A method, device, and medium for identifying software component analysis

Abstract

The present invention discloses a method, device, and medium for identifying software component analysis, which relates to the technical field of software technology. Specifically, it includes: obtaining all files in the software to be identified to obtain a first data set; extracting meta-file data to obtain a second data set, and obtaining a first open-source file set through first feature matching; performing deletion processing on the first data set to obtain a third data set, calculating the minimum hash signature through the program abstract syntax tree and the corresponding sub-syntax tree to generate a second feature set, and obtaining a second open-source file set through third feature matching; performing deletion processing on the third data set to obtain a fourth data set, obtaining an updated syntax tree based on the abstract syntax tree and the fourth data set and constructing a control flow diagram, and obtaining a third open-source file set through fourth feature matching between the third feature set and a preset reference database; merging the first open-source file set, the second open-source file set, and the second open-source file set to obtain the total open-source component set in the software to be identified.

Description

Technical Field

[0001] The present invention relates to the technical field of software technology, and in particular, to a method and device for identifying software component analysis and a medium. Background Art

[0002] In recent years, open-source databases have been widely adopted in software development due to their unique advantages. Open-source components can usually be used for free or at a low price, which is very friendly to developers in controlling costs. Open-source components can be specifically optimized according to the specific requirements of development projects during use. In addition, developers can obtain technical support such as materials and tutorials in the developer community corresponding to the open-source project. Therefore, open-source components are not only limited to traditional Web development, mobile application development, and desktop application development, but the content of open-source projects in software in emerging fields such as artificial intelligence, cloud computing, big data, SAAS, and financial services has also increased rapidly. However, at the same time, open-source components may have security vulnerabilities themselves, and there is a hidden danger that the developed finished software may be maliciously exploited. In addition, the version iteration speed of open-source components is inconsistent, and some old components are likely to bring security risks to the software due to untimely updates. Therefore, identifying the open-source file components in software is an important step in software component analysis.

[0003] Currently, the Chinese invention patent with the application number 202311667073.1 discloses a software component analysis method and related devices. The application solution includes: first, obtaining the source code of the target software, extracting the feature information of the source code, and further determining the main component information of the target software according to the feature information, using a software measurement tool to determine the measurement index of the target software, and finally, performing a risk assessment on the main component information according to the measurement index. This application can effectively solve the problem that multivariate statistical analysis technology is not used in the existing software component analysis and evaluation process, analyze some measurement data obtained by using a software measurement tool for the target software, reduce the difficulty of finding high-risk modules or high-risk classes in software development, facilitate developers or managers to effectively carry out risk management, reduce the information redundancy between various indicators, improve the efficiency of problem analysis, and improve the accuracy and efficiency of software component analysis and evaluation. However, this solution directly parses and processes all the code content, which is prone to problems such as high computational complexity and high false alarm rate. In addition, when analyzing and extracting feature extraction for the software code to be identified, it usually focuses on calculating semantic features and does not make full use of the overall structural features, which is not conducive to ensuring the accuracy of identifying open-source components. Summary of the Invention

[0004] The technical problem solved by the present invention is that when analyzing the components of software using traditional methods, the entire code content is directly parsed and processed. When the software to be detected consists of large data packets, it is prone to problems such as high computational complexity and high false alarm rate. In addition, when extracting analysis features from software code, it usually focuses on calculating semantic features and local structural features, and does not make full use of the overall structural features, which is not conducive to ensuring the accuracy of open-source component identification.

[0005] To solve the above technical problems, the present invention provides the following technical solution: A method for identifying software component analysis, including step S1, obtaining all files in the software to be identified to obtain a first data set;

[0006] Step S2, extracting meta-file data to obtain a second data set, performing feature extraction based on the second data set to obtain a first feature set, and performing a first feature match between the first feature set and a preset reference database to obtain a first open-source file set;

[0007] Step S2, performing deletion processing on the first data set based on the first open-source file set to obtain a third data set, generating a program abstract syntax tree and corresponding sub-syntax trees based on the third data set, generating a second feature set through the calculated minimum hash signatures of each file and the sub-syntax trees, and performing a third feature match between the second feature set and a preset reference database to obtain a second open-source file set;

[0008] Step S4, performing deletion processing on the third data set based on the second open-source file set to obtain a fourth data set, constructing a control flow chart based on the abstract syntax tree and the fourth data set based on an updated syntax tree, performing feature extraction through the control flow chart to obtain a third feature set, and performing a fourth feature match between the third feature set and a preset reference database to obtain a third open-source file set;

[0009] Step S5, merging the first open-source file set, the second open-source file set, and the second open-source file set to obtain the total set of open-source components in the software to be identified.

