Determine similar samples based on user-selected feature groups

Abstract

Embodiments of the present disclosure relate to determining similar samples based on a user-selected feature group. Systems, methods, and software can be used to determine similar samples. In some aspects, the method includes: obtaining one or more feature vectors of a sample, each feature vector in the one or more feature vectors corresponding to a user-selected feature group; and selecting a similar sample set based on the one or more feature vectors, wherein selecting a similar sample set based on the one or more feature vectors includes: for each feature vector in the one or more feature vectors, selecting a corresponding feature similar sample set based on the corresponding feature vector; and, for each feature vector in the one or more feature vectors, combining the corresponding selected feature similar sample set to generate a similar sample set.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of U.S. Application No. 18 / 482,244, filed on October 6, 2023. The disclosure of the prior application is considered part of (and incorporated by reference into) the disclosure of this application. Technical Field

[0003] The present disclosure relates to determining similar samples based on a user-selected set of features. Background Art

[0004] Similarity analysis refers to the process of finding samples that are similar to a given input sample. In one example, similarity analysis can be used to determine whether a software code is potentially malicious by comparing it to a sample set. A sample set may include software code with known security risks. In another example, similarity analysis can be used to select images that are close to the input image during the imaging process. In another example, similarity analysis can be used to select files and assign them the same label. This makes it possible to create a data set for supervised learning. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] Figure 1 is a schematic diagram illustrating an example system for determining similar samples according to an implementation.

[0006] Figure 2 is a flow diagram illustrating example operations for determining similar samples according to an implementation.

[0007] Figure 3 is a schematic diagram depicting an example method for determining similar samples according to an implementation.

[0008] Figure 4 Depicts a high-level architectural block diagram of a computer according to implementation.

[0009] Like reference numbers and designations in the various drawings indicate like elements. DETAILED DESCRIPTION

[0010] In some implementations, similarity analysis can be performed by converting the input sample into a feature vector and searching for neighboring vectors in pre-stored training samples to determine a similar sample set. The training sample may also be referred to as a base sample or base training sample. However, as the dimension of the feature vector increases, such analysis may become very expensive or difficult to calculate.

[0011] In some cases, dimensionality reduction techniques can be used to reduce the number of features and, therefore, the computational complexity of the operation. However, such techniques often lead to errors in the prediction results. In particular, when the degree of dimensionality is significantly reduced, the prediction error will also be significant.

[0012] In some operations, similarity analysis can be performed by dividing features into feature groups and performing similarity analysis based on feature groups selected by a user. In the case where the complete feature set is a fixed-dimensional vector, feature groups can be constructed based on continuous feature indices, or feature groups can be constructed by containing logically related feature sets. Feature groups can be disjoint, where no feature groups share the same features. Alternatively, feature groups can be overlapping, where one or more feature groups share at least one common feature. In some cases, the analysis can be further performed based on user-specified weights of the selected feature groups. This operation can improve the performance of the similarity analysis by reducing the computational complexity while improving the accuracy of the results. It also provides flexibility by using different feature groups, which may be suitable for different types of input samples.

[0013] Figures 1 to 4 and associated descriptions provide additional details of these implementations.

[0014] Figure 1 is a diagram illustrating an example system 100 for determining similar samples according to an implementation. At a high level, the example system 100 includes a software service platform 106 communicatively coupled to a client device 102 via a network 110 .

[0015] Client 102 represents an electronic device that provides a sample to be analyzed. In some cases, client device 102 can send the sample to software service platform 106 for similarity analysis. In some cases, software service platform 106 can send the output of the similarity analysis to client device 102.

[0016] The software service platform 106 represents an application, application set, software, software module, hardware or any combination thereof for determining similar samples. The software service platform 106 may be an application server, a service provider or any other network entity. The software service platform 106 may be implemented using one or more computers, computer servers or cloud computing platforms. The software service platform 106 may be used to train a machine learning model for similar sample determination operations. The software service platform 106 includes a similarity analyzer 104. The similarity analyzer 104 represents an application, application set, software, software module, hardware or any combination thereof for determining similar samples. In some implementations, the similarity analyzer 104 may generate an index set of basic samples, wherein each index set includes a feature vector corresponding to a feature group in a feature group list. The similarity analyzer 104 may receive an input sample, receive a feature group selected by a user, and generate a feature vector of the input sample for each feature group in the feature group selected by the user. Then, for each feature group in the feature group selected by the user, the similarity analyzer 104 can compare the corresponding sample feature vector with the index set of the same feature group to select a feature similar sample set for the feature group, and combine multiple feature similar sample sets to generate a similar sample output set. In some cases, some of these operations can be performed by another device. For example, the software service platform 106 can output a user interface and receive user input to select the feature group selected by the user discussed previously. Alternatively or additionally, the client device 102 can output a user interface and receive user input to select the feature group selected by the user and send the feature group selected by the user to the software service platform 106. In some cases, the client device 102 can further generate one or more feature vectors of the sample based on the feature group selected by the user, and send the one or more feature vectors to the software service platform 106 for similarity analysis. In another example, the user interface can provide a list of selectable features, which is different according to the nature of the sample. In a variant, the user can also select a distance or function for performing similarity analysis through the user interface. Figures 2 to 4 and associated descriptions provide additional details of these implementations.

[0017] Similarity analysis can be performed for different purposes. For example, similarity analysis can be performed for software code analysis. In this example, the input sample can be software code. The software code can be source code or binary code. In the software development process, the source code can be created by a programmer using a text editor or a visual programming tool before compilation. The source code can be developed in a human-readable programming language and can be saved in a text file. The source code can be converted by an assembler or compiler into a binary software code that can be executed by a computer. In some cases, the source code can be generated by an automated tool, such as an artificial intelligence driven by a large language model.

[0018] The binary software code may include a byte stream generated by compiling source code. Therefore, the binary software code may not be in a human-readable format and may not be easily parsed or analyzed by humans.

