Similarity analysis method and device for program-level codes

Abstract

The invention relates to the technical field of network security, and provides a similarity analysis method and device for program-level codes. The method comprises the steps of obtaining a first custom function call graph and a second custom function call graph according to codes of a first program and a second program; according to a calling chain of a single function unit, dividing the first custom function calling graph into a plurality of first sub-graphs, and dividing the second custom function calling graph into a plurality of second sub-graphs; when the similarity between the first root node of the first sub-graph and the second root node of the second sub-graph is greater than a similarity threshold value, determining the first sub-graph and the second sub-graph as a candidate sub-graph matching pair; for any candidate sub-graph matching pair, obtaining the similarity of the candidate sub-graph matching pair according to the number of matching nodes in the candidate sub-graph matching pair; and obtaining the code similarity of the first program and the second program according to the similarity of each candidate sub-graph matching pair. By adopting the method, the accuracy, the applicability and the processing efficiency of code similarity analysis can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, apparatus, computer device, computer-readable storage medium, and computer program product for program-level code similarity analysis. Background Art

[0002] With the rapid development of the software industry, cross-version software maintenance and updates have become commonplace. This version evolution inevitably involves code additions, deletions, refactoring, and optimization. This cross-version code evolution presents new challenges for software similarity analysis. Accurately identifying similar or related functions is a key issue, particularly when performing vulnerability detection and functional correlation analysis across versions of programs.

[0003] Traditional cross-version program-level code similarity analysis methods perform similarity analysis based on static text or syntax level comparison, or based on control flow graphs or data flow graphs.

[0004] However, similarity analysis methods based on static text or syntax-level comparisons struggle to effectively identify true connections between functions when function names, structures, or comments change, resulting in low code similarity analysis accuracy. Similarity analysis methods based on control flow graphs or data flow graphs are limited by program size and complexity and can typically only handle small-scale programs or simple function relationships. They struggle to be applied to large, complex software systems, resulting in low applicability and processing efficiency. Summary of the Invention

[0005] Based on this, it is necessary to provide a method, apparatus, computer device, computer-readable storage medium and computer program product for program-level code similarity analysis to address the above technical issues.

[0006] In a first aspect, the present application provides a method for similarity analysis of program-level codes, comprising:

[0007] Obtaining a corresponding first user-defined function call graph and a second user-defined function call graph according to the code of the first program and the code of the second program;

[0008] According to the call chain of a single functional unit, the first custom function call graph is divided into a plurality of first subgraphs, and the second custom function call graph is divided into a plurality of second subgraphs;

[0009] When the similarity between the first root node of the first subgraph and the second root node of the second subgraph is greater than a similarity threshold, determining the first subgraph and the second subgraph as a candidate subgraph matching pair;

[0010] For any candidate subgraph matching pair, obtain the similarity of the candidate subgraph matching pair according to the number of matching nodes in the candidate subgraph matching pair;

[0011] According to the similarity of each candidate subgraph matching pair, the code similarity between the first program and the second program is obtained.

[0012] In one embodiment, before obtaining the similarity of any candidate subgraph matching pair based on the number of matching nodes in the candidate subgraph matching pair, the method further includes:

[0013] Determine, using symbolic execution technology, whether the first node and the second node at the same level in any candidate subgraph matching pair are first-class matching nodes;

[0014] If the first node and the second node are not first-category matching nodes, determining whether the first node and the second node are second-category matching nodes according to an abstract interpretation algorithm;

[0015] The number of matching nodes in the candidate subgraph matching pairs is obtained according to the number of the first type of matching nodes and the number of the second type of matching nodes.

[0016] In one embodiment, determining whether the first node and the second node at the same level in any candidate subgraph matching pair are first-class matching nodes based on the symbolic execution technology includes:

[0017] For the first node of the same level in any candidate subgraph matching pair, symbolically execute the function corresponding to the first node to obtain a path condition set and an output set for each first node;

[0018] For the second node at the same level in any candidate subgraph matching pair, symbolically execute the function corresponding to the second node to obtain a path condition set and an output set for each second node;

[0019] When the path condition set of the first node is the same as the path condition set of the second node, and the output set of the first node is the same as the output set of the second node, the first node and the second node are determined to be first-type matching nodes.

[0020] In one embodiment, determining whether the first node and the second node are second-category matching nodes according to an abstract interpretation algorithm includes:

[0021] Obtaining, according to the abstract domain, a path condition set and an output set of the first node, and a path condition set and an output set of the second node;

[0022] When the path condition set of the first node includes the path condition set of the second node, and the output set of the first node includes the output set of the second node, the first node and the second node are determined to be second-type matching nodes.

[0023] In one embodiment, obtaining a corresponding first custom function call graph based on the code of the first program includes:

[0024] extracting the custom function from the code of the first program according to a static code analysis tool;

[0025] According to the abstract syntax tree, the calling location of each custom function is obtained, and the calling relationship of each custom function is recorded;

[0026] Constructing a preliminary first call relationship graph according to the call relationship of each defined function;

[0027] For each call relationship in the preliminary first call relationship graph, checking whether the called function is a system function;

[0028] When the called function is a system function, the calling relationship is deleted from the preliminary first calling relationship graph to obtain a checked preliminary first calling graph;

[0029] Each node in the checked preliminary first call graph is marked with function name, parameter and return value information, and each edge is marked with the type of call relationship to obtain a first custom function call graph.

[0030] In one embodiment, the first user-defined function call graph is divided into a plurality of first subgraphs according to the call chain of a single functional unit, including:

[0031] Determining a first root node of the first custom function call graph;

[0032] Starting from each first root node, traverse the child nodes reached by the first root node according to the breadth-first search algorithm;

[0033] A first subgraph is established based on the first root node and the child nodes reached by the first root node; the first subgraph includes each path starting from the first root node and the end node corresponding to the first root node.

[0034] In one embodiment, when the similarity between the first root node of the first subgraph and the second root node of the second subgraph is greater than a similarity threshold, before determining the first subgraph and the second subgraph as a candidate subgraph matching pair, the method further includes:

[0035] Extracting integer features, string features, interface features, and instruction features of the function corresponding to each first root node in the first subgraph to obtain a feature set of each first root node;

[0036] Extracting integer features, string features, interface features, and instruction features of the function corresponding to each second root node in the second subgraph to obtain a feature set of each second root node;

[0037] Obtaining the distance between the first root node and the second root node according to the feature set of each first root node and the feature set of each second root node;

[0038] The similarity between the first root node and the second root node is obtained according to the distance between the first root node and the second root node.

[0039] In one embodiment, obtaining the similarity of the candidate subgraph matching pairs according to the number of matching nodes in the candidate subgraph matching pairs includes:

[0040] Obtaining the total number of nodes in the candidate subgraph matching pairs;

[0041] The ratio of the number of matching nodes in the candidate subgraph matching pair to the total number of nodes is used as the similarity of the candidate subgraph matching pair.

[0042] In one embodiment, obtaining the code similarity between the first program and the second program based on the similarity of each candidate subgraph matching pair includes:

[0043] Get the total number of matching pairs of candidate subgraph matching pairs;

[0044] According to the similarity of each candidate subgraph matching pair, the sum of similarities is obtained;

[0045] The ratio of the sum of the similarities to the total number of matching pairs is used as the code similarity between the first program and the second program.

[0046] In a second aspect, the present application further provides a program-level code similarity analysis device, comprising:

[0047] A function call graph acquisition module, configured to obtain a corresponding first custom function call graph and a second custom function call graph according to the code of the first program and the code of the second program;

[0048] a subgraph acquisition module, configured to divide the first custom function call graph into a plurality of first subgraphs and the second custom function call graph into a plurality of second subgraphs according to a call chain of a single functional unit;

[0049] a candidate subgraph matching pair obtaining module, configured to determine the first subgraph and the second subgraph as a candidate subgraph matching pair when the similarity between the first root node of the first subgraph and the second root node of the second subgraph is greater than a similarity threshold;

[0050] A matching pair similarity acquisition module is used to obtain the similarity of any candidate subgraph matching pair according to the number of matching nodes in the candidate subgraph matching pair;

[0051] The code similarity acquisition module is used to obtain the code similarity between the first program and the second program according to the similarity of each candidate subgraph matching pair.