[0010] As a preferred solution of the method for identifying software component analysis described in the present invention, among them: performing feature extraction on the second data set to obtain a first feature set, obtaining file directory path data and file extension data from the first data set, arranging the file directory path data in the order from the file root directory to the sub-directory to obtain a path string, performing normalization processing on the path string to obtain a first directory path data set, traversing the first data set to identify file extensions to obtain a first file extension data set, and performing merging processing on the first directory path data set and the first file extension data set to obtain a first feature set.

[0011] As a preferred solution of the software component analysis method described in the present invention, wherein: the operation logic of the first feature matching is as follows: compare the first file extension data set with the file extension list in the preset reference database one by one to determine all files with the same extension to obtain the first matching files;

[0012] Extract the directory path data corresponding to the first matching files from the first directory path data set, compare it with the directory path data list in the preset reference database one by one to determine all files with the same path structure to obtain the first open-source file set;

[0013] The calculation logic for normalizing the path string is as follows: unify the path string delimiter symbols of different operating systems and remove redundant delimiters, convert the relative path of the path string to an absolute path, lowercase the constituent letters of the path string, and remove invalid space characters in the path string;

[0014] The preset reference database includes an open-source database on the network side and a local database.

[0015] As a preferred solution of the software component analysis method described in the present invention, wherein: delete the first open-source file set data from the first data set to obtain a third data set, parse the code in the third data set to obtain the abstract syntax tree corresponding to each file, perform a pre-order traversal on each abstract syntax tree through depth-first search to generate the corresponding sub-syntax tree, calculate the minimum hash signature of each file in the third data set based on the sub-syntax tree and the minhash algorithm, generate a second feature set based on the minimum hash signature of each file and the sub-syntax tree, and perform a third feature matching with the preset reference database according to the second feature set to obtain a second open-source file set;

[0016] As a preferred solution of the software component analysis method described in the present invention, wherein: the second feature set is composed of the syntax feature vectors of each file in the third data set, and the composition of the syntax feature vectors of each file includes: the minimum hash signature, the number of sub-syntax trees, and the total number of nodes in the sub-syntax tree;

[0017] The calculation logic of the third feature matching is as follows: extract each syntax feature vector in the second feature set, and perform threshold screening based on the syntax feature vector set of the preset reference database. Its calculation expression is:

[0018]

[0019] wherein, SFR represents the syntax feature threshold screening result, i represents the index of each file in the third data set, represents the index of each file in the preset reference database, represents the minimum hash signature of each file in the third data set, Denotes the minimum hash signature set in the preset reference database, Denotes the number of sub-syntax trees generated by each file in the third dataset, Denotes the set of the number of sub-syntax trees corresponding to the files in the preset reference database, Denotes the total number of nodes of the sub-syntax trees generated by each file in the third dataset, Denotes the set of the total number of nodes of the sub-syntax trees corresponding to the files in the preset reference database, Denotes the minimum hash deviation threshold, Denotes the sub-syntax tree deviation threshold, Denotes the sub-syntax tree node deviation threshold.

[0020] As a preferred solution of an identification software component analysis method described in the present invention, wherein: the third dataset is pruned based on the second open-source file set to obtain a fourth dataset, the abstract syntax tree is pruned based on the second open-source file set to obtain an updated syntax tree, a control flow diagram is constructed based on the updated syntax tree, a third feature set is obtained by feature extraction through the control flow diagram, and a third open-source file set is obtained by performing a fourth feature match between the third feature set and the preset reference database;

[0021] The calculation logic for converting the updated syntax tree into a control flow diagram is as follows: traverse and identify the control syntax structure based on the updated syntax tree, determine the execution order and conditional branches between each syntax tree node through the control syntax structure, perform code segmentation based on the execution order and conditional branches between each syntax tree node to obtain code segments with independent control structures, establish control flow nodes based on each code segment with an independent control structure, divide a continuous sequence of non-branching updated syntax tree nodes into basic blocks, establish corresponding control flow directed edges based on each node type and the basic block, and construct a control flow diagram based on the obtained control flow nodes, basic blocks, and control flow directed edges.