[0019] Binary software code can be a configuration of object code, executable code, or bytecode. Object code is the product of compiler output of a series of statements or instructions in a computer language. Source code can be logically divided into multiple source files. Each source file is independently compiled into a corresponding object file containing object code. The object code in the object file is binary machine code, but they may not be ready to be executed. The object file may contain incomplete references to subroutines outside of itself and placeholder addresses. During the linking process, these object files can be linked together to form an executable file that includes executable code that can be executed on a computing device. During the linking process, the linker can read the object files, resolve references between them, perform the final code layout in the memory that determines the addresses of code blocks and data blocks, fix the placeholder addresses with the actual addresses, and write out an executable file containing executable code.

[0020] Bytecode, also known as portable code or p-code, is a form of instruction set designed for efficient execution by software interpreters. Bytecodes include compact digital codes, constants, and references (usually digital addresses) that encode the results of compiler parsing and perform semantic analysis of the type, scope, and nesting depth of program objects. Bytecodes include instruction sets with one-byte opcodes followed by optional parameters. For example, the intermediate representation of bytecodes can be output by a programming language implementation to simplify interpretation or can be used to reduce hardware and operating system dependencies by allowing the same code to run across platforms on different devices. Bytecodes can usually be executed directly on a virtual machine (p-code machine, i.e., an interpreter), or can be further compiled into machine code for better performance. In some cases, binary software code encoded using a platform-independent language such as JAVA can be stored in bytecode format.

[0021] In this case, the client device 102 may be a device that receives or generates software code for analysis. The software service platform 106 may be a software service platform that performs similarity analysis on the software code to compare it with a pre-stored set of software code examples.

[0022] Applications for software similarity analysis include, but are not limited to, malware classification, malware family identification, identifying different versions of the same software, identifying software authors, identifying malware as part of a specific attack campaign, identifying software samples for whitelisting or blacklisting, and classifying files based on software complexity. Similarity analysis can be performed for other purposes, such as image analysis, video or audio recognition, natural language processing, etc.

[0023] Turning to a general description, the client device 102 may include, without limitation, any of the following: a terminal, a computing device, a mobile device, a mobile electronic device, a user device, a mobile site, a subscriber site, a portable electronic device, a mobile communication device, a wireless modem, a wireless terminal, or another electronic device. Examples of terminals may include a mobile device, an IoT (Internet of Things) device, an EoT (Enterprise of Things) device, a cellular phone, a personal digital assistant (PDA), a smart mobile phone, a notebook computer, a tablet computer, a personal computer (PC), a pager, a portable computer, a portable gaming device, a wearable electronic device, a health / medical / fitness device, a camera, a vehicle, or other mobile communication device having a component that communicates sound or data over a wireless communication network. The means of transport may include motor vehicles (e.g., motor vehicles, cars, trucks, buses, motorcycles, etc.), aircraft (e.g., airplanes, drones, drone systems, unmanned aircraft, helicopters, etc.), spacecraft (e.g., winged spacecraft, space shuttles, space capsules, space stations, satellites, etc.), watercraft (e.g., ships, ships, hovercraft, submarines, etc.), rail vehicles (e.g., trains, trams, etc.), and other types of vehicles, including any combination of any of the foregoing, whether currently existing or appearing in the future. The wireless communication network may include a wireless connection on at least one of a licensed channel and an unlicensed channel. The term "mobile device" may also refer to any hardware or software component that can terminate a user's communication session. In addition, the terms "user equipment", "UE", "user equipment device", "user agent", "UA", "user device" and "mobile device" may be used interchangeably herein.

[0024] The example system 100 includes a network 110. The network 110 represents an application, a set of applications, software, a software module, hardware, or a combination thereof that can be configured to transmit data messages between entities in the example system 100. The network 110 may include a wireless network, a wired network, the Internet, or a combination thereof. For example, the network 110 may include one or more radio access networks (RANs), a core network (CN), and the Internet. The RAN may include one or more radio access technologies. In some implementations, the radio access technology may be a global mobile communication network (GSM), an interim standard 95 (IS-95), a universal mobile telecommunications system (UMTS), CDMA2000 (code division multiple access), an evolved universal mobile telecommunications system (E-UMTS), a long term evaluation (LTE), an advanced LTE, a fifth generation (5G), or any other radio access technology. In some cases, the core network may be an evolved packet core (EPC).

[0025] RAN is a part of a wireless telecommunication system that implements radio access technologies such as UMTS, CMDA2000, 3GPP LTE, 3GPP LTE-A and 5G. In many applications, RAN includes at least one base station. A base station can be a radio base station that can control all or at least some radio-related functions in the fixed part of the system. A base station can provide a radio interface for mobile devices to communicate within their coverage area or within a cell. The base station can be distributed across a cellular network to provide a wide coverage area. The base station communicates directly with one or more mobile devices, other base stations and one or more core network nodes.

[0026] Although Figure 1 The elements are shown as including various component parts, portions or modules that implement various features and functions, however, these elements may instead include multiple sub-modules, third-party services, components, libraries, etc. as appropriate. In addition, the features and functions of the various components may be combined into fewer components as appropriate.

[0027] Figure 2 is a flow chart showing an example operation 200 for generating similar samples according to an implementation. The example operation 200 may be implemented by a software service platform, for example, Figure 1 The software service platform 106 shown in . Figure 2 The example operations 200 shown in FIG. 2 may be implemented using additional, fewer, or different operations, which may be performed in the order shown or in a different order.

[0028] At 210 , a vectorization process is performed on the sample 202 to generate one or more feature vectors based on the user-selected feature groups 204 . Each feature vector of the one or more feature vectors corresponds to one of the user-selected feature groups 204 .

[0029] Sample 202 may be software code, such as a document file, executable code, or script. Sample 202 may also be other forms of data samples evaluated in similarity analysis.

[0030] Sample 202 may have one or more features. Each feature may represent a portion of sample 202, a characteristic of sample 202, or both. Examples of features include file size, file format, file type (e.g., whether sample 202 is a binary code of software code, or source code of software code), file content (part or all of sample 202), the associated operating system or programming environment in which sample 202 is programmed or executed, the number of specific strings included in sample 202, the structure of sample 202 (e.g., the order of instruction sets in software code), signature, verification, etc. If sample 202 is an image, the features of the image may also include image size, resolution, color profile, and other information. The features of sample 202 may be obtained from metadata associated with sample 202, from a preprocessing operation that scans sample 202 and automatically extracts feature information from the code, or both. In some implementations, a feature list may be preconfigured. The preconfigured feature list may be stored on the software service platform.

