Watermark generation method and related device

Abstract

The invention provides a watermark generation method and a related device, which are used for generating a zero watermark of a source code so as to perform leakage traceability on a leaked source code. Different from an existing zero-watermark technology for generating zero watermarks according to contents of texts, the zero-watermark generation method and the zero-watermark generation device have the advantages that the zero watermarks can be generated according to the occurrence frequency and / or the occurrence sequence of each type of operation elements in various types in the source codes, so that even if the leaked source codes are subjected to changes such as blank adding, line feed, quantity name change or annotation modification, the source codes can not be watermarked. As the occurrence frequency and the occurrence sequence of the same type of operation elements in the leaked source code are generally not changed, the similarity between the zero watermark of the leaked source code generated by the method and the zero watermark of the registered source code is still high; the watermark registration server can match the source code highly similar to the leaked source code in the registered source code, so that leakage traceability of the leaked source code is facilitated.

Description

Technical Field

[0001] This application relates to the technical field of information processing, and in particular, to a watermark generation method and related devices. Background Art

[0002] With the advent of the big data era, the sharing of network resources and information exchange have brought great convenience to people's lives and work. After users obtain data, there may be situations of secondary distribution and secondary sales. In the Internet era, leaked data may be quickly spread, which poses a great challenge to the copyright protection of data and curbing the illegal spread of data. Data watermark technology is one of the important technical means to solve the problem of data leakage tracking. For example, digital watermark technology can embed additional information such as user information, company logos, and file flow information into multimedia for tracing the file transfer process.

[0003] For software companies, source code is the core asset of the company. Therefore, software companies have a very high demand for tracing the source of leaked source code. However, due to the obvious differences between source code and other media data, for example, the content of source code generally cannot be modified, and source code is plain text and cannot modify line spacing, font color, font size, etc. Therefore, it is impossible to embed additional information into the source code using existing digital watermark technology. How to achieve tracing the source of leaked source code has become a research hotspot. Summary of the Invention

[0004] This application provides a watermark generation method and related devices for generating zero watermarks of source code, which is beneficial to tracing the source of leaked source code.

[0005] In a first aspect, this application provides a watermark generation method, which can be executed by a watermark generation device. The watermark generation device can be implemented in a software or hardware or a combination of software and hardware manner. The watermark generation device can be a computer device (such as a personal computer or a server, etc.), or a physical device installed in a computer device (such as a chip), or a software program running in a computer device, or the watermark generation device can be a function provided by a cloud platform. The following introduces this watermark generation method.

[0006] The watermark generation device can receive a source code (referred to as the first source code), and then can generate a zero watermark of the first source code according to the occurrence times and / or occurrence order of each type of operation element in various types in the first source code. The zero watermark of the first source code is used to be associated and stored with the additional information of the first source code. The additional information of the first source code is used to trace the source of a second source code, where the similarity between the zero watermark of the second source code and the zero watermark of the first source code is greater than a first threshold.

[0007] Due to the obvious differences between the source code and other media data as introduced above, the present application proposes to use the zero-watermark technology for leakage traceability of the source code. In the zero-watermark technology, the watermark generation device extracts the features of the text as the zero-watermark, and then associates and stores the additional information of the text with the zero-watermark in the watermark registration server. These texts are generally referred to as registered texts. After the text is leaked, the watermark generation device extracts the features of the leaked text (or the text to be traced) to generate a zero-watermark. The watermark registration server finds the zero-watermark with a higher similarity to the zero-watermark of the text to be traced among the stored zero-watermarks based on the similarity calculation, and then finds the additional information associated and stored with the zero-watermark. The user can use the additional information for leakage traceability of the text. Since there is no need to modify the text, therefore, by generating the zero-watermark of the first source code, it is beneficial for the watermark registration server to associate and store the zero-watermark and additional information of the first source code. When the similarity between the zero-watermark of the second source code and the zero-watermark of the first source code is greater than the first threshold, it is beneficial for the watermark registration server to provide the user with the additional information associated and stored with the zero-watermark of the first source code, thereby facilitating the user to perform leakage traceability on the second source code. Among them, the watermark registration server can be a physical server or a virtual server. The watermark generation device and the watermark registration server can be independent different devices, or the two can be integrated together.

[0008] In addition, different from the existing zero-watermark technology that generates zero-watermarks according to the content of the text, in the present application, the watermark generation device generates zero-watermarks according to the occurrence times and / or occurrence order of each type of operation element in multiple types in the source code. In this way, even if the leaked source code has undergone changes such as adding spaces, line breaks, changing variable names, or modifying comments, since the occurrence times and occurrence order of the same type of operation elements in the leaked source code generally do not change, the similarity between the zero-watermark of the leaked source code generated according to the occurrence times and / or occurrence order of each type of operation element in multiple types in the source code and the zero-watermark of the registered source code is still relatively high, which is beneficial for the watermark registration server to match the source code highly similar to the leaked source code in the registered source code, thereby facilitating the leakage traceability of the leaked source code.

[0009] The zero-watermark of the second source code and the zero-watermark of the first source code can be zero-watermarks of the same type, or in other words, are generated for the second source code using the same watermark generation method as the zero-watermark of the first source code.

[0010] Optionally, the operation elements include at least one of variables, constants, operators, function calls, and keywords.

[0011] Optionally, the zero watermark of the first source code is a vector or matrix obtained by concatenating one or more vectors, which is conducive to more accurately determining the similarity between source codes by comparing the zero watermarks.

[0012] The one or more vectors may include feature vectors of target data in the first source code, and the feature vectors may include at least one of variable type vectors, operator vectors, and operation statement vectors. Among them, the variable type vector of the target data is used to record the number of occurrences of each variable type in multiple variable types in the target data, the operator vector of the target data is used to record the number of occurrences of each operator in multiple operators in the target data, and the operation statement vector of the target data is used to record the positions where each operation element in multiple operation elements appears in a part or all of the statements in the target data. In this way, it is conducive to decomposing the generation process of the zero watermark of the first source code into the process of extracting variable type vectors and / or operator vectors and / or operation statement vectors of the target data, thereby facilitating flexible adjustment of the zero watermark generation process.

[0013] Optionally, the variable type vector of the target data includes elements corresponding to each variable type in the multiple variable types, and the value of the element in the variable type vector of the target data is used to indicate the number of occurrences of the corresponding variable type in the target data. This is conducive to the variable type vector of the target data more accurately representing the frequency distribution characteristics of each variable type in the target data.

[0014] Optionally, the operator vector of the target data includes elements corresponding to each operator in the multiple operators, and the value of the element in the operator vector of the target data is used to indicate the number of occurrences of the corresponding operator in the target data. This is conducive to the operator vector of the target data more accurately representing the frequency distribution characteristics of each operator type in the target data.

[0015] Optionally, in the operation statement vector of the target data, the value of the element is used to determine an operation element from the multiple operation elements, and the position of the element is used to indicate the position where the corresponding operation element appears in a part or all of the statements in the target data. This is conducive to the operation statement vector of the target data more accurately representing the position distribution characteristics of each type of operation element in a part or all of the statements in the target data.

[0016] The greater the number of operation elements in a statement, the generally higher the importance or implementation difficulty of the statement, and the lower the possibility of the statement being modified. Optionally, the part of the statements are the n statements with the largest number of operation elements among all the statements, where n is a positive integer. In this way, it is beneficial to save the storage resources and computing resources occupied by the zero watermark while ensuring the accuracy of the comparison result.

[0017] The part of the statements being the n statements with the largest number of operation elements among all the statements may mean that the number of operation elements in the shortest statement among the n statements is not less than the number of operation elements in the longest statement among the other statements. Among them, the shortest statement is the statement with the smallest number of operation elements among the n statements, the other statements include the statements in the target data except the n statements, and the longest statement is the statement with the largest number of operation elements among the other statements.

[0018] Optionally, the target data includes all the valid data in the first source code. Or, optionally, the target data includes a part of the valid data in the first source code, which is beneficial to saving the storage resources and computing resources occupied by the zero watermark.

[0019] Optionally, the target data is the first function in the first source code. In this way, it is beneficial to determine the feature vector of the first function through the zero watermark of the source code, thereby enriching the information carried by the zero watermark.

[0020] Optionally, the one or more vectors include the feature vectors of each function in all the functions in the first source code.

[0021] Through analysis, it is found that the greater the number of code lines in a function, the greater the implementation difficulty, and the greater the possibility of the function being leaked. Based on this discovery, optionally, the one or more vectors include the feature vectors of each function in a part of the functions in the first source code, and the part of the functions are the N functions with the largest number of code lines in the first source code, where N is a positive integer.

[0022] Optionally, the additional information of the first source code is also used for leakage traceability of the second function in the third source code, where the similarity between the feature vector of the second function and the feature vector of the first function is greater than a second threshold. In this way, it is beneficial to identify the situation of partial leakage of the registered source code.

[0023] Second aspect, the present application provides a watermark generation device, which may include a receiving module and a calculation module. Among them, the receiving module is used to receive a first source code, and the calculation module is used to generate a zero watermark of the first source code according to the statistical information of operation elements in the first source code. The zero watermark of the first source code is used to be associated and stored with the additional information of the first source code, and the additional information of the first source code is used to trace the leakage of a second source code. Among them, the similarity between the zero watermark of the second source code and the zero watermark of the first source code is greater than a first threshold.