[0022] As a preferred solution of an identification software component analysis method described in the present invention, wherein: a third feature set is obtained by feature extraction through the control flow diagram, and the operation logic of the feature extraction is as follows: obtain the program instruction set corresponding to each node based on the mapping relationship between the nodes and the program instructions in the control flow diagram, divide each program instruction in the program instruction set through a fixed window sliding algorithm to obtain corresponding program instruction segments, calculate the segment hash value through the CityHash algorithm, splice the segment hash values to obtain a program instruction feature value, and obtain the third feature set based on the program instruction feature values corresponding to each program instruction.

[0023] As a preferred solution of the software component analysis method described in the present invention, where: the calculation logic of the four - time matching is as follows: calculate the edit text distance of the third feature based on the third feature set and the preset reference database, calculate the instruction similarity based on the edit text distance, and when the instruction similarity is greater than the similarity threshold, determine that the corresponding file of the data in the third feature set matches the preset reference database to obtain the third open - source file set. Its calculation expression is:

[0024]

[0025] Among them, SPC represents the instruction similarity, represents the program instruction feature value in the third feature set, represents the set of program instruction feature values in the preset reference database, represents the edit text distance between each program instruction in the third feature set and the program instructions in the preset reference database. k represents the index of each program instruction in the third feature set, l represents the index of the program instruction in the preset reference database, represents the total length, represents the maximum - value - taking function.

[0026] The present invention provides an electronic device, including a processor and a memory. The memory stores computer - readable instructions. When the computer - readable instructions are executed by the processor, the above - described software component analysis method is run.

[0027] The present invention provides a storage medium, on which a computer program is stored. It is characterized in that when the computer program is executed by a processor, the above - described software component analysis method is run.

[0028] The beneficial effects of the present invention: In the process of software component analysis, first analyze the metadata of the software, narrowing the scope of analyzing the software content data. Through the common matching of the directory path and file extension, the open - source component part that has not been shelled and directly cloned code can be quickly identified, that is, the first open - source file set in the above - mentioned invention content. After obtaining the open - source file set, perform a deletion operation on the original file data, and perform software component analysis according to the structure from more file content to less file content and from simple recognition method to complex recognition method, effectively reducing the computational complexity. Calculate the minimum hash signature through the program abstract syntax tree and the corresponding sub - syntax tree to generate the second feature set, which can use semantic features to identify open - source components. Extract features by constructing a control flow chart to obtain the program fragment hash value, and combine the edit text distance to calculate the instruction similarity to obtain the third open - source file set, which is beneficial to accurately identify the open - source component composition from the perspective of the program code control flow structure, improving the accuracy and depth of software component recognition. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 Schematic diagram of the basic process of a method for identifying software component analysis provided by an embodiment of the present invention. Specific embodiments

[0030] To make the above objects, features, and advantages of the present invention more obvious and understandable, the following will describe in detail the specific embodiments of the present invention with reference to the accompanying drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all embodiments.

[0031] Embodiment 1, referring to Figure 1 , which is an embodiment of the present invention, provides a method for identifying software component analysis, including:

[0032] Step S1, obtaining all files in the software to be identified to obtain a first data set;

[0033] Step S2, extracting meta-file data to obtain a second data set, performing feature extraction based on the second data set to obtain a first feature set, and performing first feature matching between the first feature set and a preset reference database to obtain a first open-source file set;

[0034] Step S2, performing deletion processing on the first data set based on the first open-source file set to obtain a third data set, generating a program abstract syntax tree and corresponding sub-syntax trees based on the third data set, generating a second feature set by calculating the minimum hash signature of each file and the sub-syntax trees, and performing third feature matching between the second feature set and a preset reference database to obtain a second open-source file set;

[0035] Step S4, performing deletion processing on the third data set based on the second open-source file set to obtain a fourth data set, constructing a control flow diagram based on the abstract syntax tree and the fourth data set based on an updated syntax tree, performing feature extraction through the control flow diagram to obtain a third feature set, and performing fourth feature matching between the third feature set and a preset reference database to obtain a third open-source file set;

[0036] Step S5, merging the first open-source file set, the second open-source file set, and the second open-source file set to obtain the total set of open-source components in the software to be identified.