[0052] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program and the processor executes the above method.

[0053] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program is used by a processor to execute the above method.

[0054] In a fifth aspect, the present application further provides a computer program product, wherein the computer program product includes a computer program, and the computer program is executed by a processor to execute the above method.

[0055] The above-mentioned program-level code similarity analysis method, apparatus, computer device, computer-readable storage medium and computer program product obtain the corresponding first custom function call graph and second custom function call graph based on the code of the first program and the code of the second program; divide the first custom function call graph into a plurality of first subgraphs and the second custom function call graph into a plurality of second subgraphs according to the call chain of a single functional unit; when the similarity between the first root node of the first subgraph and the second root node of the second subgraph is greater than a similarity threshold, determine the first subgraph and the second subgraph as candidate subgraph matching pairs; for any candidate subgraph matching pair, obtain the similarity of the candidate subgraph matching pair based on the number of matching nodes in the candidate subgraph matching pair; and obtain the code similarity between the first program and the second program based on the similarity of each candidate subgraph matching pair. The present application obtains the corresponding first custom function call graph and second custom function call graph based on the code of the first program and the code of the second program, excludes the system function, avoids the noise interference caused by the system function, and improves the accuracy and processing efficiency of the code similarity analysis; divides the first custom function call graph into several first subgraphs and the second custom function call graph into several second subgraphs according to the call chain of a single functional unit, which can effectively separate the functional units in the first program and the second program, reduce the difficulty of program analysis, and improve the applicability and processing efficiency of the code similarity analysis; when the first root node of the first subgraph is the same as the second subgraph, the first root node of the second subgraph is the same as the first root node of the second subgraph. When the similarity between the second root nodes of the two subgraphs is greater than the similarity threshold, the first subgraph and the second subgraph are determined as candidate subgraph matching pairs, which can accurately measure the similarity between the root node and the subgraph, reduce the number of unnecessary matching times, improve the efficiency of subgraph matching, and thus improve the processing efficiency of code similarity analysis; for any candidate subgraph matching pair, the similarity of the candidate subgraph matching pair is obtained according to the number of matching nodes in the candidate subgraph matching pair; based on the similarity of each candidate subgraph matching pair, the code similarity between the first program and the second program is obtained, which can accurately identify the similarity between different programs and improve the accuracy of code similarity analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments of the present application or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0057] Figure 1 FIG. 1 is an application environment diagram of a program-level code similarity analysis method in one embodiment;

[0058] Figure 21 is a flow chart of a method for similarity analysis of program-level codes in one embodiment;

[0059] Figure 3 A schematic diagram of a mapping relationship between two subgraph nodes in one embodiment;

[0060] Figure 4 is a structural block diagram of a program-level code similarity analysis device in one embodiment;

[0061] Figure 5 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0063] The program-level code similarity analysis method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store data that server 104 needs to process. The data storage system can be integrated on server 104, or placed on a cloud or other network server. Terminal 102 can obtain the corresponding first and second custom function call graphs based on the code of the first and second programs to determine the code similarity between the first and second programs. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, smart car devices, projectors, etc. Portable wearable devices can include smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices can include virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. Server 104 can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server providing cloud computing services.

[0064] In an exemplary embodiment, Figure 2 As shown in the figure, a similarity analysis method for program-level code is provided. Figure 1 The terminal 102 in the example is used as an example to illustrate the process, including the following steps S201 to S205.

[0065] Step S201 : obtaining a corresponding first user-defined function call graph and a second user-defined function call graph according to the code of the first program and the code of the second program.

[0066] For ease of distinction, one of the two programs undergoing similarity analysis may be referred to as a first program, and the other program may be referred to as a second program.

[0067] The code of the first program and the code of the second program can be parsed to obtain the calling relationships between all functions in the first program and the second program. Then, based on a pre-defined system function library, the calling relationships related to system functions can be deleted from the calling relationships between all functions in the first program and the second program to obtain the calling relationships between all custom functions in the first program and the second program, thereby obtaining the first custom function call graph and the second custom function call graph. System functions refer to functions provided by the standard library of an operating system or programming language, such as common functions such as input / output operations, memory management, and string processing.

[0068] Step S202 : dividing the first user-defined function call graph into a plurality of first subgraphs and dividing the second user-defined function call graph into a plurality of second subgraphs according to the call chain of a single functional unit.

[0069] The function corresponding to the root node is a function without a parent node, and the function corresponding to the root node is usually used as the program entry or the entry function of the functional module.

[0070] All root nodes of the first custom function call graph may be identified as entry nodes of the functional units, and the first custom function call graph may be divided into a plurality of first subgraphs according to the call chain of a single functional unit.

[0071] All root nodes of the second custom function call graph may be identified as entry nodes of the functional units, and the second custom function call graph may be divided into a plurality of second subgraphs according to the call chain of a single functional unit.

[0072] Step S203 : When the similarity between the first root node of the first subgraph and the second root node of the second subgraph is greater than a similarity threshold, the first subgraph and the second subgraph are determined as a candidate subgraph matching pair.

[0073] The first root node of each first subgraph in the first program and the second root node of each second subgraph in the second program are used as matching targets, and the similarity between the first root node and the second root node is calculated. The similarity represents the code similarity between the function corresponding to the first root node and the function corresponding to the second root node.

[0074] When the similarity between the first root node of the first subgraph and the second root node of the second subgraph is greater than a similarity threshold, the probability that the first subgraph and the second subgraph are similar is greater than the similarity threshold, and the first subgraph and the second subgraph can be determined as a candidate subgraph matching pair. The similarity threshold can be set according to actual conditions.

[0075] Step S204 : For any candidate subgraph matching pair, obtain the similarity of the candidate subgraph matching pair according to the number of matching nodes in the candidate subgraph matching pair.

[0076] After obtaining the candidate subgraph matching pairs, the next step is to perform node similarity matching on the first subgraph and the second subgraph in each candidate subgraph matching pair.

[0077] To reduce the matching scope and improve matching efficiency, similarity matching can be performed on nodes in the first and second subgraphs based on the different levels to which the nodes belong. The level to which a node belongs can be determined based on its distance from the root node.

[0078] For any candidate subgraph matching pair, the first subgraph and the second subgraph in the candidate subgraph matching pair can be similarly matched based on the symbolic execution technology and the abstract interpretation algorithm to determine the number of matching nodes in the candidate subgraph matching pair.

[0079] The similarity of the candidate subgraph matching pair may be obtained according to the number of matching nodes in the candidate subgraph matching pair and the total number of nodes included in the first subgraph and the second subgraph in the candidate subgraph matching pair.

[0080] Step S205 : Obtaining the code similarity between the first program and the second program based on the similarity of each candidate subgraph matching pair.

[0081] The average similarity of the candidate subgraph matching pairs can be obtained based on the similarity of each candidate subgraph matching pair and the total number of matching pairs of the candidate subgraph matching pairs; the average similarity of the candidate subgraph matching pairs can be used as the code similarity between the first program and the second program.

[0082] In the above-mentioned program-level code similarity analysis method, the corresponding first custom function call graph and second custom function call graph are obtained according to the code of the first program and the code of the second program, and the system function is excluded, which can avoid the noise interference caused by the system function and improve the accuracy and processing efficiency of the code similarity analysis; according to the call chain of a single functional unit, the first custom function call graph is divided into several first subgraphs, and the second custom function call graph is divided into several second subgraphs, which can effectively separate the functional units in the first program and the second program, reduce the difficulty of program analysis, and improve the applicability and processing efficiency of code similarity analysis; when the first subgraph When the similarity between the first root node and the second root node of the second subgraph is greater than the similarity threshold, the first subgraph and the second subgraph are determined as candidate subgraph matching pairs, which can accurately measure the similarity between the root node and the subgraph, reduce the number of unnecessary matching times, improve the efficiency of subgraph matching, and thus improve the processing efficiency of code similarity analysis; for any candidate subgraph matching pair, the similarity of the candidate subgraph matching pair is obtained according to the number of matching nodes in the candidate subgraph matching pair; according to the similarity of each candidate subgraph matching pair, the code similarity between the first program and the second program is obtained, which can accurately identify the similarity between different programs and improve the accuracy of code similarity analysis.

