Tamper detection method and device for software license and computer equipment

Abstract

The invention relates to a tampering detection method and device for a software license, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: acquiring a preset number of software license templates, and labeling tampering behavior types for the software license templates to obtain tampering information; according to the software license template marked with the tampering behavior type and the corresponding tampering information, constructing a knowledge graph containing the software license template and the tampering information; according to the knowledge graph, a dynamic sparse attention mechanism is adopted to extract semantic vectors, and a graph isomorphic network is utilized to extract graph structure features; fusing the semantic vector and the graph structure feature to form a joint feature vector; and according to the joint feature vector, training a multi-modal feature extraction model, and according to the multi-modal feature extraction model, carrying out tampering detection on the software license. By adopting the method, the tampering detection accuracy of the software license can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software security, in particular to a software license tampering detection method and device, computer equipment, computer readable storage medium and computer program product. BACKGROUND

[0002] In order to cope with increasingly fierce market competition, such as compressed new product cycle, perfect technology innovation requirements, more and more enterprises often introduce a large number of open source components in the development process. Therefore, people pay more and more attention to how to ensure the security and compliance of open source component licenses, and avoid legal risks caused by license violations.

[0003] The tampering problem of software license has always been an important challenge in the field of software security. Traditional license tampering detection methods often rely on manual review, simple file comparison or detection means based on specific rules. These methods have deficiencies in efficiency and accuracy, resulting in high false positive and false negative rates and subsequent legal problems.

[0004] The current detection method includes: matching the feature information of the file to be detected with the feature information in the homology analysis feature knowledge base to determine whether the file to be detected has a homology relationship with the file in the feature information knowledge base; and determining whether the license and copyright information in the file to be detected has tampering, deletion and addition. The method compares and analyzes by Hash algorithm, but the accuracy of the method is low, and it is difficult to handle missing data.

[0005] Therefore, there is an urgent need for a software license tampering detection method, device, computer equipment, computer readable storage medium and computer program product, which can improve the tampering detection accuracy of software license. SUMMARY

[0006] Therefore, it is necessary to provide a software license tampering detection method, device, computer equipment, computer readable storage medium and computer program product capable of improving the tampering detection accuracy of software license to solve the above technical problems.

[0007] In a first aspect, the present application provides a software license tampering detection method, comprising:

[0008] Obtaining a preset number of software license templates, and labeling tampering behavior types of the software license templates to obtain tampering information;

[0009] According to the software license templates and the corresponding tampering information after labeling the tampering behavior types, a knowledge graph containing the software license templates and the tampering information is constructed;

[0010] According to the knowledge graph, a dynamic sparse attention mechanism is used to extract a semantic vector, and a graph isomorphism network is used to extract a graph structure feature;

[0011] The semantic vector and the graph structure feature are fused to form a joint feature vector;

[0012] According to the joint feature vector, a multi-modal feature extraction model is trained, and according to the multi-modal feature extraction model, tampering detection is performed on the software license.

[0013] In one embodiment, according to the multi-modal feature extraction model, tampering detection is performed on the software license, which includes:

[0014] According to the multi-modal feature extraction model, a tampering confidence of the software license is obtained;

[0015] In the case where the tampering confidence meets a pre-set confidence threshold condition, a tampering positioning heat map of the software license is generated;

[0016] According to the tampering positioning heat map of the software license, a tampering risk score is calculated, and tampering detection is performed on the software license according to the tampering risk score.

[0017] In one embodiment, according to the tampering positioning heat map of the software license, a tampering risk score is calculated, which includes:

[0018] According to the tampering positioning heat map of the software license, the heat value of each heat point in the tampering positioning heat map is calculated respectively;

[0019] According to the heat value of each heat point in the tampering positioning heat map, the tampering result of the software license on each type of clause is determined;

[0020] The risk weight of the software license on each type of clause is obtained;

[0021] According to the tampering result of the software license on each type of clause, the risk weight, and the tampering confidence of the software license, a tampering risk score is calculated.

[0022] In one embodiment, the tampering result includes:

[0023] In the case where the maximum value of the heat value of the current heat point is greater than a first threshold value, and the variance of the heat value between the current heat point and the adjacent heat point is greater than a second threshold value, it is indicated that the text corresponding to the current heat point is tampered with individually;

[0024] In the case where the heat value of a continuous preset number of heat points is greater than a third threshold value, it is indicated that the clause text corresponding to the continuous preset number of heat points is modified.

[0025] In one embodiment, the extraction of semantic vectors using a dynamic sparse attention mechanism includes:

[0026] Based on the knowledge graph, the text data of the software license to be detected is converted into a sequence of tokens;

[0027] The token sequence is converted into an embedding vector, and the embedding vector is input into the BERT model to obtain the model output.

[0028] The risk weight of each type of clause in the software license to be tested is calculated through a gating mechanism.

[0029] A dynamic sparse attention mechanism is used to generate a sparse mask based on at least one type of clause with the highest risk weight.

[0030] The model output is weighted and aggregated with the sparse mask of at least one type of clause and then averaged to output a semantic vector.

[0031] In one embodiment, the extraction of graph structure features using graph isomorphic networks includes:

[0032] For each node in the knowledge graph, determine the features of all neighboring nodes in the previous layer;

[0033] The aggregation function of graph isomorphic networks is used to aggregate the features of each node in the previous layer with the features of all its neighboring nodes in the previous layer;

[0034] The aggregated features are input into a multilayer perceptron for nonlinear transformation to learn the relationship between the features of each node and the features of its neighboring nodes.