[0037] In this embodiment, feature extraction is performed on the second data set to obtain a first feature set. File directory path data and file extension data are obtained from the first data set. The file directory path data is arranged in the order from the file root directory to the sub-directory to obtain a path string. The path string is normalized to obtain a first directory path data set. The first data set is traversed to identify file extension names to obtain a first file extension name data set. The first directory path data set and the first file extension name data set are merged to obtain a first feature set.

[0038] In this embodiment, the operation logic for the first feature matching is as follows: Compare each item in the first file extension data set with the file extension list in the preset reference database one by one to determine all files with the same extension, obtaining the first matching files;

[0039] Extract the directory path data corresponding to the first matching files from the first directory path data set, compare it with the directory path data list in the preset reference database one by one, and determine all files with the same path structure to obtain the first open-source file set;

[0040] The calculation logic for normalizing the path string is as follows: Unify the path string delimiter of different operating systems to " / " and remove redundant delimiters, convert the relative path of the path string to an absolute path, convert the constituent letters of the path string to lowercase, and remove invalid space characters in the path string;

[0041] The preset reference database includes an open-source database on the network side and a local database.

[0042] First, the first feature matching using file extensions such as.dll and.so is beneficial for narrowing the scope of the second feature matching using the path structure, and can reduce the computational complexity.

[0043] In this embodiment, delete the first open-source file set data from the first data set to obtain the third data set, parse the code in the third data set to obtain the abstract syntax tree corresponding to each file, perform a pre-order traversal on each abstract syntax tree through depth-first search to generate the corresponding sub-syntax tree, calculate the minimum hash signature of each file in the third data set based on the sub-syntax tree and the minhash algorithm, generate the second feature set based on the minimum hash signature of each file and the sub-syntax tree, and perform the third feature matching according to the second feature set and the preset reference database to obtain the second open-source file set;

[0044] Among them, depth-first search first visits the parent node through pre-order traversal, and then recursively visits the child nodes to complete the traversal of the abstract syntax tree of each file

[0045] In this embodiment, the second feature set is composed of the syntax feature vectors of each file in the third data set. The composition of the syntax feature vector of each file includes: the minimum hash signature, the number of sub-syntax trees, and the total number of nodes in the sub-syntax tree;

[0046] The calculation logic for the third feature matching is as follows: Extract each syntax feature vector in the second feature set, and perform threshold screening based on the syntax feature vector set of the preset reference database. Its calculation expression is:

[0047]

[0048] Among them, SFR represents the screening result of the syntax feature threshold, and i represents the index of each file in the third dataset. represents the index of each file in the preset reference database. represents the minimum hash signature of each file in the third dataset. represents the set of minimum hash signatures in the preset reference database. represents the number of sub-syntax trees generated by each file in the third dataset. represents the set of the number of sub-syntax trees corresponding to the files in the preset reference database. represents the total number of nodes of the sub-syntax trees generated by each file in the third dataset. represents the set of the total number of nodes of the sub-syntax trees corresponding to the files in the preset reference database. represents the minimum hash deviation threshold. represents the sub-syntax tree deviation threshold. represents the sub-syntax tree node deviation threshold.

[0049] In this embodiment, the fourth dataset is obtained by deleting and processing the third dataset based on the second open-source file set, the updated syntax tree is obtained by deleting and processing the abstract syntax tree based on the second open-source file set, the control flow chart is constructed based on the updated syntax tree, the third feature set is obtained by feature extraction through the control flow chart, and the third open-source file set is obtained by performing the fourth feature matching between the third feature set and the preset reference database.

[0050] The calculation logic for converting the updated syntax tree into a control flow chart is as follows: traverse and identify the control syntax structure based on the updated syntax tree, determine the execution order and conditional branches between each syntax tree node through the control syntax structure, perform code segmentation based on the execution order and conditional branches between each syntax tree node to obtain code segments with independent control structures, establish control flow nodes based on each code segment with an independent control structure, divide the continuous sequence of non-branching updated syntax tree nodes into basic blocks, establish corresponding control flow directed edges based on each node type and the basic blocks, and construct a control flow chart based on the obtained control flow nodes, basic blocks, and control flow directed edges.

[0051] Among them, the control flow nodes include conditional judgment nodes (such as if and switch nodes), loop nodes (such as for and while nodes), and function call nodes.