[0083] In one of the embodiments, before obtaining the similarity of any candidate subgraph matching pair based on the number of matching nodes in the candidate subgraph matching pair, the method provided by the present application also includes: determining whether the first node and the second node at the same level in any candidate subgraph matching pair are first-class matching nodes based on symbolic execution technology; if the first node and the second node are not first-class matching nodes, determining whether the first node and the second node are second-class matching nodes based on the abstract interpretation algorithm; and obtaining the number of matching nodes in the candidate subgraph matching pair based on the number of first-class matching nodes and the number of second-class matching nodes.

[0084] After obtaining the candidate subgraph matching pairs, the next step is to perform node similarity matching on the first subgraph and the second subgraph in each candidate subgraph matching pair.

[0085] In order to reduce the matching scope and improve the matching efficiency, similarity matching of nodes in the first subgraph and the second subgraph can be performed based on the different levels to which the nodes belong.

[0086] The level to which a node belongs can be determined based on its distance from the root node. Figure 3 As shown, the left node and nodes Belong to the first layer, nodes and nodes Belong to the second layer, nodes Belongs to layer 3. To cope with the scenario where the same function is split into multiple functions, when a function is included in another function, the matching level range can be expanded to other nodes at the same level and sub-nodes of the next level.

[0087] In order to improve the matching efficiency and matching accuracy, a hierarchical matching strategy can be adopted to perform node similarity matching on the first subgraph and the second subgraph in each candidate subgraph matching pair.

[0088] Symbolic execution is a program analysis technique that treats input variables as symbols rather than concrete values, traversing different execution paths of a program and generating path conditions and output expressions. Abstract interpretation algorithms are program analysis methods that aim to perform approximate analysis by simplifying program behavior. Abstract interpretation algorithms define abstract domains to represent approximate information about a program's path conditions and outputs.

[0089] Based on symbolic execution technology, precise path conditions and output result analysis can be performed on the functions corresponding to the first node and the second node at the same level in any candidate subgraph matching pair to determine whether the first node and the second node at the same level in any candidate subgraph matching pair are first-class matching nodes; if the first node and the second node are not first-class matching nodes, the abstract path conditions and abstract outputs of the functions corresponding to the first node and the second node at the same level in any candidate subgraph matching pair are obtained according to the abstract interpretation algorithm, and analyzed to determine whether the first node and the second node are second-class matching nodes.

[0090] The number of matching nodes in the candidate subgraph matching pair can be obtained according to the number of first-category matching nodes and the number of second-category matching nodes in the candidate subgraph matching pair.

[0091] In this embodiment, symbolic execution technology can be used to determine whether the first and second nodes at the same level in any candidate subgraph matching pair are first-class matching nodes. If they are not first-class matching nodes, an abstract interpretation algorithm is then used to determine whether they are second-class matching nodes. Based on the number of first-class matching nodes and the number of second-class matching nodes, the number of matching nodes in the candidate subgraph matching pair is obtained. This can reduce the possibility of missing matching nodes and maintain high matching accuracy.

[0092] In one embodiment, based on the symbolic execution technology, whether the first node and the second node at the same level in any candidate subgraph matching pair are first-class matching nodes is determined, and the specific steps are as follows: for the first node at the same level in any candidate subgraph matching pair, the function corresponding to the first node is symbolically executed to obtain the path condition set and output set of each first node; for the second node at the same level in any candidate subgraph matching pair, the function corresponding to the second node is symbolically executed to obtain the path condition set and output set of each second node; when the path condition set of the first node and the path condition set of the second node are the same, and the output set of the first node and the output set of the second node are the same, the first node and the second node are determined to be first-class matching nodes.

[0093] For example, for the first node A at the same level in any candidate subgraph matching pair, the function corresponding to the first node A is symbolically executed to obtain the path condition set and output set of the first node A. The specific steps are as follows: initialize the symbolic variable of the function corresponding to the first node A to represent the input; traverse each branch and loop of the function corresponding to the first node A, record the conditions and corresponding outputs of different execution paths; generate a complete path condition set and output collection .

[0094] For the second node B at the same level in any candidate subgraph matching pair, symbolic execution is performed on the function corresponding to the second node B to obtain the path condition set and output set of the second node B. The specific steps are as follows: Initialize the symbolic variable of the function corresponding to the second node B to represent the input; traverse each branch and loop of the function corresponding to the second node B, record the conditions and corresponding outputs of different execution paths; generate a complete path condition set and output collection .

[0095] The path condition set and the output set of the first node A and the second node B are compared to check whether there is a completely consistent matching relationship.

[0096] When the path condition set of the first node A and the path condition set of the second node B The same, and the output set of the first node A and the output set of the second node B If they are the same, the first node A and the second node B meet the matching condition: A≡B. It can be determined that the first node A and the second node B match, and the first node A and the second node B are first-type matching nodes.

[0097] In this embodiment, for the first node and the second node of the same level in any candidate subgraph matching pair, the functions corresponding to the first node and the second node are symbolically executed to obtain the path condition set and output set of each first node and each second node; when the path condition set of the first node and the path condition set of the second node are the same, and the output set of the first node and the output set of the second node are the same, the first node and the second node are determined to be first-type matching nodes, and whether the first node and the second node are first-type matching nodes can be quickly and accurately determined.

[0098] In one embodiment, according to the abstract interpretation algorithm, whether the first node and the second node are second-type matching nodes is determined, and the specific steps are as follows: according to the abstract domain, the path condition set and output set of the first node, as well as the path condition set and output set of the second node are obtained; when the path condition set of the first node contains the path condition set of the second node, and the output set of the first node contains the output set of the second node, it is determined that the first node and the second node are second-type matching nodes.

[0099] For example, the path condition set of the function corresponding to the first node A can be obtained according to an abstract domain, such as an interval or a symbol range. and output collection , and the path condition set of the function corresponding to the second node B and output collection ; Among them, the path condition set and output set represent the summary information of the function behavior.

[0100] To determine whether the behavior of the function corresponding to the first node A is included in the function corresponding to the second node B, you can check each path condition and output of the function corresponding to the first node A and the function corresponding to the second node B, determine whether the path condition of the function corresponding to the first node A can be found to be covered by the path condition of the function corresponding to the second node B, and determine whether the output of the function corresponding to the first node A can be found to be covered by the output of the function corresponding to the second node B.

[0101] When the path condition set of the first node A The path condition set of the second node B Cover, and the output set of the first node A The output set of the second node B When covering, the first node A and the second node B meet the inclusion condition: , it can be determined that the first node A and the second node B match, and the first node A and the second node B are second-type matching nodes.

[0102] When the function corresponding to the first node A is included in the function corresponding to the second node B, it is further determined whether the function corresponding to the first node A, its peer node functions, and its child node functions are included in the function corresponding to the second node B. If included, the function corresponding to the first node A and the related multiple function pairs match the function corresponding to the second node B.

[0103] The mapping diagram of the matching relationship between the two subgraph nodes is as follows Figure 3 As shown, the node With node Matching alone, nodes and nodes Both are contained in the node , so the union of the first two matches the latter, node Contains nodes and nodes , the former matches the union of the latter two.

[0104] In this embodiment, based on the abstract domain, the path condition set and output set of the first node, as well as the path condition set and output set of the second node are obtained; when the path condition set of the first node contains the path condition set of the second node, and the output set of the first node contains the output set of the second node, the first node and the second node are determined to be second-type matching nodes, which can reduce the omission of matching nodes and maintain a high matching accuracy.