[0035] The features of each node in the current layer are obtained by using the output of the multilayer perceptron, and the graph structure features are determined based on the features of each node in the current layer.

[0036] Secondly, this application also provides a software license tampering detection device, comprising:

[0037] The acquisition and processing module is used to acquire a preset number of software license templates, mark the software license templates with tampering behavior types, and obtain tampering information;

[0038] The knowledge graph construction module is used to construct a knowledge graph containing the software license template and tampering information based on the software license template labeled with the type of tampering behavior and the corresponding tampering information.

[0039] The feature extraction module is used to extract semantic vectors based on the knowledge graph using a dynamic sparse attention mechanism, and to extract graph structure features using a graph isomorphic network.

[0040] The feature fusion module is used to fuse the semantic vector with the graph structure features to form a joint feature vector;

[0041] The tampering detection module is used to train a multimodal feature extraction model based on the joint feature vector, and to perform tampering detection on the software license based on the multimodal feature extraction model.

[0042] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0043] Obtain a preset number of software license templates, and mark the software license templates with tampering behavior types to obtain tampering information;

[0044] Based on the software license template labeled with the type of tampering behavior and the corresponding tampering information, a knowledge graph containing the software license template and tampering information is constructed.

[0045] Based on the knowledge graph, a dynamic sparse attention mechanism is used to extract semantic vectors, and graph isomorphic networks are used to extract graph structure features.

[0046] The semantic vector is fused with the graph structure features to form a joint feature vector;

[0047] Based on the joint feature vector, a multimodal feature extraction model is trained, and based on the multimodal feature extraction model, tampering detection is performed on the software license.

[0048] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0049] Obtain a preset number of software license templates, and mark the software license templates with tampering behavior types to obtain tampering information;

[0050] Based on the software license template labeled with the type of tampering behavior and the corresponding tampering information, a knowledge graph containing the software license template and tampering information is constructed.

[0051] Based on the knowledge graph, a dynamic sparse attention mechanism is used to extract semantic vectors, and graph isomorphic networks are used to extract graph structure features.

[0052] The semantic vector is fused with the graph structure features to form a joint feature vector;

[0053] Based on the joint feature vector, a multimodal feature extraction model is trained, and based on the multimodal feature extraction model, tampering detection is performed on the software license.

[0054] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0055] Obtain a preset number of software license templates, and mark the software license templates with tampering behavior types to obtain tampering information;

[0056] Based on the software license template labeled with the type of tampering behavior and the corresponding tampering information, a knowledge graph containing the software license template and tampering information is constructed.

[0057] Based on the knowledge graph, a dynamic sparse attention mechanism is used to extract semantic vectors, and graph isomorphic networks are used to extract graph structure features.

[0058] The semantic vector is fused with the graph structure features to form a joint feature vector;

[0059] Based on the joint feature vector, a multimodal feature extraction model is trained, and based on the multimodal feature extraction model, tampering detection is performed on the software license.

[0060] The aforementioned software license tampering detection methods, devices, computer equipment, computer-readable storage media, and computer program products, by acquiring a preset number of software license templates and manually labeling these templates with tampering behavior types, have collected a large amount of labeled data, providing a foundation for subsequent model training. Using the labeled license templates and tampering information, a knowledge graph containing license templates and tampering information is constructed. This graph not only contains the textual information of the license but also the type and location of tampering, providing rich semantic information for understanding the structure and tampering patterns of the license. A dynamic sparse attention mechanism is used to extract semantic vectors from the text, which can identify key information in the text and improve the expressive power of features. Simultaneously, a graph isomorphic network is used to extract graph structure features from the knowledge graph. The network can capture the dependencies between clauses in the license, providing structured information for the model. The semantic vectors and graph structure features are fused to form a joint feature vector. This joint feature vector contains not only the semantic information of the text but also the structural information of the license, enabling the model to understand the license from multiple perspectives. A multimodal feature extraction model is trained using joint feature vectors. This model can process both text and graph structure data simultaneously, improving its generalization ability and accuracy. The trained model is then used to detect tampering in software licenses, effectively identifying such tampering and improving detection accuracy and efficiency. Attached Figure Description

[0061] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0062] Figure 1 This is a diagram illustrating the application environment of a software license tampering detection method in one embodiment.

[0063] Figure 2 This is a flowchart illustrating a method for detecting software license tampering in one embodiment;

[0064] Figure 3 This is a flowchart illustrating a method for detecting software license tampering in another embodiment;

[0065] Figure 4 This is a structural block diagram of a software license tampering detection device in one embodiment;

[0066] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0067] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0068] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0069] In one exemplary embodiment, such as Figure 1 As shown, a method for detecting software license tampering is provided, including the following steps S102 to S110. Wherein:

[0070] Step S102: Obtain a preset number of software license templates, and mark the software license templates with tampering behavior types to obtain tampering information.

[0071] Specifically, license templates were collected from authoritative license databases such as SPDX (Software Package Data Exchange) and OSI (Open Source Initiative), yielding over 300 templates. These templates represent various open-source licenses, covering a wide range of use cases and terms. The collected license templates were reviewed by professionals to identify and flag potential tampering. Such tampering may include, but is not limited to: adding restrictions that were not originally present in the license, such as scope of use or distribution methods; removing disclaimers from the license, which may increase the licensee's legal liability; and altering patent-related clauses in the license, which may affect the use and protection of patents. The identified types and specific locations of tampering were recorded to create tampering information.