[0052] In this embodiment, the third feature set is obtained through feature extraction based on a control flow diagram. The operation logic of the feature extraction is as follows: based on the mapping relationship between nodes and program instructions in the control flow diagram, the program instruction set corresponding to each node is obtained; the program instructions in the program instruction set are segmented through a fixed window sliding algorithm to obtain corresponding program instruction fragments; the fragment hash values are calculated through the CityHash algorithm; the fragment hash values are concatenated to obtain program instruction feature values; and the third feature set is obtained based on the program instruction feature values corresponding to each program instruction.

[0053] In this embodiment, the calculation logic of the four - time matching is as follows: based on the third feature set and a preset reference database, the edit text distance of the third feature is calculated; the instruction similarity is calculated based on the edit text distance; when the instruction similarity is greater than the similarity threshold, it is determined that the corresponding file of the data in the third feature set matches the preset reference database, and the third open - source file set is obtained. The calculation expression is:

[0054]

[0055] Among them, SPC represents the instruction similarity, represents the program instruction feature value in the third feature set, represents the set of program instruction feature values in the preset reference database, represents the edit text distance between each program instruction in the third feature set and the program instructions in the preset reference database. k represents the index of each program instruction in the third feature set, and l represents the index of the program instruction in the preset reference database. represents the total length, represents the maximum - value - taking function.

[0056] An electronic device includes a processor and a memory. The memory stores computer - readable instructions. When the computer - readable instructions are executed by the processor, the above - described method for identifying software component analysis runs.

[0057] A storage medium stores a computer program. The computer program, when executed by a processor, runs the above - described method for identifying software component analysis.

[0058] Those skilled in the art should understand that the embodiments of the present invention can be provided as a method, a system, or a computer program product. Therefore, the present invention can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code. Among them, the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM for short), electrically erasable programmable read-only memory (EEPROM for short), erasable programmable read-only memory (EPROM for short), programmable read-only memory (PROM for short), read-only memory (ROM for short), magnetic memory, flash memory, magnetic disk or optical disk. These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured article including an instruction device, and the instruction device implements the functions specified in Figure 1 one process or a plurality of processes and / or Figure 1 function specified in one block or a plurality of blocks.

[0059] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical solutions of the present invention can be modified or equivalently replaced without departing from the spirit and scope of the technical solutions of the present invention, and they should all be covered by the scope of the claims of the present invention.

Claims

1. A method for identifying software component analysis, characterized in that, Including: Step S1: Obtain all files in the software to be recognized to get the first dataset; Step S2: Extract meta-file data to get the second dataset, perform feature extraction based on the second dataset to get the first feature set, and perform the first feature matching between the first feature set and a preset reference database to get the first open-source file set; Step S3: Perform deletion processing on the first dataset based on the first open-source file set to get the third dataset, generate a program abstract syntax tree and corresponding sub-syntax trees based on the third dataset, generate a second feature set through the calculated minimum hash signatures of each file and the sub-syntax trees, and perform the third feature matching between the second feature set and the preset reference database to get the second open-source file set; Step S4: Perform deletion processing on the third dataset based on the second open-source file set to get the fourth dataset, obtain an updated syntax tree and construct a control flow diagram based on the abstract syntax tree and the fourth dataset, perform feature extraction through the control flow diagram to get the third feature set, and perform the fourth feature matching between the third feature set and the preset reference database to get the third open-source file set; Step S5: Merge based on the first open-source file set, the second open-source file set, and the third open-source file set to get the total set of open-source components in the software to be recognized; Delete the data of the first open-source file set from the first dataset to get the third dataset, parse the code in the third dataset to obtain the abstract syntax tree corresponding to each file, perform pre-order traversal on each abstract syntax tree through depth-first search to generate the corresponding sub-syntax trees, calculate the minimum hash signature of each file in the third dataset based on the sub-syntax trees and the minimum hash algorithm, generate a second feature set based on the minimum hash signatures of each file and the sub-syntax trees, and perform the third feature matching between the second feature set and the preset reference database to get the second open-source file set; Perform feature extraction through the control flow diagram to get the third feature set, and the operation logic of the feature extraction is: obtain the program instruction set corresponding to each node based on the mapping relationship between the nodes and program instructions in the control flow diagram, perform segmentation on each program instruction in the program instruction set through the fixed window sliding algorithm to get the corresponding program instruction fragments, calculate the fragment hash values through the CityHash algorithm, splice the fragment hash values to get the program instruction feature values, and obtain the third feature set based on the program instruction feature values corresponding to each program instruction; The calculation logic of the four matches is: calculate the edit text distance of the third feature based on the third feature set and the preset reference database, calculate the instruction similarity based on the edit text distance, and when the instruction similarity is greater than the similarity threshold, determine that the corresponding file in the third feature set matches the preset reference database to get the third open-source file set, and its calculation expression is: ； Among them, SPC represents the instruction similarity, represents the program instruction feature value in the third feature set, represents the set of program instruction feature values in the preset reference database, represents the edit text distance between each program instruction in the third feature set and the program instructions in the preset reference database. k represents the index of each program instruction in the third feature set, and l represents the index of the program instruction in the preset reference database, represents the total length, represents the maximum value function.