[0105] In one embodiment, a corresponding first custom function call graph is obtained based on the code of the first program, and the specific steps are as follows: according to the static code analysis tool, the custom function is extracted from the code of the first program; according to the abstract syntax tree, the call location of each custom function is obtained, and the call relationship of each custom function is recorded; according to the call relationship of each custom function, a preliminary first call relationship graph is constructed; for each call relationship in the preliminary first call relationship graph, whether the called function is a system function is checked; when the called function is a system function, the call relationship is deleted from the preliminary first call relationship graph to obtain the checked preliminary first call graph; each node in the checked preliminary first call graph is marked with the function name, parameters and return value information, and the type of the call relationship is marked for each edge to obtain the first custom function call graph.

[0106] The name, parameters, and return value type of the custom function can be extracted from the code of the first program using a static code analysis tool.

[0107] Based on the Abstract Syntax Tree (AST), the calling location of each custom function can be obtained, and the calling relationship of each custom function can be recorded. The calling relationship includes the relationship between the calling function and the called function.

[0108] A preliminary first call relationship graph can be constructed based on the call relationship of each defined function; for each call relationship in the preliminary first call relationship graph, it can be checked whether the called function is a system function based on a pre-defined system function library.

[0109] When the called function is a system function, the calling relationship is deleted from the preliminary first calling relationship graph to obtain the checked preliminary first calling graph; each node in the checked preliminary first calling graph is marked with the function name, parameters and return value information, and the type of calling relationship is marked for each edge to obtain the first custom function calling graph.

[0110] In this embodiment, custom functions are extracted from the code of the first program using a static code analysis tool; the call locations of each custom function are obtained based on the abstract syntax tree, and the call relationships of each custom function are recorded to construct a preliminary first call relationship graph; call relationships related to system functions are deleted from the preliminary first call relationship graph to obtain a pre-checked preliminary first call graph; each node in the pre-checked preliminary first call graph is labeled with function name, parameters, and return value information, and each edge is labeled with the type of call relationship to obtain a first custom function call graph. The first custom function call graph includes the call relationships between each custom function in the first program while excluding interference from system functions, which can improve the accuracy and processing efficiency of code similarity analysis.

[0111] In one embodiment, the first custom function call graph is divided into several first subgraphs according to the call chain of a single functional unit, and the specific steps are as follows: determining the first root node of the first custom function call graph; taking each first root node as the starting point, traversing the child nodes reached by the first root node according to the breadth-first search algorithm; establishing a first subgraph based on the first root node and the child nodes reached by the first root node; the first subgraph includes each path starting from the first root node and the end node corresponding to the first root node.

[0112] A node without a parent node is considered a root node. The function corresponding to the root node is a function without a parent node. The function corresponding to the root node is usually used as the program entry or the entry function of a functional module.

[0113] The topology of the first custom function call graph can be used to traverse all nodes. Any node without an incoming edge is considered the first root node. Starting from each first root node, a breadth-first search (BFS) algorithm is used to traverse the child nodes reached by the first root node. This process ensures that all relevant functions of each functional unit (functional module) are covered in a subgraph. During each traversal, a first subgraph is established based on the first root node and the child nodes reached by the first root node. The first subgraph contains every path starting from the first root node and the corresponding endpoint node of the first root node. After the first subgraph is partitioned, each first subgraph can be stored separately. The nodes of each first subgraph represent custom functions, and its edges represent the call relationships between functions.

[0114] For nodes involved in multiple first subgraphs simultaneously, that is, certain functions are called by different functional modules, these cross-nodes must be retained in each involved first subgraph to ensure graph integrity and analysis consistency. For these cross-nodes, their source is marked in each first subgraph, and the multiple upstream call relationships of the node are recorded.

[0115] In this embodiment, taking each first root node in the first custom function call graph as the starting point, the child nodes reached by the first root node are traversed according to the breadth-first search algorithm; based on the first root node and the child nodes reached by the first root node, a first subgraph of the call chain including a single functional unit is established.

[0116] In one embodiment, when the similarity between the first root node of the first subgraph and the second root node of the second subgraph is greater than a similarity threshold, before determining the first subgraph and the second subgraph as a candidate subgraph matching pair, the method provided by the present application also includes: extracting the integer features, string features, interface features and instruction features of the functions corresponding to each first root node in the first subgraph to obtain a feature set of each first root node; extracting the integer features, string features, interface features and instruction features of the functions corresponding to each second root node in the second subgraph to obtain a feature set of each second root node; obtaining the distance between the first root node and the second root node based on the feature set of each first root node and the feature set of each second root node; and obtaining the similarity between the first root node and the second root node based on the distance between the first root node and the second root node.

[0117] The integer features, string features, interface (API) features, and instruction features of the functions corresponding to each first root node in the first subgraph can be extracted as the feature set of each first root node. Integer features represent integer, long, floating-point, and double-precision values with constant values; string features represent referenced constant strings; interface features represent the system and third-party application programming interface calls involved; and instruction features represent the number of involved instructions, such as judgment, jump, and return.

[0118] The integer features, string features, interface features, and instruction features of the function corresponding to each second root node in the second subgraph may be extracted as the feature sets of each second root node.

[0119] The distance between the first root node and the second root node can be obtained according to the feature set of each first root node and the feature set of each second root node. The distance between the first root node and the second root node can be the Jaccard distance. The calculation formula of the Jaccard distance is shown in formula (1).

[0120] (1)

[0121] Among them, M represents the feature set of the first root node, N represents the feature set of the second root node, Represents the size of the intersection between feature sets M and N (the number of common features). represents the union size of feature set M and feature set N (the total number of all unique features), Represents the Jaccard distance between the feature set of the first root node and the feature set of the second root node.

[0122] The Jaccard distance between the feature set of the first root node and the feature set of the second root node may be used as the Jaccard distance between the first root node and the second root node.

[0123] Jaccard distance can be used to measure the difference between two feature sets. The smaller the Jaccard distance, the higher the similarity. Therefore, the formula for the similarity between the first root node and the second root node is as shown in formula (2).

[0124] (2)

[0125] Formula (2) represents the similarity ratio between two root nodes. The closer the value is to 1, the more similar the functions corresponding to the root nodes are. Represents the similarity between the first root node A and the second root node B, Represents the Jaccard distance between the first root node A and the second root node B.

[0126] In this embodiment, integer features, string features, interface features, and instruction features of the functions corresponding to each first root node in the first subgraph and each second root node in the second subgraph are extracted to obtain feature sets of each first root node and each second root node to obtain the distance between the first root node and the second root node; based on the distance between the first root node and the second root node, a more accurate similarity between the first root node and the second root node is obtained.

[0127] In one embodiment, the similarity of the candidate subgraph matching pair is obtained based on the number of matching nodes in the candidate subgraph matching pair. The specific steps are as follows: obtaining the total number of nodes in the candidate subgraph matching pair; and taking the ratio of the number of matching nodes in the candidate subgraph matching pair to the total number of nodes as the similarity of the candidate subgraph matching pair.

[0128] The total number of nodes in the candidate subgraph matching pair can be obtained according to the number of nodes in the first subgraph and the number of nodes in the second subgraph in the candidate subgraph matching pair.

[0129] The ratio of the number of matching nodes in the candidate subgraph matching pair to the total number of nodes is used as the similarity of the candidate subgraph matching pair, as shown in Formula (3). The similarity of the candidate subgraph matching pair is the similarity between the first subgraph and the second subgraph.

[0130] (3)

[0131] in, Represents the similarity between the first subgraph q and the second subgraph t, NumberOfEquivalentFunction represents the number of matching nodes in the candidate subgraph matching pair, q represents the first subgraph in the candidate subgraph matching pair, and t represents the second subgraph in the candidate subgraph matching pair. It represents the total number of nodes in the first subgraph q and the second subgraph t, that is, the total number of nodes in the candidate subgraph matching pairs.