[0031] In some implementations, features may be grouped in multiple feature groups. Each feature group may contain one or more features. In some cases, features may be grouped based on the relevance, interpretability, or both of these features. For example, features related to import may be grouped into an import feature group. In the context of a software code sample, features related to import include features related to parameters, code sets, or instruction sets imported into the software code sample. Other examples of feature groups include an export feature group, including features related to parameters, code sets, or instruction sets exported by the software code sample; a certificate feature group, including features related to a code set or instruction set in a software code sample that contains or processes a certificate; a general observation feature group, including general features of the sample such as file size, file format, and other information; a string feature group, including features related to a preconfigured string list in a software code sample; a machine learning feature group, including features extracted by applying machine learning operations to a code sample (example machine learning operations include autoencoders, converters, convolutional neural networks, etc.); a fuzzy feature group, including features related to a code set or instruction set implementing fuzzy techniques in a software code sample; and other feature groups. In some implementations, the grouping of feature groups may be preset. The feature group lists and the features in these feature groups may be stored on the software service platform.

[0032] In some implementations, user input is received by the software service platform. The user input indicates the feature group selected by the user 204. In some cases, the software service platform may output a list of feature groups in a user interface. For example, the software service platform may display the list of feature groups on a screen of the software service platform. Each feature group may have a selectable user interface object associated with it, such as a button or a check box. The user may select one or more feature groups that the user prefers to be included in the similarity analysis by using the associated user interface object, such as by clicking a button or selecting a check box. The software service platform may receive the feature group selected by the user by receiving the user input.

[0033] In some cases, the user interface may also provide a description or list of features in each feature group, or both, to assist the user in the selection process. For example, a description or list of features in each feature group, or both, may be displayed on the user interface. Alternatively or additionally, the description or list of features may be displayed by receiving another user input, for example, in a pop-up window or new screen output in response to a click.

[0034] In some cases, the software service platform may provide a user interface for a user to select a custom feature group. For example, a user may select a set of characteristics to form a custom group. The software service platform may receive user input indicating the characteristics in the custom feature group.

[0035] In some cases, the user may select one feature group. Alternatively, the user may select multiple feature groups. Figure 2 Three feature vectors ( 222 a , 222 b , 222 c ) corresponding to three feature groups selected by users are shown, and other numbers of feature groups selected by users may also be used.

[0036] In some cases, the user can also set a weight for each selected feature group. The weight can be one of the preconfigured weights that the user can select, for example, an integer scale between 1 and 10, a percentage scale from 10% to 100% in 5% increments, or other numbers. The weight can also be an integer or floating point number that the user can enter into the user interface.

[0037] In some implementations, instead of outputting a user interface object for feature selection at the software service platform and receiving user input at the software service platform, the software service platform may receive user input from another device, such as from a Figure 1 The client device 102 shown may be a web server that provides a web page for selection. These devices may provide a user interface for the previously discussed feature group selection, receive user input indicating the feature groups selected by the user and the weights of each user-selected feature group, and send the user input to the software service platform.

[0038] Feature vectors can be generated based on the feature groups 204 selected by the user, for example, feature vectors 222a, 222b and 222c, where each feature vector corresponds to a feature group selected by the user. In some cases, the vectorization process can be used to convert the sample 202 into a vector representation by using a feature extraction algorithm. For each feature group selected by the user, each feature in the group can be converted to a numerical value in the format of an integer or a floating point number. The numerical values ​​can be connected to form a feature vector for the feature group selected by the user. Alternatively or additionally, the numerical values ​​can be combined or converted to generate feature vectors. Examples of conversion or combination techniques include multiplication, addition, by nonlinear transformation functions (e.g., Fourier transform, rectification, etc.).

[0039] At 230, feature similarity analysis is performed. As shown, similarity analyses 230a, 230b, and 230c are performed on corresponding feature vectors, namely feature vectors 222a, 222b, and 222c, to generate corresponding feature sets 232a, 232b, and 232c.

[0040] In some cases, a k-nearest neighbor algorithm (k-NN) can be used to perform similarity analysis on feature vectors. In an example k-NN algorithm, the distance between the input data point and the training example index is calculated. Examples of distances used for calculation can be Euclidean distance, Hamming distance, or other metrics, including, for example, cosine similarity. The k-nearest neighbors of the input data point are then identified. The k-NN algorithm used to perform feature similarity analysis can be an exact k-NN algorithm or an approximate k-NN algorithm.

[0041] In this operation, the basic training samples are processed by the same feature extraction process as previously discussed to generate different index sets for different feature groups. For each feature group in the feature group list previously discussed, the index of the basic training samples for the corresponding feature group is generated by performing the vectorization process of the basic training samples using the features in the feature group. Since the feature group list is preconfigured, these calculations can be performed before process 200, and the index sets corresponding to these feature groups can be stored on the software service platform. The index sets corresponding to the feature groups in the feature group 204 selected by the user are used in the feature similarity analysis 230. Alternatively or additionally, the index sets for the feature groups in the feature group 204 selected by the user are calculated during the feature similarity analysis 230. For example, the feature group 204 selected by the user may include a custom feature group, and therefore, after receiving the feature group 204 selected by the user, the index sets corresponding to the custom feature group can be calculated.

[0042] For similarity analysis 230a, feature vector 222a is used as an input data point for the corresponding k-NN model. The index set of the corresponding feature group, that is, the index set generated by processing the basic training sample based on the feature group as feature vector 222a, is used as the index set for the corresponding K-NN model. The distance between feature vector 222a and each index in the corresponding index set is calculated. Feature similarity sample set 232a is determined based on the distance. In some cases, the samples in the feature similarity sample set are k basic training samples whose indexes have the shortest distance to feature vector 222a. The same process is repeated for other feature vectors and their corresponding k-NN models to generate feature similarity sample sets 232b and 232c. In another example, the similarity analysis can rely on the use of local sensitive hashing (LSH), before or as an alternative to the use of the previously mentioned k-NN algorithm.

