An automated evidence collection method and system for software copyright infringement

Abstract

The present application provides an automated evidence collection method and system for software copyright infringement. Among them, the method first collects the calling sequence of multi-language interfaces based on the target software running process to form unified semantic expression data; at the same time, a high-sensitivity sound sensor is used to record the sound signal of the electronic device motherboard to generate the device sound characteristics; then the semantic data and the sound characteristics are jointly encoded through a cross-modal alignment mechanism to generate multi-modal related data; then the memory enhancement unit and machine learning technology are used to automatically learn the correspondence between the multi-language interface and the sound characteristics, and establish a cross-modal mapping relationship; finally, based on the mapping relationship, the cross-language plagiarism behavior is matched and the software similarity relationship data is automatically output. This application realizes the automated and accurate detection of cross-language software plagiarism behavior by combining code semantic analysis with hardware voiceprint features.

Description

Technical Field

[0001] The present application relates to the technical field of software intellectual property protection, and in particular to an automated evidence collection method and system for software copyright infringement. Background Art

[0002] With the globalization of software development, cross-language programming and code reuse are becoming increasingly common. Plagiarists often circumvent traditional detection by converting source code into other programming languages. This cross-language plagiarism poses new challenges to software copyright protection, necessitating automated detection technologies that can identify semantic equivalence between different programming languages.

[0003] Currently, a cross-language plagiarism detection solution based on abstract syntax tree transformation exists. This method converts source code from different languages ​​into a unified intermediate representation and determines plagiarism by comparing the structural similarities of the intermediate representation. This solution utilizes syntax tree parsing and normalization techniques to eliminate syntactic differences between programming languages ​​to a certain extent and extract comparable semantic features.

[0004] However, existing solutions have significant shortcomings. The conversion process loses some language-specific semantic information, making it difficult to accurately identify obfuscated code. Furthermore, these solutions offer limited analysis of code functionality and behavior, failing to effectively distinguish legitimate reuse from malicious plagiarism, resulting in a high false positive rate. Furthermore, existing methods lack correlation analysis of hardware execution characteristics, making them incapable of countering deliberately designed countermeasures. Summary of the Invention

[0005] The embodiments of the present application provide an automated evidence collection method and system for software copyright infringement, which are used to solve the problem of insufficient automation accuracy in the prior art.

[0006] In a first aspect, embodiments of the present application provide an automated evidence collection method for software copyright infringement, comprising:

[0007] Based on the target software's running process, the calling sequence of multi-language interfaces is collected and processed to form unified semantic expression data;

[0008] Using the high-sensitivity sound sensor of the target software, the sound signal generated by the mainboard of the electronic device running the target software is recorded and processed to generate the device sound signature;

[0009] The unified semantic expression data and the device sound features are jointly encoded through a cross-modal alignment mechanism to generate multimodal associated data;

[0010] Utilizing a memory enhancement unit in a technical module of the target software in combination with machine learning technology, automatically learning and processing the correspondence between the multi-language interfaces and the sound features in the multi-modal association data to generate a cross-modal mapping relationship;

[0011] Based on the cross-modal mapping relationship, cross-language plagiarism behaviors are matched and software similarity relationship data is automatically output.

[0012] Optionally, the unified semantic expression data and the device sound features are jointly encoded through a cross-modal alignment mechanism to generate multimodal associated data, including:

[0013] Based on the energy distribution of the device sound characteristics and the call frequency of the unified semantic expression data, the sound signal is dynamically segmented to generate adaptive sound segments;

[0014] Using the timestamp information in the unified semantic expression data, bidirectional timing verification processing is performed on the adaptive sound segment and the corresponding interface call segment to obtain a verified data pair;

[0015] Performing vectorization conversion processing on the interface call segment in the verified data pair according to a preset symbol mapping rule to generate a numerical vector sequence;

[0016] Performing feature extraction processing on the adaptive sound segments in the verified data pair by a frequency domain transformation method to generate a frequency domain vector sequence;

[0017] Based on the time alignment relationship between the numerical vector sequence and the frequency domain vector sequence, fusion processing is performed through a dual-channel encoding network with adjustable weights to generate multimodal associated data.

[0018] Optionally, utilizing a memory enhancement unit in a technical module of the target software in combination with machine learning technology to automatically learn the correspondence between the multi-language interfaces and the sound features in the multi-modal association data to generate a cross-modal mapping relationship, including:

[0019] Segmenting the numerical vector sequence and the frequency domain vector sequence in the multimodal correlation data according to fixed time windows to generate a plurality of data blocks;

[0020] Assigning a unique identifier to each of the data chunks, and storing the data chunks and their identifiers in a dynamic memory storage area;

[0021] When a new sequence of numerical vectors is input, similarity search processing is performed in the dynamic memory storage area to find historical data blocks with similar call features;

[0022] Extracting historical frequency domain vectors and weight information stored in the historical data block;

[0023] Performing feature superposition processing on the historical frequency domain vector and the frequency domain vector, and adjusting the superposition ratio according to the weight information to obtain a fusion feature;

[0024] The fused features and the new numerical vector sequence are jointly encoded to generate a cross-modal mapping relationship representing the correspondence between the multilingual interface and the sound features.

[0025] Optionally, based on the target software running process, the multi-language interface call sequence is collected and processed to form unified semantic expression data, including:

[0026] By monitoring and capturing interface call events during the target software's runtime, the call time, interface identifier, and parameter characteristics of each interface call event are recorded to generate an original call record;

[0027] Performing language type identification on the original call record, and classifying and storing interface calls in different languages ​​according to the identification result to obtain classified call information;

[0028] Inputting the classified call information into a preset mapping rule library, converting different language interfaces of the same function into a unified function code through the mapping rule library to obtain a standard call;

[0029] Sorting the standard calls according to the calling time to generate a standardized calling sequence;

[0030] Based on the call frequency changes of the standardized call sequence, the analysis window size is dynamically adjusted to perform segmented processing to obtain segmented calls;

[0031] Perform dependency analysis on the segmented calls, mark the order of the calls, and obtain a marked call list;

[0032] The tag call column is combined with the corresponding time metadata to form unified semantic expression data.

[0033] Optionally, based on the time alignment relationship between the numerical vector sequence and the frequency domain vector sequence, a fusion process is performed through a dual-channel coding network with adjustable weights to generate multimodal associated data, including:

[0034] Performing synchronous segmentation processing on the numerical vector sequence and the frequency domain vector sequence to generate time-aligned vector segment groups, each group comprising a numerical vector segment and a corresponding frequency domain vector segment;

[0035] Analyzing the interface call features in each of the numerical vector segments, and calculating the dynamic fusion weight according to the call density and type distribution of the numerical vector segments;

[0036] extracting the call semantic features of the numerical vector segment and the voiceprint pattern features of the frequency domain vector segment respectively through a dual-channel processing architecture;

[0037] At the feature fusion node, the call semantic features are proportionally adjusted and combined with the voiceprint pattern features according to the dynamic fusion weight to obtain a fused feature group;

[0038] The fused feature groups are spliced ​​in original time sequence to generate multimodal association data.

[0039] Optionally, performing feature superposition processing on the historical frequency domain vector and the frequency domain vector, and adjusting the superposition ratio according to the weight information to obtain a fusion feature, includes:

[0040] Performing an aging check on the historical frequency domain vectors, retaining valid historical frequency domain vectors, and removing expired historical frequency domain vectors;

[0041] Arranging the valid historical frequency domain vectors in chronological order to form a historical frequency domain vector sequence;

[0042] Extracting feature points of the real-time frequency domain vector and performing matching calculation with the historical frequency domain vectors in the historical frequency domain vector sequence to obtain a matching calculation result;

[0043] Determining the superposition ratio of each of the historical frequency domain vectors according to the weight information and the matching degree calculation result;

[0044] Accumulating the historical frequency domain vector and the real-time frequency domain vector according to the superposition ratio to obtain an accumulated calculation result, and truncating values ​​that exceed a range;

[0045] The format of the accumulated calculation results is converted to obtain fusion features.