[0072] Step S104: Based on the software license template labeled with the type of tampering behavior and the corresponding tampering information, construct a knowledge graph containing the software license template and tampering information.

[0073] Specifically, manually annotated software license templates and corresponding tampering information are integrated, including the license's text content, the type, location, impact, and any other relevant metadata. Key entities, such as license name, version number, clause number, and key terms, are identified within the text content. These entities form the basis for constructing the knowledge graph. Relationships between entities are determined. For example, a clause may be associated with a specific type of tampering, or a license version may contain multiple tampered clauses; these relationships help reveal the inherent connections within the license content. The knowledge graph is constructed using entities and relationships, where entities are typically represented as nodes, relationships as edges, and combinations of nodes and edges represent the license's structure and tampering information. Further information, such as evidence of tampering, the motive for tampering, and the legal consequences of tampering, is added to the knowledge graph to enrich its text content.

[0074] Step S106: Based on the knowledge graph, a dynamic sparse attention mechanism is used to extract semantic vectors, and graph isomorphic networks are used to extract graph structure features.

[0075] Specifically, the dynamic sparse attention mechanism is an attention mechanism introduced on top of the BERT model. It achieves adaptive focusing on the importance of clauses at the clause level through differentiable Top-K gating. It can automatically identify and increase the attention weight of key legal clauses (such as patent licenses, disclaimers, etc.), which are crucial for understanding the legal meaning of a license. In this way, the model can focus more on the most critical parts of understanding the license, thereby improving computational efficiency by 70% compared to traditional global attention mechanisms.

[0076] Dynamic sparse attention, when processing text data, does not give equal attention to all tokens, but dynamically selects a subset of important tokens for focus. This mechanism automatically adjusts the focus based on different input data, thereby improving the model's ability to capture key information. In natural language processing, semantic vectors are vectors that represent the semantic information of text. These semantic vectors not only contain the main content of the text but also emphasize the importance of key legal clauses. Through dynamic sparse attention, vectors representing the core meaning of the text can be extracted, capturing the main content and contextual relationships of the text.

[0077] Graph Isomorphic Networks (GINs) are a type of graph neural network used to process graph-structured data. GINs learn the structural features of a graph by aggregating information about nodes and their neighbors to update node representations. In knowledge graphs, graph structural features refer to the relationships and connection patterns between nodes (such as entities and concepts). Graph isomorphic networks can extract these structural features from knowledge graphs, reflecting the associations and dependencies between entities.

[0078] To address the heterogeneous alignment issue between syntactic structure and clause logic in legal texts, a mapping between semantic vectors and the latent space of graph nodes is constructed. This mapping is optimized using a cross-modal alignment loss function, significantly reducing alignment error (experimental data demonstrates a 62.4% reduction), thus making the correspondence between semantic vectors and graph structure features more accurate.

[0079] Step S108: The semantic vector and graph structure features are fused to form a joint feature vector.

[0080] Specifically, first, semantic vectors and graph structure features need to be standardized or normalized to ensure they are on the same scale, thus preventing one feature from dominating the other during the fusion process. Then, it's necessary to ensure the two features are semantically corresponding. For example, if semantic vectors represent terms in text and graph structure features represent term nodes in a knowledge graph, then it's necessary to ensure they describe the same entity or concept. Finally, semantic vectors and graph structure features are merged in the vector space. This can be achieved in several ways, such as:

[0081] Concatenation: directly concatenate two feature vectors into a longer vector.

[0082] Weighted summation: Assign weights to the two feature vectors and then perform a weighted summation.

[0083] Feature crossing: Interacting information between two feature vectors through nonlinear transformations (such as multilayer perceptrons).

[0084] The fused joint feature vector can be used as input to a machine learning model. During training, the model learns how to extract useful information from the joint feature vector and apply it to specific tasks such as classification, regression, or clustering.

[0085] Step S110: Train a multimodal feature extraction model based on the joint feature vector, and perform tamper detection on the software license based on the multimodal feature extraction model.

[0086] Specifically, a multimodal feature extraction model is trained using the joint feature vector as input. This model can be a deep learning model, such as a Convolutional Neural Network (CNN), a Recurrent Neural Network (RNN), or a Transformer, which learns how to extract useful information from the joint feature vector. During training, the model attempts to find the optimal parameters to accurately extract features useful for tamper detection from the input joint feature vector. Once trained, the model can be used to detect tampering on new software licenses. Specifically, for each license to be detected, its semantic vector and graph structure features are first extracted, and then these features are fused into a joint feature vector. This joint feature vector is input into the trained multimodal feature extraction model, which outputs a score or label representing the probability of tampering. Based on this output, it is possible to determine whether the license has been tampered with and the severity of the tampering.

[0087] The aforementioned software license tampering detection method collects a large amount of labeled data by obtaining a preset number of software license templates and manually labeling these templates with tampering behavior types, providing a foundation for subsequent model training. Using the labeled license templates and tampering information, a knowledge graph containing license templates and tampering information is constructed. This graph not only contains the textual information of the license but also the type and location of tampering, providing rich semantic information for understanding the structure and tampering patterns of the license. A dynamic sparse attention mechanism is used to extract semantic vectors from the text, which can identify key information in the text and improve the expressive power of features. Simultaneously, a graph isomorphic network is used to extract graph structure features from the knowledge graph. The network can capture the dependencies between clauses in the license, providing structured information for the model. The semantic vectors and graph structure features are fused to form a joint feature vector. This joint feature vector contains not only the semantic information of the text but also the structural information of the license, enabling the model to understand the license from multiple perspectives. A multimodal feature extraction model is trained using joint feature vectors. This model can process both text and graph structure data simultaneously, improving its generalization ability and accuracy. The trained model is then used to detect tampering in software licenses, effectively identifying such tampering and improving detection accuracy and efficiency.

