming language and the operating system version corresponding to the software package to be tested, determine the operating environment of the software package and run the software package to be tested. The detection result analysis device 1030 is used to monitor the behavior of the software package to be tested after it is run. It is also possible to detect the files released after the software package to be tested is run, and to determine whether the software package to be tested is a malicious software package through the software package statistical information.

[0097] The memory 130 may include a volatile memory, such as a random access memory (RAM); the memory 130 may also include a non-volatile memory (NVM), such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); the memory 130 may also include a combination of the above types. The memory 130 may store program code, specifically executing Figure 4 Steps S410 to S440 and optional steps in the embodiment are not described in detail here.

[0098] The communication interface 120 may be an internal interface (eg, a high-speed serial computer expansion bus interface), a wired interface (eg, an Ethernet interface), or a wireless interface (eg, a cellular network interface or a wireless local area network interface) for communicating with other devices or modules.

[0099] Need to explain, Figure 5 This is only a possible implementation of the embodiment of the present application. In practical applications, the electronic device 100 may also include more or fewer components, which is not limited here. For contents not shown or described in the embodiment of the present application, please refer to the aforementioned Figure 4 The relevant explanations in the embodiments will not be repeated here.

[0100] It should be understood that this embodiment can be implemented by a general physical server, for example, an ARM server or an X86 server, or it can be implemented by a virtual machine based on a general physical server combined with NFV technology. A virtual machine refers to a complete computer system with complete hardware system functions simulated by software and running in a completely isolated environment. This application does not make any specific limitations.

[0101] Figure 5 The electronic device shown may also be a computer cluster consisting of at least one server, which is not specifically limited in this application.

[0102] The present application also provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a processor, Figure 4 The method flow shown is realized.

[0103] The present application also provides a computer program product. When the computer program product is run on a processor, Figure 4 The method flow shown is realized.

[0104] The above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination thereof. When implemented by software, the above embodiments may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded or executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media sets. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a high-density digital video disc (DVD), or a semiconductor medium. The semiconductor medium may be an SSD.

[0105] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A software package detection method, characterized in that: Applied to electronic equipment, the method comprises: Acquire a software package to be tested and feature information of the software package to be tested, wherein the feature information includes programming language features and release information; According to the programming language feature, the software package to be tested is run in the running environment corresponding to the programming language feature; Obtaining a behavior log and a release file of the software package under test output by the operating environment during the operation of the operating environment; The type of the software package to be tested is determined based on at least one of the behavior log, the release file, and the software package statistical information meeting a preset condition, wherein the software package statistical information is determined based on at least the release information.

2. The method according to claim 1, characterized in that The types of the software packages to be tested include executable software packages and inoperable software packages; The determining the type of the software package to be tested based on at least one of the behavior log, the release file, and the software package statistical information meeting a preset condition comprises: Based on at least one of the behavior log, the release file, and the software package statistical information meeting a preset condition, it is determined that the software package to be tested is an inoperable software package.

3. The method according to claim 2, characterized in that The preset conditions include one or more of the following: The behavior log includes one or more of the following: the software package under test connects to the network, the software package under test writes or reads data to or from a folder other than the folder to which the software package under test belongs, and a background service is started or shut down; The release file includes a preset code feature; The software package statistics information may include one or more of the following: the number of software package downloads is greater than a first threshold, the number of user complaints is greater than a second threshold, and the publisher has published software packages of the type that cannot be run.

4. The method according to claim 1, characterized in that: The release information comes from the statistical information of the open source website server to which the software package to be tested belongs, and the software package statistical information also includes the information of the data package to be tested parsed according to the programming language characteristics.

5. The method according to claim 1, characterized in that: The software package statistics are determined based at least on the release information, including: The software package statistical information is determined based on the release information and information corresponding to the software provided by a third-party platform.

6. The method according to claim 1, characterized in that The step of running the software package to be tested in the operating environment corresponding to the programming language feature according to the programming language feature includes: According to the programming language feature, parsing the definition file of the software package to be tested, the definition file including the operating system version, programming software version and dependent package information corresponding to the software package to be tested; Determine, according to the definition file, the operating environment corresponding to the software package to be tested, wherein the operating environment includes an operating system, programming software, and dependent packages corresponding to the information in the definition file; The software package to be tested is run in the running environment.

7. The method according to claim 6, characterized in that The step of running the software package to be tested in the operating environment corresponding to the programming language feature according to the programming language feature also includes: According to the programming language feature, parsing the declaration code or declaration file of the dependent package referenced in the software package to be tested; According to the declaration code or the declaration file, a dependent package referenced in the declaration code or the declaration file is downloaded in the operating environment.

8. The method according to claim 6 or 7, characterized in that: The step of running the software package to be tested in the operating environment corresponding to the programming language feature according to the programming language feature also includes: Parsing at least one function included in the software package to be tested according to the programming language feature; According to the at least one function, generating a call instruction corresponding to the at least one function; Based on the calling instruction corresponding to the at least one function, at least one function of the software package to be tested is executed.

9. The method according to claim 2, characterized in that: The method further comprises: Based on the fact that the software package to be tested is an inoperable software package, a user is alerted to the type of the software package to be tested or an open source website to which the software package to be tested belongs is notified to delete the software package to be tested.

10. A readable medium, characterized in that: The readable medium contains instructions, which, when executed by a processor of an electronic device, enable the electronic device to implement the method of any one of claims 1 to 9.

11. An electronic device, characterized in that: include: a memory for storing instructions to be executed by one or more processors of the electronic device; and a processor, which is one of the processors of the electronic device, configured to execute the instructions so that the electronic device implements the method according to any one of claims 1 to 9.

Images