[0024] Optionally, the zero watermark of the first source code is a vector or matrix obtained by splicing one or more vectors. The one or more vectors include feature vectors of target data in the first source code. The feature vectors include at least one of variable type vectors, operator vectors, and operation statement vectors. Among them, the variable type vector of the target data is used to record the number of occurrences of each variable type in multiple variable types in the target data. The operator vector of the target data is used to record the number of occurrences of each operator in multiple operators in the target data. The operation statement vector of the target data is used to record the position where each operation element in multiple operation elements appears in a part or all of the statements in the target data.

[0025] Optionally, the variable type vector of the target data includes elements corresponding to each variable type in the multiple variable types, and the value of the element in the variable type vector of the target data is used to indicate the number of occurrences of the corresponding variable type in the target data.

[0026] Optionally, the operator vector of the target data includes elements corresponding to each operator in the multiple operators, and the value of the element in the operator vector of the target data is used to indicate the number of occurrences of the corresponding operator in the target data.

[0027] Optionally, in the operation statement vector of the target data, the value of the element is used to determine an operation element from the multiple operation elements, and the position of the element is used to indicate the position where the corresponding operation element appears in a part or all of the statements in the target data.

[0028] Optionally, the part of the statements is the n statements with the largest number of operation elements in all the statements, and n is a positive integer.

[0029] Optionally, the target data is the first function in the first source code.

[0030] Optionally, the one or more vectors include the feature vectors of each function in a part of the functions in the first source code, where the part of the functions are the N functions with the most lines of code in the first source code, and N is a positive integer.

[0031] Optionally, the additional information of the first source code is further used to trace the leakage of a second function in the third source code, where the similarity between the feature vector of the second function and the feature vector of the first function is greater than a second threshold.

[0032] Optionally, the operation elements in the first source code include at least one of variables, constants, operators, function calls, and keywords.

[0033] In a third aspect, the present application provides a computer device, which may include a processor and a memory. The memory is used to store program code, and the processor is used to execute the method described in the first aspect or any possible implementation manner of the first aspect by executing the program code.

[0034] In a fourth aspect, the present application provides a computer device cluster, including at least one computer device, and each computer device includes a processor and a memory; the processors of the at least one computer device are used to execute the instructions stored in the memories of the at least one computer device, so that the computer device cluster executes the method described in the first aspect or any possible implementation manner of the first aspect.

[0035] In a fifth aspect, the present application provides a computer-readable storage medium, in which instructions (or computer-readable instructions or computer program instructions or functional programs or program codes) are stored. When these instructions run on a computer device, the computer device is caused to execute the method described in the first aspect or any possible implementation manner of the first aspect of the embodiments of the present application.

[0036] In a sixth aspect, the present application provides a computer program product, and when the instructions (or computer-readable instructions or computer program instructions or functional programs or program codes) included in the computer program product are executed by a computer device, the method described in the first aspect or any possible implementation manner of the first aspect of the embodiments of the present application is implemented.

[0037] Since the devices provided in the embodiments of the present application can be used to execute the corresponding method in the foregoing embodiments, the technical effects that can be obtained by the device embodiments of the present application can refer to the technical effects obtained by the corresponding method embodiments in the foregoing, and will not be elaborated here. Description of the Drawings

[0038] Figure 1 and Figure 2Schematically shows the business process of the embedded watermark technology;

[0039] Figure 3 Schematically shows the workflow of a software company using the method of embedding watermarks in text to protect source code;

[0040] Figure 4 Schematically shows the process related to zero-watermark technology;

[0041] Figure 5-1 and Figure 5-2 Schematically shows the possible application scenarios of the solution of this application and the possible business processes designed based on the solution of this application respectively;

[0042] Figure 6 Schematically shows the possible content of a source code file;

[0043] Figure 7 Schematically shows the possible process of the method of this application;

[0044] Figure 8 Schematically shows the variable type vector of function i among N functions of the source code;

[0045] Figure 9 Schematically shows the operator vector of function i;

[0046] Figure 10-1 Schematically shows Figure 6 A statement in the shown source code and the corresponding values of each operation element in this statement;

[0047] Figure 10-2 Schematically shows the operation statement vector of 5 statements in function i;

[0048] Figure 11 Schematically shows the zero-watermark of the source code;

[0049] Figure 12 Schematically shows the possible process of the watermark registration server searching for the registered zero-watermark matching the zero-watermark to be traced in the zero-watermark library;

[0050] Figure 13 Schematically shows a possible structure of the computer device provided by this application;

[0051] Figure 14 Schematically shows a possible structure of the computer device cluster provided by this application;

[0052] Figure 15 Schematically shows the connection method between computer devices in the computer device cluster. Specific implementation manner

[0053] In the digital economy era, data is the core asset of many companies. The value of data has also led to an endless stream of data leakage problems. The "IBM 2022 Cost of Data Breach Report" shows that 83% of the surveyed organizations have experienced multiple data breaches. In 2022, the average cost of a data breach reached $4.35 million. The average leakage cost in key industries such as finance, energy, transportation, communication, and education is $4.82 million.

[0054] Leakage tracing is to trace the path of data leakage after a data breach occurs, which is used to determine the leaker, location, and time of the data breach. On the one hand, leakage tracing can help enterprises understand the weak links in internal security management and technical measures. On the other hand, it is conducive to playing a psychological deterrent role against the leakers who commit criminal acts, thereby effectively reducing the occurrence of similar incidents.

[0055] Data watermarking is recognized as an important means to effectively solve the above-mentioned tracing pain points. Digital watermarking is a technology that embeds identification information into a multimedia file through a certain algorithm without affecting the value and use of the original multimedia. For example, digital watermarking technology can embed identification information such as user information, company logo, and file flow information into a multimedia file for tracing the file transfer process.

[0056] As Figure 1 shown, before a data breach, after the receiving institution or employee obtains the original data through a personal computer (PC), the watermark information can be embedded into the original data to generate watermarked data. The watermark information can include the identification information introduced above. After the data is leaked to the Internet, the distributing institution can obtain the leaked data from the Internet, extract the watermark information from the leaked data, and determine the leaking institution or employee and the leakage batch based on the watermark information.

[0057] As Figure 2 shown, in the watermark embedding stage, the watermark embedding device can encrypt the watermark information and then embed it into the original data to generate watermarked data. After the watermarked data is leaked to the Internet, the watermark extraction device can obtain the data from the Internet, extract the watermark from the data and decrypt it to obtain the watermark information. This watermark information can be used to determine the leaking institution or employee and the leakage batch.

[0058] The evaluation metrics of watermarks generally include robustness, transparency, embedding capacity, security, and practicality. Among them, robustness refers to the ability to correctly extract the watermark after various attacks. Transparency means that subjectively, users cannot perceive some changes in the database, and objectively, the change rates of the mean and mean square error are small. Embedding capacity refers to the number of watermark bit information that can be embedded, usually evaluated using the number of watermark bits that can be embedded in each tuple or the total embedding amount metric. Security means that without mastering the key, the attacker cannot extract the hidden watermark information, cannot damage the watermark information, and cannot forge or replace illegal watermark information. Practicality refers to the application effect of the algorithm, including the execution efficiency of the embedding / extraction algorithm and the required memory space.

[0059] For software companies, the source code is the core asset of the company. Therefore, software companies have a very high demand for tracing the leakage of source code. The source code also belongs to a type of text. Figure 3 Schematically shows the workflow of a software company using the method of embedding watermarks in text to protect the source code.

[0060] As Figure 3 shown, in the enterprise intranet, the code server, the PC of User 2, and the PC of User 3 are respectively set with modules having the function of embedding watermarks (denoted as Module 1). After User 1 uploads the source code to the code server through his own PC, the code server can embed watermark information in the source code (for example, Figure 3 the first watermark information in the summarized watermark information shown), to obtain the source code with watermarks. After User 2 downloads the source code with watermarks from the code server through his own PC, he can embed watermark information in the source code (for example, Figure 3 the second watermark information in the summarized watermark information shown), and then forward the obtained source code with watermarks to the PC of User 3. After receiving the source code, the PC of User 3 can embed watermark information in the source code (for example, Figure 3 the third watermark information in the summarized watermark information shown). The PC of the administrator can be set with a module having the function of extracting watermarks (denoted as Module 2). Suppose User 3 leaks the source code to the Internet through his own PC. The administrator can download the source code from the Internet through his own PC, and the watermark information extracted from it is as Figure 3 shown, that is, it includes the aforementioned three watermark information. The administrator can use the summarized watermark information to trace the leakage of the source code leaked to the Internet.