[0088] In one embodiment, such as Figure 2 As shown, based on the multimodal feature extraction model, tampering detection of software licenses is performed, including:

[0089] Step S202: Obtain the tampering confidence level of the software license based on the multimodal feature extraction model.

[0090] Step S204: If the tampering confidence level meets the preset confidence threshold condition, generate a tampering location heatmap of the software license.

[0091] Step S206: Calculate the tampering risk score based on the tampering location heatmap of the software license, and perform tampering detection on the software license based on the tampering risk score.

[0092] Specifically, firstly, the software license document is input into the multimodal feature extraction model. The model processes the input document and extracts semantic vectors representing the semantic content of the document and graph structure features representing the structural information of the document, thus forming multimodal features.

[0093] The model uses extracted multimodal features to assess the tampering probability of each part of the license, generating a tampering confidence score for each part. This score reflects the model's confidence level in whether that part has been tampered with. If the calculated tampering confidence score exceeds a preset threshold (e.g., 0.6), the model considers that part to have a high risk of tampering. The confidence score is calculated using the following formula:

[0094] Where c is the tamper confidence level, ranging from [0,1]; σ is the Sigmoid function; H is the 768-dimensional joint feature vector, Wc T Risk weights for various clauses.

[0095] For high-risk sections, the model generates a tampering location heatmap. This heatmap uses color coding (e.g., red for high risk, green for low risk) to visually represent the tampering risk of each part of the license. Based on the heatmap, the model calculates a tampering risk score for the entire license. This score comprehensively considers the tampering risk of all parts of the license, providing a global risk assessment.

[0096] Based on the calculated tampering risk score, the model detects tampering of the software license. If the risk score exceeds a certain preset value, the model will mark the license as tampered.

[0097] In this embodiment, by combining the semantic information of the text content with the graph structure features of the license structure, the multimodal feature extraction model can more accurately identify tampering behavior in the license and reduce false positives and false negatives.

[0098] In one embodiment, such as Figure 3 As shown, based on the heatmap of software license tampering locations, a tampering risk score is calculated, including:

[0099] Step S302: Calculate the heat value of each heat point in the tampered location heat map according to the tampered location heat map of the software license;

[0100] Step S304: Based on the heat value of each heat point in the tampered location heat map, determine the tampering results of various terms of the software license;

[0101] Step S306: Obtain the risk weights for various terms of the software license;

[0102] Step S308: Calculate the tampering risk score based on the tampering results of various terms in the software license, the risk weight, and the tampering confidence level of the software license.

[0103] Specifically, the heat value of each point is obtained from the tamper location heatmap. Heatmaps typically use color coding to represent the degree of tampering risk in different areas, with darker colors indicating higher risk. The heat value of each heat point reflects the likelihood of tampering with the corresponding portion of the license. Based on the heat value of each heat point, the tampering results of various clauses in the software license are analyzed and determined to identify specific tampering acts.

[0104] Obtain the risk weights associated with the various terms in the software license. These weights are typically based on the importance of the terms and the potential impact of tampering. For example, tampering with certain critical terms, such as patent licensing or disclaimers, may have more serious consequences than tampering with general terms.

[0105] A tampering risk score is calculated by combining the tampering result, risk weights, and tampering confidence level. This score is a comprehensive indicator that considers not only the probability of tampering (heat value and confidence level) but also the potential impact of tampering (risk weights). The calculation method may involve multiplying the tampering heat value of each clause by its risk weight, then summing the results in a weighted manner, while adjusting the final score by taking into account the overall tampering confidence level.

[0106] The formula for calculating the risk score of tampering is as follows:

[0107]

[0108] Where R is the tampering risk score; K is the set of key clause locations; w i Risk weighting for the terms; m i The heat value for each type of clause.

[0109] For example, R>=0.82: tampering confirmed; 0.6<=R<0.82: suspected tampering (requires manual review); R<0.6: no tampering. The heatmap thresholds and risk weights for various clauses are as follows:

[0110] Clause type Heat map threshold Risk weight Patent grant M>0.85 9.5 Disclaimer M>0.75 8.0 Trademark usage M>0.65 6.5

[0111] In this embodiment, by conducting a detailed analysis of the license tampering heatmap and combining it with the risk weights of various clauses, potential tampering risk points in the license can be identified more accurately, thereby improving the accuracy of risk identification. By calculating the tampering risk score, the originally qualitative tampering risk is transformed into a quantitative score, making the risk assessment more objective and standardized.

[0112] In one embodiment, the result of the tampering includes:

[0113] If the maximum value of the heat value of the current heat point is greater than the first threshold, and the variance of the heat values ​​between the current heat point and neighboring heat points is greater than the second threshold, it indicates that the text corresponding to the current heat point has been tampered with separately.

[0114] If the heat values ​​of a consecutive preset number of heat points are all greater than the third threshold, it means that the text of the clause corresponding to the consecutive preset number of heat points has been modified.