[0046] Optionally, based on the call frequency change of the standardized call sequence, the analysis window size is dynamically adjusted to perform segmented processing to obtain segmented calls, including:

[0047] Continuously monitoring the call frequency changes of the standardized call sequence, reducing the analysis window when the call frequency is continuously higher than a preset first threshold, increasing the analysis window when the call frequency is continuously lower than a preset second threshold, and keeping the analysis window unchanged in other cases, to obtain an adjusted window length;

[0048] According to the adjusted window duration, the standardized call sequence is divided into a plurality of segmented calls of equal duration.

[0049] In a second aspect, the embodiments of the present application provide an automated evidence collection system for software copyright infringement, including:

[0050] The acquisition module collects and processes the calling sequence of multi-language interfaces based on the target software's running process to form unified semantic expression data;

[0051] a recording module, utilizing the high-sensitivity sound sensor of the target software to record and process the sound signals generated by the mainboard of the electronic device running the target software, thereby generating a device sound signature;

[0052] an encoding module that performs joint encoding processing on the unified semantic expression data and the device sound features through a cross-modal alignment mechanism to generate multimodal associated data;

[0053] a learning module that utilizes a memory enhancement unit in the technical module of the target software and combines machine learning technology to automatically learn the correspondence between the multi-language interfaces and the sound features in the multi-modal association data to generate a cross-modal mapping relationship;

[0054] The matching module matches cross-language plagiarism behaviors based on the cross-modal mapping relationship and automatically outputs software similarity relationship data.

[0055] In a third aspect, an embodiment of the present application provides a computing device comprising a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement an automated evidence collection method for software copyright infringement as described in the first aspect above.

[0056] In a fourth aspect, an embodiment of the present application provides a computer storage medium storing a computer program. When the computer program is executed by a computer, it implements an automated evidence collection method for software copyright infringement as described in the first aspect.

[0057] In an embodiment of the present application, based on the target software running process, the call sequence of the multi-language interface is collected and processed to form unified semantic expression data; the high-sensitivity sound sensor of the target software is used to record and process the sound signal generated by the electronic device mainboard running the target software to generate the device sound feature; through the cross-modal alignment mechanism, the unified semantic expression data and the device sound feature are jointly encoded and processed to generate multi-modal associated data; the memory enhancement unit in the technical module of the target software is used, combined with machine learning technology, to automatically learn the correspondence between the multi-language interfaces and the sound features in the multi-modal associated data to generate a cross-modal mapping relationship; based on the cross-modal mapping relationship, cross-language plagiarism behavior is matched, and software similarity relationship data is automatically output.

[0058] The technical solution of this application has the following beneficial effects:

[0059] The sequential collection and processing of multi-language interface calls can break through the limitations of programming language syntax differences and extract semantic features that characterize the essence of software functions; high-sensitivity sound sensors record motherboard sound signals to obtain unique features at the hardware execution level, providing physical auxiliary evidence for plagiarism detection; cross-modal joint encoding processing realizes the deep association between code semantics and hardware voiceprints, and builds a dual verification mechanism for software functions and hardware execution; the memory enhancement unit combined with machine learning technology can automatically learn the complex mapping relationship between cross-language interfaces and voiceprint features, and establish an intelligent plagiarism recognition model; the matching mechanism based on cross-modal mapping relationships can accurately identify plagiarism behaviors that have undergone language conversion and code obfuscation, and output objective similarity analysis results.

[0060] Furthermore, the method first dynamically segments the sound signal based on energy distribution and call frequency to generate adaptive sound segments. It then uses timestamp information for bidirectional timing verification to ensure strict correspondence between interface calls and sound segments. Numerical vectors and frequency domain vectors are then generated through symbol mapping and frequency domain transformation, respectively. Finally, feature fusion is achieved through a weight-adjustable dual-channel encoding network to generate multimodal associated data. The technical benefit of this process lies in ensuring precise alignment of cross-modal data through dynamic segmentation and timing verification. The dual-channel encoding network achieves complementary advantages between semantic features and voiceprint features, providing high-quality multimodal feature representation for subsequent plagiarism identification.

[0061] These and other aspects of the present application will become more readily apparent from the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0063] Figure 1 A flowchart of an automated evidence collection method for software copyright infringement provided by this application is shown;

[0064] Figure 2 A schematic diagram of the structure of an automated evidence collection system for software copyright infringement provided by this application is shown;

[0065] Figure 3 A schematic structural diagram of a computing device provided by the present application is shown. DETAILED DESCRIPTION

[0066] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0067] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this document or may be executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any order of execution. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this document are used to distinguish different messages, devices, modules, etc., and do not represent a sequential order, nor do they limit "first" and "second" to being different types.

[0068] Research has found that existing solutions based on abstract syntax tree transformation (AST) have significant limitations in cross-language software plagiarism detection. Their sole reliance on code structure similarity analysis makes them incapable of addressing increasingly complex plagiarism methods. This is especially true when plagiarists perform deep semantic-preserving transformations on the code, which can cause key functional features to be lost during the syntax tree transformation process. Furthermore, these solutions completely ignore behavioral characteristics at the hardware execution level, allowing plagiarists to deliberately create execution discrepancies by modifying compiler optimization options, leading to misjudgments by the detection system. This shortcoming stems from the fact that existing technologies still understand software plagiarism at the purely code level and lack a design for a collaborative verification mechanism between "functional semantics and hardware behavior."

[0069] To address the above issues, this paper proposes an automated forensic method for software copyright infringement. Specifically, it simultaneously collects multilingual interface call sequences and motherboard voiceprint features, utilizes dynamic segmentation and bidirectional timing verification to ensure precise data alignment, then achieves deep feature fusion through a dual-channel encoding network with adjustable weights. Finally, a memory-enhanced unit establishes an intelligent mapping between cross-language interfaces and voiceprint features. This method overcomes the limitations of traditional pure code analysis. Through a dual verification mechanism combining "software behavioral features + hardware execution fingerprints," it can identify both semantically equivalent plagiarism through language conversion and deliberate discrepancies created through techniques such as compiler optimization. This method effectively addresses the core flaws of existing technologies, such as high false positive rates and weak anti-circumvention capabilities, providing a more reliable forensic method for software intellectual property protection.

[0070] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0071] Figure 1 The present invention provides a flowchart of an automated evidence collection method for software copyright infringement, as shown in FIG. Figure 1 As shown, the method includes:

[0072] 101. Based on the target software running process, collect and process the multi-language interface call sequence to form unified semantic expression data;

[0073] In this step, the multi-language interface calling sequence refers to the calling relationship sequence between different programming languages ​​during the software running process;

[0074] Unified semantic expression data refers to the conversion of different language interfaces into functional description data in a unified format.

[0075] In an embodiment of the present application, first, when the target software is running, all cross-language interface call events are captured in real time through the system monitoring mechanism, and the occurrence time, caller information and called interface characteristics of each call event are recorded. Secondly, the captured call events are identified by language type to distinguish interface calls implemented in different programming languages. The identified call events are then input into a preset semantic conversion rule library, and interfaces with different languages ​​but the same functions are mapped to a unified function coding system. Then, according to the chronological order of the calls, the converted function codes are organized into a time-series call sequence. Finally, the time-series sequence is normalized to ensure that the function codes converted from different languages ​​have a consistent expression format, and the final unified semantic expression data is generated.

[0076] In a real case, taking software containing two programming languages ​​as an example, the first step is to monitor the cross-language calling behavior during software runtime; secondly, the time when the call occurs and the interface characteristics are recorded; then the interfaces of different languages ​​are mapped to a unified functional classification system; finally, a time-ordered function call sequence is generated.