[0132] In this embodiment, the ratio of the number of matching nodes in the candidate subgraph matching pair to the total number of nodes is used as the similarity of the candidate subgraph matching pair, so that a more accurate similarity of the candidate subgraph matching pair can be obtained.

[0133] In one embodiment, the code similarity between the first program and the second program is obtained based on the similarity of each candidate subgraph matching pair, and the specific steps are as follows: obtaining the total number of matching pairs of the candidate subgraph matching pairs; obtaining the sum of similarities based on the similarity of each candidate subgraph matching pair; and taking the ratio of the sum of similarities to the total number of matching pairs as the code similarity between the first program and the second program.

[0134] The number of candidate subgraph matching pairs can be taken as the total number of matching pairs.

[0135] The similarities of all candidate subgraph matching pairs can be added together to obtain the total similarity.

[0136] The ratio of the sum of similarities to the total number of matching pairs, that is, the average similarity of the candidate subgraph matching pairs, can be used as the code similarity between the first program and the second program, as shown in Formula (4).

[0137] (4)

[0138] in, Indicates the first program and the second program The code similarity between represents the sum of similarities, Represents the total number of matching pairs.

[0139] In this embodiment, the sum of similarities is obtained based on the similarity of each candidate subgraph matching pair; the ratio of the sum of similarities to the total number of matching pairs is used as the code similarity between the first program and the second program, so that a more accurate code similarity between the first program and the second program can be obtained.

[0140] In order to better understand the above method, an application example of the program-level code similarity analysis method of the present application is described in detail below.

[0141] With the rapid development of the software industry, cross-version software maintenance and updates have become commonplace. This process of version evolution inevitably involves code additions, deletions, refactoring, and optimization. This cross-version code evolution presents new challenges for software similarity (also known as homology) analysis. Accurately identifying similar or related functions is a key issue, particularly when conducting vulnerability detection and functional correlation analysis across versions of programs.

[0142] Traditional cross-version program-level code similarity analysis methods rely on static text or syntax-level comparisons. This method struggles to effectively identify true relationships between functions when function names, structures, or comments change. To analyze cross-version functions, some studies have introduced similarity analysis based on control flow graphs or data flow graphs, attempting to establish a mapping of cross-version functions by similarity in program execution paths. However, this method is limited by program size and complexity and can typically only handle small-scale programs or simple function relationships, making it difficult to apply to large, complex software systems.

[0143] In the fields of software engineering and software security, accurate cross-version function correlation not only helps identify the evolution of vulnerabilities but also provides a reference for functional expansion, optimization, and maintenance of new software versions. For example, by identifying identical or similar functions across versions, it is possible to effectively analyze which functional modules are reused or expanded and assess their impact on system security. Therefore, developing a program-level code similarity analysis method that can effectively analyze the correlation between cross-version functions can help software engineers better understand the program evolution process and provide important support for code security detection, vulnerability remediation, and functional migration.

[0144] This example builds on existing methods for program-level code similarity analysis by procedural matching. This method, a cross-version function association mechanism, uses a multi-step matching strategy to gradually establish precise mappings between functions, making it particularly suitable for cross-version code analysis. This method effectively addresses analysis challenges arising from function name changes, code refactoring, and program logic changes, ensuring more accurate code similarity analysis across different versions.

[0145] A program-level code similarity analysis method based on progressive matching mainly includes the following steps:

[0146] Step 1: Build a custom function call graph at the program level;

[0147] Step 2: Function-oriented subgraph cutting;

[0148] Step 3: Construct candidate subgraph matching pairs;

[0149] Step 4: Using the subgraph matching algorithm based on hierarchical matching idea;

[0150] Step 5: Similarity calculation.

[0151] The purpose of this embodiment is to provide a program-level code similarity analysis method based on progressive matching, which can establish an accurate mapping relationship for all functions of the two programs while determining the code similarity between the two programs. By introducing a custom function call graph and function-oriented subgraph cutting technology, the accuracy of similarity analysis can be effectively improved. By constructing candidate subgraph matching pairs and introducing symbolic execution technology and abstract interpretation algorithms, the behavioral characteristics of internal functions of the program can be deeply analyzed while ensuring efficiency, solving the problems of insufficient accuracy and low efficiency of complex code similarity detection faced by traditional technologies.

[0152] Specifically, the program-level code similarity analysis method provided in this embodiment constructs a custom function call graph at the program level, analyzes the call relationship between the various functions within the program, and divides the program into multiple functional modules through a function-oriented subgraph cutting method. At the same time, based on a progressive matching algorithm, candidate subgraph matching pairs are constructed, and multi-level matching is performed on the functions in the subgraphs to establish an accurate mapping relationship between all custom functions in the two programs. By combining symbolic execution with abstract interpretation, the inclusion relationship of functions can be effectively determined, further improving the accuracy and comprehensiveness of code similarity analysis.

[0153] In summary, the program-level code similarity analysis method provided in this embodiment can improve analysis efficiency and reduce false positives and negatives in large-scale software code comparisons, and is suitable for code homology detection, plagiarism detection, and malware analysis of complex software.

[0154] Step 1: Build a custom function call graph at the program level:

[0155] After obtaining the code for the first program (or the first project) and the second program (or the second project) to be analyzed, the first and second program-level custom function call graphs are constructed. The first custom function call graph contains the call relationships between all custom functions in the first program, and the second custom function call graph contains the call relationships between all custom functions in the second program. The first and second custom function call graphs eliminate interference from system functions, facilitating subsequent in-depth analysis. Step 1 primarily includes the following specific steps:

[0156] Step 1.1, source code analysis:

[0157] Use static code analysis tools to read the source code of the first and second programs and extract the names, parameters, and return types of all custom functions in the first and second programs. Identify the scope of all functions and ensure that only custom functions in the current program are captured, excluding standard library functions provided by the system.

[0158] Step 1.2, call relationship extraction:

[0159] In the source code of the first and second programs, the call location of each custom function in the first and second programs can be obtained based on the Abstract Syntax Tree (AST). Whenever a function call is found, the relationship between the calling function and the called function is recorded. A preliminary first call relationship graph can be constructed based on the call relationship of each custom function in the first program; a preliminary second call relationship graph can be constructed based on the call relationship of each custom function in the second program; the preliminary first call relationship graph includes each custom function in the first program and other custom functions it calls; the preliminary second call relationship graph includes each custom function in the second program and other custom functions it calls.

[0160] Step 1.3, filter system function:

[0161] For each recorded call relationship in the first program, check whether the called function is a system function. This can be done using a predefined system function library. If so, exclude the called function from the preliminary first call relationship graph to obtain a checked preliminary first call graph. After checking, only the call relationships between user-defined functions are retained in the preliminary first call relationship graph.

[0162] For each recorded call relationship in the second program, check whether the called function is a system function. This can be done by comparing it with a predefined system function library. If so, exclude the call relationship from the preliminary second call relationship graph, resulting in a checked preliminary second call relationship graph. After checking, the preliminary second call relationship graph only retains the call relationships between user-defined functions.

[0163] Step 1.4, call graph generation:

[0164] A directed graph representation can be used to display the call relationships between custom functions. Each node in the preliminary first call graph after inspection is labeled with the function name, parameters, and return value information, and each edge is labeled with the type of call relationship to obtain the first custom function call graph. Each node in the preliminary second call graph after inspection is labeled with the function name, parameters, and return value information, and each edge is labeled with the type of call relationship to obtain the second custom function call graph.

[0165] Step 2: Function-oriented subgraph cutting:

[0166] In software programs involving front-end and back-end, different routes are often set to access different functional units, and different functional units represent different event types that need to be processed during runtime. Therefore, after constructing a custom function call graph at the program level, this embodiment further proposes a function-oriented subgraph cutting method to divide the overall call graph of the program into multiple subgraphs according to functional modules. Each subgraph represents the call chain of a functional unit. The specific division steps are as follows:

[0167] Step 2.1, root node identification:

[0168] For the entire first custom function call graph, first identify all first root nodes. Root nodes correspond to functions without parent nodes, typically serving as program entry points or entry points to functional modules. Using the topological structure of the first custom function call graph, all nodes are traversed; any node without an incoming edge is considered a first root node.

