Program-level code similarity analysis method and device based on semantic slicing

Abstract

The invention relates to the technical field of network security, and discloses a program-level code similarity analysis method and device based on semantic slicing, and the method comprises the steps: constructing a program-level target function call graph based on a target source code; matching the target function call graph with a standard function call graph to obtain a plurality of isomorphic sub-graphs; performing semantic slicing on each function node in the first sub-graph and the second sub-graph to obtain a first slicing result of the first sub-graph and a second slicing result of the second sub-graph; and evaluating the slice similarity between each function in the first slice result and each function in the second slice result, and determining the similarity of the target source code according to the slice similarity. According to the method, the user-defined function call graph for eliminating system function interference is constructed, an isomorphic sub-graph matching algorithm is combined, multi-dimensional features are comprehensively considered, the accuracy of similarity calculation is improved, effective support is provided for practical application scenes such as code reconstruction and security audit, and the guarantee of code quality and security is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and particularly relates to a method and device for program-level code similarity analysis based on semantic slicing. Background Art

[0002] In software engineering, code similarity analysis is an important technology for improving software quality, reducing redundancy and maintenance costs. Existing methods are mainly divided into several categories: text-based, structure-based, and semantic-based.

[0003] Text-based methods usually adopt string comparison and hashing techniques to judge similarity by finding identical code fragments. Although such methods are simple, they cannot handle semantically similar codes.

[0004] Structure-based analysis methods rely on abstract syntax trees (ASTs) or control flow graphs (CFGs) for comparison, which can capture certain structural similarities. However, they are often inefficient when facing complex dependency relationships and multi-layer nested calls, and are easily interfered by system functions.

[0005] Semantic-based analysis methods such as data flow analysis and program slicing, although they can effectively capture semantic information, usually require high computing resources. Especially when dealing with large code libraries, the performance bottleneck is obvious. At the same time, many existing technologies cannot effectively exclude the influence of standard library functions when judging code similarity, resulting in frequent false positives and false negatives, reducing the accuracy of the analysis results. In addition, existing semantic slicing methods often cannot make full use of the dependency relationships between instructions when analyzing the dependency structure, resulting in inaccurate similarity calculation.

[0006] Existing methods have obvious deficiencies in accurately identifying code similarity, and there is an urgent need for a more efficient and accurate solution to meet the requirements of modern software development for code refactoring, security auditing, and quality assessment. Summary of the Invention

[0007] In view of this, the present invention provides a method and device for program-level code similarity analysis based on semantic slicing to solve the problems of inaccurate and low-efficiency analysis results of program-level code similarity.

[0008] In a first aspect, the present invention provides a method for program-level code similarity analysis based on semantic slicing, the method comprising:

[0009] Constructing a program-level target function call graph based on the target source code;

[0010] Matching the target function call graph with a standard function call graph to obtain a plurality of isomorphic subgraphs, the isomorphic subgraphs including a first subgraph and a second subgraph;

[0011] Semantically slice each function node in the first sub-graph and the second sub-graph respectively to obtain the first slicing result of the first sub-graph and the second slicing result of the second sub-graph;

[0012] Evaluate the slicing similarity between each function in the first slicing result and each function in the second slicing result, and determine the similarity of the target source code according to the slicing similarity.

[0013] The program-level code similarity analysis method based on semantic slicing provided by the present invention aims to efficiently identify the similarity in source code by constructing a custom function call graph that excludes the interference of system functions, combined with an innovative isomorphic sub-graph matching algorithm. It introduces a lightweight semantic slicing analysis technology to optimize the processing of complex dependencies, and comprehensively considers multi-dimensional features to improve the accuracy of similarity calculation, providing a more reliable similarity analysis tool for software development and maintenance, and also providing effective support for practical application scenarios such as code refactoring and security auditing, enhancing the guarantee of code quality and security.

[0014] In an optional implementation manner, constructing a program-level target function call graph based on the target source code includes:

[0015] Parse the target source code and screen out multiple custom functions included in the target source code;

[0016] Analyze the call positions and call relationships of each custom function, and construct a call relationship graph;

[0017] Filter out the system functions in the call relationship graph, and optimize and display the call relationship graph according to the remaining custom functions to obtain a function call graph.

[0018] The program-level code similarity analysis method based on semantic slicing provided by the present invention extracts the names, parameters, and return value types of custom functions by parsing the source code, constructs a call graph containing only custom functions by analyzing and identifying the call relationships of all functions, excludes the interference of system functions, ensures that the similarity analysis focuses on the core logic of the program, reduces the noise caused by system functions, thereby improving the accuracy and reliability of subsequent analysis. The constructed call graph provides a clear basis for further similarity matching and facilitates the identification of relationships between functions.

[0019] In an optional implementation manner, matching the target function call graph with a standard function call graph to obtain multiple isomorphic sub-graphs includes:

[0020] Take any node in the target function call graph as the starting node, and sequentially match all nodes with each node in the standard function call graph according to a preset matching criterion to obtain matching node pairs;

[0021] Based on the matching node pairs, compare the adjacent edges connected to the matching node pairs to obtain matching edge pairs;

[0022] Determine an isomorphic subgraph based on the matching node pairs and the matching edge pairs. The attributes of each node and edge in the first subgraph in the isomorphic subgraph correspond and match the attributes of each node and edge in the second subgraph.

[0023] In an alternative embodiment, determining an isomorphic subgraph based on the matching node pairs and the matching edge pairs includes:

[0024] Obtain the matching node pairs to be processed, and perform synchronous expansion of adjacent nodes on them to obtain first adjacent nodes and second adjacent nodes;

[0025] Determine whether the first adjacent nodes and the second adjacent nodes match to obtain multiple matching adjacent nodes of the matching node pairs;

[0026] Traverse each matching node pair and matching adjacent node pair to obtain an isomorphic subgraph.