[0043] At 240, feature similarity sample sets 232a, 232b, and 232c are combined to generate output set 242. Different combination techniques can be used. In one example, multi-occurrence can be used as a criterion for selecting samples in output set 242. Similar samples in sets 232a, 232b, and 232c are checked. Some basic samples may appear in more than one feature familiarity sample set. A preset threshold number can be configured. For example, if the preset threshold number is configured to 2, all basic samples that appear in 2 or more feature familiarity sample sets are placed in output set 242.

[0044] In another example, distance can be used as standard.For each sample included in set 232a, 232b and 232c, the distance between sample and corresponding input vector (i.e. feature vector 222a, 222b or 222c) is compared, and the first X samples with the shortest distance are selected as the sample in output set 242, where X is the number of samples in output set 242. This distance can be the distance previously discussed in feature similarity analysis 230. For example, output set 242 can be formed by selecting X samples with the shortest distance in set 232a, 232b, 232c. X can be configured by user, administrator or other operator or algorithm. Alternatively or in combination, output set 242 can be formed by selecting a sample lower than a configured threshold value in set 232a, 232b and 232c. In some cases, the distance for each feature similarity set can be normalized before the previously discussed comparison and selection process. For example, in similarity analysis 230a, the shortest distance between feature vector 222a and the corresponding index is identified and used to divide the distance between feature vector 222a and the index in the corresponding index set to generate a normalized distance for the index set. The normalized distance is used in the distance-based combination process. Similar normalization processes can be performed for other similarity analyses 230b and 230c.

[0045] Alternatively or additionally, if the dimensions of the feature vectors 222a, 222b, and 222c are different, a normalization process may be performed. For example, the distance obtained in each similarity analysis 230a, 230b, 230c may be divided by the square root of the dimension of the corresponding feature vector.

[0046] As previously described, in the same case, the user-specified weight for each feature group in the feature group selected by the user can be received. In these cases, the weight specified by the user is used in the combination process. In one example, as previously described, the distance obtained in each similarity analysis 230a, 230b and 230c can be normalized. The normalized distance for the base training sample in the feature similarity set 232a, 232b, 232c can be multiplied by the user-specified weight of the corresponding feature vector, and the first X samples with the shortest distance are selected as the samples in the output set 242, where X is the number of samples in the output set 242.

[0047] In one example, a user may assign a weight of 1 to the imported feature group, a weight of 3 to the general observation feature group, and a weight of 5 to the fuzzy feature group. A vectorization process is performed on sample 202 to extract feature vector 1 based on features in the imported feature group, feature vector 2 based on features in the general observation feature group, and feature vector 3 based on features in the fuzzy feature group. A vectorization process is also performed on the basic training samples to generate different index sets 1, 2, and 3 based on features in the imported feature group, the general observation feature group, and the fuzzy feature group, respectively. The distance between feature vector 1 and index set 1 is calculated and the 10 basic training samples in index set 1 with the shortest distance to feature vector 1 form feature similarity set 1. The distance for each basic training sample in feature similarity set 1 is normalized and then multiplied by the user-selected weight for the imported feature group, i.e., 1, to obtain weighted normalized distances for these basic training samples. Feature similarity sets 2 and 3 are formed for the general observation feature group and the fuzzy feature group, respectively. The distance of each base training sample in feature similarity sets 2 and 3 is normalized and multiplied by the corresponding user-selected weights for these feature groups, i.e., 3 and 5, to obtain the weighted normalized distances for these base training samples. The weighted normalized distances of all base training samples in feature similarity sets 1, 2, and 3 are compared, and the top 10 base training samples with the shortest weighted normalized distances are selected to form the output set.

[0048] Alternatively or additionally, a plurality of criteria can be used in combination to determine output set 242. For example, each base sample in feature similarity set 232a, 232b and 232c can be assigned a multiple occurrence factor based on how many feature similarity sets the base sample appears in. Each base sample in feature similarity set 232a, 232b and 232c can also be assigned a distance factor based on the weighted normalized distance with the corresponding feature vector. Each factor can be multiplied and summed with the corresponding factor weight to calculate the total score of the base sample. The factor weight can be preconfigured, for example, by the administrator of the software service platform, or can be selected by user input. The base samples can be sorted based on their total scores, and the first X base samples can be selected to form output set 242.

[0049] In some cases, the output set 242 can be output on a user interface of a software service platform that performs the analysis. Other information of the selection process, such as multiple occurrence information, distance information, or a combination, can also be provided. Alternatively or additionally, the output set 242 can be sent to a different device for output. Other information, such as multiple occurrence information, distance information, or a combination can also be sent to a different device.

[0050] In classification operations, the class of an input data point can be determined based on a majority vote of the class labels of the k nearest neighbors. In regression operations, the average or weighted average of the K neighboring target values ​​can be calculated to determine the target value of an input data point.

[0051] In some cases, the classification operation or regression operation of k-NN can be performed after the output set 242 is generated. For example, each base sample in the output set 242 has a classification label, and the classification of the sample 202 can be determined based on a majority vote of these base samples. In one implementation, operation 200 can be used to determine the security status of software code. In these cases, the input sample can be software code, and the classification label can include "safe" or "potentially malicious". Alternatively or additionally, the classification label can further indicate different risk levels of malicious potential. In these cases, the determined classification label can also be output or sent to another device for output.

[0052] In another implementation, operation 200 may be used for image processing. In these cases, the input sample may be an example image, and the base samples in output set 242 may be used to search for a target image that is close to the example image. In these cases, the retrieved target image may also be output or sent to another device for output.

[0053] Figure 3 is a flow chart showing an example method 300 for generating similar samples according to an implementation. The example method 300 may be implemented by a server, for example, Figure 1 The software service platform 106 is shown. Figure 3 The example method 300 shown in FIG. 3 may be implemented using additional, fewer, or different operations, which may be performed in the order shown or in a different order.

[0054] At 310, one or more feature vectors of the sample are obtained. Each feature vector of the one or more feature vectors corresponds to a feature group selected by a user.