[0061] Currently, text-based invisible watermarking schemes mainly include text modification-based schemes, document structure-based schemes, natural language-based schemes, and zero-width character-based schemes. Among them, text modification-based schemes embed watermarks by adding punctuation marks, special syntax, etc. Natural language-based schemes refer to embedding watermarks by converting the expression order of sentences and replacing synonyms / near-synonyms. However, in order to ensure the normal implementation of the source code function, the content of the source code generally cannot be modified. Therefore, both text modification-based schemes and natural language-based schemes are not applicable to the protection of source code. Document structure-based schemes embed watermarks by modifying line spacing encoding, character spacing encoding, and feature encoding (color, font, size, underline). However, since the source code is a plain text file and the document structure cannot be modified as required, document structure-based schemes are also not applicable to the protection of source code. Zero-width character-based schemes: Use zero-width characters (invisible unicode characters) to embed watermarks. However, in some source code editors, zero-width characters can be displayed. Therefore, zero-width character-based schemes are also not applicable to the protection of source code.

[0062] In summary, although the source code is a text file, there are obvious differences in the use of source code and other texts. For example, the content of the source code cannot be modified (which will affect reading or cause compilation failure). In addition, the source code is plain text and the line spacing, font color, font size, etc. cannot be modified, which makes the above text-based invisible watermarking schemes not applicable to the protection of source code.

[0063] Currently, there is also a zero-watermark technology in the industry that does not make any changes to the original carrier signal. Instead, it realizes the leakage traceability of the text by extracting the features of the text and associating the features of the text with additional information and storing them in the watermark registration server. Therefore, it is expected to solve the difficulties encountered in the source code watermarking scenario in terms of transparency, robustness, and inconvenience in modifying the original content.

[0064] Figure 4 Schematically shows a process example related to zero-watermarking. Refer to Figure 4 , the watermark generation device can extract the features of the text, use the features or encoded features as the zero-watermark of the text, and add the information for leakage traceability to the additional information. After that, the watermark registration server can associate and store the zero-watermark and additional information of the text to complete the archive registration. When performing leakage traceability on the leaked text, the watermark generation device can extract the features of the leaked text and use the extracted features or encoded features as the zero-watermark of the text (referred to as the zero-watermark to be traced). After that, the watermark registration server can search for the zero-watermark that is highly similar to the zero-watermark to be traced among the registered zero-watermarks based on similarity calculation, and then obtain the associated and stored additional information based on the found zero-watermark, that is, leakage traceability can be realized.

[0065] By analyzing the characteristics of the zero-watermark scheme, this application proposes to use the zero-watermark scheme for source code leakage traceability. From Figure 4 As can be seen from the process shown, extracting the features of the text is a particularly important technical link in the zero-watermark scheme. The quality of the feature extraction algorithm seriously affects the zero-watermark comparison result. Optimizing the feature extraction method is conducive to optimizing the zero-watermark comparison result, such as reducing false negatives and / or false positives, which is conducive to meeting the requirements of software companies for the watermark scheme of source code. For example, adding an invisible watermark to the source code to track each flow link of the source code; making some text content modifications to the source code that do not affect the function implementation, such as modifying variable names, etc., will not affect the leakage traceability based on the watermark.

[0066] The following introduces the scheme for text feature extraction.

[0067] Optionally, message-digest algorithm 5 (MD5) or information digest algorithms such as SHA256 can be used to extract the features of the text.

[0068] Among them, MD5 is a widely used cryptographic hash function that can generate a 128-bit hash value based on the input file or text. The MD5 algorithm has the following characteristics: 1. Compressibility: The length of the calculated MD5 value is fixed for any length of data; 2. Easy to calculate: It is very easy to calculate the MD5 value from the original data; 3. Anti-modification: Any change to the original data, even if only 1 byte is modified, the resulting MD5 value will be very different; 4. Strong anti-collision: Given the original data and its MD5 value, it is very difficult to find a data with the same MD5 value (i.e., forged data). MD5 can generate a unique MD5 "digital fingerprint" for any file (regardless of its size, format, quantity). After the file is modified, its MD5, that is, the corresponding "digital fingerprint", will change.

[0069] The SHA256 algorithm is also a cryptographic hash function. For messages of any length, SHA256 will generate a 256-bit hash value. The characteristics of the algorithm are similar to those of MD5 and will not be elaborated here.

[0070] Through analysis, it is found that there are some disadvantages when information digest algorithms are applied to the zero-watermark of source code. For example, it is easy to fail to match. Because the source code is easy to modify, such as adding spaces, line breaks, modifying comments, or even deliberately modifying variable names to avoid detection. Such minor modifications will cause a huge change in the hash value calculated using the information digest algorithm, resulting in the hash value of the leaked source code being different from the hash value of the registered source code and the matching failing. Therefore, information digest algorithms cannot well meet the requirements of source code watermarking.

[0071] Alternatively, optionally, a text similarity matching algorithm can be used to extract the features of the text.

[0072] The text fingerprint algorithm, such as the similarity hashing algorithm (simhash), extracts keywords (the most frequently used meaningful words) from the text, and combines the occurrence frequencies of the keywords as weights to generate a spatial vector of the text. The similarity between texts is judged by comparing the distances between the vectors. This algorithm is generally used for paper plagiarism detection and can better tolerate minor changes in the text.

[0073] Through analysis, it is found that the application of the text similarity matching algorithm to source code zero watermark has the following disadvantages.

[0074] First of all, the feature extraction is inaccurate. The words in the source code are generally variable names, which are valid within a small range (such as within a function) and have no specific semantics. Unlike the frequently occurring keywords in an article that can represent the theme of the article. Therefore, the features extracted from the source code based on this algorithm cannot accurately represent the source code, and false alarms are likely to occur during similarity comparison.

[0075] Secondly, the text similarity algorithm extracts features based on feature words. When the leaked source code changes the variable names, it will not be able to correctly match the registered source code.

[0076] Therefore, the information digest algorithm also cannot well meet the requirements of source code zero watermark.

[0077] Based on the above analysis and findings, the present application provides a watermark generation scheme to meet the needs of software companies for the watermark scheme of source code. The present application does not limit the specific scenarios to which the watermark generation scheme provided by the present application is applied, nor does it limit the specific business processes of source code zero watermark designed by users or enterprises based on this scheme. Below, through Figure 5-1 and Figure 5-2 Examples are given to introduce possible application scenarios of the scheme of the present application and possible business processes designed based on this scheme.

[0078] Figure 5-1 Schematically shows a scenario of enterprise source code protection and the business process of source code zero watermark in this scenario. Figure 5-1 The shown scenario may include a scenario where the enterprise is responsible for protecting the code of the company. In this scenario, relevant activities such as the generation, storage, and circulation of the source code all occur within the enterprise (i.e., within the internal network), and the generation of zero watermark can also be placed within the enterprise internal network (referred to as the enterprise internal network for short). Figure 5-1 Taking the case where the manager's PC is located outside the enterprise internal network as an example, optionally, the manager's PC can be set within the enterprise internal network.

[0079] Figure 5-1The zero-watermark generation device (abbreviated as watermark generation device) is represented by a rectangle marked with a zero watermark. As Figure 5-1 shown, the watermark generation device can be set in the code server, the PC of User 2, the PC of User 3, and the PC of the administrator. Optionally, a computer device (such as a PC or a server) can implement the function of the watermark generation device by installing and running a software program (such as a client plug-in). Alternatively, the watermark generation device can be a functional module implemented by hardware or a combination of hardware and software.

[0080] Figure 5-1 The business process shown includes steps A501 to A510. As shown in step A501, User 1 can upload the generated source code to the code server through their own PC. As shown in step A502, after the code server detects that new code has been uploaded, it can call the watermark generation device to generate the zero watermark of the source code, and send the zero watermark and additional information 1 to the watermark registration server. The watermark registration server can save the watermark and the additional information. At this time, the source code can be called the registered source code, and the zero watermark can be called the registered zero watermark. As shown in step A503, User 2 downloads the source code from the code server through their own PC. As shown in step A504, the monitoring program on User 2's PC detects that source code has been downloaded, and can call the watermark generation device to generate the zero watermark of the source code, and send the zero watermark and additional information 2 to the watermark registration server. The watermark registration server can save the watermark and the additional information. As shown in step A505, User 2 can forward the source code to User 3 through their own PC. As shown in step A506, the monitoring program on User 3's PC detects that source code has been downloaded, and can call the watermark generation device to generate the zero watermark of the source code, and send the zero watermark and additional information 3 to the watermark registration server. The watermark registration server can save the watermark and the additional information.

[0081] Optionally, since the zero watermarks uploaded in steps A502, A504, and A506 are the same, the watermark registration server can store the additional information 1, additional information 2, and additional information 3 in association with the same zero watermark, so as to avoid repeatedly comparing the zero watermark to be traced with the same registered zero watermark due to repeated storage of the zero watermark, which is beneficial to saving storage resources and computing resources. The content of additional information 1 to additional information 3 can refer to the corresponding content in the Figure 5-1 shown table respectively. Figure 5-1 Taking the additional information including the usage time and the user of use (device or person) as an example. The present application does not limit the content and form of the additional information, as long as the additional information is beneficial to assisting the administrator in tracing the source code leakage. For example, the additional information can include at least one of the identification of the user and / or device that transfers the source code, the time of transferring the source code, and the way of transferring the source code (such as downloading or uploading).