[0027] In an alternative embodiment, determining whether the first adjacent nodes and the second adjacent nodes match to obtain multiple matching adjacent nodes of the matching node pairs includes:

[0028] If the first adjacent nodes and the second adjacent nodes are already matched, form matching adjacent nodes;

[0029] If any one of the first adjacent nodes and the second adjacent nodes matches other nodes, or the first adjacent nodes and the second adjacent nodes do not meet the preset matching criteria, report a matching conflict;

[0030] If the first adjacent nodes and the second adjacent nodes are not matched, perform a matching judgment on the first adjacent nodes and the second adjacent nodes according to the preset matching criteria. If the first adjacent nodes and the second adjacent nodes match, form matching adjacent nodes; otherwise, report a matching conflict;

[0031] If a matching conflict occurs, return to the previous layer to reselect new matching node pairs until there is no matching conflict.

[0032] The program-level code similarity analysis method based on semantic slicing provided by the present invention efficiently identifies the isomorphic relationship of subgraphs through a candidate node list and recursive isomorphic search, and cooperates with a conflict handling and backtracking mechanism to ensure that the algorithm can adapt to complex queries, significantly improving the matching efficiency. It can quickly identify similar logical structures in a large-scale code library, reduce memory consumption and computational complexity, thereby providing feasibility for practical applications. The accurate identification of isomorphic subgraphs enhances the depth of similarity analysis and reduces the risks of false matching and missed matching.

[0033] In an alternative embodiment, semantic slicing is performed on each function node of the first sub-graph to obtain a first slicing result of the first sub-graph, including:

[0034] Performing semantic slicing on the target function nodes in the first sub-graph using forward slicing to obtain the variables or parameters of the target function nodes;

[0035] Analyzing the dependency relationships of the variables or functions, and gradually expanding the target slicing result until the dependency relationships no longer change, to obtain the slicing result of the target function nodes;

[0036] The slicing results of the respective target function nodes in the first sub-graph form the first slicing result of the first sub-graph.

[0037] The program-level code similarity analysis method based on semantic slicing provided by the present invention analyzes the dependency relationships of the respective variables or functions, avoids the performance degradation caused by the coefficient matrix representation, gradually expands the dependency information of each node, and finally obtains a detailed slicing result, significantly improving the analysis ability for complex dependency structures, being able to accurately capture the influence relationships between instructions, reducing the performance bottleneck of traditional methods when dealing with complex code, making the similarity calculation more accurate, and thus improving the overall analysis effect.

[0038] In an alternative embodiment, evaluating the slicing similarity between the functions in the first slicing result and the functions in the second slicing result includes:

[0039] Constructing a similarity matrix for the functions in the first slicing result and the corresponding functions in the second slicing result;

[0040] Based on the similarity matrix, determining the similarity between the functions by calculating the Jaccard distance, as the slicing similarity of the functions.

[0041] In an alternative embodiment, determining the similarity of the target source code according to the slicing similarity includes:

[0042] Calculating the semantic similarity of the respective matching function nodes in the target isomorphic sub-graph according to the slicing similarity;

[0043] Calculating the similarity of the target source code according to the semantic similarity in multiple target isomorphic sub-graphs.

[0044] The program-level code similarity analysis method based on semantic slicing provided by the present invention constructs a multi-dimensional similarity matrix, provides a more comprehensive analysis perspective, enables the similarity calculation to comprehensively consider different features of the functions, enhances the depth and accuracy of the analysis, and reduces the probability of missed detection and false detection. Quantifying the similarity between functions using the Jaccard distance, by determining the one-to-one mapping relationship between function nodes, maximizing the sum of node similarities, ensuring finding the optimal match, and making the similarity evaluation more accurate.

[0045] In a second aspect, the present invention provides a program-level code similarity analysis device based on semantic slicing. The device includes:

[0046] A function call graph construction module, configured to construct a target function call graph at the program level based on the target source code;

[0047] An isomorphic subgraph matching module, configured to match the target function call graph with a standard function call graph to obtain a plurality of isomorphic subgraphs. The isomorphic subgraphs include a first subgraph and a second subgraph that match each other;

[0048] A semantic slicing module, configured to perform semantic slicing on each function node in the first subgraph and the second subgraph respectively to obtain a first slicing result of the first subgraph and a second slicing result of the second subgraph;

[0049] A similarity calculation module, configured to evaluate the slicing similarity between each function in the first slicing result and each function in the second slicing result, and determine the similarity of the target source code according to the slicing similarity.

[0050] In a third aspect, the present invention provides a computer device, including: a memory and a processor, which are communicatively connected to each other. The memory stores computer instructions, and the processor executes the computer instructions to execute the method according to the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings required for the description of the specific embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0052] Figure 1 is a schematic flowchart of a program-level code similarity analysis method based on semantic slicing according to an embodiment of the present invention;

[0053] Figure 2 is a schematic flowchart of another program-level code similarity analysis method based on semantic slicing according to an embodiment of the present invention;

[0054] Figure 3 is a schematic structural diagram of a target function call graph in a program-level code similarity analysis method based on semantic slicing according to an embodiment of the present invention;

[0055] Figure 4 is a schematic structural diagram of a standard function call graph in a program-level code similarity analysis method based on semantic slicing according to an embodiment of the present invention;

[0056] Figure 5 It is a schematic diagram of the complete process for performing similarity analysis on the program code in the source code file to be analyzed in the program-level code similarity analysis method based on semantic slicing according to an embodiment of the present invention;

[0057] Figure 6 It is a structural block diagram of a program-level code similarity analysis device based on semantic slicing according to an embodiment of the present invention;

[0058] Figure 7 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. Specific Embodiments

[0059] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Apparently, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0060] An embodiment of the present invention provides a program-level code similarity analysis method based on semantic slicing. By constructing a custom function call graph that excludes the interference of system functions and combining with an isomorphic subgraph matching algorithm, the effect of efficiently and accurately identifying the similarity in program-level source code is achieved.