[0055] At 320, a similar sample set is selected based on one or more feature vectors. For each feature vector in the one or more feature vectors, a corresponding feature similar sample set is selected based on the corresponding feature vector. For each feature vector in the one or more feature vectors, the corresponding selected feature similar sample set is combined to generate a similar sample set.

[0056] Figure 4 A high-level block diagram of a computer 400 according to an implementation is depicted. The computer 400 may be implemented as Figure 1 The computer 400 can also be used to implement the software service platform 106 and the client device 102 in the embodiment of the present invention. Figures 2 to 3 The operations discussed in the description are merely one possible implementation of the subject matter described, and are not intended to limit the disclosure to a single described implementation. Those of ordinary skill in the art will appreciate the fact that the described components can be connected, combined, and / or used in alternative ways consistent with the present disclosure.

[0057] In some cases, the processing algorithm established by the code package can be implemented in an executable computing code, for example, a C / C++ executable code. In some cases, the computer 400 can include an independent Linux system running a batch application. In some cases, the computer 400 can include a mobile or personal computer.

[0058] Computer 400 may include a computer that includes input devices such as a keypad, keyboard, touch screen, microphone, voice identification device, other devices that can receive user information, and / or output devices that transmit information associated with the operation of the computer, including digital data, visual and / or audio information or a GUI.

[0059] The computer 400 may act as a client, a network component, a server, a database or other firmware, and / or any other component. In some implementations, one or more components of the computer 400 may be configured to operate in a cloud computing-based environment.

[0060] At a high level, the computer 400 is an electronic computing device operable to receive, transmit, process, store or manage data. According to some implementations, the computer 400 may also include or be communicatively coupled to an application server, an email server, a web server, a cache server, a streaming data server, a business intelligence (BI) server and / or other servers.

[0061] Computer 400 may collect data of network events or mobile application usage events from a web browser or client application, e.g., an installed plug-in, over network 110. In addition, data may be collected by computer 400 from internal users (e.g., from a command console or by another suitable access method), external or third parties, other automated applications, and any other suitable entity, person, system, or computer.

[0062] Each of the components of the computer 400 can communicate using a system bus 412. In some implementations, any and / or all of the components of the computer 400, hardware and / or software, can interface with each other and / or interface 402 through the system bus 412 using an application programming interface (API) 408 and / or a service layer 410. The API 408 may include specifications for routines, data structures, and object classes. The API 408 may be computer language independent or dependent and refer to a complete interface, a single function, or even a set of APIs. The service layer 410 provides software services to the computer 400. The functions of the computer 400 can be accessed by all service consumers using this service layer. Software services, such as those provided through the service layer 410, provide reusable, defined business functions through defined interfaces. For example, the interface may be software written in JAVA, C++, or another suitable language that provides data in an extensible markup language (XML) or other suitable form. Although depicted as an integrated component of the computer 400, alternative implementations may depict the API 408 and / or service layer 410 as independently functioning components relative to other components of the computer 400. Furthermore, any or all portions of the API 408 and / or service layer 410 may be implemented as a sub- or sub-module of another software module, enterprise application, or hardware module without departing from the scope of the present disclosure.

[0063] Computer 400 includes interface 402. Although Figure 4 A single interface 402 is described as being shown in the computer 400, but two or more interfaces 402 may be used depending on the specific needs, expectations, or specific implementation of the computer 400. The interface 402 is used by the computer 400 to communicate with other systems in a distributed environment connected to a network (whether or not described). Typically, the interface 402 includes a suitable combination of software and / or hardware encoding and logic for operating to communicate with the network. More specifically, the interface 402 may include software that supports one or more communication protocols associated with the communication so that the network or the hardware of the interface is operable to communicate physical signals within and outside the computer 400.

[0064] Computer 400 includes at least one processor 404. Although Figure 4 A single processor 404 is described in the computer 400, but two or more processors may be used depending on the particular needs, desires, or specific implementations of the computer 400. Generally, the processor 404 executes commands and operates on data to perform operations of the computer 400. Specifically, the processor 404 executes Figures 1 to 4 The functionality disclosed in .

[0065] The computer 400 also includes a memory 410 for processing data for use in the computer 400. Figure 4A single memory 414 is depicted, but two or more memories may be used depending on the particular needs, desires, or implementations of the computer 400. While the memory 414 is depicted as an essential component of the computer 400, in alternative implementations, the memory 414 may be external to the computer 400.

[0066] Application 406 is an algorithmic software engine that provides functionality according to specific needs, desires, or specific implementations of computer 400, particularly with respect to functionality required for anomaly detection. Although described as a single application 406, application 406 may be implemented as multiple applications 406 on computer 400. Furthermore, although described as integral to computer 400, in alternative implementations, application 406 may be external to computer 400.

[0067] There may be any number of computers 400 associated with the network or external to the network and communicating through the network. In addition, the present disclosure contemplates that many users may use one computer 400 or one user may use multiple computers 400.

[0068] Implementations of the described subject matter may include one or more of the features, alone or in combination.

[0069] For example, in a first implementation, a method includes: obtaining one or more feature vectors of a sample, each feature vector of the one or more feature vectors corresponding to a feature group selected by a user; and selecting a similar sample set based on the one or more feature vectors, wherein selecting the similar sample set based on the one or more feature vectors includes: for each feature vector of the one or more feature vectors, selecting a corresponding feature similar sample set based on the corresponding feature vector; and for each feature vector of the one or more feature vectors, combining the corresponding selected feature similar sample set to generate the similar sample set.

[0070] The above and other described implementations may each, optionally, include one or more of the following features:

[0071] The first feature may be combined with any of the following features, further comprising: receiving a user-specified weight for each of the one or more feature vectors; and wherein the similar sample set is further selected based on the user-specified weight.

[0072] The second feature can be combined with any previous or following feature, wherein for each feature vector in the one or more feature vectors, selecting a corresponding feature similar sample set based on the corresponding feature vector includes: for each feature vector in the one or more feature vectors, calculating the distance between the feature vector and the corresponding feature index set of the basic sample; and selecting the corresponding feature similar sample set based on the calculated distance.