[0082] As shown in step A507, user 3 can send the source code to the outside of the enterprise (such as the Internet) through their own PC. As shown in step A508, the administrator can intercept the leaked source code outside through their own PC. As shown in step A509, the administrator can call the watermark generation device to extract its zero watermark and send a traceability request to the watermark registration server, and this traceability request can carry this zero watermark (referred to as the zero watermark to be traced). After receiving the traceability request, the watermark registration server can match a zero watermark in the registered zero watermarks whose similarity to the zero watermark to be traced is greater than a threshold (referred to as the first threshold). Then, as shown in step A510, the watermark registration server can send the additional information associated with the matched zero watermark to the administrator's PC, and the administrator can perform source code leakage traceability based on this additional information. This additional information can be as Figure 5-1 shown in the content of the table, that is, this additional information includes additional information 1 to additional information 3, which can be understood as the aggregated additional information associated with this zero watermark.

[0083] Figure 5-2 Schematically shows the source code protection scenario of the cloud platform (such as the code hosting platform) and the business process of the source code zero watermark in this scenario. The code hosting platform mostly provides code storage, distribution, and collaboration services in the form of cloud services. Figure 5-2 The code server and the watermark registration server shown are virtual servers. The code server and the watermark registration server can be cloud services provided by the cloud platform. Therefore, the two can also be respectively referred to as code services and watermark registration services. The code hosting platform can provide open-source project services for individual developers and also provide private software project services for enterprises. Such as the social programming and code hosting website (GitHub), which is the largest code hosting platform in the world with a user group of more than 26 million. In addition, there are also storage repositories (Gitlab), Gitee, Tencent Developer Platform, Alibaba Code, etc. Some developers and enterprise users also have the need for source code leakage protection.

[0084] Figure 5-2 The watermark generation device is represented by a rectangle marked with a zero watermark. As Figure 5-2 shown, the watermark generation device can be set in the watermark registration server. Optionally, the watermark generation device can be a function of the watermark registration server.

[0085] Figure 5-2The business process shown includes steps B501 to B508. As shown in step B501, user 1 can upload the generated source code to the code server on the cloud platform through their own PC. As shown in step B502, after the code server detects that new code has been uploaded, it can call and send the source code (which can be in the form of a file or the location where the source code is stored) and additional information 1 to the watermark registration server. The watermark registration server can read the source code file, generate a zero watermark for the source code using the watermark generation device, and then make an associated record of the zero watermark and additional information 1. At this time, the source code can be called the registered source code, and the zero watermark can be called the registered zero watermark. As shown in step B503, user 2 downloads the source code from the code server through their own PC. As shown in step B504, after the code server monitors that user 2 has downloaded the source code, it sends the source code (which can be in the form of a file or the location where the source code is stored) and additional information 2 to the watermark registration server. The watermark registration server can read the source code file, generate a zero watermark for the source code using the watermark generation device, and then make an associated record of the zero watermark and additional information 1.

[0086] Optionally, since the source code sent in steps B502 and B504 is the same, the zero watermarks respectively generated in response to these two steps by the watermark registration server are the same. The watermark registration server can store the additional information 1 and additional information 2 in association with the same zero watermark to avoid repeatedly comparing the zero watermark to be traced with the same registered zero watermark due to repeated storage of the zero watermark, thereby facilitating the conservation of storage resources and computing resources. The content of additional information 1 and additional information 2 can respectively refer to Figure 5-2 the corresponding content in the table shown. And Figure 5-1 different from the additional information shown, Figure 5-2 the additional information shown also includes the usage type of the source code by the user (i.e., the way of transmitting the source code mentioned above).

[0087] As shown in step B505, user 2 can send the source code to the outside of the enterprise (such as the Internet) through their own PC. As shown in step B506, the manager can intercept the leaked source code outside through their own PC. As shown in step B507, the manager can use their own PC to send a traceability request to the watermark registration server, and the traceability request can carry the leaked source code (or the source code to be traced). After receiving the traceability request, the watermark registration server can use the watermark generation device to generate a zero watermark of the source code to be traced (referred to as the zero watermark to be traced). Then, among the registered zero watermarks, a zero watermark with a similarity greater than a threshold (referred to as the first threshold) to the zero watermark to be traced is matched. Then, as shown in step B508, the watermark registration server can send the additional information associated with the matched zero watermark to the manager's PC, and the manager can trace the leakage of the source code based on the additional information. The additional information can be as Figure 5-2 shown in the content of the table, that is, the additional information includes additional information 1 and additional information 2, which can be understood as the aggregated additional information associated with the zero watermark.

[0088] Figure 6 schematically showing the content of a source code file. Starting from Figure 6 the basic structure of the shown source code file (abbreviated as the source code), it can be found that the arithmetic elements in the source code can include one or more of variables, constants, operators, function calls, and keywords. For different source codes, the occurrence times and / or orders of the same type of arithmetic elements are generally different.

[0089] Based on the above findings, the present application provides a method for generating a zero watermark. For the convenience of description, the device for executing this method in the present application is referred to as a watermark generation device. As Figure 5-1 shown, the watermark generation device can be a module implemented by software (such as a plugin). Or, optionally, the watermark generation device can be a module implemented by hardware (such as a logic circuit) or a module implemented in a combination of software and hardware. For example, the module can be set in Figure 5-1 the code server, the PC of employee 2, and the PC of employee 3 shown. At this time, the module can generate the zero watermark of the registered source code. For example, the module can be set in the manager's PC. At this time, the module can generate the zero watermark of the source code to be traced. For example, the module can be set in the watermark registration server. For example, the module can be Figure 5-2 a function in the virtualized watermark registration server shown. At this time, the module can be used to generate both the zero watermark of the registered source code and the zero watermark of the source code to be traced. Or, the watermark generation device can be a physical computer device. For example, the computer device can be a physical watermark registration server, or, Figure 5-1The code server, the PC of Employee 2, the PC of Employee 3, and the PC of the manager shown can be used as watermark generation devices respectively.

[0090] The watermark generation device can receive the source code, and then generate the zero watermark of the source code according to the occurrence times and / or occurrence order of each type of operation element in multiple types in the source code. For the convenience of distinguishing from the existing zero watermark, the zero watermark generated by the watermark generation device according to the occurrence times and / or occurrence order of each type of operation element in multiple types in the source code can also be called the zero watermark of the target type of the source code (abbreviation: target zero watermark). The design concepts, methods, and devices related to the target zero watermark are introduced later. For the sake of simplicity of description, the zero watermark mentioned later refers to the target zero watermark.

[0091] As introduced before, the watermark registration server can associate and store the zero watermark of the registered source code and additional information. The watermark registration server can receive the traceability request sent by the client. The watermark registration server can generate the zero watermark of the source code to be traced according to the zero watermark generation method provided in this application, or the traceability request can carry the zero watermark of the source code to be traced. Then, the watermark registration server can determine the matching result between the source code to be traced and the registered source code according to the zero watermark of the source code to be traced and the zero watermark of the registered source code. For example, when the similarity between the zero watermark of the source code to be traced and the zero watermark of the registered source code is greater than the first threshold, the watermark registration server can determine that the registered source code has been leaked, the source code to be traced is the leaked registered source code, and the matching result between the two can indicate that the source code to be traced and the registered source code match successfully, or the zero watermarks of the two match successfully. The source code to be traced mentioned in this application can refer to the source code confirmed to be leaked or suspected to be leaked by the user.

[0092] When the source code to be traced matches the registered source code, the watermark registration server can send a traceability response to the client. The traceability response can carry the additional information of the registered source code. After receiving the traceability response through the client, the user can perform leakage traceability on the source code to be traced based on the additional information.

[0093] It can be seen that the watermark generation method provided by this application is conducive to meeting the requirements of software companies for the watermark scheme of source code. For example, since zero watermark does not need to be embedded in the source code, invisible watermark can be added to the source code to track each flow link of the source code. For example, different from the existing zero watermark technology that generates zero watermark according to the content of the text, in this application, the watermark generation device generates zero watermark according to the occurrence times and / or occurrence order of each type of operation element in multiple types in the source code. In this way, even if the leaked source code has undergone changes such as adding spaces, line breaks, changing variable names or modifying comments, since the occurrence times and occurrence order of the same type of operation elements in the leaked source code generally do not change, therefore, the zero watermark of the leaked source code generated according to the occurrence times and / or occurrence order of each type of operation element in multiple types in the source code still has a high similarity with the zero watermark of the registered source code, which is conducive to the watermark registration server matching the source code highly similar to the leaked source code in the registered source code, thus facilitating the tracing of the leakage of the leaked source code.

[0094] To facilitate the comparison of the similarity between the zero watermark of the registered source code and the zero watermark of the source code to be traced, the zero watermark can be a vector (referred to as the target vector) or a matrix (referred to as the target matrix).

[0095] In mathematics, a vector refers to a quantity with magnitude and direction. It can be visually represented as a line segment with an arrow. The direction of the arrow represents the direction of the vector, and the length of the line segment represents the magnitude of the vector. For example, an ordered one-dimensional array like (1, 2, 3) can be transformed into a vector starting from the origin to the coordinates (1, 2, 3) in three-dimensional space. In addition, in machine learning, the attribute values of a certain thing are often transformed into vectors, that is, into spatial attributes, which is more conducive to analyzing the characteristics of things and facilitating calculations.