[0061] According to an embodiment of the present invention, an embodiment of a program-level code similarity analysis method based on semantic slicing is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order than here.

[0062] In this embodiment, a program-level code similarity analysis method based on semantic slicing is provided, which can be used in the above computer system. Figure 1 It is a flowchart of a program-level code similarity analysis method based on semantic slicing according to an embodiment of the present invention. As Figure 1 shown, the process includes the following steps:

[0063] Step S101, construct a program-level target function call graph based on the target source code.

[0064] Specifically, after obtaining the target source code of the project to be analyzed, a function call graph at the program level is constructed based on the target source code. The function call graph is a graph structure used to represent the call relationships between custom functions in a program. In this graph, nodes represent each function, and directed edges represent the relationship of calling one function from another. By constructing the function call graph, the structure and logic of the program can be intuitively analyzed and understood, and the dependency relationships between functions can be identified, thereby providing support for code optimization, refactoring, and similarity analysis. In this embodiment, the function call graph includes the call relationships between the respective defined functions in the target source code.

[0065] Step S102: Match the target function call graph with the standard function call graph to obtain multiple isomorphic subgraphs, where the isomorphic subgraphs include a first subgraph and a second subgraph.

[0066] Specifically, most of the existing subgraph isomorphism methods adopt the pruning strategy proposed by Ullmann, which has two main limitations: one is the difficulty in effectively processing complex queries, and the other is the need to rely on large indexes that consume a large amount of memory resources. To overcome the above limitations, a new subgraph isomorphism algorithm is introduced in this embodiment to match the target function call graph with the standard function call graph, obtaining a mutually matching first subgraph and second subgraph. Among them, the first subgraph is a part of the target function call graph, and the second subgraph is a part of the standard function call graph. The target function call graph and the standard function call graph can be function call graphs constructed according to the source codes of different projects respectively. Through similarity analysis, developers can be helped to discover potential problems in a timely manner, improving code quality and maintainability.

[0067] In the matching process, an arbitrary node in the target function call graph is selected as the starting node, and it is compared with the candidate nodes in the standard function call graph based on the matching criteria. The candidate nodes that meet the conditions are stored in the candidate node list.

[0068] Step S103: Semantically slice each function node in the first subgraph and the second subgraph respectively to obtain a first slicing result of the first subgraph and a second slicing result of the second subgraph.

[0069] Specifically, traditional program slicing methods are less efficient in processing dependency structure representation and call context, especially when dealing with complex dependency relationships, performance bottlenecks are likely to occur. In this embodiment, a lightweight semantic slicing algorithm is introduced for efficient dependency analysis.

[0070] The slicing algorithm introduces an Instruction Dependency Table (IDT) and an Instruction Dependency Set (IDS) to avoid representing the sparse matrix of dependency relationships. IDS L(i) is used to store the dependency information of each node i in the Control Flow Graph (CFG), that is, all instructions or variables that may affect the execution of node i. In the initial state, L 0 (i) = {i}.

[0071] Step S104: Evaluate the slice similarity between each function in the first slice result and each function in the second slice result, and determine the similarity of the target source code based on the slice similarity.

[0072] The program-level code similarity analysis method based on semantic slicing provided in this embodiment aims to efficiently identify the similarity in the source code by constructing a custom function call graph that excludes the interference of system functions, combined with an innovative isomorphic subgraph matching algorithm. It introduces a lightweight semantic slicing analysis technology to optimize the processing of complex dependency relationships, comprehensively considers multi-dimensional features, improves the accuracy of similarity calculation, provides a more reliable similarity analysis tool for software development and maintenance, and also provides effective support for practical application scenarios such as code refactoring and security auditing, enhancing the guarantee of code quality and security.

[0073] In this embodiment, a program-level code similarity analysis method based on semantic slicing is provided, which can be used in the above computer system. Figure 2 It is a flowchart of the program-level code similarity analysis method based on semantic slicing according to an embodiment of the present invention, as Figure 2 shown. The process includes the following steps:

[0074] Step S201: Construct a program-level target function call graph based on the target source code.

[0075] Specifically, the above step S201 includes:

[0076] Step S2011: Parse the target source code and screen out multiple custom functions included in the target source code.

[0077] Specifically, use a static code analysis tool to read the target source code, extract the names, parameters, return value types, etc. of all custom functions. Identify the scopes of all custom functions to ensure that only the custom functions in the current program are captured, exclude the standard library functions provided by the system, and only retain the custom functions. Generally, there are multiple custom functions.

[0078] Step S2012: Analyze the call locations and call relationships of each defined function, and construct a call relationship graph.

[0079] Specifically, in the target source code, through the analysis of the Abstract Syntax Tree (AST), find the call locations of all custom functions. Each node represents a construct of the code (such as expressions, statements, declarations, etc.), and the AST is used to analyze and transform program code. For each function call found, record the relationship between the calling function and the called function, and construct a preliminary call relationship graph that includes each custom function and other custom functions it calls. As Figure 3 shown in the structural schematic diagram of the target function call graph, this call graph contains eight function nodes: A1, A2, A3, A4, A5, A6, A7, A8. The call relationships between the functions are: A1 calls A2 and A3, A4 calls A5, A5 calls A6 and A7, A6 calls A8. This is only for example, and not limited thereto.

[0080] Step S2013: Filter out the system functions in the call relationship graph, optimize and display the call relationship graph according to the remaining custom functions, and obtain the function call graph.

[0081] Specifically, for each call relationship recorded in the call relationship graph, check whether the called function is a system function. This can be done by comparing it with the functions in the predefined system function library. If the called function is included in the predefined system function library, then exclude the node and call relationship corresponding to the called function from the call relationship graph, and continue to optimize the call relationship graph, only retaining the custom functions and the call relationships between them.