[0115] Specifically, point tampering refers to the modification of a single point or a small area within the text. To identify this, it's necessary to check if the maximum value of the current heatmap point exceeds a first threshold (e.g., 0.9). This threshold is used to determine if the heatmap point has a sufficiently high confidence level of tampering. Simultaneously, the variance of the heatmap values ​​of the current heatmap point and its neighboring heatmap points (e.g., two points before and two points after it) needs to be calculated. If this variance exceeds a second threshold (e.g., 0.3), it indicates a significant difference between the current heatmap point and its neighbors, which could be a sign of tampering. When both conditions are met, the text corresponding to the current heatmap point can be considered to have been individually tampered with.

[0116] Block tampering refers to the modification of a large area or multiple consecutive points in the text. To identify block tampering, it is necessary to check whether the heat values ​​of a predetermined number of consecutive heat points (e.g., 10 or more) all exceed a third set threshold (e.g., 0.7). If the heat values ​​of these consecutive heat points all exceed the threshold, it indicates that the text corresponding to these points may have been modified or tampered with entirely.

[0117] In this embodiment, this method can distinguish between point tampering and block tampering in the text, thereby more accurately identifying and locating tampering behavior.

[0118] In one embodiment, a dynamic sparse attention mechanism is used to extract semantic vectors, including:

[0119] Based on the knowledge graph, the text data of the software license to be detected is converted into a sequence of tokens;

[0120] The token sequence is converted into an embedding vector, and the embedding vector is input into the BERT model to obtain the model output.

[0121] The risk weight of each type of clause in the software license to be tested is calculated through a gating mechanism.

[0122] A dynamic sparse attention mechanism is used to generate a sparse mask based on at least one type of clause with the highest risk weight.

[0123] The model output is weighted and aggregated with a sparse mask of at least one type of clause and then averaged to produce a semantic vector.

[0124] Specifically, first, the software license text to be detected is converted into a series of tokens. Tokens are the basic units of text and can be words, characters, or parts of words. These token sequences are then converted into embedding vectors, which are points in a high-dimensional space that capture the semantic information of the tokens. The embedding vectors are then fed into a pre-trained BERT model, which understands the context of the text and outputs a high-level semantic representation of each token.

[0125] A risk weight for each type of clause in the license is calculated using a gating mechanism (a learning mechanism). The risk weight reflects the importance of different clauses in tampering detection. Based on the risk weight, at least one type of clause with the highest weight is selected, and a sparse mask is generated for these clauses. The sparse mask is a selective attention mechanism that only focuses on the clauses considered most important. The output of the BERT model is weighted and aggregated with the generated sparse mask, meaning the model's output is adjusted according to the sparse mask to highlight the most important clauses. Then, the weighted aggregated result is average pooled to generate a fixed-length semantic vector that captures the core semantic information of the license text. Finally, the output semantic vector can be used for further analysis, such as tampering detection, text classification, or other natural language processing tasks.

[0126] In this embodiment, through this process, the dynamic sparse attention mechanism can adaptively focus on key information in the license text, thereby improving the quality of semantic vectors and the accuracy of tamper detection. This method is particularly suitable for processing software license texts containing complex legal clauses.

[0127] In one embodiment, graph structural features are extracted using graph isomorphic networks, including:

[0128] For each node in the knowledge graph, determine the features of all neighboring nodes in the previous layer;

[0129] The aggregation function of graph isomorphic networks is used to aggregate the features of each node in the previous layer with the features of all its neighboring nodes in the previous layer;

[0130] The aggregated features are input into a multilayer perceptron for nonlinear transformation to learn the relationship between the features of each node and the features of its neighboring nodes.

[0131] The features of each node in the current layer are obtained by using the output of the multilayer perceptron, and the graph structure features are determined based on the features of each node in the current layer.

[0132] Specifically, in a knowledge graph, each node is connected to other nodes (i.e., neighboring nodes) via edges. First, it's necessary to determine the features of all neighboring nodes of each node in the previous (or initial) layer. Using aggregation functions in graph isomorphic networks, the features of each node are aggregated with the features of all its neighbors. The aggregation function integrates information about the node itself and its neighbors; common aggregation operations include summation, averaging, or more complex weighting methods.

[0133] The aggregated features are input into a Multilayer Perceptron (MLP), a type of neural network that performs non-linear transformations on the input features to learn the complex relationships between node features and neighbor features. This transformation helps extract higher-level feature representations. Using the output of the MLP, new features for each node in the current layer are obtained. These new features not only contain information about the node itself but also information about its neighbors, thus capturing the structural features of the graph. The processing formula of the MLP includes:

[0134]

[0135] Among them, h v (l) Let v be the feature vector of node v in layer l; MLP (l) For a multilayer perceptron of layer l; ∈ (l) is the learnable scaling factor, initially set to 0.01; N(v) is the set of neighboring nodes of node v; h u (l-1) The features of the previous layer of neighbor node u.

[0136] Based on the characteristics of each node at the current layer, the structural features of the graph can be determined. These features can be used to represent the topological structure and relational patterns of the nodes in the graph.

[0137] In this embodiment, the graph isomorphic network can learn the representation of each node in the graph. These representations include not only the node's own attribute information but also the node's topological structure information within the graph, thereby effectively extracting graph structure features. These features can be used for various graph-related tasks, such as node classification, graph classification, and link prediction. In the context of knowledge graphs, these graph structure features can help to better understand and analyze the terms and dependencies in licenses.

[0138] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0139] Based on the same inventive concept, this application also provides a software license tampering detection device for implementing the software license tampering detection method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more software license tampering detection device embodiments provided below can be found in the limitations of the software license tampering detection method described above, and will not be repeated here.