[0096] Optionally, the target vector or the target matrix can be obtained by splicing multiple vectors. These multiple vectors can include the feature vectors of the source code. The feature vectors can include at least one type of vector among variable type vectors, operator vectors, and operation statement vectors. In this way, it is conducive to disassembling the generation process of the zero watermark of the source code into the process of extracting the variable type vector and / or operator vector and / or operation statement vector of the source code, thus facilitating the flexible adjustment of the zero watermark generation process.

[0097] Through analysis, it is found that although malicious leakers can evade detection by modifying variable names, they cannot change variable types because changing variable types will cause the source code to run incorrectly or obtain incorrect calculation results. Based on this discovery, this application proposes that the feature vector can include a variable type vector, and the variable type vector of the source code is used to record the occurrence times of each variable type among multiple variable types in the source code. The variable type vector can record the occurrence times of each variable type in the current source code in vector form. Optionally, the variable type vector of the source code includes elements corresponding to each variable type among multiple variable types in the source code, and each element in the variable type vector of the source code is used to indicate the occurrence times of the corresponding variable type in the source code.

[0098] The operator vector of the source code is used to record the occurrence times of each operator among multiple operators in the source code. The operator vector can record each type of operator in the current source code in vector form. Optionally, the operator vector of the source code can include elements corresponding to each operator among multiple operators, and each element in the operator vector of the source code is used to indicate the occurrence times of the corresponding operator in the source code.

[0099] The operation statement vector of the source code is used to record the operation order of one or more statements in the source code. Optionally, the operation order of one or more statements is used to indicate the occurrence order of each operation element among multiple operation elements in these one or more statements. Optionally, the number of operation elements in any one of the n statements is more than the number of operation elements in any one of the statements other than the n statements in the target data.

[0100] The above three types of vectors will be introduced with method examples later, and will not be elaborated here for the time being.

[0101] When the source code to be traced contains a part of the data of the registered source code, it can still be considered that the registered source code has been leaked. However, since the source code to be traced may not include other data in the source code to be traced, the similarity between the zero watermark of the source code to be traced and the zero watermark of the registered source code may be less than the above first threshold.

[0102] To identify partial data leakage in the source code, the above-mentioned multiple vectors may include feature vectors of each of the N functions in the source code, where N is a positive integer. The feature vectors of the functions can be understood with reference to the feature vectors of the source code introduced above. The difference between the two lies in the statistical range of the statistical results of the operation elements indicated by the feature vectors. For example, the variable type vector of the source code is used to record the occurrence times of each of the multiple variable types in the source code, while the variable type vector of the function is used to record the occurrence times of each of the multiple variable types in the function. Examples of the feature vectors of the functions will be introduced later and will not be elaborated here for the time being.

[0103] When the similarity between the feature vector of a certain function (referred to as the second function) in the zero watermark of the source code to be traced and the feature vector of a certain function (referred to as the first function) in the zero watermark of the registered source code is greater than the second threshold, the watermark registration server may determine that the second function and the first function are the same, the source code to be traced includes a part of the data / fragment of the registered source code, and part of the registered source code has leaked / fragmented. The matching result between the two may indicate that the source code to be traced matches the registered source code.

[0104] When the source code to be traced matches the registered source code, the watermark registration server may feedback a tracing response to the client. The tracing response may carry additional information of the registered source code. After the user receives the tracing response through the client, the user may perform leakage tracing on the second function in the source code to be traced based on the additional information.

[0105] Assume that the source code includes M functions, where M is a positive integer. Then, N may be equal to M, that is, the above-mentioned multiple vectors include the feature vectors of each function in the source code. Or, when M is greater than 1, in order to save storage resources and computing resources, N may be a positive integer less than M, that is, the above-mentioned multiple vectors include the feature vectors of each of a part of the functions in the source code. The user may select N functions from the M functions according to needs. Examples of optional ways to determine N functions from M functions will be introduced later and will not be elaborated here for the time being.

[0106] The idea of generating the zero watermark of the source code by the watermark generation device was introduced above. Next, based on the above idea, an example of the method for the watermark generation device to generate the zero watermark of the source code will be introduced. As introduced above, the process of the watermark generation device generating the zero watermark of the registered source code and the process of generating the zero watermark to be traced can both refer to this method respectively.

[0107] Figure 7 Schematically show the possible process of this method. As Figure 7 shown, this method may include S701 to S704.

[0108] S701. Identify the programming language of the source code;

[0109] After the watermark generation device obtains the source code, it can identify the programming language of the source code. Specifically, S701 may include S7011 and S7012.

[0110] S7011, determine the programming language type of the source code;

[0111] After the watermark generation device obtains the source code, it can determine the programming language type of the source code according to the source code suffix and / or writing format, etc.

[0112] S7012, determine the annotation method, variable type, and keywords according to the programming language type;

[0113] Since the annotation methods, variable types, keywords, etc. corresponding to different programming language types may be different, therefore, after the watermark generation device determines the programming language type, it can determine the annotation method, variable type, keywords, etc. of the source code according to the programming language type.

[0114] S702, perform data cleaning on the source code;

[0115] After the watermark generation device identifies the programming language of the source code, it can perform data cleaning on the source code, such as deleting invalid content in the source code. The invalid content refers to the content in the source code that does not affect the function of the source code. Malicious leakers may remove this invalid content when leaking the source code externally. In order to facilitate the matching of the zero watermark of the registered source code and the zero watermark of the externally released source code, the watermark generation device can generate the zero watermark based on the source code after data cleaning. Specifically, S702 may include S7021 and S7022.

[0116] S7021, delete blank lines and comments;

[0117] After the watermark generation device determines the annotation method of the source code, it can identify and delete the comments in the source code. Optionally, the watermark generation device can also delete the blank lines in the source code.

[0118] S7022, delete invalid variables and statements;

[0119] After the watermark generation device determines the variable type and keywords of the source code, it can identify and delete the invalid variables and / or statements in the source code.

[0120] This application does not limit the timing between S7021 and S7022.

[0121] S703, extract features of functions in the source code;

[0122] As introduced above, the watermark generation device can splice the zero watermark of the source code using multiple vectors including the feature vectors of one or more functions in the source code. Therefore, after the watermark generation device cleans the data of the source code, it can extract the features of the functions in the source code. Specifically, S703 may include S7031 to S7034.

[0123] S7031. Determine the N functions with the most effective lines of code in the source code;

[0124] The functions in a source code file are limited, and the watermark generation device can extract the features of each function separately. In Figure 7 the example, to save the storage space and computing resources occupied by the zero watermark, the watermark generation device can select a part of the functions from the source code and extract the feature vectors of each function in this part. Assume that the source code includes M functions, M is a positive integer greater than 1, and N is a positive integer less than M. N can be a preset value, such as defaulting to 10, or the user can customize the value of N according to needs.

[0125] This application does not limit the way the watermark generation device selects N functions. Through analysis, it is found that the more lines of code in a function, the greater the implementation difficulty and the greater the possibility of the function being leaked. Based on this discovery, this application proposes that the watermark generation device can select the N functions with the most effective lines of code from the M functions of the source code. An effective line refers to a line containing an operation statement. Optionally, any line in the source code after data cleaning is an effective line.

[0126] After the watermark generation device determines the N functions, it can generate the feature vectors of each function in the N functions respectively. As introduced above, the feature vector can include at least one type of vector among the variable type vector, operator vector, and operation statement vector. Below, take the feature vector including the variable type vector, operator vector, and operation statement vector as an example.

[0127] S7032. Generate the variable type vector of each function in the N functions respectively;

[0128] After the watermark generation device determines the N functions, it can generate the variable type vector of each function in the N functions respectively. As introduced above, the variable type vector of a function is used to record the occurrence times of each variable type among multiple variable types in the function. Optionally, the variable type vector of a function can include the elements corresponding to each variable type among multiple variable types, and the value of the element in the variable type vector of the function is used to indicate the occurrence times of the corresponding variable type in the function.

[0129] Since the source code of different programming languages may contain different variable types, Figure 8Taking the source code in C language as an example, a variable type vector of a certain function (denoted as function i) among N functions of the source code is schematically shown, where i is a positive integer less than or equal to N. For example, Figure 8 as shown, multiple variable types may include various variable types such as character type variable "char", integer type variable "int", floating-point type variable "float", double-precision floating-point type variable "double", and structure variable "struct". For example, Figure 8 as shown, the variable type vector of function i includes elements corresponding to each variable type. From left to right, the first element of the variable type vector is the element corresponding to "char", and the value of this element (i.e., 5) is used to indicate that "char" appears 5 times in function i. Similarly, the second element of the variable type vector is the element corresponding to "int", and the value of this element (i.e., 20) is used to indicate that "int" appears 20 times in function i. And so on. According to Figure 8 the vector shown, "float" appears 8 times, "double" appears 2 times, and "struct" appears 1 time in function i. The source code in C language may also include other variable types, which will not be elaborated here due to space limitations. This application does not limit the specific types of the multiple variable types indicated by the variable type vector.