[0082] Construct a function call graph according to the optimized call relationship, use a directed graph representation method to display the call relationships between custom functions, label each node of the function call graph with function name, parameters, and return value information, and label each edge with the type of call relationship.

[0083] As Figure 3 shown, if A6 is a system function, then the optimized function call graph filters out A6 and A8, and A5 only calls A7. This is only for example, and not limited thereto.

[0084] The program-level code similarity analysis method based on semantic slicing provided in this embodiment parses the source code, extracts the names, parameters, and return value types of custom functions, analyzes and identifies the call relationships of all functions, constructs a call graph that only contains custom functions, excludes the interference of system functions, ensures that the similarity analysis focuses on the core logic of the program, reduces the noise caused by system functions, thereby improving the accuracy and reliability of subsequent analysis. The constructed call graph provides a clear basis for further similarity matching and facilitates the identification of relationships between functions.

[0085] Step S202: Match the target function call graph with the standard function call graph to obtain multiple isomorphic subgraphs, where the isomorphic subgraphs include a first subgraph and a second subgraph.

[0086] Specifically, the above step S202 includes:

[0087] Step S2021: Use any node in the target function call graph as the starting node, and sequentially match all nodes with the nodes in the standard function call graph according to a preset matching criterion to obtain matching node pairs.

[0088] Specifically, arbitrarily select a node in the target function call graph as the starting node. Starting from the starting node, search for candidate nodes in the standard function call graph that may match the starting node. The preset matching criterion is to screen and match based on node attributes (including but not limited to: function name, code level, number of parameters, etc.). Store the candidate nodes with matching node attributes in the candidate node list. The starting node and its matching candidate node form a matching node pair.

[0089] According to the process of finding matching nodes for the starting node, find matching nodes for each node in the target function call graph and form matching node pairs respectively. As Figure 4 shown in the partial structural schematic diagram of the standard function call graph, as Figure 3 shown, if A1 is selected as the starting node, then match A1 with Figure 4 B1 - B7 in Figure 4 respectively to obtain the matching node pair A1 - B1 of A1. Then sequentially match A2 - A8 with Figure 3 B1 - B7 in Figure 4 respectively to obtain the matching node pairs of A2 - A8.

[0090] The matching node pairs formed by the nodes in Figure 4 and the nodes in Figure 4 include: A1 - B1, A2 - B2, A3 - B3, A4 - B4, A5 - B5, A6 - B6, A7 - B7, which are only for illustration and not limited thereto.

[0090] Step S2022: Based on the matching node pairs, compare the adjacent edges connected to the matching node pairs to obtain matching edge pairs.

[0091] Specifically, based on the matching node pairs, matching candidate edges are determined, and according to the screening principle of edge attributes, the matching edge pairs are determined from the matching candidate edges.

[0092] As Figure 4 shown, based on each matching node pair, the candidate edges determined include: R1 - S1, R3 - S3, R4 - S4, R5 - S5, and the calling function and the called function of the matching edge pairs match respectively.

[0093] Step S2023, based on the matching node pairs and the matching edge pairs, an isomorphic sub - graph is determined, and the attributes of each node and edge in the first sub - graph in the isomorphic sub - graph correspond and match the attributes of each node and edge in the second sub - graph.

[0094] Specifically, after the candidate node list is determined, each candidate node will be checked one by one in a recursive manner to see if it can form an isomorphic sub - graph. Based on the previously matched matching node pairs (i.e., the set V matched ) and the matched matching edge pairs (i.e., the set E matched ), the isomorphic search is carried out. For each matched node pair <u, u ′ > ∈ V matched , the algorithm will apply the reciprocal node expansion strategy to synchronously expand adjacent nodes in the two graphs, thus gradually forming an exact match of the sub - graphs.

[0095] In some optional implementation manners, in the above - mentioned step S2023, determining the isomorphic sub - graph based on the matching node pairs and the matching edge pairs includes:

[0096] Step a1, obtain the matching node pairs to be processed, and synchronously expand their adjacent nodes to obtain the first adjacent nodes and the second adjacent nodes.

[0097] Specifically, first, a matching node pair <u, u′> to be processed is obtained from the stack S, and the adjacent relationship between node u in the target function call graph and node u′ in the standard function call graph is checked. For the unmatched adjacent relationships, the algorithm will look for candidate relationships in the adjacent relationships of u′. This process will perform a strict matching check on the endpoints of the candidate relationships to ensure that the corresponding matching principles (such as the consistency of node and edge attributes) are satisfied.

[0098] Step a2, determine whether the first adjacent nodes and the second adjacent nodes match to obtain multiple matching adjacent nodes of the matching node pairs.

[0099] Specifically, to find all exact isomorphic sub - graphs of the query graph in the database graph, after finding an isomorphic sub - graph, the algorithm does not terminate, but continues to try all possible matching combinations of each node and edge in the query graph through the backtracking and recursive mechanisms.

[0100] During the search for isomorphic subgraphs, if the algorithm fails to find any isomorphic subgraphs that meet the conditions, it is determined that there is no homology relationship between the target function call graph and the standard function call graph, and the matching process ends; otherwise, if an isomorphic subgraph is successfully found, it can be preliminarily determined that the two have potential homology.

[0101] Step a3: Traverse each pair of matching nodes and pairs of matching adjacent nodes to obtain an isomorphic subgraph.

[0102] Specifically, if Figure 3 A5 in Figure 4 is used as the initial node, and Figure 3 B1, B4, and B5 in Figure 4 are matched as candidate nodes, through cyclic node matching, the node pairs: (A5, B4), (A7, B3), (A6, B5), (A8, B6) can be finally determined. Therefore

[0103] In some alternative embodiments, the above step a2 includes:

[0104] If the first adjacent node and the second adjacent node have been matched, a pair of matching adjacent nodes is formed.