[0140] In one exemplary embodiment, such as Figure 4 As shown, a software license tampering detection device is provided, comprising:

[0141] The acquisition and processing module 402 is used to acquire a preset number of software license templates, mark the tampering behavior type of the software license templates, and obtain tampering information;

[0142] The knowledge graph construction module 404 is used to construct a knowledge graph containing the software license template and the tampering information based on the software license template after the tampering behavior type is marked and the corresponding tampering information.

[0143] The feature extraction module 406 is used to extract semantic vectors based on the knowledge graph using a dynamic sparse attention mechanism and to extract graph structure features using a graph isomorphic network.

[0144] The feature fusion module 408 is used to fuse semantic vectors with graph structure features to form a joint feature vector;

[0145] The tampering detection module 410 is used to train a multimodal feature extraction model based on the joint feature vector, and to perform tampering detection on the software license based on the multimodal feature extraction model.

[0146] In one embodiment, the tampering detection module 410 is specifically used to obtain the tampering confidence of the software license based on the multimodal feature extraction model; generate a tampering location heatmap of the software license when the tampering confidence meets the preset confidence threshold condition; calculate the tampering risk score based on the tampering location heatmap of the software license; and perform tampering detection on the software license based on the tampering risk score.

[0147] In one embodiment, the tampering detection module 410 is specifically used to calculate the heat value of each heat point in the tampering location heat map of the software license; determine the tampering result of various terms of the software license based on the heat value of each heat point in the tampering location heat map; obtain the risk weight of various terms of the software license; and calculate the tampering risk score based on the tampering result of various terms of the software license, the risk weight, and the tampering confidence level of the software license.

[0148] In one embodiment, the result of the tampering includes:

[0149] If the maximum value of the current heat point is greater than the first threshold, and the variance of the heat values ​​between the current heat point and its neighboring heat points is greater than the second threshold, it indicates that the text corresponding to the current heat point has been tampered with individually; if the heat values ​​of a consecutive preset number of heat points are all greater than the third threshold, it indicates that the text of the clauses corresponding to the consecutive preset number of heat points has been modified.

[0150] In one embodiment, the feature extraction module 406 is specifically used to convert the text data of the software license to be detected into token sequences based on the knowledge graph; convert the token sequences into embedding vectors, input the embedding vectors into the BERT model to obtain the model output; calculate the risk weight of each type of clause of the software license to be detected through a gating mechanism; generate a sparse mask based on at least one type of clause with the highest risk weight using a dynamic sparse attention mechanism; and perform weighted aggregation and average pooling on the model output and the sparse mask of at least one type of clause to output a semantic vector.

[0151] In one embodiment, the feature extraction module 406 is specifically used to determine the features of all neighboring nodes in the previous layer for each node in the knowledge graph; to aggregate the features of each node in the previous layer with the features of all neighboring nodes in the previous layer using the aggregation function of the graph isomorphic network; to input the aggregated features into a multilayer perceptron for nonlinear transformation to learn the relationship between the features of each node and the features of neighboring nodes; to obtain the features of each node in the current layer using the output of the multilayer perceptron, and to determine the graph structure features based on the features of each node in the current layer.

[0152] The modules in the aforementioned software license tampering detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0153] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores knowledge graph data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When executed by the processor, the computer program implements a method for detecting software license tampering.

[0154] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0155] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0156] Obtain a preset number of software license templates, mark the software license templates with the type of tampering behavior, and obtain tampering information;

[0157] Based on the software license template labeled with the type of tampering behavior and the corresponding tampering information, a knowledge graph containing the software license template and tampering information is constructed.

[0158] Based on the knowledge graph, a dynamic sparse attention mechanism is used to extract semantic vectors, and graph isomorphic networks are used to extract graph structure features.

[0159] The semantic vector is fused with the graph structure features to form a joint feature vector;

[0160] A multimodal feature extraction model is trained based on the joint feature vector, and then used to detect tampering of software licenses.

[0161] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0162] Based on the multimodal feature extraction model, obtain the tampering confidence level of the software license;

[0163] If the tampering confidence level meets the preset confidence threshold, a heatmap of the tampering location of the software license is generated.

[0164] Based on the tampering location heatmap of the software license, a tampering risk score is calculated, and the software license is tampered with based on the tampering risk score.

[0165] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0166] Based on the tampered location heatmap of the software license, calculate the heat value of each heat point in the tampered location heatmap;

[0167] Based on the heat value of each heat point in the tampered location heat map, determine the tampering results of various terms and conditions in the software license;

[0168] Risk weighting of various terms and conditions for obtaining a software license;

[0169] The tampering risk score is calculated based on the results of tampering with various terms of the software license, the risk weight, and the confidence level of the software license tampering.

[0170] In one embodiment, the result of the tampering includes:

[0171] If the maximum value of the heat value of the current heat point is greater than the first threshold, and the variance of the heat values ​​between the current heat point and neighboring heat points is greater than the second threshold, it indicates that the text corresponding to the current heat point has been tampered with separately.

[0172] If the heat values ​​of a consecutive preset number of heat points are all greater than the third threshold, it means that the text of the clause corresponding to the consecutive preset number of heat points has been modified.

[0173] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0174] Based on the knowledge graph, the text data of the software license to be detected is converted into a sequence of tokens;

[0175] The token sequence is converted into an embedding vector, and the embedding vector is input into the BERT model to obtain the model output.

