Software component identification method based on installation directory discovery and static-dynamic cooperative analysis

Abstract

This invention discloses a software component identification method based on installation directory discovery and dynamic / static collaborative analysis, belonging to the field of software data processing technology. The method includes the following steps: scanning and location discovery, dynamic / static collaborative analysis, and component identification result output. This invention performs incremental scanning of the target system and verifies the scanning and location accuracy to obtain verification results, enabling precise location of the software installation directory and deployment instances, further improving the reliability of the identification process and avoiding misidentification or omission. Furthermore, when insufficient accuracy is detected, the scanning and identification strategy is optimized before analysis, continuously improving the process and ensuring a more targeted and efficient scanning process, thereby enhancing identification accuracy. Moreover, the dynamic / static collaborative analysis combines static analysis and dynamic monitoring, enabling more accurate identification of software components. Simultaneously, confidence verification is used for further correlation and comparison, making the software component identification results more reliable and effective.

Description

Technical Field

[0001] This invention relates to the field of software data processing technology, and in particular to a method for identifying software components based on installation directory discovery and dynamic / static collaborative analysis. Background Technology

[0002] As modern software architectures evolve, software components and their dependencies become increasingly complex. Traditional static analysis can only analyze information about known components in file directories, ignoring dynamically loaded modules and changes in container environments. Dynamic analysis can capture runtime behavior, but its results are limited by the runtime state and cannot comprehensively identify all software components. Therefore, the combination of dynamic and static analysis is crucial for the comprehensive identification and management of software components.

[0003] In existing technologies, software component identification typically involves two main stages: static and dynamic analysis. First, the software's installation directory is scanned to collect all relevant files and their metadata, such as filenames, sizes, and extensions. Next, static analysis is performed. Specifically, static analysis tools, such as executable linker analyzers, are used to initially determine the file types, often distinguishing them by extensions and header information. In the dynamic analysis stage, the software is run and its behavior is monitored. By observing the interaction between the software and the operating system, loaded libraries, and system calls, runtime components can be further identified. This can be done using dynamic analysis tools such as DynamoRIO and Frida, or system call monitoring tools. Furthermore, to ensure the accuracy of component identification, signature and fingerprint recognition technologies can be used to verify software components by comparing them to known digital signatures or hash values. Next, logs or configuration files generated by package management tools are parsed to identify all components during the software installation process, further refining the component analysis. Finally, a detailed report is generated, typically including version information for each component, dependencies, and whether it belongs to a known third-party library or contains known vulnerabilities. The entire process combines static and dynamic analysis, effectively providing comprehensive software component identification results.

[0004] For example, Chinese patent application CN114780391A discloses a method, apparatus, device, and storage medium for analyzing code security defects, including: performing static analysis on the object under test to obtain code security defects existing in the object under test; performing software component analysis on the object under test to identify the source files of third-party components existing in the object under test; and determining the code security defects corresponding to the source files from each code security defect.

[0005] For example, Chinese invention patent CN120256275B discloses a method, device, and medium for identifying software components, including: obtaining a first dataset by acquiring all files in the software to be identified; extracting meta-file data to obtain a second dataset, and obtaining a first open-source file set by matching a first feature; reducing the first dataset to obtain a third dataset, calculating a minimum hash signature and generating a second feature set by using a program abstract syntax tree and corresponding sub-syntax trees, and obtaining a second open-source file set by matching a third feature; reducing the third dataset to obtain a fourth dataset, obtaining an updated syntax tree and constructing a control flow graph based on the abstract syntax tree and the fourth dataset, and obtaining a third open-source file set by matching the third feature set with a preset reference database using a fourth feature; and merging the first, second, and third open-source file sets to obtain a total set of open-source components in the software to be identified.

[0006] The above-mentioned technology has at least the following technical problems:

[0007] Static analysis relies on predefined rules and can identify static information such as package names, versions, and dependencies, but it cannot fully identify dynamically loaded or runtime-changing components. However, modern software is often deployed in hybrid environments containing multiple operating systems, containers, and virtualization platforms. This makes it impossible for existing static analysis methods to accurately capture certain dependencies, especially given the variability of software and its dependencies in containerized and virtualized environments.

[0008] Another point to consider is that while dynamic analysis can capture the actual behavior and dependencies of a program during runtime, it lacks in-depth information about static features. This makes it impossible for dynamic analysis to fully identify certain static dependencies (such as libraries statically linked at compile time). In existing technologies, the results of static and dynamic analysis are often isolated, lacking a unified correlation and verification mechanism, making it difficult to ensure both comprehensiveness and accuracy in identification and verifiability of results. Summary of the Invention

[0009] To address the technical problem of low accuracy in software component identification due to the weak correlation between static and dynamic analysis in existing technologies, this invention provides a software component identification method based on installation directory discovery and dynamic-static collaborative analysis. The technical solution is as follows:

[0010] This invention provides a software component identification method based on installation directory discovery and dynamic / static co-analysis. The method comprises the following steps: incrementally scanning the target system to locate the installation directory and deployment instances of the software it carries; obtaining verification results during the scanning process to verify the scanning positioning accuracy; and determining the need for optimization of the scanning identification strategy based on the verification results. The need determination process is as follows: if the verification result is a failure, it is determined that there is a need for optimization of the scanning identification strategy, and a dynamic / static co-analysis command is sent after optimization; if the verification result is a success, it is determined that there is no need for optimization, and a dynamic / static co-analysis command is sent to perform dynamic / static co-analysis, which includes static file parsing and dynamic runtime parsing; if it is determined that there is no need, a dynamic / static co-analysis command is sent to achieve software component identification through dynamic / static co-analysis; otherwise, a dynamic / static co-analysis command is sent after optimization of the scanning identification strategy; and obtaining confidence levels for correlation comparison in dynamic / static co-analysis. The verification results are used to determine whether to output software component identification results. The specific implementation is as follows: The static-dynamic timing synchronization deviation used for confidence assessment between static file parsing and dynamic runtime parsing is obtained. This deviation is compared with a stored timing synchronization deviation threshold to determine the confidence verification result. Specifically, if the static-dynamic timing synchronization deviation is not less than the timing synchronization deviation threshold, the confidence verification result is determined to be abnormal, and the software component identification result is not output; dynamic and static collaborative parsing is then performed again. If the static-dynamic timing synchronization deviation is less than the timing synchronization deviation threshold, the static-dynamic information completion rate is obtained and compared with the information completion setting value. Specifically, if the static-dynamic information completion rate is greater than the information completion setting value, the confidence verification result is determined to be normal, and the software component identification result is output. Otherwise, the confidence verification result is determined to be abnormal, and collaborative analysis and optimization are performed to enhance the effectiveness of dynamically loaded information in supplementing the missing parts of static parsing, thereby improving the collaborative effect of dynamic and static parsing.

[0011] The beneficial effects of the technical solutions provided in the embodiments of the present invention include at least the following:

[0012] 1. This invention first performs incremental scanning on the target system to identify its software installation directories and deployment instances. During the scanning process, verification results are simultaneously acquired to validate the scanning positioning accuracy. Incremental scanning focuses on newly added or changed parts, avoiding the cost of full scanning each time; positioning based on installation directories and deployment instances improves identification efficiency and coverage; and the simultaneous acquisition of verification results during scanning helps to promptly detect deviations or errors in scanning positioning, thereby improving overall accuracy. Compared to existing technologies that mostly use fixed scanning strategies and lack a closed-loop mechanism for adjusting strategies based on actual scanning results, this invention drives the optimization of the scanning strategy through verification results, forming an adaptive process that helps improve identification accuracy and reduce false positives and false negatives. Based on the verification results, it is determined whether there is a need to optimize the scanning identification strategy. If no need is found, a dynamic and static collaborative parsing command is sent directly; if optimization is found, the scanning identification strategy is optimized first, and then the dynamic and static collaborative parsing command is sent. Driving strategy optimization through verification results helps improve identification accuracy and efficiency in different scenarios. Furthermore, by employing a combined static and dynamic analysis approach—that is, integrating static information with dynamic behavior—software components can be identified more comprehensively. This compensates for potential blind spots that may exist when using only static or dynamic methods, reducing the possibility of misidentification or omissions that might result from static or dynamic analysis alone, thus achieving a more comprehensive identification. Simultaneously, this invention introduces a confidence verification mechanism, allowing identification results to be output only under conditions of high certainty, thereby improving the reliability of the final result. This is a crucial step neglected in many existing software component identification processes. Overall, this invention not only improves the accuracy and efficiency of software installation directory and deployment instance identification but also enhances the credibility of the identification results. Compared to existing technologies, it is more adaptive, wastes fewer resources, provides more comprehensive coverage, and has a lower risk of misidentification or omission.

[0013] 2. Incremental scanning is used to scan the target system to locate the software's installation directory and deployment instances. During the scanning process, the system monitors and acquires multiple verification parameters, such as directory location success rate, directory false recognition rate, instance identification success rate, and instance false recognition rate, to verify the scanning accuracy. Compared with traditional methods that often use fixed-depth, fixed-parallelism full scans and lack real-time verification and strategy adjustment mechanisms for identification accuracy, the dynamic strategy adjustment provided by this invention significantly improves the accuracy of identification and location, allowing the scanning and location process to be quantitatively evaluated, thereby promptly identifying problems with identification accuracy rather than relying on subjective experience. In addition, traditional methods often neglect the resource consumption and parallelism adjustment of the scanning process, focusing only on the identification result itself. This invention, however, simultaneously monitors resource indicators such as scanning time and memory usage, ensuring that the scanning process not only focuses on identification accuracy but also considers efficiency and resource consumption while improving identification accuracy, avoiding missed identifications due to shallow scanning or resource waste due to excessively deep scanning or excessive parallelism. At the same time, through optimization of the scanning identification strategy, the rule base update cycle and incremental scanning time limit are further adjusted according to actual needs to ensure efficient and accurate identification in complex target system environments. Furthermore, rule base updates in traditional methods are often periodic and inflexible, which may lead to delayed or untimely updates affecting the recognition results. This invention optimizes the scanning strategy based on verification results, ensuring that the recognition strategy is updated in a timely manner as the target system environment changes. This avoids the inefficiency and misidentification problems caused by fixed strategies, and improves the accuracy and real-time performance of scanning and recognition.