[0105] [[ID=2×]]If any one of the first adjacent node and the second adjacent node is matched with other nodes, or the first adjacent node and the second adjacent node do not meet the preset matching criteria, a matching conflict is reported.

[0106] If the first adjacent node and the second adjacent node are not matched, a matching judgment is made on the first adjacent node and the second adjacent node according to the preset matching criteria. If the first adjacent node and the second adjacent node are matched, a pair of matching adjacent nodes is formed; otherwise, a matching conflict is reported.

[0107] If a matching conflict occurs, return to the previous layer to re-select a new pair of matching nodes until there is no matching conflict.

[0108] Specifically, when processing relationship matching, the algorithm will find multiple candidate relationships for each unmatched query graph relationship and iteratively check whether these candidate relationships match the query relationship. For each relationship matching, it is necessary to check whether its corresponding endpoints meet the matching conditions. As Figure 5 shown, it is a schematic diagram of the complete process for similarity analysis of the program code in the source code file to be analyzed. The specific rules are as follows:

[0109] 1) Matched endpoints: If the relationship endpoint v of the query graph and the relationship endpoint v' of the database graph have been matched in the previous steps, this relationship matching is considered valid and no further check is required.

[0110] 2) Conflict detection: If one of the endpoints in v and v′ matches other nodes, or v and v′ do not meet the matching criteria, the algorithm will report a conflict and backtrack. In case of abnormal situations (such as one match and one non-match) during the matching process, backtracking is required.

[0111] 3) Unmatched endpoints: If both v and v′ are unmatched nodes, the algorithm will further check whether they meet the matching conditions (such as similar attributes or consistent structures). If the conditions are met, the new matching pair <v, v′> will be added to the matching set V matched and pushed onto the stack S, preparing to apply the same recursive expansion strategy in subsequent steps; if the conditions are not met, a conflict will be reported.

[0112] For the endpoints reporting conflicts, a backtracking mechanism can be adopted: During the matching process, if it is found that there are conflicts in relation matching or endpoint matching, the algorithm will backtrack from the current matching state to the previous state. Specifically, it includes trying the next candidate match for the current relationship until a conflict-free match is found; if all candidate matches have been tried and the conflict still cannot be resolved, the algorithm will further backtrack to the previous-level relationship matching and reselect a new candidate matching pair.

[0113] During the backtracking process, the algorithm will restore the global data structure to the state before the backtracking point. That is to say, all node and relationship matches will be removed from the sets V matched and E matched and the content in the stack S will also be restored to the previous state accordingly.

[0114] The program-level code similarity analysis method based on semantic slicing provided in this embodiment efficiently identifies the isomorphic relationship of subgraphs through the candidate node list and recursive isomorphism search, and cooperates with the conflict handling and backtracking mechanism to ensure that the algorithm can adapt to complex queries, significantly improving the matching efficiency, being able to quickly identify similar logical structures in a large-scale code library, reducing memory consumption and computational complexity, thus providing feasibility for practical applications. The accurate identification of isomorphic subgraphs enhances the depth of similarity analysis and reduces the risks of false matching and missed matching.

[0115] Step S203: Semantically slice each function node in the first subgraph and the second subgraph respectively to obtain the first slicing result of the first subgraph and the second slicing result of the second subgraph.

[0116] Specifically, the above step S203 includes:

[0117] Step S2031: Semantically slice the target function node in the first subgraph using forward slicing to obtain the variables or parameters of the target function node.

[0118] Specifically, the instruction backward dependency set IDS L(i) is used to store the dependency information of each node i in the control flow graph (CFG), that is, all instructions or variables that may affect the execution of node i. In the initial state, L 0 (i) = {i}.

[0119] Subsequently, the recurrence relation is used to perform iterative calculation on L(i):

[0120] L k+1 (i) ≡ L k (i) ∪ ∪ j∈CD(i) L k (j) ∪ ∪ x∈REF(i) S k (x)

[0121] In the formula, k ≥ 0 represents the number of iterations, CD(i) represents the control dependency set that affects node i, and REF(i) returns the set of variables used in node i. S(x) is the current backward static slice result of variable x, and the calculation formula is as follows:

[0122]

[0123] In the formula, DEF(i) returns the set of variables defined or modified in node i. For source code, some variables may be multi-valued, and the algorithm extends the slices of these multi-valued variables at the definition nodes.

[0124] To provide initial static slices for the formal parameters and global variables of each function procedure, the algorithm also introduces symbolic parameters, such as l x 、l y etc. The symbolic parameters are initialized at the entrance of the procedure as follows:

[0125]

[0126] In the formula, FRML(P) represents the set of formal parameters of procedure P, and GLOB(P) represents the set of global variables used in procedure P. The slices initialized by symbolic parameters can flexibly represent the dependency relationships of each variable. In subsequent analyses, the symbolic parameters will be replaced by specific dependency sets.

[0127] Step S2032: Analyze the dependency relationships of variables or functions, and gradually expand the target slice result until the dependency relationships no longer change, to obtain the slice result of the target function node.

[0128] Step S2033: The slice results of each target function node in the first subgraph form the first slice result of the first subgraph.

[0129] Specifically, semantic slicing needs to be performed on both subgraphs of the isomorphic subgraphs, and the slicing methods are the same. In this embodiment, the first subgraph is taken as an example for illustration, and the second subgraph will not be elaborated.

[0130] The result of semantic slicing can be represented as an anonymous function expression abstraction λx.S(x), where x is a symbolic parameter. Each slice is initialized with a symbolic parameter in the initial calculation. As the recursive slice analysis progresses, the symbolic parameter is replaced by a concrete value by the dependencies. The final slice may contain multiple symbolic parameters and is represented in the form of λl_xl_y.S(x).