[0176] The risk weight of each type of clause in the software license to be tested is calculated through a gating mechanism.

[0177] A dynamic sparse attention mechanism is used to generate a sparse mask based on at least one type of clause with the highest risk weight.

[0178] The model output is weighted and aggregated with a sparse mask of at least one type of clause and then averaged to produce a semantic vector.

[0179] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0180] For each node in the knowledge graph, determine the features of all neighboring nodes in the previous layer;

[0181] The aggregation function of graph isomorphic networks is used to aggregate the features of each node in the previous layer with the features of all its neighboring nodes in the previous layer;

[0182] The aggregated features are input into a multilayer perceptron for nonlinear transformation to learn the relationship between the features of each node and the features of its neighboring nodes.

[0183] The features of each node in the current layer are obtained by using the output of the multilayer perceptron, and the graph structure features are determined based on the features of each node in the current layer.

[0184] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0185] Obtain a preset number of software license templates, mark the software license templates with the type of tampering behavior, and obtain tampering information;

[0186] Based on the software license template labeled with the type of tampering behavior and the corresponding tampering information, a knowledge graph containing the software license template and tampering information is constructed.

[0187] Based on the knowledge graph, a dynamic sparse attention mechanism is used to extract semantic vectors, and graph isomorphic networks are used to extract graph structure features.

[0188] The semantic vector is fused with the graph structure features to form a joint feature vector;

[0189] A multimodal feature extraction model is trained based on the joint feature vector, and then used to detect tampering of software licenses.

[0190] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0191] Based on the multimodal feature extraction model, obtain the tampering confidence level of the software license;

[0192] If the tampering confidence level meets the preset confidence threshold, a heatmap of the tampering location of the software license is generated.

[0193] Based on the tampering location heatmap of the software license, a tampering risk score is calculated, and the software license is tampered with based on the tampering risk score.

[0194] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0195] Based on the tampered location heatmap of the software license, calculate the heat value of each heat point in the tampered location heatmap;

[0196] Based on the heat value of each heat point in the tampered location heat map, determine the tampering results of various terms and conditions in the software license;

[0197] Risk weighting of various terms and conditions for obtaining a software license;

[0198] The tampering risk score is calculated based on the results of tampering with various terms of the software license, the risk weight, and the confidence level of the software license tampering.

[0199] In one embodiment, the result of the tampering includes:

[0200] If the maximum value of the heat value of the current heat point is greater than the first threshold, and the variance of the heat values ​​between the current heat point and neighboring heat points is greater than the second threshold, it indicates that the text corresponding to the current heat point has been tampered with separately.

[0201] If the heat values ​​of a consecutive preset number of heat points are all greater than the third threshold, it means that the text of the clause corresponding to the consecutive preset number of heat points has been modified.

[0202] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0203] Based on the knowledge graph, the text data of the software license to be detected is converted into a sequence of tokens;

[0204] The token sequence is converted into an embedding vector, and the embedding vector is input into the BERT model to obtain the model output.

[0205] The risk weight of each type of clause in the software license to be tested is calculated through a gating mechanism.

[0206] A dynamic sparse attention mechanism is used to generate a sparse mask based on at least one type of clause with the highest risk weight.

[0207] The model output is weighted and aggregated with a sparse mask of at least one type of clause and then averaged to produce a semantic vector.

[0208] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0209] For each node in the knowledge graph, determine the features of all neighboring nodes in the previous layer;

[0210] The aggregation function of graph isomorphic networks is used to aggregate the features of each node in the previous layer with the features of all its neighboring nodes in the previous layer;

[0211] The aggregated features are input into a multilayer perceptron for nonlinear transformation to learn the relationship between the features of each node and the features of its neighboring nodes.

[0212] The features of each node in the current layer are obtained by using the output of the multilayer perceptron, and the graph structure features are determined based on the features of each node in the current layer.

[0213] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0214] Obtain a preset number of software license templates, mark the software license templates with the type of tampering behavior, and obtain tampering information;

[0215] Based on the software license template labeled with the type of tampering behavior and the corresponding tampering information, a knowledge graph containing the software license template and tampering information is constructed.

[0216] Based on the knowledge graph, a dynamic sparse attention mechanism is used to extract semantic vectors, and graph isomorphic networks are used to extract graph structure features.

[0217] The semantic vector is fused with the graph structure features to form a joint feature vector;

[0218] A multimodal feature extraction model is trained based on the joint feature vector, and then used to detect tampering of software licenses.

[0219] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0220] Based on the multimodal feature extraction model, obtain the tampering confidence level of the software license;

[0221] If the tampering confidence level meets the preset confidence threshold, a heatmap of the tampering location of the software license is generated.

[0222] Based on the tampering location heatmap of the software license, a tampering risk score is calculated, and the software license is tampered with based on the tampering risk score.

[0223] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0224] Based on the tampered location heatmap of the software license, calculate the heat value of each heat point in the tampered location heatmap;

[0225] Based on the heat value of each heat point in the tampered location heat map, determine the tampering results of various terms and conditions in the software license;

[0226] Risk weighting of various terms and conditions for obtaining a software license;

[0227] The tampering risk score is calculated based on the results of tampering with various terms of the software license, the risk weight, and the confidence level of the software license tampering.

[0228] In one embodiment, the result of the tampering includes:

[0229] If the maximum value of the heat value of the current heat point is greater than the first threshold, and the variance of the heat values ​​between the current heat point and neighboring heat points is greater than the second threshold, it indicates that the text corresponding to the current heat point has been tampered with separately.