[0073] The third feature, which may be combined with any of the previous or following features, further includes: normalizing the calculated distance, and wherein the similar sample set is generated based on the normalized distance.

[0074] The fourth feature, which can be combined with any previous or following feature, is characterized in that obtaining one or more feature vectors of the sample includes: receiving user input, wherein the user input indicates a selection of a feature group, and generating the one or more feature vectors for the sample for the feature group.

[0075] The fifth feature, which can be combined with any of the previous or following features, further includes: outputting one or more user interface objects indicating multiple feature groups at the user interface.

[0076] The sixth feature, which can be combined with any of the previous features, is that the sample is a software code.

[0077] In a second implementation, a computer-readable medium includes instructions that, when executed, cause an electronic device to perform operations, the operations comprising: obtaining one or more feature vectors of a sample, each of the one or more feature vectors corresponding to a feature group selected by a user; and selecting a similar sample set based on the one or more feature vectors, wherein selecting the similar sample set based on the one or more feature vectors comprises: for each feature vector of the one or more feature vectors, selecting a corresponding feature similar sample set based on the corresponding feature vector; and for each feature vector of the one or more feature vectors, combining the corresponding selected feature similar sample set to generate the similar sample set.

[0078] The above and other described implementations may each, optionally, include one or more of the following features:

[0079] The first feature may be combined with any of the following features, the operation further comprising: receiving a user-specified weight for each of the one or more feature vectors; and wherein the similar sample set is further selected based on the user-specified weight.

[0080] The second feature can be combined with any previous or following feature, wherein for each feature vector in the one or more feature vectors, selecting a corresponding feature similar sample set based on the corresponding feature vector includes: for each feature vector in the one or more feature vectors, calculating the distance between the feature vector and the corresponding feature index set of the basic sample; and selecting the corresponding feature similar sample set based on the calculated distance.

[0081] A third feature, which may be combined with any of the previous or following features, further comprises: normalizing the calculated distance, and wherein the similar sample set is generated based on the normalized distance.

[0082] The fourth feature, which can be combined with any previous or following feature, is characterized in that obtaining one or more feature vectors of the sample includes: receiving user input, wherein the user input indicates a selection of a feature group, and generating the one or more feature vectors for the sample for the feature group.

[0083] The fifth feature, which can be combined with any of the previous or following features, further comprises: outputting one or more user interface objects indicating the plurality of feature groups at the user interface.

[0084] The sixth feature, which can be combined with any of the previous features, is that the sample is a software code.

[0085] In a third implementation, a computer-implemented system includes: one or more computers; and one or more computer storage devices, interoperably coupled with the one or more computers and having a tangible, non-transitory, machine-readable medium storing one or more instructions, wherein the one or more instructions perform one or more operations when executed by the one or more computers, the one or more operations including: obtaining one or more feature vectors of a sample, each feature vector of the one or more feature vectors corresponding to a feature group selected by a user; and selecting a similar sample set based on the one or more feature vectors, wherein selecting the similar sample set based on the one or more feature vectors includes: for each feature vector of the one or more feature vectors, selecting a corresponding feature similar sample set based on the corresponding feature vector; and for each feature vector of the one or more feature vectors, combining the corresponding selected feature similar sample set to generate the similar sample set.

[0086] The above and other described implementations may each, optionally, include one or more of the following features:

[0087] The first feature may be combined with any of the following features, the operation further comprising: receiving a user-specified weight for each of the one or more feature vectors; and wherein the similar sample set is further selected based on the user-specified weight.

[0088] The second feature can be combined with any previous or following feature, wherein for each feature vector in the one or more feature vectors, selecting a corresponding feature similar sample set based on the corresponding feature vector includes: for each feature vector in the one or more feature vectors, calculating the distance between the feature vector and the corresponding feature index set of the basic sample; and selecting the corresponding feature similar sample set based on the calculated distance.

[0089] A third feature, which may be combined with any of the previous or following features, further comprises: normalizing the calculated distance, and wherein the similar sample set is generated based on the normalized distance.

[0090] The fourth feature, which can be combined with any previous or following feature, is characterized in that obtaining one or more feature vectors of the sample includes: receiving user input, wherein the user input indicates a selection of a feature group, and generating the one or more feature vectors for the sample for the feature group.

[0091] The fifth feature, which can be combined with any of the previous or following features, further comprises: outputting one or more user interface objects indicating the plurality of feature groups at the user interface.

[0092] The sixth feature, which can be combined with any of the previous features, is that the sample is a software code.

[0093] The implementation of the subject matter and functional operations described in this specification can be implemented in digital circuits, in tangible embodied computer software or firmware, in computer hardware, including the structure disclosed in this specification and its structural equivalent, or in one or more combinations thereof. The implementation of the subject matter described in this specification can be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a tangible, non-transient computer storage medium for data processing device execution or control of its operation. Alternatively or additionally, program instructions can be encoded on an artificially generated propagation signal, such as a machine-generated electrical, optical or electromagnetic signal, which is generated to encode information for transmission to a suitable receiving device for data processing device execution. The computer storage medium can be a machine-readable storage device, a machine-readable storage substrate, a random or serial access storage device, or a combination of one or more thereof.

[0094] The terms "data processing apparatus", "computer" or "electronic computer equipment" (or equivalents understood by those of ordinary skill in the art) refer to data processing hardware and include all kinds of apparatus, devices and machines for processing data, including, for example, a programmed processor, a computer, or multiple processors or computers. The apparatus may also be or also include a dedicated logic circuit, such as a central processing unit (CPU), an FPGA (field programmable gate array) or an ASIC (application-specific integrated circuit). In some implementations, the data processing apparatus and / or the dedicated logic circuit may be hardware-based and / or software-based. The apparatus may optionally include code that creates an execution environment for a computer program, such as code that constitutes processor firmware, a protocol stack, a database management system, an operating system or a combination of one or more thereof. The current disclosure contemplates the use of a data processing apparatus with or without a conventional operating system, such as LINUX, UNIX, WINDOWS, MAC OS, ADNROID, IOS or other suitable conventional operating systems.