[0131] During the slicing process, a slicing criterion <p, v> is defined, where p represents the analysis end point of the program (such as the end node of a function), and v represents the variable of interest (such as the global variable, local variable or parameter of a function). The forward slicing method is mainly adopted. By analyzing the dependency relationship from the program start point to the end point, all statements that may be affected by the slicing criterion are collected.

[0132] During the forward slicing process, the slicing algorithm analyzes the dependencies at each control flow graph node through the IDT and IDS structures, and gradually expands its slicing result according to the definition and use relationship of variables. The slicing calculation is iteratively performed until the dependency relationship is no longer updated, that is, the fixed point is reached and the algorithm stops.

[0133] The program-level code similarity analysis method based on semantic slicing provided in this embodiment avoids the performance reduction caused by the coefficient matrix representation by analyzing the dependency relationship of each variable or function, gradually expands the dependency information of each node, and finally obtains a detailed slicing result, significantly improving the analysis ability of complex dependency structures, being able to accurately capture the influence relationship between instructions, reducing the performance bottleneck of traditional methods when dealing with complex code, making the similarity calculation more accurate, and thus improving the overall analysis effect.

[0134] Step S204, evaluate the slice similarity of each function in the first slice result and each function in the second slice result, and determine the similarity of the target source code according to the slice similarity.

[0135] Specifically, the above step S204 includes:

[0136] Step S2041, construct a similarity matrix of each function in the first slice result and each function in the corresponding second slice result.

[0137] Specifically, for the similarity calculation of the slice pairs of functions with different nodes, a linear assignment algorithm is used to determine the "one-to-one" mapping relationship result of function nodes. Preferably, the Kuhn-Munkres algorithm is used in this embodiment to determine the association result of candidate subgraph matching pairs. The optimal root node matching result is searched mainly by maximizing the sum of node similarities. The node similarity mainly represents the code similarity between the functions represented by the root nodes. The specific steps include:

[0138] (1) Construct a similarity matrix: Suppose there are two sets of nodes (function nodes). We can use a matrix to represent the similarity between the two sets of nodes. The rows of the matrix represent the functions in one program, the columns represent the functions in another program, and each element represents the similarity score between these two functions.

[0139] (2) Initial labeling: Assign an initial label (initial weight) to each row or column in the matrix to ensure that each function node has at least one potential matching pair.

[0140] (3) Find the initial matching: Find a preliminary matching scheme to try to match the function nodes one-to-one. This step can be simply carried out by maximum weight matching.

[0141] (4) Adjust the labels: If the preliminary matching is not sufficient to cover all nodes (a perfect matching cannot be found), then update the potential matching by adjusting the labels. The adjustment of the labels follows the following rules:

[0142] Find the unmatched nodes and try to extend their matching paths; adjust the labels so that the weights of the unmatched nodes increase, thereby increasing the chance of matching.

[0143] (5) Update the matching: By gradually adjusting the labels and extending the paths of the unmatched nodes, finally find a new and optimal matching scheme.

[0144] (6) Termination condition: When all nodes are matched, the algorithm terminates, and at this time an optimal matching scheme is obtained.

[0145] Step S2042, based on the similarity matrix, determine the similarity between each function by calculating the Jaccard distance, as the slice similarity of each function.

[0146] Specifically, based on the similarity matrix, measure the feature differences between functions by calculating the Jaccard distance, and use this as the code similarity between functions. In this embodiment, the main features extracted include:

[0147] Index name, number of lines of code, number of declared variables, total number of operators, number of parameters, number of expressions, total number of operands, number of loops (for, while, and do-while), number of exceptions thrown, number of exceptions referenced, cyclomatic complexity, number of local variables, number of function calls, number of conditional statements, number of iterative statements, number of return statements, number of input statements, number of output statements, number of assignments through function calls, number of selection statements, number of assignment statements, number of parameters passed, only as an example, but not limited thereto.

[0148] The calculation formula of the Jaccard distance is as follows:

[0149]

[0150] Among them, A and B respectively represent the feature sets of two functions, and the features in the feature sets may include the above-mentioned features.

[0151] |A∩B| represents the size of the intersection (the number of common features) between feature set A and feature set B.

[0152] |A∪B| represents the size of the union (the total number of all unique features) of feature set A and feature set B.

[0153] When calculating the similarity of function codes, the Jaccard distance is used to measure the difference between the feature sets of two functions. The smaller the Jaccard distance, the higher the function similarity. Therefore, the formula for the function code similarity is:

[0154]

[0155] This formula represents the similarity ratio between two functions. The closer the value is to 1, the more similar the functions are.

[0156] Step S2043: Calculate the semantic similarity of each matching function node in the target isomorphic subgraph according to the slice similarity.

[0157] Specifically, based on the isomorphic subgraph, all the functions corresponding to it are respectively formed into sets:

[0158]

[0159] Among them, and are two functions with an isomorphic relationship.

[0160] Count the number of code similarities of each semantic slice that exceed the threshold, denoted as NumberOfEquivalentSlices. Then the similarity of two matching functions is expressed as:

[0161]

[0162] Among them, q and t respectively represent the functions to be matched, and NumberOfAllSlices(q,t) represents the number of code snippet of the total semantic slices in function q and function t.

[0163] Suppose There are code slices, There are code slices, Each code slice of will be compared with For the second semantic similarity comparison, the maximum value of the semantic similarities of the two comparison slices is taken as S Similarity , where The calculation formula of is as follows:

[0164]

[0165] Therefore, The semantic similarity between and is as shown in the following formula. The semantic similarity between and is as shown in the following formula.

[0166]

[0167] Step S2044, calculate the similarity of the target source code according to the semantic similarities in multiple target isomorphic subgraphs.

[0168] Specifically, calculate the function similarity values of all isomorphic subgraph matching pairs, and the code similarity between the two programs to be compared is as shown in the following formula.