[0130] S7033. Generate an operator vector for each of the N functions respectively;

[0131] After the watermark generation device determines the N functions, it can generate an operator vector for each of the N functions respectively. As introduced above, the operator vector of a function is used to record the occurrence times of each operator among multiple operators in the function. Optionally, the operator vector of a function includes elements corresponding to each operator among multiple operators, and the value of the element in the operator vector of the function is used to indicate the occurrence times of the corresponding operator in the function.

[0132] Since the operator types included in the source code of different programming languages may be different, Figure 9 taking the source code in C language as an example, the operator vector of function i is schematically shown. For example, Figure 9 as shown, multiple operators may include various variable types such as addition operator "+", subtraction operator "-", multiplication operator "*", division operator " / ", and logical AND operator "&&". For example, Figure 9As shown, the operator vector of function i includes elements corresponding to each operator. From left to right, the first element of the operator vector is the element corresponding to "+", and the value of this element (i.e., 5) is used to indicate that "+" appears 5 times in function i. Similarly, the second element of the operator vector is the element corresponding to "-", and the value of this element (i.e., 7) is used to indicate that "-" appears 7 times in function i. And so on. According to Figure 9 the vector shown, in function i, "*" appears 8 times, " / " appears 0 times (i.e., does not appear), and "&&" appears 1 time. The source code of C language may also include other operators. Due to space limitations, they are not introduced in detail here. This application does not limit the specific types of the multiple operators indicated by the operator vector.

[0133] S7034. Generate the operation statement vectors of each of the N functions respectively;

[0134] After the watermark generation device determines the N functions, it can generate the operation statement vectors of each of the N functions respectively. As introduced above, the operation statement vector of a function is used to record the operation order of one or more statements in the function. Optionally, the operation order of one or more statements is used to indicate the occurrence order of each operation element in these one or more statements.

[0135] The operation statement vector of a function is used to record the operation order of all statements in the function. Or, in order to save the storage space and computing resources occupied by the zero watermark, the watermark generation device can select a part of the statements (such as n statements) from the function and determine the operation statement vector of the function based on this part of the statements. Assume that the function includes m statements, where m is a positive integer greater than 1, and n is a positive integer less than m. n can be a preset value, such as the default value of 5, or the user can customize the value of n according to needs. The n statements can refer to Figure 6 the statements in the dotted box shown.

[0136] This application does not limit the manner in which the watermark generation device selects n statements. The watermark generation device can select the n statements with the most operation elements from the m statements of the function. For example, the watermark generation device can sort the m statements of the function according to the number of operation elements contained. The more operation elements a statement contains, the higher the order of this statement. That is, the number of operation elements in any one of the n statements is more than that in any one of the m statements other than these n statements.

[0137] Optionally, the operation statement vector of a statement includes elements corresponding to each operation element in the statement. Different operation elements may correspond to different elements. The value of an element is used to indicate the type of the corresponding operation element, and the order of appearance of the element in the operation statement vector is used to indicate the order of appearance of the corresponding operation element in the statement. Alternatively, in the operation statement vector of a statement, the value of an element is used to determine one operation element from multiple operation elements, and the position of the element is used to indicate the position where the corresponding operation element appears in the statement. As introduced above, multiple operation elements may include one or more of operation elements such as variable names, constant names, operators, function calls, keywords, and data types.

[0138] Suppose the possible values of the elements of the operation statement vector include 1 to 8, and the value "1" is used to indicate that the type of the operation element is a variable, the value "2" is used to indicate that the type of the operation element is a constant, the value "3" is used to indicate that the type of the operation element is an operator, the value "4" is used to indicate that the type of the operation element is a function, the value "5" is used to indicate that the type of the operation element is the keyword "if" or "else" or "else if", the value "6" is used to indicate that the type of the operation element is the keyword "for" or the keyword "while", the value "7" is used to indicate that the type of the operation element is a keyword other than "if", "else", "else if", "for", and "while", and the value "8" is used to indicate that the type of the operation element is a variable type. Figure 10-1 Schematically show Figure 6 A statement in the source code shown and the values corresponding to each operation element in the statement, as Figure 10-1 shown, the elements in the operation statement vector of this statement can be successively 6, 2, 3, 4, 1, 2, and 1 from left to right.

[0139] When the watermark generation device selects Figure 6 the 1 statement shown from Figure 10-1 the function shown, the elements in the operation statement vector of this function can be successively 6, 2, 3, 4, 1, 2, and 1 from left to right. When the watermark generation device selects multiple statements from function i, the operation statement vector of function i can be understood as being obtained by splicing the operation statement vectors of each statement in the multiple statements. For example, when the watermark generation device selects 5 statements (successively called statement 1,..., statement 5) from function i, the operation statement vector of function i can be as Figure 10-2 shown.

[0140] This application does not limit the timing sequence among S7032, S7033, and S7034.

[0141] S704. Synthesize the feature vector of the function into a zero watermark;

[0142] After S703, the watermark generation device can obtain the feature vectors of each of the N functions (i.e., N feature vectors), and each feature vector includes the variable type vector, operator vector, and statement operation vector of the corresponding function. The watermark generation device can combine the feature vectors of the N functions to obtain the zero watermark of a complete source code file. The combined zero watermark can be, for example Figure 11 as shown

[0143] This application does not limit the combination method of the N feature vectors Figure 11 Taking the example that the watermark generation device horizontally concatenates the feature vectors of the N functions into a vector. Optionally, the watermark generation device can vertically concatenate the feature vectors of the N functions into a matrix, the matrix includes N rows, and each row is the feature vector of one of the N functions, and different rows are the feature vectors of different functions. Or, the watermark generation device can first divide the feature vectors of the N functions into P groups, where P is a positive integer less than N. After horizontally concatenating the feature vectors of each group into a vector to obtain P vectors, the P vectors are vertically concatenated into a matrix with P rows. When the lengths (or dimensions) of the N feature vectors are different, the N feature vectors can be processed to have the same length. For example, elements with preset values (such as 0) are filled in the shorter feature vectors. This application does not limit the order in which the watermark generation device concatenates the N feature vectors. As Figure 11 shown, the concatenation order of the corresponding feature vectors in the zero watermark can be determined according to the order in which the functions appear in the source code. Optionally, after the watermark generation device concatenates the feature vectors of the N functions into a vector or matrix, the watermark generation device can process the vector or matrix to obtain the zero watermark, and this processing can include but is not limited to transposition

[0144] In Figure 7 the process shown, S701 is used to execute the subsequent steps more accurately, and S701 is an optional step. S702 is used to execute the subsequent steps more accurately, and S702 is an optional step. Optionally, the watermark generation device can be a trained machine learning model, and this machine learning model is used to output the zero watermark of the source code after inputting the source code

[0145] As Figure 6 or Figure 7As shown, the watermark registration server can associate and save the zero watermark of the registered source code and additional information. The watermark registration server can receive a traceability request sent by a client. The traceability request can carry the zero watermark of the source code to be traced (or detected), or the watermark registration server can generate the zero watermark. After that, the watermark registration server can search in the zero watermark library for the registered zero watermark of the source code that matches the zero watermark of the source code to be traced (abbreviated as the zero watermark to be traced). Optionally, the watermark registration server can also search for the feature vector of the function in the registered zero watermark that matches the feature vector of the function in the zero watermark to be traced.

[0146] Figure 12 Schematically shows a possible process for the watermark registration server to search in the zero watermark library for the registered zero watermark of the source code that matches the zero watermark of the source code to be traced. As Figure 12 shown, this process can include S1201 to S1208.

[0147] S1201: Read the registered zero watermark of the source code from the zero watermark library;

[0148] After receiving the traceability request, the watermark registration server can determine multiple zero watermarks (referred to as the zero watermark library) from the saved registered zero watermarks of the source code. The multiple zero watermarks can be all or part of the zero watermarks saved by the watermark registration server. After that, the watermark registration server can read a registered zero watermark from the zero watermark library without replacement.

[0149] S1202: Determine whether the programming languages are the same. If they are the same, trigger S1203. If they are different, trigger S1201;

[0150] After receiving the traceability request, the watermark registration server can determine whether the programming language of the registered source code is the same as the programming language of the source code to be traced. If they are the same, trigger S1203. If they are different, trigger S1201.

[0151] Optionally, the zero watermark can also be used to indicate the programming language of the corresponding source code. For example, the value of an element at a specified position (such as the first element) of the zero watermark can be used to indicate the type of the programming language of the corresponding source code. Or, the additional information associated with and stored by the zero watermark can be used to determine the type of the programming language of the corresponding source code.

[0152] S1203: Calculate the first similarity between the registered zero watermark and the zero watermark to be traced;

[0153] If the programming language of the registered source code is the same as that of the source code to be traced, the watermark registration server can calculate the similarity between the registered zero watermark and the zero watermark to be traced. The value of the similarity is used to measure the similarity between the two zero watermarks. Moreover, the better the value of the similarity, the higher the similarity between the two zero watermarks can be considered. On the contrary, the worse the value of the similarity, the lower the similarity between the two zero watermarks can be considered. For the sake of convenience of description, this application refers to this similarity as the first similarity.