[0095] A computer program, which may also be referred to or described as a program, software, software application, module, software module, script or code, may be written in any form of programming language, including compiled or interpreted languages, or declarative or procedural languages, and it may be deployed in any form, including as a separate program or as a module, component, subroutine or other suitable unit for use in a computer environment. A computer program may but need not correspond to a file in a file system. A program may be stored in a portion of a file that stores other programs or data, for example, one or more scripts are stored in a markup language document, in a single file dedicated to the program in question, or in multiple collaborative files, for example, a file storing a portion of one or more modules, subroutines or codes. A computer program may be deployed to execute on a computer or on multiple computers located in one location or distributed across multiple locations and interconnected by a communication network. Although the portions of the program described in the various figures are shown as separate modules that implement various features and functions through various objects, methods or other processes, the program may instead appropriately include several submodules, third-party services, components, libraries, etc. On the contrary, the features and functions of various components may be appropriately combined into a single component.

[0096] The processes and logic flows described in this specification can be performed by one or more programmable computers, which execute one or more computer programs to perform functions by operating input data and generating output. The processes and logic flows can also be performed by special-purpose logic circuits, such as CPUs, FPGAs, ASICs, and the apparatus can also be implemented as these special-purpose logic circuits.

[0097] The computer that is suitable for the execution of computer program can be based on general or special microprocessor, both together or any other kind of CPU.Usually, CPU will receive instruction and data from ROM or RAM or both.The essential element of computer is CPU and one or more memory devices for storing instruction and data that execute or implement instruction.Usually, computer will also include, or be operably coupled to, receive data or transmit data or both together to one or more mass storage devices for storing data, for example, disk, magneto-optical disk or optical disk.However, computer need not have such device.In addition, computer can be embedded into another device, for example, mobile phone, PDA, mobile audio or video player, game controller, global positioning system (GPS) receiver or portable storage device, for example, USB flash drive, just give a few examples.

[0098] Computer-readable media (transitory or non-transitory, as the case may be) suitable for storing computer program instructions and data include all forms of non-volatile memory, media and memory devices, including, for example, semiconductor memory devices, such as erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM) and flash disks; magnetic disks, such as internal hard disks or removable disks; magneto-optical disks; and CD ROM, DVD+ / -R, DVD-RAM and DVD-ROM disks. The memory may store a variety of objects or data, including caches, categories, architectures, applications, backup data, tasks, web pages, web page templates, database tables, repositories of stored and / or dynamic information, and any other appropriate information including any parameters, variables, algorithms, instructions, rules, restrictions, or other references. Additionally, the memory may also include any other appropriate data, such as logs, policies, security or access data, report files, and others. The processor and memory may be supplemented or incorporated by special purpose logic circuitry.

[0099] To provide interaction with a user, implementations of the subject matter described in this specification may be implemented on a computer having a display device for displaying information to the user, such as a CRT (cathode ray tube), LCD, LED, or plasma display, and a keyboard and pointer device, such as a mouse, trackball, or trackpad, through which the user can provide input to the computer. Input may also be provided to the computer using a touch screen, such as a tablet computer surface with pressure sensors, a multi-touch screen using capacitive or electrical detection, or other types of touch screens. Other types of devices may also be used to provide interaction to the user; for example, feedback provided to the user may be any form of sensory feedback, such as visual feedback, auditory feedback, or tactile feedback; and input from the user may be received in any form, including auditory, verbal, or tactile input. In addition, the computer may interact with the user by sending and receiving files to and from a device used by the user; for example, by sending a web page to a web browser on a user's client device in response to a request received from the web browser.

[0100] The term "graphical user interface" or "GUI" may be used in the singular or plural to describe each of one or more graphical user interfaces and displays of a particular graphical user interface. Thus, a GUI may represent any graphical user interface that processes information and efficiently presents the information results to a user, including, but not limited to, a web browser, a touch screen, or a command line interface (CLI). Typically, a GUI may include a plurality of user interface (UI) elements, some or all of which are associated with a web browser, such as interactive areas, drop-down lists, and buttons that can be operated by a business suite user. These and other UI elements may relate to or represent the functionality of a web browser.

[0101] The implementation of the subject matter described in this specification can be implemented on a computer system, which includes a back-end component such as a data server, or includes a middleware component such as an application server, or includes a front-end component such as a client computer with a graphical user interface or a web browser, and a user can interact with the implementation of the subject matter described in this specification through the front-end component, or any combination of one or more of these back-end, middleware or front-end components. System components can be interconnected by any form or medium of wired and / or wireless digital data communication, such as a communication network. Examples of communication networks include local area networks (LANs), radio access networks (RANs), metropolitan area networks (MANs), wide area networks (WANs), global microwave access interoperability (WIMAX), wireless LANs (WLANs) using, for example, 802.11a / b / g / n / ac / ax / be and / or 802.20, all or part of the Internet, and / or any other communication system or communication system at one or more locations. The network can communicate, for example, Internet Protocol (IP) packets, frame relay frames, asynchronous transfer mode (ATM) units, voice, video, data and / or other suitable information between network addresses.

[0102] A computing system may include clients and servers. Clients and servers are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other.

[0103] In some implementations, any or all components of a computing system, hardware and / or software, may interface with each other and / or interfaces using an API and / or service layer. An API may include specifications for routines, data structures, and object classes. An API may be computer language independent or dependent and refer to a complete interface, a single function, or even an API set. The service layer provides software services to the computing system. The functions of the various components of the computing system can be accessed by all service consumers through this service layer. Software services provide reusable, defined business functions through defined interfaces. For example, the interface may be software written in JAVA, C++, or other suitable languages ​​that provide data in XML or other suitable forms. The API and / or service layer may be a necessary and / or independent component relative to other components of the computing system. Moreover, any or all parts of the service layer may be implemented as sub- or sub-modules of other software modules, enterprise applications, or hardware modules that do not depart from the scope of this disclosure.