[0230] If the heat values ​​of a consecutive preset number of heat points are all greater than the third threshold, it means that the text of the clause corresponding to the consecutive preset number of heat points has been modified.

[0231] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0232] Based on the knowledge graph, the text data of the software license to be detected is converted into a sequence of tokens;

[0233] The token sequence is converted into an embedding vector, and the embedding vector is input into the BERT model to obtain the model output.

[0234] The risk weight of each type of clause in the software license to be tested is calculated through a gating mechanism.

[0235] A dynamic sparse attention mechanism is used to generate a sparse mask based on at least one type of clause with the highest risk weight.

[0236] The model output is weighted and aggregated with a sparse mask of at least one type of clause and then averaged to produce a semantic vector.

[0237] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0238] For each node in the knowledge graph, determine the features of all neighboring nodes in the previous layer;

[0239] The aggregation function of graph isomorphic networks is used to aggregate the features of each node in the previous layer with the features of all its neighboring nodes in the previous layer;

[0240] The aggregated features are input into a multilayer perceptron for nonlinear transformation to learn the relationship between the features of each node and the features of its neighboring nodes.

[0241] The features of each node in the current layer are obtained by using the output of the multilayer perceptron, and the graph structure features are determined based on the features of each node in the current layer.

[0242] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0243] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0244] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0245] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A tamper detection method of a software license, characterized by, The method comprises: acquiring a preset number of software license templates, and labeling tampering behavior types of the software license templates to obtain tampering information; constructing a knowledge graph containing software license templates and tampering information according to the software license templates after labeling the tampering behavior types and the corresponding tampering information; according to the knowledge graph, extracting a semantic vector by using a dynamic sparse attention mechanism, and extracting a graph structure feature by using a graph isomorphism network; fusing the semantic vector and the graph structure feature to form a joint feature vector; training a multi-modal feature extraction model according to the joint feature vector, and detecting tampering of a software license according to the multi-modal feature extraction model.

2. The method of claim 1, wherein, The tampering detection of the software license according to the multi-modal feature extraction model comprises: acquiring a tampering confidence of the software license according to the multi-modal feature extraction model; generating a tampering positioning heat map of the software license in the case that the tampering confidence meets a preset confidence threshold condition; calculating a tampering risk score according to the tampering positioning heat map of the software license, and detecting tampering of the software license according to the tampering risk score.

3. The method of claim 2, wherein, The calculation of the tampering risk score according to the tampering positioning heat map of the software license comprises: calculating a heat value of each heat point in the tampering positioning heat map according to the tampering positioning heat map of the software license; determining a tampering result of the software license on each type of clause according to the heat value of each heat point in the tampering positioning heat map; acquiring a risk weight of the software license on each type of clause; calculating a tampering risk score according to the tampering result of the software license on each type of clause, the risk weight, and the tampering confidence of the software license.

4. The method of claim 3, wherein, The tampering result comprises: in the case that a maximum value of the heat value of a current heat point is greater than a first threshold value, and a variance of the heat value between the current heat point and a neighboring heat point is greater than a second threshold value, it is indicated that the text corresponding to the current heat point is tampered with individually; in the case that the heat value of a continuous preset number of heat points is greater than a third threshold value, it is indicated that the clause text corresponding to the continuous preset number of heat points is modified.

5. The method of claim 1, wherein, The extraction of the semantic vector by using the dynamic sparse attention mechanism comprises: according to the knowledge graph, converting text data of the software license to be detected into a token sequence tokens; converting the token sequence tokens into an embedding vector, and inputting the embedding vector into a BERT model to obtain a model output result; calculating a risk weight of each type of clause of the software license to be detected through a gating mechanism; generating a sparse mask according to at least one type of clause with a high risk weight by using a dynamic sparse attention mechanism; performing weighted aggregation and average pooling on the model output result and the sparse mask of at least one type of clause to output a semantic vector.

6. The method of claim 1, wherein, The extraction of the graph structure feature by using the graph isomorphism network comprises: for each node in the knowledge graph, determining the features of all neighbor nodes in the previous layer; performing aggregation on the features of each node in the previous layer and the features of all neighbor nodes in the previous layer by using an aggregation function of the graph isomorphism network. The features after the polymerization are input into a multi-layer perception machine for nonlinear transformation, and the relationship between the features of each node and the features of neighbor nodes is learned; The features of each node at the current layer are obtained by using the multi-layer perception machine, and the graph structure features are determined according to the features of each node at the current layer.

7. A tamper detection apparatus of a software license, characterized by, The device comprises: An acquisition and processing module is configured to acquire a preset number of software license templates, label tampering behavior types of the software license templates, and obtain tampering information; A knowledge graph construction module is configured to construct a knowledge graph comprising software license templates and tampering information according to the software license templates after the tampering behavior types are labeled and the corresponding tampering information; A feature extraction module is configured to extract semantic vectors by using a dynamic sparse attention mechanism and extract graph structure features by using a graph isomorphism network according to the knowledge graph; A feature fusion module is configured to fuse the semantic vectors and the graph structure features to form joint feature vectors; A tampering detection module is configured to train a multi-modal feature extraction model according to the joint feature vectors, and perform tampering detection on software licenses according to the multi-modal feature extraction model.

8. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor executes the computer program to implement the steps of the method of any one of claims 1 to 6.

9. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 6.

Images