[0077] 102. Using the high-sensitivity sound sensor of the target software, record and process the sound signal generated by the mainboard of the electronic device running the target software to generate a device sound signature;

[0078] In this step, the high-sensitivity sound sensor refers to a special device that can collect the sound of electronic equipment operation;

[0079] Device sound characteristics refer to the sound characteristic data that reflects the working status of the hardware when the software is running.

[0080] In an embodiment of the present application, key chip locations are first selected on the target device's mainboard and a high-sensitivity sound sensor array is deployed. Next, sound acquisition parameters, including sampling rate, gain, and filter range, are configured to ensure that the unique electromagnetic soundprint characteristics of the software during operation can be captured. Then, while the target software is running, sound signal acquisition is synchronously initiated to record the sound wave signals throughout the entire operating cycle. The collected raw sound wave signals are then preprocessed to remove interference from environmental noise and irrelevant frequency bands. Finally, a feature extraction algorithm is used to analyze the spectral characteristics of the sound wave signal, extracting the frequency domain energy distribution pattern that can characterize the software's operating characteristics, and generate device sound feature data.

[0081] Continue to monitor the operation of the above software. First, install sound sensors at key locations on the motherboard. Second, set acquisition parameters based on the software operation characteristics. Then, record the sound signals during the software execution. Finally, extract distinctive sound features.

[0082] 103. Performing joint encoding processing on the unified semantic expression data and the device sound features through a cross-modal alignment mechanism to generate multimodal associated data;

[0083] In this step, the cross-modal alignment mechanism refers to the processing method to coordinate the temporal relationship of different types of data;

[0084] Joint encoding processing refers to the process of converting data from different sources into related features.

[0085] In an embodiment of the present application, the call time distribution characteristics in the unified semantic expression data are first analyzed to determine the key call-intensive areas and stable areas. Secondly, the segmentation strategy of the sound signal is dynamically adjusted according to the change in call density, and a finer time window is adopted in the call-intensive area. Then, using precise timestamp information, the semantic call segment is strictly matched with the corresponding sound signal segment to establish a cross-modal data pair. Then, through the feature conversion method, the matched semantic call segment is converted into a numerical vector, and the sound signal segment is converted into a frequency domain feature vector. Finally, a dual-channel processing architecture is designed to perform feature interaction and fusion at a specific level while maintaining the independence of the two types of features to generate multimodal data containing semantic and voiceprint association information.

[0086] Continuing with the above case, we first analyze the temporal correspondence between function calls and sound signals; secondly, we establish matching pairs between call segments and sound segments; then we convert the matching data into features in a unified format; and finally, we generate feature data that contains the association between functions and sounds.

[0087] 104. Utilizing a memory enhancement unit in the technical module of the target software and combining it with machine learning technology, automatically learning and processing the correspondence between the multi-language interfaces and the sound features in the multi-modal association data to generate a cross-modal mapping relationship;

[0088] In this step, the memory enhancement unit refers to a computing module with information storage and processing capabilities;

[0089] Cross-modal mapping relationship refers to the association model established between different data.

[0090] In this embodiment, a processing architecture with a memory storage mechanism is first constructed, and a dynamic memory matrix is ​​designed to store typical feature patterns. Secondly, multimodal correlation data is input into the processing architecture, and a training process learns the association patterns between semantic calls and voiceprint features. During the training process, the memory unit automatically identifies and stores recurring feature combination patterns, establishing long-term memory. Then, through an online learning mechanism, the memory storage content is continuously updated to adapt to new feature changes. Finally, at the output layer of the processing architecture, a cross-modal mapping model is generated that accurately reflects the correspondence between multilingual interfaces and voiceprint features.

[0091] Continuing with the above example, we first build a processing architecture with memory function; secondly, we input the associated data of functions and sounds for training; then we store the typical feature correspondence patterns; and finally, we generate a mapping model that can recognize the association between functions and sounds.

[0092] 105. Based on the cross-modal mapping relationship, cross-language plagiarism behaviors are matched, and software similarity relationship data is automatically output.

[0093] In this step, cross-language plagiarism refers to code plagiarism achieved by switching programming languages;

[0094] Similarity relationship data refers to the result data that reflects the similarity of software functions.

[0095] In this embodiment of the present application, a trained cross-modal mapping model is first loaded to initialize the comparison parameters and threshold settings. Next, the semantic expression data of the software to be tested and the device sound features are input and converted into representations in a unified feature space through the mapping model. Next, a similarity metric is calculated between the software to be tested and the target software in the feature space to assess the degree of similarity in their functional implementation. The matching results of both semantic and voiceprint dimensions are then comprehensively analyzed to eliminate potential misjudgments that could arise from a single dimension. Finally, an identification report is generated that includes an overall similarity assessment and detailed comparison results, and the software similarity relationship data is automatically output.

[0096] To complete the above case, first load the trained function and sound association model; secondly, input the feature data of the software to be tested; then use the model to calculate the similarity with the target software; finally, output the result report including the plagiarism judgment.

[0097] In summary, steps 101 to 105 construct a complete software infringement evidence collection process. Through multimodal analysis of function calls and hardware sounds, effective identification of cross-language plagiarism is achieved, solving the detection difficulties of traditional methods in language conversion scenarios.

[0098] To further improve the efficiency and accuracy of cross-modal feature learning, in some embodiments, in step 103, the unified semantic expression data and the device sound features are jointly encoded using a cross-modal alignment mechanism to generate multimodal associated data, including:

[0099] 201. Based on the energy distribution of the device sound feature and the call frequency of the unified semantic expression data, dynamically segment the sound signal to generate adaptive sound segments;

[0100] In step 201, energy distribution refers to the intensity characteristics of the sound signal in different frequency bands;

[0101] Call frequency refers to the number of times the interface is called per unit time;

[0102] Adaptive sound segments refer to sound signal segments whose duration is dynamically adjusted according to the call characteristics.

[0103] In an embodiment of the present application, the spectral energy distribution characteristics of the device sound signal are first analyzed to identify the energy concentration area; secondly, the frequency change pattern of the interface call in the unified semantic expression data is statistically analyzed; then, the sound segmentation duration is dynamically adjusted according to the high and low call frequencies, with shorter segments used in high-frequency call areas and longer segments used in low-frequency areas; finally, adaptive sound segments that match the interface call characteristics are generated.

[0104] 202. Using the timestamp information in the unified semantic expression data, perform a bidirectional timing verification process on the adaptive sound segment and the corresponding interface call segment to obtain a verified data pair;

[0105] In step 202, the timestamp information refers to the data recording the time when the interface call occurs;

[0106] Bidirectional time series verification refers to verifying the data correspondence from two dimensions: time and event;

[0107] A verified data pair refers to a verified combination of an interface call segment and a sound segment.

[0108] In an embodiment of the present application, first, the timestamp information of the interface call segment is extracted; secondly, the corresponding time interval is located in the adaptive sound segment; then, it is verified from the time dimension whether the sound segment completely covers the call period; then, the correlation between the call behavior and the sound characteristics is verified from the event dimension; finally, the verified call segment and the sound segment are combined into a verified data pair.

[0109] 203. Perform vectorization conversion processing on the interface call segment in the verified data pair according to a preset symbol mapping rule to generate a numerical vector sequence;

[0110] In step 203, the symbol mapping rule refers to the corresponding relationship of converting the interface function symbol into a numerical value;

[0111] A sequence of numerical vectors is a digital representation of the functional characteristics of an interface.

[0112] In an embodiment of the present application, a preset interface function symbol mapping table is first loaded; secondly, the interface call symbols in the verified data pairs are converted into function codes; then a numerical vector is generated based on the semantic relationship of the function codes; finally, the conversion results are arranged in chronological order to form a numerical vector sequence.

[0113] 204. Perform feature extraction processing on the adaptive sound segment in the verified data pair by a frequency domain transformation method to generate a frequency domain vector sequence;

[0114] In step 204, frequency domain transformation refers to a method of converting the time domain sound signal into a frequency domain representation;

[0115] Frequency domain vector sequence refers to the digital representation of the spectral characteristics of the sound signal.