2. The method for identifying software component analysis according to claim 1, wherein: Feature extraction is performed on the second data set to obtain a first feature set. File directory path data and file extension data are obtained from the first data set. The file directory path data is arranged in the order from the file root directory to the sub-directory to obtain a path string. The path string is normalized to obtain a first directory path data set. The first data set is traversed to identify file extensions to obtain a first file extension data set. The first directory path data set and the first file extension data set are merged to obtain a first feature set.

3. The method for identifying software component analysis according to claim 2, wherein: The operation logic for the first feature matching is as follows: The first file extension data set is compared one by one with the file extension list in the preset reference database to determine all files with the same extension to obtain a first matching file. The directory path data corresponding to the first matching file is extracted from the first directory path data set and compared one by one with the directory path data list in the preset reference database to determine all files with the same path structure to obtain a first open-source file set. The calculation logic for normalizing the path string is as follows: Unify the path string delimiter symbols of different operating systems and remove redundant delimiters, convert the relative path of the path string to an absolute path, lowercase the constituent letters of the path string, and remove invalid space characters in the path string. The preset reference database includes a network-side open-source database and a local database.

4. The method for identifying software component analysis according to claim 1, wherein: The second feature set is composed of the syntax feature vectors of each file in the third data set. The composition of the syntax feature vector of each file includes: the minimum hash signature, the number of sub-syntax trees, and the total number of nodes in the sub-syntax trees. The calculation logic for the third feature matching is as follows: Extract each syntax feature vector in the second feature set and perform threshold screening based on the syntax feature vector set of the preset reference database. Its calculation expression is: ； Among them, SFR represents the screening result of the syntactic feature threshold, and i represents the index of each file in the third dataset. represents the index of each file in the preset reference database. represents the minimum hash signature of each file in the third dataset. represents the set of minimum hash signatures in the preset reference database. represents the number of sub-syntax trees generated by each file in the third dataset. represents the set of the number of sub-syntax trees corresponding to the files in the preset reference database. represents the total number of nodes of the sub-syntax trees generated by each file in the third dataset. represents the set of the total number of nodes of the sub-syntax trees corresponding to the files in the preset reference database. represents the minimum hash deviation threshold. represents the sub-syntax tree deviation threshold. represents the sub-syntax tree node deviation threshold.

5. The method for identifying software component analysis according to claim 1, wherein: The fourth data set is obtained by deleting the third data set based on the second open-source file set. The abstract syntax tree is deleted based on the second open-source file set to obtain an updated syntax tree. A control flow chart is constructed based on the updated syntax tree. Feature extraction is performed through the control flow chart to obtain a third feature set. The third open-source file set is obtained by performing the fourth feature matching between the third feature set and the preset reference database. The calculation logic for converting the updated syntax tree into a control flow chart is as follows: Traverse and identify the control syntax structure based on the updated syntax tree, determine the execution order and conditional branches between the syntax tree nodes through the control syntax structure, perform code segmentation based on the execution order and conditional branches between the syntax tree nodes to obtain code segments with independent control structures, establish control flow nodes based on the code segments with independent control structures, divide the continuous sequence of updated syntax tree nodes without branches into basic blocks, establish corresponding control flow directed edges based on each node type and basic block, and construct a control flow chart based on the obtained control flow nodes, basic blocks, and control flow directed edges.

6. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein, When the processor executes the program, it implements the steps of a method for identifying software component analysis as described in any one of claims 1 to 5.

7. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of a method for identifying software component analysis as described in any one of claims 1 to 5.

Images