[0169] For the entire second custom function call graph, first identify all second root nodes. Root nodes correspond to functions without parent nodes, typically serving as program entry points or entry points to functional modules. Using the topology of the second custom function call graph, all nodes can be traversed; any node without an incoming edge is a second root node.

[0170] Step 2.2, subgraph construction:

[0171] Starting from each first root node, a breadth-first search (BFS) algorithm is used to traverse all reachable child nodes of the first root node. This process ensures that all relevant functions of each functional module are covered in a subgraph. During each traversal, a first subgraph is created, which contains every path starting from the first root node and the corresponding endpoint node of the first root node.

[0172] Starting from each second root node, a breadth-first search (BFS) algorithm is used to traverse all reachable child nodes of the second root node. This process ensures that all relevant functions of each functional module are covered in a subgraph. During each traversal, a second subgraph is created, which contains every path starting from the second root node and the corresponding endpoint node of the second root node.

[0173] Step 2.3, cross-node processing:

[0174] For nodes involved in multiple first subgraphs and second subgraphs at the same time, that is, certain functions are called by different functional modules, these cross-nodes must be retained in each involved first subgraph and second subgraph to ensure the integrity of the graph and the coherence of the analysis.

[0175] For these intersection nodes, their sources are marked in each first subgraph and second subgraph, and multiple upstream call relationships of the node are recorded.

[0176] Step 2.4, save the sub-image:

[0177] After the first subgraph and the second subgraph are divided, each of the first subgraph and the second subgraph is stored separately. The nodes of each of the first subgraph and the second subgraph represent user-defined functions, and the edges thereof represent call relationships between the functions.

[0178] Step 3: Construct candidate subgraph matching pairs:

[0179] To optimize the many-to-many subgraph matching strategy, this embodiment uses a progressive association algorithm, which consists of two main steps: the first is to construct candidate subgraph matching pairs, and the second is subgraph matching. The main purpose of constructing candidate subgraph matching pairs is to pair potentially similar subgraphs before proceeding to the next step of subgraph matching. This approach can effectively reduce the number of subgraph matching attempts.

[0180] To construct candidate subgraph matching pairs, this embodiment primarily considers the root nodes in each first subgraph and each second subgraph in the two programs as matching targets, calculating the similarity of these root nodes for partitioning. Different root nodes represent different entry points. If the code of two entry points is similar, it indicates that the two subgraphs may require further analysis.

[0181] In this step, this embodiment uses the Hungarian algorithm to determine the association results of candidate subgraph matching pairs. It mainly searches for the optimal root node matching result by maximizing the sum of node similarities. Here, node similarity mainly represents the code similarity between the functions represented by the root node.

[0182] In this embodiment, four types of features are mainly extracted to evaluate the similarity between the functions corresponding to the nodes, including integer features, string features, interface (Application Programming Interface, API) features, and instruction features. Among them, integer features represent integer, long integer, floating point, and double precision values with constant values; string features represent referenced constant strings; interface features represent the system and third-party application programming interface calls involved; instruction features represent the number of instructions involved, such as judgment, jump, and return;

[0183] Afterwards, this embodiment chooses to calculate the Jaccard distance to measure the feature differences between the functions corresponding to the nodes, and uses this as the similarity between the nodes.

[0184] The calculation formula of Jaccard distance is shown in formula (1).

[0185] (1)

[0186] Among them, M represents the feature set of the first root node, N represents the feature set of the second root node, Represents the size of the intersection between feature sets M and N (the number of common features). represents the union size of feature set M and feature set N (the total number of all unique features), Represents the Jaccard distance between the feature set of the first root node and the feature set of the second root node.

[0187] The Jaccard distance between the feature set of the first root node and the feature set of the second root node may be used as the Jaccard distance between the first root node and the second root node.

[0188] Jaccard distance can be used to measure the difference between two feature sets. The smaller the Jaccard distance, the higher the similarity. Therefore, the formula for the similarity between the first root node and the second root node is as shown in formula (2).

[0189] (2)

[0190] Formula (2) represents the similarity ratio between two root nodes. The closer the value is to 1, the more similar the functions corresponding to the root nodes are. Represents the similarity between the first root node A and the second root node B, Represents the Jaccard distance between the first root node A and the second root node B.

[0191] Step 4: Subgraph matching algorithm using hierarchical matching idea:

[0192] After the candidate subgraph matching pairs are constructed, the next step is to match similar nodes in the candidate subgraph matching pairs. There are a large number of nodes in the first subgraph and the second subgraph, and the matching of these nodes is also a many-to-many matching form. In order to further reduce the matching range and improve the matching efficiency, this embodiment considers matching based on the different levels to which the nodes belong. The level to which the nodes belong is based on the distance of the node from the root node. Figure 3 As shown, the node on the left and nodes Belong to the first layer, nodes and nodes Belong to the second layer, nodes Belongs to the 3rd layer.

[0193] Furthermore, to address scenarios where the same function is split into multiple functions, when a function is contained within another function, the matching hierarchy can be scaled to include other nodes at the same level and subnodes at the next level. To achieve the matching of similar nodes in the candidate subgraph matching pairs, this embodiment uses a function matching and inclusion relationship judgment algorithm based on symbolic execution and abstract interpretation. The specific algorithm steps are as follows:

[0194] (1) Symbolic execution:

[0195] Perform symbolic execution on the function corresponding to the first node A and the second node B to generate their respective path condition sets and output expressions. The specific steps include:

[0196] 1) Initialize the symbolic variables of the function corresponding to the first node A and the function corresponding to the second node B to represent the input.

[0197] 2) Traverse each branch and loop of the function corresponding to the first node A and the function corresponding to the second node B, and record the conditions and corresponding outputs of different execution paths.

[0198] 3) Generate a complete set of path conditions for the function corresponding to the first node A , the complete path condition set of the function corresponding to the second node B , the output set of the function corresponding to the first node A The output set of the function corresponding to the second node B .

[0199] (2) Matching relationship determination:

[0200] Compare the path condition set and output set of the first node A and the second node B to check whether there is a completely consistent matching relationship:

[0201]

[0202] If all and , making , then the matching result is returned as true. That is, when the path condition set of the first node A and the path condition set of the second node B The same, and the output set of the first node A and the output set of the second node B If they are the same, the matching result is true, and it can be determined that the first node A and the second node B match, and the first node A and the second node B are first-class matching nodes. Indicates the first node A Path conditions, Indicates the first Path conditions, Indicates the first node A outputs, Indicates the first outputs.

[0203] (3) Abstract interpretation:

[0204] If symbolic execution fails to find a match, the function corresponding to the first node A and the function corresponding to the second node B are abstractly interpreted to generate abstract path conditions and abstract outputs, which represent summary information of the function behavior. The specific steps include:

[0205] 1) Define abstract domains (such as intervals, symbol ranges, etc.) to represent path conditions and output approximations.

[0206] 2) The path condition set of the function corresponding to the first node A and output collection , and the path condition set of the function corresponding to the second node B and output collection .

[0207] (4) Inclusion relationship determination:

[0208] Determine whether the behavior of the function corresponding to the first node A is included in the function corresponding to the second node B. Set the inclusion condition:

[0209]

[0210] Check each path condition and output to determine whether A's path condition can be found in B's path condition. The output is the same.

[0211] The specific implementation is that if there are all and , making , then the return contains the result true. That is, when the path condition set of the first node A The path condition set of the second node B Cover, and the output set of the first node A The output set of the second node B When covering, the inclusion result is true, and it can be determined that the first node A and the second node B match, and the first node A and the second node B are second-type matching nodes.

[0212] When the function corresponding to the first node A is included in the function corresponding to the second node B, it is further determined whether the function corresponding to the first node A, its peer node functions, and its child node functions are included in the function corresponding to the second node B. If included, the function corresponding to the first node A and the related multiple function pairs match the function corresponding to the second node B.