[0116] In an embodiment of the present application, the adaptive sound segment is first framed; secondly, a frequency domain transformation algorithm is applied to each frame signal; then, the energy distribution parameters of the characteristic frequency band are extracted; finally, the characteristic parameters are organized into a frequency domain vector sequence in chronological order.

[0117] 205. Based on the time alignment relationship between the numerical vector sequence and the frequency domain vector sequence, a fusion process is performed through a dual-channel coding network with adjustable weights to generate multimodal associated data.

[0118] In step 205, the time alignment relationship refers to the time correspondence between the two types of vector sequences;

[0119] A dual-channel encoding network refers to a neural network structure that processes two types of features in parallel.

[0120] In an embodiment of the present application, a time correspondence table between numerical vectors and frequency domain vectors is first established; secondly, a dual-coding network architecture with independent channels is designed; then a feature interaction mechanism is introduced in the middle layer of the network; then, the fusion weight is dynamically adjusted according to the call importance; finally, fused data containing cross-modal correlation information is generated in the network output layer.

[0121] Here's a specific example:

[0122] In the scenario of detecting Java and Python code plagiarism, the motherboard sound signal is first divided into sound segments of different lengths according to the density of Python extension calls; secondly, the precise timestamps of Java native method calls are used to verify the matching degree of the corresponding sound segments; then, the Java method calls are converted into numerical vectors with unified functional coding; at the same time, frequency domain features are extracted for the matching sound segments; finally, the two types of features are fused through a dual-channel network to generate multimodal correlation data that can identify cross-language plagiarism.

[0123] In summary, steps 201 to 205 ensure detailed analysis of key call areas through dynamic segmentation, strict timing verification ensures accurate correspondence of cross-modal data, and dual-channel fusion achieves deep association between semantic and voiceprint features, ultimately forming a multimodal feature representation that can effectively identify cross-language plagiarism.

[0124] To establish a more comprehensive cross-modal feature learning mechanism, in some embodiments, step 104 utilizes a memory enhancement unit in the technical module of the target software in combination with machine learning technology to automatically learn the correspondence between the multi-language interfaces and the sound features in the multi-modal association data to generate a cross-modal mapping relationship, including:

[0125] 301. Segment the numerical vector sequence and the frequency domain vector sequence in the multimodal correlation data according to fixed time windows to generate multiple data blocks;

[0126] In step 301, the fixed time window refers to a preset equal time interval for analyzing characteristic data, and the length of the interval is determined according to typical software operation characteristics;

[0127] A data block refers to a feature data unit containing numerical vectors and frequency domain vectors intercepted within a fixed time window, and each data block maintains complete time continuity.

[0128] In an embodiment of the present application, first, the optimal time window length is determined by analyzing a large number of software running samples. This length needs to take into account both feature extraction accuracy and computational efficiency; secondly, the input numerical vector sequence and frequency domain vector sequence are strictly synchronized in time alignment to ensure that the two types of features are completely matched in the time dimension; then, the two types of feature sequences are accurately divided according to the determined time window boundary, and each division point is smoothed to avoid feature breaks; finally, the feature data in each time window is integrity checked, incomplete data units are eliminated, and qualified data blocks are retained for subsequent processing.

[0129] 302. Assign a unique identifier to each data block, and store the data block and its identifier in a dynamic memory storage area;

[0130] In step 302, the unique identifier refers to a unique identification code generated based on the characteristic content and time information of the data block, which includes information such as timestamp, characteristic fingerprint and data type;

[0131] Dynamic memory storage area refers to a feature storage library with dynamic update capabilities implemented using a specific data structure, supporting fast writing, querying, and updating operations.

[0132] In an embodiment of the present application, a multi-level identifier generation algorithm is first designed, which comprehensively considers factors such as the time position, feature distribution and association relationship of data chunks; secondly, a memory storage area with a cache optimization mechanism is constructed, and a hierarchical storage strategy is adopted to manage feature data of different timeliness; then a bidirectional index relationship is established between data chunks and identifiers, which supports rapid positioning of identifiers through feature content, and rapid retrieval of data chunks through identifiers; finally, a dynamic maintenance mechanism of the storage area is implemented to regularly clean up low-value data and retain high-value feature patterns.

[0133] 303. When a new numerical vector sequence is input, similarity search processing is performed in the dynamic memory storage area to find historical data blocks with similar call features;

[0134] In step 303, similarity retrieval refers to the process of searching for historical data blocks that match the current input features in the memory storage area. This process needs to consider the multi-dimensional similarity of the features;

[0135] Call characteristics refer to regular information such as call frequency, call pattern, and parameter characteristics shown in the interface call sequence.

[0136] In an embodiment of the present application, key feature indicators are first extracted from a newly input numerical vector sequence, including call density, call type distribution, and parameter characteristics; secondly, a multi-level retrieval strategy is designed, firstly performing a fast coarse search in the memory storage area to screen out a set of candidate data blocks, and then performing fine feature matching; then a multi-dimensional feature similarity evaluation model is constructed, comprehensively considering the temporal characteristics, statistical characteristics, and structural characteristics of the call sequence; finally, the candidate results are sorted according to the similarity score, and the most representative historical data blocks are selected for subsequent processing.

[0137] 304. Extracting historical frequency domain vectors and weight information stored in the historical data block;

[0138] In step 304, the historical frequency domain vector refers to the voiceprint feature data associated with the specific interface call pattern stored in the memory storage area, which records the hardware acoustic characteristics during the historical software operation;

[0139] Weight information refers to a quantitative parameter used to characterize the importance and reliability of a data block, which is dynamically adjusted during use.

[0140] In an embodiment of the present application, first, the physical position of the target historical data block in the memory storage area is located based on the similarity retrieval results; secondly, the complete frequency domain feature vector stored in the data block is read, including key features such as the spectrum envelope and energy distribution; then, the weight parameter associated with the data block is obtained, which reflects the historical usage effect and feature quality; finally, the extracted historical features are verified for validity to ensure that they can be used for current feature fusion processing.

[0141] 305. Perform feature superposition processing on the historical frequency domain vector and the frequency domain vector, and adjust the superposition ratio according to the weight information to obtain a fusion feature;

[0142] In step 305, feature superposition refers to a processing method that organically combines historical features with current features. This method needs to maintain the temporal and spatial consistency of features.

[0143] Fusion features refer to enhanced feature representations that contain historical and current information generated after superposition processing.

[0144] In an embodiment of the present application, the historical frequency domain vector and the current frequency domain vector are first aligned on the time axis to eliminate timing deviation; secondly, the fusion coefficient of the historical features is calculated based on the weight information, and this coefficient determines the contribution of the historical features to the final result; then, a feature mixing algorithm is designed to achieve smooth transition and natural fusion of features in the frequency domain space; finally, the fusion result is quality checked to generate an enhanced feature representation that meets the requirements for subsequent modeling.

[0145] 306. Perform joint encoding processing on the fused features and the new numerical vector sequence to generate a cross-modal mapping relationship representing the correspondence between the multilingual interface and the sound features.

[0146] In step 306, joint encoding refers to the process of integrating feature data of different sources and types into a unified representation;

[0147] The cross-modal mapping relationship refers to a mathematical model established through machine learning that can accurately reflect the correspondence between multilingual interfaces and hardware voiceprints.

[0148] In an embodiment of the present application, a neural network architecture with multi-channel input capability is first designed, which includes independent feature processing channels and shared feature interaction layers; secondly, the fused voiceprint features and the new numerical vector sequence are input into the network, and the feature representations of each layer are calculated through forward propagation; then, special feature interaction nodes are set in the network to promote information exchange between different modal features; finally, the network parameters are optimized through end-to-end training, and a cross-modal mapping model with strong generalization capability is output.