[0104] Although this specification contains many specific implementation details, these should not be interpreted as limitations on the scope of any invention or the scope of what is claimed, but rather as descriptions of features specific to a particular implementation of a particular invention. Certain features of the corresponding implementations described in the context of this specification may also be implemented in combination in a single implementation. Conversely, various features of a single implementation described in the context may also be implemented separately in multiple implementations or in any suitable sub-combination. In addition, although features may be described above as working in certain combinations, and even initially claimed as such, one or more features from the claimed combination may, in some cases, be deleted from the combination, and the claimed combination may be directed to a sub-combination or a variant of a sub-combination.

[0105] Specific implementations of the subject matter have been described. Other implementations, variations, and permutations of the described implementations are within the scope of the appended claims, which will be apparent to those skilled in the art. Although the operations are depicted in the drawings and claims in a particular order, this should not be understood as requiring that the operations be performed in the particular order shown or in a sequential order, or that all of the described operations (some operations may be considered optional) be performed to achieve the desired results. Under certain conditions, multitasking and parallel processing may be advantageous.

[0106] In addition, the separation and / or integration of various system modules and components in the implementations described above should not be understood as requiring such separation and / or integration in all implementations, and it should be understood that the program components and systems described can generally be integrated together into a single software product or packaged into multiple software products.

[0107] Therefore, the example implementations described above do not define or limit the present disclosure. Other changes, substitutions and alterations are also possible without departing from the spirit and scope of the present disclosure.

Claims

1. A method comprising: Obtaining one or more feature vectors of the sample, each feature vector of the one or more feature vectors corresponds to a feature group selected by a user; as well as Selecting a similar sample set based on the one or more feature vectors, wherein selecting the similar sample set based on the one or more feature vectors comprises: For each feature vector of the one or more feature vectors, selecting a corresponding feature similarity sample set based on the corresponding feature vector; as well as For each feature vector of the one or more feature vectors, the corresponding selected feature similar sample set is combined to generate the similar sample set.

2. The method according to claim 1, further comprising: receiving a user-specified weight for each of the one or more feature vectors; And wherein the similar sample set is also selected based on the weight specified by the user.

3. The method according to claim 1, wherein for each of the one or more feature vectors, selecting a corresponding feature similarity sample set based on the corresponding feature vector comprises: For each feature vector of the one or more feature vectors, calculating a distance between the feature vector and a corresponding feature index set of a basic sample; as well as The corresponding feature similarity sample set is selected based on the calculated distance.

4. The method according to claim 3, further comprising: The calculated distance is normalized, and wherein the similar sample set is generated based on the normalized distance.

5. The method according to claim 1, wherein obtaining one or more feature vectors of the sample comprises: receiving user input, wherein the user input indicates a selection of a feature group, and The one or more feature vectors for the feature group of the sample are generated.

6. The method according to claim 5, further comprising: One or more user interface objects indicative of the plurality of feature groups are output at a user interface. The method of claim 1 , wherein the sample is software code.

8. A computer-readable medium comprising instructions that, when executed, cause an electronic device to perform operations comprising: Obtaining one or more feature vectors of the sample, each feature vector of the one or more feature vectors corresponds to a feature group selected by a user; as well as Selecting a similar sample set based on the one or more feature vectors, wherein selecting the similar sample set based on the one or more feature vectors comprises: For each feature vector of the one or more feature vectors, selecting a corresponding feature similarity sample set based on the corresponding feature vector; as well as For each feature vector of the one or more feature vectors, the corresponding selected feature similar sample set is combined to generate the similar sample set.

9. The computer-readable medium of claim 8, the operations further comprising: receiving a user-specified weight for each of the one or more feature vectors; And wherein the similar sample set is also selected based on the weight specified by the user.

10. The computer-readable medium according to claim 8, wherein for each of the one or more feature vectors, selecting a corresponding feature similarity sample set based on the corresponding feature vector comprises: For each feature vector of the one or more feature vectors, calculating a distance between the feature vector and a corresponding feature index set of a basic sample; as well as The corresponding feature similarity sample set is selected based on the calculated distance.

11. The computer readable medium of claim 10, the operations further comprising: The calculated distance is normalized, and wherein the similar sample set is generated based on the normalized distance.

12. The computer-readable medium of claim 10, wherein obtaining one or more feature vectors of the sample comprises: receiving user input, wherein the user input indicates a selection of a feature group, and The one or more feature vectors for the feature group of the sample are generated.

13. The computer readable medium of claim 12, the operations further comprising: One or more user interface objects indicative of the plurality of feature groups are output at a user interface.

14. The computer-readable medium of claim 8, wherein the sample is software code.

15. A computer-implemented system comprising: one or more computers; as well as One or more computer storage devices interoperably coupled with the one or more computers and having a tangible, non-transitory, machine-readable medium storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising: Obtaining one or more feature vectors of the sample, each feature vector of the one or more feature vectors corresponds to a feature group selected by a user; and Selecting a similar sample set based on the one or more feature vectors, wherein selecting the similar sample set based on the one or more feature vectors comprises: For each of the one or more feature vectors, selecting a corresponding feature similarity sample set based on the corresponding feature vector; and For each feature vector of the one or more feature vectors, the corresponding selected feature similar sample set is combined to generate the similar sample set.

16. The computer-implemented system of claim 15, the operations further comprising: receiving a user-specified weight for each of the one or more feature vectors; And wherein the similar sample set is also selected based on the weight specified by the user.

17. The computer-implemented system of claim 15, wherein for each of the one or more feature vectors, selecting a corresponding feature-similar sample set based on the corresponding feature vector comprises: For each feature vector of the one or more feature vectors, calculating a distance between the feature vector and a corresponding feature index set of a basic sample; as well as The corresponding feature similarity sample set is selected based on the calculated distance.

18. The computer-implemented system of claim 17, the operations further comprising: The calculated distance is normalized, and wherein the similar sample set is generated based on the normalized distance.

19. The computer-implemented system of claim 15, wherein obtaining one or more feature vectors of the sample comprises: receiving user input, wherein the user input indicates a selection of a feature group, and The one or more feature vectors for the feature group of the sample are generated.

20. The computer implemented system of claim 15, the operations further comprising: One or more user interface objects indicative of the plurality of feature groups are output at a user interface.

Images