[0213] The mapping diagram of the matching relationship between the two subgraph nodes is as follows Figure 3 As shown, the node With node Matching alone, nodes and nodes Both are contained in the node , so the union of the first two matches the latter, node Contains nodes and nodes , the former matches the union of the latter two.

[0214] Step 5: Similarity calculation:

[0215] Step 5.1, subgraph similarity calculation:

[0216] The number of matching nodes in each candidate subgraph matching pair is counted and expressed as NumberOfEquivalentFunction. The similarity of the candidate subgraph matching pair, that is, the similarity between the first subgraph and the second subgraph, is shown in Equation (3).

[0217] (3)

[0218] in, Represents the similarity between the first subgraph q and the second subgraph t, NumberOfEquivalentFunction represents the number of matching nodes in the candidate subgraph matching pair, q represents the first subgraph in the candidate subgraph matching pair, and t represents the second subgraph in the candidate subgraph matching pair. It represents the total number of nodes in the first subgraph q and the second subgraph t, that is, the total number of nodes in the candidate subgraph matching pairs.

[0219] Step 5.2, program similarity calculation:

[0220] The similarity of all candidate subgraph matching pairs is calculated, and the code similarity between the first program and the second program is shown in formula (4).

[0221] (4)

[0222] in, Indicates the first program and the second program The code similarity between represents the sum of similarities, Represents the total number of matching pairs.

[0223] The program-level code similarity analysis method provided in this embodiment has the following beneficial effects:

[0224] (1) This embodiment first parses the code of the first program and the second program to construct a first custom function call graph and a second custom function call graph at the program level, eliminating interference from system functions. The first custom function call graph contains the call relationships between all custom functions in the first program, and the second custom function call graph contains the call relationships between all custom functions in the second program, providing a comprehensive foundation for subsequent program analysis. Compared with traditional methods, the exclusion of system functions allows the analysis to focus more on custom functions and avoid unnecessary noise. This can improve the accuracy of code analysis, avoid noise interference caused by system functions, and allow the analysis to focus more on the core logic and custom functions of the program, thereby improving the accuracy of code similarity analysis.

[0225] (2) Based on the first custom function call graph and the second custom function call graph, this embodiment further proposes a function-oriented subgraph cutting method. By identifying the first root node and the second root node in the first custom function call graph and the second custom function call graph, and taking these first root nodes and the second root nodes as the starting point, the first subgraph and the second subgraph of multiple functional modules are divided. Each first subgraph represents a functional unit in the first program, and each second subgraph represents a functional unit in the second program, which helps to accurately analyze the structure and relationship between different functional modules of the code, and is particularly suitable for the analysis and functional division of large-scale programs. Through the function-oriented subgraph division method, different functional units in the first program and the second program can be effectively separated, which reduces the difficulty of analyzing complex programs, helps to quickly identify functional modules in the program, and improves the processing efficiency of large-scale programs.

[0226] (3) This embodiment adopts the Hungarian algorithm to generate candidate subgraph matching pairs by calculating the similarity between the first root node in the first program and the second root node in the second program. The Jaccard distance is used to measure the code similarity between the functions represented by the root nodes. Among them, four types of function features (integer features, string features, API features, and instruction features) are extracted to perform function similarity calculation. Combining the Jaccard distance and the Hungarian algorithm, this embodiment can more accurately measure the similarity between the root node and the subgraph, effectively reducing the number of unnecessary matches and improving the efficiency of subgraph matching. Through feature extraction and similarity calculation, potentially similar subgraph pairs can be identified more accurately, significantly optimizing the effect of subgraph similarity calculation.

[0227] (4) In the subgraph matching process, this embodiment adopts a hierarchical matching strategy. Through symbolic execution technology, the path conditions and output results of the functions corresponding to the nodes are accurately analyzed, and abstract interpretation is used to supplement the omissions in the matching. Multi-level matching not only takes into account changes in function names and structures, but can also handle complex logical changes, such as function reconstruction or splitting. This matching algorithm can cope with function reconstruction and logical changes in complex program structures, ensuring accurate mapping of cross-version functions. In particular, when dealing with function reconstruction or splitting, it can still maintain a high matching accuracy, improving the applicability and robustness of homology analysis.

[0228] (5) This embodiment extracts the integer features, string features, interface features, and instruction features of the functions corresponding to the nodes, and combines them with the Jaccard distance to calculate the similarity between functions. On the basis of constructing candidate matching pairs, the number of matching nodes in each subgraph pair is further counted to calculate the code similarity of the two programs. It can accurately identify the relationship between cross-version functions and help establish function mapping between different software versions. The similarity calculation method of this embodiment can accurately identify the function similarity and function mapping between different versions of software, support the functional correlation analysis of cross-version programs, and help developers understand the program update and evolution process, especially in terms of function migration and security vulnerability detection.

[0229] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0230] Based on the same inventive concept, an embodiment of the present application further provides a program-level code similarity analysis device for implementing the program-level code similarity analysis method described above. The implementation solution provided by this device is similar to the implementation solution described in the above method. Therefore, the specific limitations of one or more program-level code similarity analysis device embodiments provided below can be found in the limitations of the program-level code similarity analysis method described above, and will not be repeated here.

[0231] In an exemplary embodiment, Figure 4As shown, a similarity analysis device for program-level codes is provided, wherein:

[0232] A function call graph acquisition module 401 is configured to obtain a first user-defined function call graph and a second user-defined function call graph according to the code of the first program and the code of the second program;

[0233] A subgraph acquisition module 402 is configured to divide the first user-defined function call graph into a plurality of first subgraphs and the second user-defined function call graph into a plurality of second subgraphs according to a call chain of a single functional unit;

[0234] a candidate subgraph matching pair obtaining module 403 , configured to determine the first subgraph and the second subgraph as a candidate subgraph matching pair when the similarity between the first root node of the first subgraph and the second root node of the second subgraph is greater than a similarity threshold;

[0235] A matching pair similarity obtaining module 404 is configured to obtain, for any candidate subgraph matching pair, the similarity of the candidate subgraph matching pair based on the number of matching nodes in the candidate subgraph matching pair;

[0236] The code similarity obtaining module 405 is configured to obtain the code similarity between the first program and the second program according to the similarity of each candidate subgraph matching pair.

[0237] In one embodiment, the device also includes a matching node number determination module, which is used to: determine whether the first node and the second node at the same level in any candidate subgraph matching pair are first-class matching nodes based on symbolic execution technology; if the first node and the second node are not first-class matching nodes, determine whether the first node and the second node are second-class matching nodes based on an abstract interpretation algorithm; and obtain the number of matching nodes in the candidate subgraph matching pair based on the number of first-class matching nodes and the number of second-class matching nodes.

[0238] In one embodiment, the module for determining the number of matching nodes is further used to: for the first node of the same level in any candidate subgraph matching pair, symbolically execute the function corresponding to the first node to obtain the path condition set and output set of each first node; for the second node of the same level in any candidate subgraph matching pair, symbolically execute the function corresponding to the second node to obtain the path condition set and output set of each second node; when the path condition set of the first node and the path condition set of the second node are the same, and the output set of the first node and the output set of the second node are the same, determine that the first node and the second node are first-type matching nodes.

[0239] In one embodiment, the module for determining the number of matching nodes is further used to: obtain the path condition set and output set of the first node, and the path condition set and output set of the second node based on the abstract domain; when the path condition set of the first node contains the path condition set of the second node, and the output set of the first node contains the output set of the second node, determine that the first node and the second node are second-type matching nodes.

[0240] In one embodiment, the function call graph acquisition module 401 is also used to: extract custom functions from the code of the first program according to a static code analysis tool; obtain the call location of each custom function according to the abstract syntax tree, and record the call relationship of each custom function; construct a preliminary first call relationship graph according to the call relationship of each custom function; for each call relationship in the preliminary first call relationship graph, check whether the called function is a system function; when the called function is a system function, delete the call relationship from the preliminary first call relationship graph to obtain the checked preliminary first call graph; mark the function name, parameters and return value information for each node in the checked preliminary first call graph, and mark the type of call relationship for each edge to obtain the first custom function call graph.