[0149] Here's a specific example:

[0150] When analyzing the plagiarism behavior of a cross-platform software, we first set a 300ms analysis window and divide the C# interface call sequence and the corresponding motherboard voiceprint features into multiple data blocks; generate an identifier containing time information and feature fingerprints for each block, and store it in a memory bank with an LRU cache mechanism; when detecting suspected plagiarized Python code, retrieve C# code blocks with similar call patterns from the memory bank; after extracting the historical voiceprint features stored in these blocks, assign different weights according to their historical usage effects; these voiceprint features are fused with the voiceprint of the current Python code according to the weights to generate enhanced features; finally, a mapping relationship between the Python interface and the voiceprint is established through a deep neural network to accurately identify plagiarism behavior.

[0151] In summary, steps 301 to 306 ensure the quality of feature extraction through refined time window management, achieve long-term knowledge accumulation through intelligent memory mechanism, optimize feature fusion effect through dynamic weight adjustment, and establish a robust cross-modal association model through deep joint coding. Ultimately, a plagiarism detection system is constructed that can effectively cope with various code transformations and language conversions, significantly improving the accuracy and reliability of software intellectual property protection.

[0152] In order to establish a more complete multi-language interface call analysis mechanism, in some embodiments, in step 101, the multi-language interface call sequence is collected and processed based on the target software running process to form unified semantic expression data, including:

[0153] 401. Capture interface call events during target software runtime by monitoring, record the call time, interface identifier, and parameter characteristics of each interface call event, and generate an original call record;

[0154] In step 401, the interface call event refers to a cross-language function or method call that occurs when the software is running;

[0155] The invocation moment refers to the precise point in time when the invocation occurs;

[0156] Interface identifier refers to the name or number that uniquely distinguishes different interfaces;

[0157] Parameter characteristics refer to the type and quantity of parameters passed during the call;

[0158] Raw call records refer to the collection of raw call data that has not been processed.

[0159] In an embodiment of the present application, a lightweight monitoring agent is first deployed in the target software running environment. The agent captures all cross-language call events through a system-level hook mechanism; secondly, a detailed record is generated for each captured call event, including a nanosecond timestamp, a complete interface path, and a parameter feature summary; then, a preliminary check is performed on the record to eliminate incomplete call events; finally, all valid records are temporarily stored in chronological order to form a structured set of original call records.

[0160] 402. Perform language type identification on the original call record, and classify and store interface calls in different languages ​​according to the identification result to obtain classified call information;

[0161] In step 402, language type identification refers to the process of determining the programming language to which the interface call belongs;

[0162] Classified call information refers to call data classified and organized by language.

[0163] In an embodiment of the present application, a multilingual feature library is first constructed, which contains interface naming rules and calling conventions unique to each language; secondly, a two-level recognition strategy is designed, first determining obvious features through quick matching, and then processing complex situations through in-depth analysis; then a language type label is added to each call record; finally, the call records are grouped and stored by language category, while keeping the original chronological order unchanged.

[0164] 403. Input the classified call information into a preset mapping rule library, and convert different language interfaces of the same function into a unified function code through the mapping rule library to obtain a standard call;

[0165] In step 403, the mapping rule base refers to a knowledge base that stores the corresponding relationship between multi-language interface functions;

[0166] Unicode refers to a function identifier that is not related to a specific language;

[0167] The standard call refers to the normalized call representation after conversion.

[0168] In an embodiment of the present application, a hierarchical function classification system is first designed to cover common software function categories; secondly, a mapping rule from multi-language interfaces to function codes is established, taking into account interface semantics and parameter characteristics; then, the classified call information is batch converted to map the same function interfaces in different languages ​​to a unified code; finally, a consistency check is performed on the conversion results to ensure semantic integrity.

[0169] 404. Sort the standard calls according to the call time to generate a standardized call sequence;

[0170] In step 404 , the standardized call sequence refers to a set of unified function codes ordered by time.

[0171] In an embodiment of the present application, first, the timestamp information of all standard calls is extracted; second, an efficient sorting algorithm is designed to process large-scale call data; then, the temporal continuity of the sorting results is checked and possible misalignment problems are repaired; finally, a standardized call sequence with strict time order is generated.

[0172] 405. Based on the change in the calling frequency of the standardized calling sequence, dynamically adjust the analysis window size to perform segmented processing to obtain segmented calls;

[0173] In step 405, the calling frequency refers to the number of interface calls per unit time;

[0174] The analysis window refers to the time interval used for segment processing;

[0175] Segmented calls refer to subsequences of calls within a window.

[0176] In the embodiment of the present application, the moving frequency of the call sequence is first calculated in real time; secondly, a multi-level frequency threshold is set to trigger window adjustment; then a gradual adjustment strategy is adopted to avoid sudden changes; finally, the call sequence is segmented according to the current window size to ensure segment integrity.

[0177] 406. Perform dependency analysis on the segmented calls, mark the order of the calls, and obtain a marked call list;

[0178] In step 406, the dependency refers to the sequential execution constraints between calls;

[0179] A labeled call sequence is a call sequence with dependency information added.

[0180] In an embodiment of the present application, the parameter passing relationship in the segmented call is first analyzed; secondly, potential resource competition situations are identified; then key precedence constraints are marked; and finally, a call sequence containing complete dependency information is generated.

[0181] 407. Combine the tag call column with the corresponding time metadata to form unified semantic expression data.

[0182] In step 407, temporal metadata refers to additional information that records temporal characteristics;

[0183] Unified semantic expression data refers to the final generated normalized call representation.

[0184] In an embodiment of the present application, first, the temporal characteristic metadata of each segment is extracted; second, a compact data structure is designed to store dependencies; then, the tag call column is associated with the metadata; and finally, unified expression data with complete semantic information is generated.

[0185] Here's a specific example:

[0186] When analyzing a cross-language e-commerce system, we first monitored Java and Python API calls and recorded payment interface call details. We identified that Java's processPayment and Python's execute_payment belong to the same function and uniformly coded them as PAY. After sorting by call time, we discovered high-frequency call periods and automatically narrowed the analysis window. We also identified the verification interface dependencies that must be called before payment. Finally, we generated call process data with complete semantics.

[0187] In summary, steps 401 to 407 achieve accurate analysis and unified representation of multilingual interfaces through a refined call collection and processing process, providing a high-quality semantic data foundation for subsequent plagiarism detection and effectively solving the problem of cross-language code analysis.

[0188] In order to establish a more accurate and complete multimodal data fusion mechanism, in some embodiments, step 205 performs fusion processing based on the time alignment relationship between the numerical vector sequence and the frequency domain vector sequence through a dual-channel encoding network with adjustable weights to generate multimodal correlation data, including:

[0189] 501. Perform synchronous segmentation processing on the numerical vector sequence and the frequency domain vector sequence to generate time-aligned vector segment groups, each group including a numerical vector segment and a corresponding frequency domain vector segment;

[0190] In step 501, synchronous segmentation processing refers to the process of accurately aligning and segmenting the numerical vector sequence and the frequency domain vector sequence in the time dimension, and it is necessary to ensure that the two types of feature data in each segment have a strict time correspondence;

[0191] A vector segment group refers to a paired combination of numerical vector segments and frequency domain vector segments intercepted within the same time interval. Each vector segment group represents the multimodal features within a complete time segment.

[0192] In an embodiment of the present application, first, a high-precision time synchronization calibration is performed on the numerical vector sequence and the frequency domain vector sequence, and a millisecond-level time correspondence table is established; secondly, an adaptive segmentation algorithm is designed to dynamically determine the optimal segmentation point according to the feature change rate, and adopt a finer-grained segmentation in high dynamic areas; then, a strictly synchronized segmentation operation is performed on the two types of feature sequences to ensure that each segment interval contains a complete feature evolution process; finally, the numerical vector and frequency domain vector in each time segment are quality checked and paired for verification to generate a set of vector segment groups with a strict time alignment relationship.