[0154] This application does not limit the method for the watermark registration server to calculate the value of the first similarity. Taking the zero watermark as a vector as an example, the watermark registration server can use algorithms such as cosine similarity algorithm, Pearson correlation coefficient algorithm, or Euclidean distance algorithm to calculate the value of the first similarity.

[0155] Taking the watermark registration server using the cosine similarity algorithm to calculate the first similarity as an example, assuming that the registered zero watermark and the zero watermark to be traced are the first vector and the second vector respectively, the watermark registration server can calculate the cosine value of the angle between the first vector and the second vector in a vector space. This cosine value can be used to measure the magnitude of the difference between the first vector and the second vector. The closer this cosine value is to 1, it indicates that the angle between the two vectors tends to 0 degrees, and further indicates that the two vectors are more similar. The closer this cosine value is to 0, it indicates that the angle between these two vectors tends to 90 degrees, and further indicates that the two vectors are less similar.

[0156] After the watermark registration server calculates the cosine value of the angle between the first vector and the second vector, it can calculate the similarity between the two vectors according to this cosine value. The larger the cosine value, the larger the similarity. On the contrary, the smaller the cosine value, the smaller the similarity.

[0157] S1204. Determine whether the first similarity is greater than the first threshold. If so, trigger S1205; if not, trigger S1206.

[0158] After the watermark registration server calculates the value of the first similarity, it can determine whether the value of the first similarity is greater than the first threshold. If the first similarity is greater than the first threshold, trigger S1205; if not, trigger S1206. Optionally, when the first similarity is equal to the first threshold, the watermark registration server can also execute S1205.

[0159] Assume that the value range of the first similarity is [0, 1], and the first threshold is 0.95. When the first similarity is greater than 0.95, S1205 can be triggered. When the value of the first similarity is less than or equal to 0.95, S1206 can be triggered.

[0160] Optionally, after the watermark registration server calculates the cosine value of the angle between different vectors, it may not calculate the similarity between two vectors based on this cosine value. Correspondingly, it may not store the first threshold. When the cosine value is greater than a certain value (e.g., 0.91), it can be considered that the first similarity is greater than the first threshold. When the cosine value is less than or equal to this value, it can be considered that the first similarity is not greater than the first threshold.

[0161] The first threshold can be defined according to the actual situation. When the value of the first threshold is too small, it is easy to cause misjudgment. When the value of the first threshold is too large, for example, setting the first threshold to 1 means that the angle between two vectors needs to be 0, and at this time, false negatives are likely to occur. For example, if a malicious leaker adds a line of operation statement in a certain function, it will cause a very small difference in the operator vector.

[0162] S1205. The registered source code matches successfully with the source code to be traced;

[0163] When the watermark registration server determines that the value of the first similarity is greater than the first threshold, the watermark registration server can determine that the registered source code matches successfully with the source code to be traced. The source code to be traced is highly similar to this registered source code. This registered source code has been leaked or is suspected of being leaked. This source code to be traced is or is suspected of being the leaked registered source code, and the comparison ends. After that, the watermark registration server can send a tracing response to the client (e.g., the manager's PC). The tracing response can carry additional information about this registered source code. After the user receives the tracing response through the client, the user can perform leakage tracing on the source code to be traced based on this additional information.

[0164] S1206. Calculate the second similarity between the feature vectors of each function in the zero watermark to be traced and the feature vectors of each function in the registered zero watermark respectively;

[0165] When the watermark registration server determines that the value of the first similarity is greater than the first threshold, the watermark registration server can calculate the second similarity between the feature vectors of each function in the zero watermark to be traced and the feature vectors of each function in the registered zero watermark respectively.

[0166] For example, the watermark registration server can determine the feature vectors of each of the N functions (referred to as the N functions to be traced) in the source code to be traced from the zero watermark to be traced, and, determine the feature vectors of each of the N functions (referred to as the N registered functions) in the registered source code from the registered zero watermark. The process of determining the feature vectors of the N functions from the zero watermark can be determined according to the process of synthesizing the feature vectors of the N functions into the zero watermark.

[0167] For each of the N functions to be traced, the watermark registration server can calculate the similarity between the feature vector of this function and the feature vector of each of the N registered functions. That is to say, for each of the N functions to be traced, the watermark registration server can calculate N similarity values. For ease of description, the similarity between the feature vectors of functions is called the second similarity. The method by which the watermark registration server calculates the second similarity can refer to the method for calculating the first similarity introduced above. The difference between the two is that the first similarity is the similarity between two zero watermarks, and the second similarity is the similarity between the feature vectors of two functions. For example, the watermark registration server can use algorithms such as the cosine similarity algorithm, the Pearson correlation coefficient algorithm, or the Euclidean distance algorithm to calculate the second similarity. For example, the cosine similarity algorithm can be used to calculate the cosine value of the angle between the feature vectors of two functions, and then the value of the second similarity can be determined according to this cosine value. The smaller the cosine value, the smaller the similarity. On the contrary, the larger the cosine value, the larger the similarity.

[0168] S1207. Determine whether the second similarity is greater than the second threshold. If so, trigger S1208; if not, trigger S1201.

[0169] After the watermark registration server calculates the second similarity between the feature vector of each of the N functions to be traced and the feature vector of each of the N registered functions, the watermark registration server can determine whether the calculated value of the second similarity is greater than the second threshold. If the second similarity is greater than the second threshold, trigger S1208; if not, trigger S1201. Optionally, when the second similarity is equal to the second threshold, the watermark registration server can also execute S1208.

[0170] Assume that the value range of the second similarity is [0, 1], and the second threshold can be 0.9. When the second similarity is greater than 0.9, S1208 can be triggered. When the value of the second similarity is less than or equal to 0.9, S1201 can be triggered.

[0171] Optionally, after the watermark registration server calculates the cosine value of the angle between different vectors, it can not calculate the similarity between the two vectors according to this cosine value. Correspondingly, it can not store the second threshold. When this cosine value is greater than a certain value (such as 0.95), it can be considered that the second similarity is greater than the second threshold. When this cosine value is less than or equal to this value, it can be considered that the second similarity is not greater than the second threshold.

[0172] The second threshold can be defined according to the actual situation. When the value of the second threshold is too small, it is easy to cause misjudgment. When the value of the second threshold is too large, for example, setting the second threshold to 1 means that the angle between two vectors needs to be 0, and at this time, false negatives are likely to occur. For example, if a malicious leaker adds a line of arithmetic statement in a certain function, it will cause a very small difference in the operator vectors of the two functions.

[0173] Optionally, after calculating a value of the second similarity, the watermark registration server can determine whether the value of the second similarity is greater than the second threshold. If it is greater than the second threshold, it may not be necessary to calculate the second similarity between other feature vectors.

[0174] S1208. The functions in the registered source code match the functions in the source code to be traced successfully.

[0175] When the watermark registration server determines that the value of the second similarity between a function to be traced (referred to as the second function) and a registered function (referred to as the first function) is greater than the second threshold, the watermark registration server can determine that the second function to be traced matches the registered first function successfully. The second function in the source code to be traced is highly similar to the first function in the registered source code. It is suspected that the first function in this registered source code has been leaked. The second function in the source code to be traced is or is suspected to be the leaked first function, and the comparison is over. After that, the watermark registration server can send a tracing response to the client (such as the manager's PC). The tracing response can carry the additional information of this registered source code. After receiving the tracing response through the client, the user can perform leakage tracing on the functions of the source code to be traced based on this additional information.

[0176] When any of the second similarities calculated by the watermark registration server through step S1206 is not greater than the second threshold, the watermark registration server can execute S1201 again.

[0177] When the registered source code flows within the enterprise or flows outside, the administrator can send a tracing request to the watermark registration server through the client. The watermark registration server can Figure 12 find the zero watermark that matches the currently flowing source code (i.e., the source code to be traced) or its code snippet in the watermark library by the method shown. If found, it can be determined that the currently flowing source code is a leaked source code or includes a leaked code snippet.

[0178] Figure 12The overall idea of the shown process is to first perform a comparison at the source code file level. If similar source code files are found, the comparison for this time is ended; otherwise, a function-level comparison is carried out. If the administrator does not pay attention to the leakage of code snippet copying, the watermark registration server may not compare the similarity between the feature vectors of functions, or the feature vectors in the zero watermark are the feature vectors of the source code. For example, the variable type vector in the zero watermark can be the variable type vector of the source code, the operator vector in the zero watermark can be the operator vector of the source code, and the operation statement vector in the zero watermark can be the operation statement vector of the source code. Correspondingly, only a file-level comparison can be performed in the subsequent comparison.

[0179] The method of the embodiment of the present application is introduced above. Next, the device provided by the embodiment of the present application will be introduced.