[0169]

[0170] Among them, n represents the number of all matching pairs.

[0171] The program-level code similarity analysis method based on semantic slicing provided in this embodiment constructs a multi-dimensional similarity matrix, provides a more comprehensive analysis perspective, enables the similarity calculation to comprehensively consider different features of functions, enhances the depth and accuracy of the analysis, and reduces the probability of missed detection and false detection. The Jaccard distance is used to quantify the similarity between functions. By determining the one-to-one mapping relationship between function nodes, the sum of node similarities is maximized to ensure finding the optimal match, making the similarity evaluation more accurate.

[0172] In this embodiment, a program-level code similarity analysis device based on semantic slicing is also provided. This device is used to implement the above-mentioned embodiments and preferred implementation manners, and those that have been described will not be repeated. As used hereinafter, the term "module" can be a combination of software and / or hardware that can achieve a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation in hardware, or a combination of software and hardware is also possible and contemplated.

[0173] This embodiment provides a program-level code similarity analysis device based on semantic slicing, as Figure 6 shown, including:

[0174] A function call graph construction module 601, configured to construct a target function call graph at the program level based on the target source code.

[0175] The isomorphic subgraph matching module 602 is used to match the target function call graph with the standard function call graph to obtain multiple isomorphic subgraphs, where the isomorphic subgraphs include a first subgraph and a second subgraph that match each other.

[0176] The semantic slicing module 603 is used to perform semantic slicing on each function node in the first subgraph and the second subgraph respectively to obtain a first slicing result of the first subgraph and a second slicing result of the second subgraph.

[0177] The similarity calculation module 604 is used to evaluate the slicing similarity between each function in the first slicing result and each function in the second slicing result, and determine the similarity of the target source code according to the slicing similarity.

[0178] In some alternative embodiments, the function call graph construction module 601 includes:

[0179] The custom function screening unit is used to parse the target source code and screen out multiple custom functions included in the target source code.

[0180] The relationship graph construction unit is used to analyze the call positions and call relationships of each custom function, and construct a call relationship graph.

[0181] The relationship graph optimization unit is used to filter out system functions in the call relationship graph, optimize and display the call relationship graph according to the remaining custom functions, and obtain the function call graph.

[0182] In some alternative embodiments, the isomorphic subgraph matching module 602 includes:

[0183] The node matching unit is used to use any node in the target function call graph as the starting node, and sequentially match all nodes with each node in the standard function call graph according to a preset matching criterion to obtain matching node pairs.

[0184] The edge matching unit is used to compare the adjacent edges connected to the matching node pairs based on the matching node pairs to obtain matching edge pairs.

[0185] The isomorphic subgraph determination unit is used to determine isomorphic subgraphs based on the matching node pairs and the matching edge pairs. The attributes of each node and edge in the first subgraph in the isomorphic subgraph correspond to and match the attributes of each node and edge in the second subgraph.

[0186] In some alternative embodiments, the isomorphic subgraph determination unit includes:

[0187] The node expansion subunit is used to obtain the matching node pairs to be processed, synchronously expand their adjacent nodes, and obtain a first adjacent node and a second adjacent node.

[0188] An adjacent node matching subunit, configured to determine whether a first adjacent node and a second adjacent node match, so as to obtain multiple matching adjacent nodes of a matching node pair.

[0189] A node pair traversing subunit, configured to traverse each matching node pair and matching adjacent node pair, so as to obtain an isomorphic subgraph.

[0190] In some alternative embodiments, the semantic slicing module 603 includes:

[0191] A function node slicing unit, configured to perform semantic slicing on a target function node in a first subgraph by using forward slicing, so as to obtain variables or parameters of the target function node.

[0192] A dependency analysis unit, configured to analyze the dependency relationships of variables or functions, and gradually expand the target slicing result until the dependency relationships no longer change, so as to obtain a slicing result of the target function node.

[0193] A slicing result confirmation unit, configured to form a first slicing result of the first subgraph with the slicing results of each target function node in the first subgraph.

[0194] In some alternative embodiments, the similarity calculation module 604 includes:

[0195] A similarity matrix construction unit, configured to construct a similarity matrix of each function in the first slicing result and each function in the corresponding second slicing result.

[0196] A Jaccard distance calculation unit, configured to determine the similarity between each function by calculating the Jaccard distance based on the similarity matrix, as the slicing similarity of each function.

[0197] A semantic similarity calculation unit, configured to calculate the semantic similarity of each matching function node in the target isomorphic subgraph according to the slicing similarity.

[0198] A source code similarity determination unit, configured to calculate the similarity of the target source code according to the semantic similarity in multiple target isomorphic subgraphs.

[0199] The further function descriptions of the above-mentioned various modules and units are the same as those in the corresponding foregoing embodiments, and will not be elaborated herein.

[0200] The program-level code similarity analysis device based on semantic slicing in this embodiment is presented in the form of functional units. Here, the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and a memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0201] An embodiment of the present invention further provides a computer device having the above-mentioned Figure 6 program-level code similarity analysis device based on semantic slicing as shown.

[0202] Please refer to Figure 7 , Figure 7 which is a schematic structural diagram of a computer device provided by an alternative embodiment of the present invention. As Figure 7 shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including a high-speed interface and a low-speed interface. Each component communicates with each other using different buses and can be installed on a common motherboard or installed in other ways as needed. The processor can process instructions executed within the computer device, including instructions stored in the memory or on the memory to display graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In some alternative embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a set of blade servers, or a multi-processor system). Figure 7 In

[0203] FIG., one processor 10 is taken as an example.

[0204] The processor 10 can be a central processing unit, a network processor, or a combination thereof. Among them, the processor 10 can further include a hardware chip. The above-mentioned hardware chip can be an application-specific integrated circuit, a programmable logic device, or a combination thereof. The above-mentioned programmable logic device can be a complex programmable logic device, a field programmable gate array, a general array logic, or any combination thereof.