[0193] 502. Analyze the interface call features in each of the numerical vector segments, and calculate the dynamic fusion weight according to the call density and type distribution of the numerical vector segments;

[0194] In step 502, the interface call feature refers to the call behavior characteristics encoded in the numerical vector, including the call sequence pattern, parameter passing relationship and execution context;

[0195] Call density refers to the number of valid interface calls that occur within a specific time window;

[0196] Type distribution refers to the proportion of calls of different functional categories in the total number of calls;

[0197] Dynamic fusion weight refers to the fusion ratio coefficient calculated in real time based on feature importance and reliability.

[0198] In an embodiment of the present application, a sliding window technique is first used to analyze the call density change curve in the numerical vector segment to identify the call hotspot area; secondly, the call type distribution characteristics are extracted through the feature decomposition method to quantify the call proportion of each function; then, based on a preset weight calculation model, the initial weight is calculated by comprehensively considering factors such as call density, type distribution and context relevance; finally, a time decay factor is introduced to dynamically adjust the weight to ensure the appropriate enhancement of recent features and generate the dynamic weight value finally used for feature fusion.

[0199] 503. Extracting the call semantic features of the numerical vector segment and the voiceprint pattern features of the frequency domain vector segment respectively through a dual-channel processing architecture;

[0200] In step 503, the dual-channel processing architecture refers to a neural network structure with independent feature processing paths, each path specifically processing feature data of one modality;

[0201] Call semantic features refer to high-level abstract representations extracted from numerical vectors that reflect the semantics of interface functions;

[0202] Voiceprint pattern features refer to the discriminative patterns extracted from frequency domain vectors that represent the unique acoustic characteristics of hardware during operation.

[0203] In an embodiment of the present application, a deep neural network architecture with two independent feature processing channels is first constructed, and each channel contains a multi-layer feature transformation structure; secondly, a special feature extraction layer is designed in the first channel to abstract the call semantic features from the numerical vector layer by layer, and capture the functional intent and execution logic of the interface call; then, multi-scale frequency domain feature analysis is implemented in the second channel to extract discriminative voiceprint pattern features from the frequency domain vector to reflect the unique laws of hardware execution; finally, the deeply processed semantic features and voiceprint features are output at the high levels of the two channels respectively, providing high-quality feature representation for subsequent fusion.

[0204] 504. At a feature fusion node, the call semantic features are proportionally adjusted and combined with the voiceprint pattern features according to the dynamic fusion weight to obtain a fused feature group.

[0205] In step 504, the feature fusion node refers to a specific functional layer in the network that is specifically designed for multimodal feature combination;

[0206] Scaling refers to the process of precisely controlling the contribution of features based on dynamic weights; combination processing refers to the algorithm that organically integrates features from different modalities;

[0207] The fused feature group refers to the new feature representation generated after optimized combination.

[0208] In the embodiment of the present application, first, a special feature fusion layer is designed in the network, which contains a complete mechanism for feature interaction and combination; secondly, the contribution ratio of each modal feature is calculated according to the dynamic fusion weight, and a weighted fusion strategy is adopted for precise control; then a multi-level feature combination algorithm is implemented, first performing preliminary fusion in low-dimensional space, and then performing deep integration in high-dimensional space; finally, the fusion result is quality evaluated and optimized, and a fusion feature group is output that retains the advantages of the original features and has new representation capabilities.

[0209] 505. Splice the fused feature groups according to the original time sequence to generate multimodal association data.

[0210] In step 505, the original time sequence refers to the initial time sequence and position relationship of the feature data;

[0211] Multimodal correlation data refers to the final generated feature sequence that contains complete temporal information and cross-modal correlations.

[0212] In the embodiment of the present application, first, a time position index of the fused feature group is established to accurately record the time information of each feature group in the original sequence; secondly, a feature splicing algorithm with time sequence preservation capability is designed to ensure that the time continuity is not destroyed; then, a smooth transition processing is implemented between segments to eliminate possible splicing traces; finally, the complete multimodal association data is quality inspected and optimized to generate a final output result with strict time consistency and rich feature expression.

[0213] Here's a specific example:

[0214] When analyzing a cross-language video processing framework, the Java interface call features and GPU voiceprint features are first accurately segmented according to the video frame processing stage; a larger fusion weight is calculated for the high-density calls in the special effects rendering stage; the semantic features of the special effects algorithm and the voiceprint features of GPU rendering are extracted separately through a dual-channel network; the two types of features are organically combined according to the weights at the fusion layer; and finally, the features of each processing stage are spliced ​​together to form a complete video processing pipeline representation, successfully identifying plagiarized code that is rewritten in C++ but maintains the same processing logic.

[0215] In summary, steps 501 to 505 build a complete cross-modal feature fusion pipeline through refined time alignment processing, intelligent dynamic weight calculation, professional dual-channel feature extraction and optimized feature fusion strategy, realizing in-depth analysis and intelligent integration of multi-source heterogeneous data, providing a more comprehensive and accurate feature representation basis for software behavior recognition, and significantly improving the performance and reliability of the plagiarism detection system.

[0216] In order to establish a more accurate feature fusion mechanism, in some embodiments, in step 305, the historical frequency domain vector and the frequency domain vector are subjected to feature superposition processing, and the superposition ratio is adjusted according to the weight information to obtain a fusion feature, including:

[0217] 601. Perform an aging check on the historical frequency domain vectors, retain valid historical frequency domain vectors, and remove expired historical frequency domain vectors.

[0218] In step 601, timeliness check refers to the process of comprehensively evaluating the freshness and validity of historical feature data, which needs to consider multiple dimensions such as data collection time, usage frequency, and feature stability;

[0219] Valid historical frequency domain vectors refer to voiceprint feature data that has passed time-testing and has high reference value. These data should have clear collection time stamps and complete usage records.

[0220] Expired historical frequency domain vectors refer to voiceprint feature data that has exceeded the validity period or does not meet quality standards. These data may lose their reference value due to software updates or hardware changes.

[0221] In the embodiment of the present application, a multi-dimensional timeliness evaluation system is first established, which comprehensively considers factors such as the time attenuation law, feature drift and actual usage effect; secondly, a detailed usage file is established for each historical frequency domain vector, recording key information such as acquisition time, number of calls and matching accuracy; then an intelligent timeliness judgment algorithm is designed to dynamically calculate the effectiveness score of each historical feature; finally, a hierarchical processing strategy is implemented to retain high-quality features for a long time, mark critical features, and eliminate expired features in a timely manner to ensure the overall quality of the feature library.

[0222] 602. Arrange the valid historical frequency domain vectors in chronological order to form a historical frequency domain vector sequence;

[0223] In step 602, the historical frequency domain vector sequence refers to a set of voiceprint features that has been filtered for time and organized in strict time order. This sequence reflects the temporal evolution of software running features.

[0224] In the embodiment of the present application, an efficient feature indexing mechanism is first designed to quickly locate the time position of each valid historical frequency domain vector; secondly, a stable sorting algorithm is implemented to process large-scale historical feature data; then a time series continuity check mechanism is established to identify and repair possible time faults; finally, a historical feature sequence with complete time information is generated to provide a reliable basis for subsequent matching analysis.

[0225] 603. Extract feature points of the real-time frequency domain vector, and perform matching calculation on the feature points with the historical frequency domain vectors in the historical frequency domain vector sequence to obtain a matching calculation result.

[0226] In step 603, the feature points refer to the key spectral components with high discrimination in the frequency domain vector, which can effectively characterize the voiceprint characteristics of specific software behavior;

[0227] Matching calculation refers to the process of quantifying the degree of correlation between real-time features and historical features through multi-dimensional similarity evaluation;

[0228] The match calculation result is a normalized similarity score ranging from 0 to 1.

[0229] In an embodiment of the present application, a stable set of feature points is first extracted from the real-time frequency domain vector, including key features such as peak frequency, energy distribution, and spectral envelope; secondly, a multi-level matching model is constructed, comprehensively considering dimensions such as spectral shape, energy distribution, and time evolution; then, an interference-resistant similarity calculation algorithm is designed to eliminate the influence of environmental noise and hardware differences; finally, the calculation results are standardized and credibility verified to output a reliable matching score.