[0241] In one embodiment, the subgraph acquisition module 402 is further used to: determine the first root node of the first custom function call graph; take each first root node as the starting point, and traverse the child nodes reached by the first root node according to the breadth-first search algorithm; establish a first subgraph based on the first root node and the child nodes reached by the first root node; the first subgraph includes each path starting from the first root node and the end node corresponding to the first root node.

[0242] In one embodiment, the device also includes a node similarity acquisition module, which is used to: extract the integer features, string features, interface features and instruction features of the function corresponding to each first root node in the first subgraph to obtain the feature set of each first root node; extract the integer features, string features, interface features and instruction features of the function corresponding to each second root node in the second subgraph to obtain the feature set of each second root node; obtain the distance between the first root node and the second root node based on the feature set of each first root node and the feature set of each second root node; obtain the similarity between the first root node and the second root node based on the distance between the first root node and the second root node.

[0243] In one embodiment, the candidate subgraph matching pair acquisition module 403 is further configured to: acquire the total number of nodes of the candidate subgraph matching pair; and use the ratio of the number of matching nodes in the candidate subgraph matching pair to the total number of nodes as the similarity of the candidate subgraph matching pair.

[0244] In one embodiment, the code similarity acquisition module 405 is further used to: obtain the total number of matching pairs of the candidate subgraph matching pairs; obtain the sum of similarities based on the similarity of each candidate subgraph matching pair; and use the ratio of the sum of similarities to the total number of matching pairs as the code similarity between the first program and the second program.

[0245] Each module in the program-level code similarity analysis device can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0246] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 5 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O) and a communication interface. The processor, memory and input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store data of an embodiment of the method for similarity analysis of program-level code. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a method for similarity analysis of program-level code is implemented.

[0247] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0248] In one embodiment, a computer device is further provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0249] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0250] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0251] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0252] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. In particular, any reference to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the various embodiments provided herein may be, but are not limited to, general-purpose processors, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), programmable logic devices (PLDs), quantum computing-based data processing logic devices, artificial intelligence (AI) processors, and the like.

[0253] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0254] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A method for similarity analysis of program-level codes, characterized in that: The method comprises: Obtaining a corresponding first user-defined function call graph and a second user-defined function call graph according to the code of the first program and the code of the second program; According to the call chain of a single functional unit, the first custom function call graph is divided into a plurality of first subgraphs, and the second custom function call graph is divided into a plurality of second subgraphs; When the similarity between the first root node of the first subgraph and the second root node of the second subgraph is greater than a similarity threshold, determining the first subgraph and the second subgraph as a candidate subgraph matching pair; For any candidate subgraph matching pair, obtain the similarity of the candidate subgraph matching pair according to the number of matching nodes in the candidate subgraph matching pair; According to the similarity of each candidate subgraph matching pair, the code similarity between the first program and the second program is obtained.

2. The method according to claim 1, characterized in that Before obtaining the similarity of any candidate subgraph matching pair based on the number of matching nodes in the candidate subgraph matching pair, the method further includes: Determine, using symbolic execution technology, whether the first node and the second node at the same level in any candidate subgraph matching pair are first-class matching nodes; If the first node and the second node are not first-category matching nodes, determining whether the first node and the second node are second-category matching nodes according to an abstract interpretation algorithm; The number of matching nodes in the candidate subgraph matching pairs is obtained according to the number of the first type of matching nodes and the number of the second type of matching nodes.

3. The method according to claim 2, characterized in that The step of determining whether the first node and the second node at the same level in any candidate subgraph matching pair are first-class matching nodes according to the symbolic execution technology includes: For the first node of the same level in any candidate subgraph matching pair, symbolically execute the function corresponding to the first node to obtain a path condition set and an output set for each first node; For the second node at the same level in any candidate subgraph matching pair, symbolically execute the function corresponding to the second node to obtain a path condition set and an output set for each second node; When the path condition set of the first node is the same as the path condition set of the second node, and the output set of the first node is the same as the output set of the second node, the first node and the second node are determined to be first-type matching nodes.

4. The method according to claim 2, characterized in that The determining, according to the abstract interpretation algorithm, whether the first node and the second node are second-category matching nodes includes: Obtaining, according to the abstract domain, a path condition set and an output set of the first node, and a path condition set and an output set of the second node; When the path condition set of the first node includes the path condition set of the second node, and the output set of the first node includes the output set of the second node, the first node and the second node are determined to be second-type matching nodes.

5. The method according to claim 1, characterized in that According to the code of the first program, a corresponding first custom function call graph is obtained, including: extracting the custom function from the code of the first program according to a static code analysis tool; According to the abstract syntax tree, the calling location of each custom function is obtained, and the calling relationship of each custom function is recorded; Constructing a preliminary first call relationship graph according to the call relationship of each defined function; For each call relationship in the preliminary first call relationship graph, checking whether the called function is a system function; When the called function is a system function, the calling relationship is deleted from the preliminary first calling relationship graph to obtain a checked preliminary first calling graph; Each node in the checked preliminary first call graph is marked with function name, parameter and return value information, and each edge is marked with the type of call relationship to obtain a first custom function call graph.

6. The method according to claim 1, characterized in that The first custom function call graph is divided into a plurality of first subgraphs according to the call chain of a single functional unit, including: Determining a first root node of the first custom function call graph; Starting from each first root node, traverse the child nodes reached by the first root node according to the breadth-first search algorithm; A first subgraph is established based on the first root node and the child nodes reached by the first root node; the first subgraph includes each path starting from the first root node and the end node corresponding to the first root node.

7. The method according to claim 1, characterized in that When the similarity between the first root node of the first subgraph and the second root node of the second subgraph is greater than a similarity threshold, before determining the first subgraph and the second subgraph as a candidate subgraph matching pair, the method further includes: Extracting integer features, string features, interface features, and instruction features of the function corresponding to each first root node in the first subgraph to obtain a feature set of each first root node; Extracting integer features, string features, interface features, and instruction features of the function corresponding to each second root node in the second subgraph to obtain a feature set of each second root node; Obtaining the distance between the first root node and the second root node according to the feature set of each first root node and the feature set of each second root node; The similarity between the first root node and the second root node is obtained according to the distance between the first root node and the second root node.

8. The method according to claim 1, characterized in that Obtaining the similarity of the candidate subgraph matching pairs according to the number of matching nodes in the candidate subgraph matching pairs includes: Obtaining the total number of nodes in the candidate subgraph matching pairs; The ratio of the number of matching nodes in the candidate subgraph matching pair to the total number of nodes is used as the similarity of the candidate subgraph matching pair.

9. The method according to claim 1, characterized in that Obtaining the code similarity between the first program and the second program according to the similarity of each candidate subgraph matching pair includes: Get the total number of matching pairs of candidate subgraph matching pairs; According to the similarity of each candidate subgraph matching pair, the sum of similarities is obtained; The ratio of the sum of the similarities to the total number of matching pairs is used as the code similarity between the first program and the second program.

10. A program-level code similarity analysis device, characterized in that: The device comprises: A function call graph acquisition module, configured to obtain a corresponding first custom function call graph and a second custom function call graph according to the code of the first program and the code of the second program; a subgraph acquisition module, configured to divide the first custom function call graph into a plurality of first subgraphs and the second custom function call graph into a plurality of second subgraphs according to a call chain of a single functional unit; a candidate subgraph matching pair obtaining module, configured to determine the first subgraph and the second subgraph as a candidate subgraph matching pair when the similarity between the first root node of the first subgraph and the second root node of the second subgraph is greater than a similarity threshold; A matching pair similarity acquisition module is used to obtain the similarity of any candidate subgraph matching pair according to the number of matching nodes in the candidate subgraph matching pair; The code similarity acquisition module is used to obtain the code similarity between the first program and the second program according to the similarity of each candidate subgraph matching pair.

Images