[0204] Among them, the memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0205] The memory 20 can include a program storage area and a data storage area. Among them, the program storage area can store an operating system and application programs required for at least one function; the data storage area can store data created according to the use of the computer device. In addition, the memory 20 can include a high-speed random access memory and can also include a non-transitory memory, such as at least one disk storage device, a flash memory device, or other non-transitory solid-state storage devices. In some alternative embodiments, the memory 20 can optionally include a memory remotely set relative to the processor 10, and these remote memories can be connected to the computer device through a network. Examples of the above-mentioned network include but are not limited to the Internet, an enterprise intranet, a local area network, a mobile communication network, and combinations thereof.

[0206] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, a hard disk, or a solid state drive; the memory 20 may further include a combination of the above types of memory.

[0207] The computer device further includes a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0208] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations fall within the scope defined by the appended claims.

Claims

1. A program-level code similarity analysis method based on semantic slicing, characterized in that The method includes: Constructing a target function call graph at the program level based on the target source code; Matching the target function call graph with a standard function call graph to obtain multiple isomorphic subgraphs, where the isomorphic subgraphs include a first subgraph and a second subgraph; Performing semantic slicing on each function node in the first subgraph and the second subgraph respectively to obtain a first slicing result of the first subgraph and a second slicing result of the second subgraph; Evaluating the slicing similarity between the functions in the first slicing result and the functions in the second slicing result, and determining the similarity of the target source code according to the slicing similarity.

2. The method according to claim 1, characterized in that, Constructing a target function call graph at the program level based on the target source code, including: Parsing the target source code and screening out multiple custom functions included in the target source code; Analyzing the call positions and call relationships of the respective custom functions to construct a call relationship graph; Filtering out system functions in the call relationship graph, and optimizing and displaying the call relationship graph according to the remaining custom functions to obtain a function call graph.

3. The method according to claim 1, characterized in that Matching the target function call graph with a standard function call graph to obtain multiple isomorphic subgraphs, including: Taking any node in the target function call graph as a starting node, and sequentially matching all nodes with the nodes in the standard function call graph according to a preset matching criterion to obtain matching node pairs; Based on the matching node pairs, comparing the adjacent edges connected to the matching node pairs to obtain matching edge pairs; Determining an isomorphic subgraph based on the matching node pairs and the matching edge pairs, where the attributes of the nodes and edges in the first subgraph of the isomorphic subgraph correspond to and match the attributes of the nodes and edges in the second subgraph.

4. The method according to claim 3, characterized in that, Determining an isomorphic subgraph based on the matching node pairs and the matching edge pairs, including: Obtaining the matching node pairs to be processed, and synchronously expanding adjacent nodes thereof to obtain first adjacent nodes and second adjacent nodes; Judging whether the first adjacent nodes and the second adjacent nodes match to obtain multiple matching adjacent nodes of the matching node pairs; Traversing each matching node pair and matching adjacent node pair to obtain an isomorphic subgraph.

5. The method according to claim 4, wherein Judging whether the first adjacent nodes and the second adjacent nodes match to obtain multiple matching adjacent nodes of the matching node pairs, including: If the first adjacent nodes and the second adjacent nodes have been matched, forming matching adjacent nodes; If any node in the first adjacent nodes and the second adjacent nodes matches other nodes, or the first adjacent nodes do not conform to the preset matching criterion with the second adjacent nodes, reporting a matching conflict; If the first adjacent nodes and the second adjacent nodes are not matched, performing a matching judgment on the first adjacent nodes and the second adjacent nodes according to the preset matching criterion. If the first adjacent nodes and the second adjacent nodes match, forming matching adjacent nodes, otherwise reporting a matching conflict; If a matching conflict occurs, returning to the upper layer to reselect new matching node pairs until there is no matching conflict.

6. The method according to claim 1, characterized in that, Performing semantic slicing on each function node in the first subgraph to obtain a first slicing result of the first subgraph, including: Performing forward slicing on the target function nodes in the first subgraph to obtain variables or parameters of the target function nodes; Analyze the dependency relationships of the variables or functions, and gradually expand the target slice result until the dependency relationships no longer change, to obtain the slice result of the target function node; The slice results of each target function node in the first subgraph constitute the first slice result of the first subgraph.

7. The method according to claim 1, characterized in that, Evaluate the slice similarity of each function in the first slice result and each function in the second slice result, including: Construct a similarity matrix of each function in the first slice result and each corresponding function in the second slice result; Based on the similarity matrix, determine the similarity between each function by calculating the Jaccard distance, which is used as the slice similarity of each function.

8. The method according to claim 1, wherein Determine the similarity of the target source code according to the slice similarity, including: Calculate the semantic similarity of each matching function node in the target isomorphic subgraph according to the slice similarity; Calculate the similarity of the target source code according to the semantic similarity in multiple target isomorphic subgraphs.

9. A program-level code similarity analysis device based on semantic slicing, characterized in that The device includes: A function call graph construction module, configured to construct a program-level target function call graph based on the target source code; An isomorphic subgraph matching module, configured to match the target function call graph with a standard function call graph to obtain multiple isomorphic subgraphs, where the isomorphic subgraphs include a mutually matching first subgraph and a second subgraph; A semantic slicing module, configured to perform semantic slicing on each function node in the first subgraph and the second subgraph respectively to obtain a first slice result of the first subgraph and a second slice result of the second subgraph; A similarity calculation module, configured to evaluate the slice similarity of each function in the first slice result and each function in the second slice result, and determine the similarity of the target source code according to the slice similarity.

10. A computer device, characterized in that, Including: A memory and a processor, the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to execute the method according to any one of claims 1 to 8.

Images