[0230] 604. Determine the superposition ratio of each of the historical frequency domain vectors according to the weight information and the matching degree calculation result;

[0231] In step 604, the overlay ratio refers to the fusion weight dynamically determined according to the feature quality and matching degree, which determines the contribution of the historical features to the final fusion result.

[0232] In the embodiment of the present application, a weight calculation model is first established, comprehensively considering factors such as basic weight, matching score and timeliness coefficient; secondly, a dynamic adjustment strategy is designed to optimize the weight parameters based on real-time feedback; then, weight normalization processing is implemented to ensure that the sum of the weights of each historical feature meets the requirements; finally, weight credibility verification is performed to eliminate abnormal weight values ​​and ensure the stability of the fusion process.

[0233] 605. Accumulate the historical frequency domain vector and the real-time frequency domain vector according to the superposition ratio to obtain an accumulation result, and truncate values ​​that exceed a range.

[0234] In step 605, the accumulation calculation refers to the process of linearly combining the historical features and the real-time features according to the precise weights; the truncation processing refers to the protection mechanism of safely limiting the fusion results that exceed the normal range.

[0235] In the embodiment of the present application, a high-precision weighted fusion algorithm is first implemented to ensure the correct combination of each feature component; secondly, a progressive fusion strategy is designed to gradually adjust the fusion strength; then a real-time monitoring mechanism is established to detect abnormal values ​​in the fusion process; finally, intelligent truncation processing is implemented to eliminate the influence of extreme values ​​while retaining the essence of the features.

[0236] 606. Perform format conversion on the accumulated calculation result to obtain a fusion feature.

[0237] In step 606, format conversion refers to the process of adjusting the fusion result to a standard feature representation to ensure compatibility with subsequent processing steps.

[0238] In the embodiment of the present application, the format specifications of the fusion result are first checked to identify the data items that need to be adjusted; secondly, necessary type conversion and range adjustment are performed; then feature standardization is performed to eliminate dimensional differences; finally, the conversion result is quality verified to generate final features that meet the requirements.

[0239] Here's a specific example:

[0240] When analyzing the plagiarism behavior of a cross-platform database system, we first screened out the Oracle call voiceprint features collected in the past six months from the feature library, and eliminated the old features that became invalid due to server upgrades; we strictly sorted these valid features by collection time to form a complete historical feature sequence; we monitored the voiceprint features of the suspected plagiarized PostgreSQL system in real time and extracted the feature points of its query processing stage; we performed a fine match with the historical Oracle voiceprints and found that the two had a high degree of similarity in index scanning voiceprints; based on the matching results and the preset weight model, we determined the fusion ratio of the Oracle voiceprint to be 0.6; we weightedly fused the historical Oracle voiceprints with the real-time PostgreSQL voiceprints according to this ratio, and smoothed the abnormal peaks; and finally generated enhanced fusion features, which clearly showed the similarities between the two databases in query optimizer implementation, providing conclusive evidence for plagiarism determination.

[0241] In summary, steps 601 to 606 ensure feature quality through strict time management, maintain feature continuity through precise timing organization, evaluate feature correlation through intelligent matching calculation, optimize fusion effects through dynamic weight adjustment, and ensure result reliability through secure numerical processing. Ultimately, a complete feature fusion pipeline is constructed, providing more accurate and reliable feature representation for software plagiarism detection, significantly improving the detection accuracy and anti-interference capability of the system.

[0242] In order to establish a more intelligent call sequence analysis method, in some embodiments, in step 405, based on the call frequency change of the standardized call sequence, the analysis window size is dynamically adjusted to perform segmented processing to obtain segmented calls, including:

[0243] 701. Continuously monitor the call frequency change of the standardized call sequence, reduce the analysis window when the call frequency is continuously higher than a preset first threshold, increase the analysis window when the call frequency is continuously lower than a preset second threshold, and keep the analysis window unchanged in other cases, thereby obtaining an adjusted window duration;

[0244] In step 701, the call frequency change refers to the dynamic fluctuation of the number of interface calls per unit time;

[0245] The preset first threshold refers to a high frequency critical value that triggers the window to shrink;

[0246] The preset second threshold refers to a low frequency critical value that triggers the expansion of the window;

[0247] The adjusted window duration refers to the length of the analysis interval that is dynamically optimized based on the call frequency.

[0248] In the embodiment of the present application, a real-time call frequency monitoring mechanism is first established, and a sliding window technology is used to count the number of calls per unit time; secondly, a frequency state determination model is designed to accurately identify the three states of high frequency, low frequency and normal; then a progressive window adjustment strategy is implemented to avoid sudden changes in the analysis window; finally, the adjustment result is checked for stability to ensure that the window duration is suitable for the current call characteristics.

[0249] 702. Divide the standardized call sequence into a plurality of segmented calls of equal length according to the adjusted window duration.

[0250] In step 702, the segmented calls of equal duration refer to call subsequences divided according to a uniform duration.

[0251] In the embodiment of the present application, the optimal segmentation scheme is first calculated based on the adjusted window duration; secondly, a segmentation algorithm that takes into account both efficiency and accuracy is designed; then, the standardized call sequence is accurately segmented to ensure that each segment contains complete call features; finally, the segmentation results are quality checked and boundary anomalies are corrected.

[0252] Here's a specific example:

[0253] When analyzing the order processing flow of an e-commerce system, the system first detected a sudden increase in the payment interface call frequency to 50 times per second, exceeding the preset first threshold of 45 times. The system immediately reduced the analysis window from 500 milliseconds to 300 milliseconds. Then, in the logistics query phase, the call frequency dropped to 10 times per second, which was 15 times lower than the second threshold. The system expanded the window to 700 milliseconds. Finally, the entire order processing flow was divided into multiple feature segments according to the adjusted window duration. The high-frequency payment area used fine segmentation to capture fast calls, and the low-frequency query area used broad segmentation to improve efficiency, thus achieving an accurate characterization of system behavior.

[0254] In summary, steps 701 to 702 dynamically perceive changes in call frequency and intelligently adjust the analysis granularity, ensuring both detailed analysis of high-frequency critical calls and the processing efficiency of low-frequency calls. This provides a better analysis basis for subsequent plagiarism detection and significantly improves the system's adaptability to different call patterns.

[0255] Figure 2 The present invention provides a schematic diagram of the structure of an automated evidence collection system for software copyright infringement, as shown in FIG. Figure 2 As shown, the system includes:

[0256] The acquisition module 21 collects and processes the calling sequence of the multi-language interface based on the target software running process to form unified semantic expression data;

[0257] The recording module 22 uses the high-sensitivity sound sensor of the target software to record and process the sound signal generated by the mainboard of the electronic device running the target software to generate the device sound signature;

[0258] An encoding module 23 performs a joint encoding process on the unified semantic expression data and the device sound features through a cross-modal alignment mechanism to generate multimodal associated data;

[0259] A learning module 24 utilizes a memory enhancement unit in the technical module of the target software and combines machine learning technology to automatically learn the correspondence between the multi-language interfaces and the sound features in the multi-modal association data to generate a cross-modal mapping relationship;

[0260] The matching module 25 matches cross-language plagiarism behaviors based on the cross-modal mapping relationship and automatically outputs software similarity relationship data.

[0261] Figure 2 The automated evidence collection system for software copyright infringement can be executed Figure 1 The implementation principles and technical effects of the automated evidence collection method for software copyright infringement described in the illustrated embodiment are not further elaborated. The specific manner in which each module and unit performs operations in the automated evidence collection system for software copyright infringement in the aforementioned embodiment has been described in detail in the relevant embodiments of the method and will not be further elaborated here.

[0262] In one possible design, Figure 2 An automated evidence collection system for software copyright infringement according to the embodiment shown can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32;

[0263] The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0264] The processing component 32 is used for the above Figure 1 The embodiment provides an automated evidence collection method for software copyright infringement.