[0180] As introduced above, the watermark generation device provided by the present application may include a receiving module and a calculation module. Among them, the receiving module is used to receive the first source code, and the calculation module is used to generate the zero watermark of the first source code according to the statistical information of the operation elements in the first source code. The zero watermark of the first source code is used to be associated and stored with the additional information of the first source code, and the additional information of the first source code is used to trace the leakage of the second source code, where the similarity between the zero watermark of the second source code and the zero watermark of the first source code is greater than the first threshold. The division of modules here is only illustrative, just a logical function division. In actual implementation, there may be other division methods. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Each functional module in the watermark generation device can be integrated into one module, or each module can exist physically alone, or two or more modules can be integrated into one module. The modules in the watermark generation device can be implemented in the form of hardware or in the form of software functional units.

[0181] The embodiment of the present application provides a computer device. Figure 13 It is a possible structural schematic diagram of the computer device 13 in the embodiment of the present application. Refer to Figure 13 As shown, the computer device 13 includes: a processor 131, a communication interface 132, and a memory 133. The processor 131, the communication interface 132, and the memory 133 communicate with each other through a bus 134. The computer device 13 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the computer device 13.

[0182] The bus 134 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 13 The bus 134 is represented by only one line, but it does not mean that there is only one bus or one type of bus. The bus 134 may include a path for transmitting information between various components of the computer device 13 (for example, the memory 133, the processor 131, and the communication interface 132).

[0183] The processor 131 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0184] The memory 133 may include a volatile memory, such as a random access memory (RAM). The processor 131 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0185] The memory 133 stores executable program codes, and the processor 131 executes the executable program codes to respectively implement the functions of the aforementioned receiving module and the computing module, thereby implementing the method provided by the present application. That is, the memory 133 stores instructions for executing the method provided by the present application.

[0186] The communication interface 132 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computer device 13 and other devices or a communication network.

[0187] The embodiments of the present application also provide a computer device cluster. The computer device cluster includes at least one computer device. The computer device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computer device can also be a terminal device such as a desktop computer, a laptop computer, or a smart phone.

[0188] As Figure 14 shown, the computer device cluster includes at least one computer device 13. In the memory 133 of one or more computer devices 13 in the computer device cluster, the same instructions for executing the zero-watermark generation method can be stored.

[0189] In some possible implementation manners, in the memory 133 of one or more computer devices 13 in the computer device cluster, partial instructions for executing the zero-watermark generation method can also be stored respectively. In other words, the combination of one or more computer devices 13 can jointly execute the instructions for executing the zero-watermark generation method.

[0190] It should be noted that the memories 133 in different computer devices 13 in the computer device cluster can store different instructions, which are respectively used to execute partial functions of the watermark generation device. That is, the instructions stored in the memories 133 of different computer devices 13 can implement the functions of one or more modules in the receiving module and the calculation module.

[0191] In some possible implementation manners, one or more computer devices in the computer device cluster can be connected through a network. Among them, the network can be a wide area network or a local area network, etc. Figure 15 shows a possible implementation manner. As Figure 15 shown, two computer devices 13A and 13B are connected through a network. Specifically, they are connected to the network through the communication interfaces in each computer device. In this type of possible implementation manners, the memory 133 in the computer device 13A stores instructions for executing the function of the receiving module. At the same time, the memory 133 in the computer device 13B stores instructions for executing the function of the calculation module.

[0192] Figure 15 The connection manner between the computer device clusters shown can be considered that since the zero-watermark generation method provided in the present application requires a large amount of calculation processes, it is considered to hand over the function implemented by the calculation module to the computer device 13B for execution.

[0193] It should be understood that Figure 15 the function of the computer device 13A shown in can also be completed by multiple computer devices 13. Similarly, the function of the computer device 13B can also be completed by multiple computer devices 13.

[0194] The present application also provides a computer program product containing instructions. The computer program product may be software or a program product containing instructions that can run on a computer device or be stored in any available medium. When the computer program product runs on at least one computer device, at least one computer device is caused to execute all or part of the steps in any of the above method examples.

[0195] The embodiments of the present application also provide a computer-readable storage medium. The computer-readable storage medium may be any available medium that a computer device can store or a data storage device such as a data center containing one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive), etc. The computer-readable storage medium includes instructions that instruct the computer device to execute all or part of the steps in any of the above method examples.

[0196] In the above examples, the descriptions of each example have their own emphases. For parts not detailed in a certain example, reference may be made to the relevant descriptions of other examples. It should be noted that for the foregoing method examples, for the sake of simple description, they are all expressed as a series of action combinations. However, those skilled in the art should know that the present application is not limited by the described action sequence, because according to the present application, certain steps may be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the examples described in the specification are all preferred examples, and the actions and modules involved are not necessarily essential to the present application.

[0197] In several examples provided by the present application, it should be understood that the disclosed device can be implemented in other ways. For example, the device examples described above are only illustrative. For example, the above division of units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed coupling or direct coupling or communication connection to each other can be through some interfaces. The indirect coupling or communication connection of the device or unit can be in an electrical or other form.

[0198] The units described as separate components above may or may not be physically separated. The components displayed as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the present example solution.

[0199] In the description, claims and above-mentioned drawings of this application, the terms "first", "second", "third", etc. are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that such terms can be interchanged under appropriate circumstances, and this is only a way of distinguishing objects with the same attributes when describing the embodiments of this application. In addition, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion, so that a process, method, system, product or device comprising a series of units does not have to be limited to those units, but may include other units not clearly listed or inherent to these processes, methods, products or devices. The term "a plurality of" as used in the embodiments of this application refers to two or more. It should be understood that the term "and / or" herein is only a description of the association relationship between associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / " herein generally represents an "or" relationship between the associated objects before and after.

[0200] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. A watermark generation method, characterized in that, The method includes: Receiving a first source code; Generating a zero watermark of the first source code according to the occurrence times and / or occurrence order of operation elements of each type among multiple types in the first source code, where the zero watermark of the first source code is used to be stored in association with additional information of the first source code, and the additional information of the first source code is used to trace the leakage of a second source code. Among them, the similarity between the zero watermark of the second source code and the zero watermark of the first source code is greater than a first threshold.

2. The method according to claim 1, wherein The operation elements include at least one of variables, constants, operators, function calls, and keywords.

3. The method according to claim 2, characterized in that, The zero watermark of the first source code is a vector or matrix obtained by splicing one or more vectors. The one or more vectors include feature vectors of target data in the first source code. The feature vectors include at least one of variable type vectors, operator vectors, and operation statement vectors. Among them, the variable type vector of the target data is determined according to the occurrence times and / or occurrence order of variables of each variable type among the multiple variable types in the target data. The operator vector of the target data is determined according to the occurrence times and / or occurrence order of operators of each operator type among the multiple operator types in the target data. The operation statement vector of the target data is determined according to the occurrence times and / or occurrence order of operation elements of each operation element type among the multiple operation element types in a part or all of the statements in the target data.

4. The method according to claim 3, characterized in that, The variable type vector of the target data includes elements corresponding to each variable type among the multiple variable types, and the values of the elements in the variable type vector of the target data are used to indicate the number of times the corresponding variable type appears in the target data.

5. The method according to claim 3 or 4, characterized in that The operator vector of the target data includes elements corresponding to each operator among the multiple operators, and the values of the elements in the operator vector of the target data are used to indicate the number of times the corresponding operator appears in the target data.

6. The method according to any one of claims 3-5, characterized in that, In the operation statement vector of the target data, the value of an element is used to determine an operation element from the multiple operation elements, and the position of the element is used to indicate the position where the corresponding operation element appears in a part or all of the statements in the target data.

7. The method according to claim 6, characterized in that, The part of the statements is the n statements with the largest number of operation elements in the all statements, and n is a positive integer.

8. The method according to any one of claims 3-7, characterized in that, The target data is the first function in the first source code.

9. The method according to claim 8, characterized in that, The one or more vectors include the feature vectors of each function in a part of the functions in the first source code, and the part of the functions are the N functions with the most code lines in the first source code, and N is a positive integer.

10. The method according to claim 8 or 9, characterized in that The additional information of the first source code is also used to trace the leakage of a second function in a third source code. Among them, the similarity between the feature vector of the second function and the feature vector of the first function is greater than a second threshold.

11. A watermark generation device, characterized in that, including: A receiving module, configured to receive a first source code; A calculation module, configured to generate a zero watermark of the first source code according to the occurrence times and / or occurrence order of operation elements of each type among multiple types in the first source code, where the zero watermark of the first source code is used to be stored in association with additional information of the first source code, and the additional information of the first source code is used to trace the leakage of a second source code. Wherein, the similarity between the zero watermark of the second source code and the zero watermark of the first source code is greater than a first threshold.

12. A computer device, characterized in that, It includes a processor and a memory, where the memory is used to store program code, and the processor is used to execute the method according to any one of claims 1 to 10 by executing the program code.

13. A computer device cluster, characterized in that, It includes at least one computer device, and each of the computer devices includes a memory and a processor; The processor of the at least one computer device is used to execute instructions stored in the memory of the at least one computer device, so that the computer device cluster executes the method according to any one of claims 1-10.

14. A computer-readable storage medium, characterized in that, Program code is stored in the computer-readable storage medium, and when the program code is executed by a computer device, it implements the method according to any one of claims 1 to 10.

15. A computer program product, characterized in that, When the program code included in the computer program product is executed by a computer device, it implements the method according to any one of claims 1 to 10.

Images