[0265] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component may also be implemented as one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above method.

[0266] The storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile memory device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk, or optical disk.

[0267] Of course, a computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0268] The input / output interface provides an interface between the processing component and the peripheral interface module, which can be an output device, an input device, etc.

[0269] The communication component is configured to facilitate, among other things, wired or wireless communications between the computing device and other devices.

[0270] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. In this case, the computing device can refer to a cloud server, and the above-mentioned processing components, storage components, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0271] The present application also provides a computer storage medium storing a computer program, wherein the computer program can achieve the above-mentioned Figure 1 The embodiment shown is an automated evidence collection method for software copyright infringement.

[0272] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0273] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0274] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0275] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An automated evidence collection method for software copyright infringement, characterized in that: include: Based on the target software's running process, the calling sequence of multi-language interfaces is collected and processed to form unified semantic expression data; Using the high-sensitivity sound sensor of the target software, the sound signal generated by the mainboard of the electronic device running the target software is recorded and processed to generate the device sound signature; The unified semantic expression data and the device sound features are jointly encoded through a cross-modal alignment mechanism to generate multimodal associated data; Utilizing a memory enhancement unit in a technical module of the target software in combination with machine learning technology, automatically learning and processing the correspondence between the multi-language interfaces and the sound features in the multi-modal association data to generate a cross-modal mapping relationship; Based on the cross-modal mapping relationship, cross-language plagiarism behaviors are matched and software similarity relationship data is automatically output; The cross-modal alignment mechanism is used to jointly encode the unified semantic expression data and the device sound features to generate multimodal associated data, including: Based on the energy distribution of the device sound characteristics and the call frequency of the unified semantic expression data, the sound signal is dynamically segmented to generate adaptive sound segments; Using the timestamp information in the unified semantic expression data, bidirectional timing verification processing is performed on the adaptive sound segment and the corresponding interface call segment to obtain a verified data pair; Performing vectorization conversion processing on the interface call segment in the verified data pair according to a preset symbol mapping rule to generate a numerical vector sequence; Performing feature extraction processing on the adaptive sound segments in the verified data pair by a frequency domain transformation method to generate a frequency domain vector sequence; Based on the time alignment relationship between the numerical vector sequence and the frequency domain vector sequence, fusion processing is performed through a dual-channel encoding network with adjustable weights to generate multimodal associated data.

2. The method according to claim 1, characterized in that Utilizing the memory enhancement unit in the technical module of the target software and combining it with machine learning technology, automatically learning and processing the correspondence between the multi-language interfaces and the sound features in the multi-modal association data to generate a cross-modal mapping relationship, including: Segmenting the numerical vector sequence and the frequency domain vector sequence in the multimodal correlation data according to fixed time windows to generate a plurality of data blocks; Assigning a unique identifier to each of the data chunks, and storing the data chunks and their identifiers in a dynamic memory storage area; When a new sequence of numerical vectors is input, similarity search processing is performed in the dynamic memory storage area to find historical data blocks with similar call features; Extracting historical frequency domain vectors and weight information stored in the historical data block; Performing feature superposition processing on the historical frequency domain vector and the frequency domain vector, and adjusting the superposition ratio according to the weight information to obtain a fusion feature; The fused features and the new numerical vector sequence are jointly encoded to generate a cross-modal mapping relationship representing the correspondence between the multilingual interface and the sound features.

3. The method according to claim 1, wherein Based on the target software's running process, the multi-language interface call sequence is collected and processed to form unified semantic expression data, including: By monitoring and capturing interface call events during the runtime of the target software, the call time, interface identifier and parameter characteristics of each interface call event are recorded to generate an original call record; Performing language type identification on the original call record, and classifying and storing interface calls in different languages ​​according to the identification result to obtain classified call information; Inputting the classified call information into a preset mapping rule library, converting different language interfaces of the same function into a unified function code through the mapping rule library to obtain a standard call; Sorting the standard calls according to the calling time to generate a standardized calling sequence; Based on the call frequency changes of the standardized call sequence, the analysis window size is dynamically adjusted to perform segmented processing to obtain segmented calls; Perform dependency analysis on the segmented calls, mark the order of the calls, and obtain a marked call list; The tag call column is combined with the corresponding time metadata to form unified semantic expression data.

4. The method according to claim 1, wherein Based on the time alignment relationship between the numerical vector sequence and the frequency domain vector sequence, a fusion process is performed through a dual-channel encoding network with adjustable weights to generate multimodal associated data, including: Performing synchronous segmentation processing on the numerical vector sequence and the frequency domain vector sequence to generate time-aligned vector segment groups, each group comprising a numerical vector segment and a corresponding frequency domain vector segment; Analyzing the interface call features in each of the numerical vector segments, and calculating the dynamic fusion weight according to the call density and type distribution of the numerical vector segments; extracting the call semantic features of the numerical vector segment and the voiceprint pattern features of the frequency domain vector segment respectively through a dual-channel processing architecture; At the feature fusion node, the call semantic features are proportionally adjusted and combined with the voiceprint pattern features according to the dynamic fusion weight to obtain a fused feature group; The fused feature groups are spliced ​​in original time sequence to generate multimodal association data.

5. The method according to claim 2, characterized in that Performing feature superposition processing on the historical frequency domain vector and the frequency domain vector, and adjusting the superposition ratio according to the weight information to obtain a fusion feature, including: Performing an aging check on the historical frequency domain vectors, retaining valid historical frequency domain vectors, and removing expired historical frequency domain vectors; Arranging the valid historical frequency domain vectors in chronological order to form a historical frequency domain vector sequence; Extracting feature points of the real-time frequency domain vector and performing matching calculation with the historical frequency domain vectors in the historical frequency domain vector sequence to obtain a matching calculation result; Determining the superposition ratio of each of the historical frequency domain vectors according to the weight information and the matching degree calculation result; Accumulating the historical frequency domain vector and the real-time frequency domain vector according to the superposition ratio to obtain an accumulated calculation result, and truncating values ​​that exceed a range; The format of the accumulated calculation results is converted to obtain fusion features.

6. The method according to claim 3, characterized in that Based on the call frequency change of the standardized call sequence, the analysis window size is dynamically adjusted to perform segmented processing to obtain segmented calls, including: Continuously monitoring the call frequency changes of the standardized call sequence, reducing the analysis window when the call frequency is continuously higher than a preset first threshold, increasing the analysis window when the call frequency is continuously lower than a preset second threshold, and keeping the analysis window unchanged in other cases, to obtain an adjusted window length; According to the adjusted window duration, the standardized call sequence is divided into a plurality of segmented calls of equal duration.

7. An automated evidence collection system for software copyright infringement, applied to an automated evidence collection method for software copyright infringement as claimed in any one of claims 1 to 6, characterized in that: include: The acquisition module collects and processes the calling sequence of multi-language interfaces based on the target software's running process to form unified semantic expression data; a recording module, utilizing the high-sensitivity sound sensor of the target software to record and process the sound signals generated by the mainboard of the electronic device running the target software, thereby generating a device sound signature; an encoding module that performs joint encoding processing on the unified semantic expression data and the device sound features through a cross-modal alignment mechanism to generate multimodal associated data; a learning module that utilizes a memory enhancement unit in the technical module of the target software and combines machine learning technology to automatically learn the correspondence between the multi-language interfaces and the sound features in the multi-modal association data to generate a cross-modal mapping relationship; The matching module matches cross-language plagiarism behaviors based on the cross-modal mapping relationship and automatically outputs software similarity relationship data.

8. A computing device, characterized in that It includes a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement an automated evidence collection method for software copyright infringement as described in any one of claims 1 to 6.

9. A computer storage medium, characterized in that A computer program is stored, and when the computer program is executed by a computer, an automated evidence collection method for software copyright infringement according to any one of claims 1 to 6 is implemented.

Images