[0014] 3. Through the deep collaborative work of static parsing, dynamic parsing, and information completion, the present invention achieves efficient and accurate software component identification. First, the quality of static parsing is verified. The effectiveness of static file parsing is mainly judged by the recognition success rates of package names, versions, and license information. If the static parsing is considered qualified, confidence verification is continued, and the identification results are output. If the static parsing is unqualified, the accuracy of dynamic parsing is further improved by adjusting the memory monitoring parameters in dynamic running parsing, such as the memory image acquisition frequency and the process monitoring lifecycle. Further, during the dynamic running parsing process, the fluctuation amount is monitored and scanned for verification, including the fluctuations of directory location success rate and instance recognition success rate, and the memory image acquisition frequency and the process monitoring lifecycle are dynamically adjusted to ensure the stable progress of the parsing process. On this basis, the determination of the software component identification results is output through confidence verification, and at the same time, through granularity-level monitoring and adjustment, the perception ability of dynamic library loading and dependency relationship changes is enhanced while maintaining the recognition stability, so as to strengthen the refinement and adaptability of dynamic-static collaborative identification, improve the accuracy of dynamic-static collaborative parsing, and further ensure that the finally output identification results are more accurate and reliable. Compared with traditional dynamic-static fusion methods, this process has significant improvements in aspects such as accuracy, robustness, adaptive ability, and credibility control, and thus is more practical and reliable in the software component identification task of complex target systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the following-described drawings are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0016] Figure 1 It is a flowchart of the software component identification method based on installation directory discovery and dynamic-static collaborative analysis provided by the embodiment of the present invention;

[0017] Figure 2 It is a step process logic diagram of the software component identification method based on installation directory discovery and dynamic-static collaborative analysis provided by the embodiment of the present invention; <000004~1> Figure 3 It is a flowchart for obtaining the confidence verification results of the software component identification method based on installation directory discovery and dynamic-static collaborative analysis provided by the embodiment of the present invention;

[0019] Figure 4 It is a collaborative analysis optimization logic diagram of the software component identification method based on installation directory discovery and dynamic-static collaborative analysis provided by the embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0020] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0021] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0022] As software systems become increasingly complex and diverse, the number and types of software deployed in enterprise systems are growing daily, and they are widely present across multiple operating systems, containers, and runtime environments. Traditional software component identification methods often rely on static file scanning or package management information parsing. While these methods can identify known software package information to some extent, their accuracy drops significantly when faced with dynamically loaded modules, runtime dependency libraries, or nested components in container images.

[0023] Against this backdrop, it is necessary to propose a software component identification method based on installation directory discovery and dynamic-static collaborative analysis. By intelligently discovering and verifying the system installation directory, the method can accurately locate software deployment instances. Combined with dynamic runtime behavior analysis, it can supplement and verify dependency, version, and license information that is difficult to identify in static analysis, thereby improving the completeness and credibility of the identification. This method can effectively meet the actual needs of software asset auditing, security vulnerability detection, and compliance verification in multi-platform and multi-container environments.

[0024] like Figure 1 The diagram shown is a flowchart of a software component identification method based on installation directory discovery and dynamic / static collaborative analysis provided in an embodiment of the present invention. (Refer to...) Figure 1 The method includes the following steps: scanning and localization detection, dynamic and static collaborative analysis, and output of component identification results. (Reference) Figure 2 ,like Figure 2 The diagram shows the step-by-step flowchart of the software component identification method based on installation directory discovery and dynamic-static collaborative analysis provided in this embodiment of the invention. The corresponding logic is as follows: perform incremental scanning on the target system to locate the installation directory and deployment instance of the software it carries, verify the scanning and positioning accuracy to obtain the verification result, determine the need for scanning identification strategy optimization based on the verification result, if it is determined that there is no need, send a dynamic-static collaborative parsing instruction and obtain the confidence verification result, if it is determined that there is a need, send a dynamic-static collaborative parsing instruction after optimizing the scanning identification strategy and obtain the confidence verification result, and determine whether to output the software component identification result accordingly.

[0025] Specifically, the first step of the software component identification method based on installation directory discovery and dynamic / static collaborative analysis, namely S1: scanning and localization discovery, involves: firstly, performing an incremental scan of the target system to locate the installation directories and deployment instances of the software it hosts; simultaneously, acquiring verification results during the scanning process to validate the accuracy of the localization, and using these results to determine the need for optimizing the scanning identification strategy. By acquiring and analyzing the verification results used to verify the accuracy of the identification of installation directories and deployment instances during the scanning phase, issues of directory misidentification and omission can be identified in a timely manner, significantly improving the localization accuracy of software distribution in the target system. Furthermore, using the verification results as feedback, the scanning identification strategy can be dynamically adjusted, enabling adaptive optimization for different system environments, directory structures, or container characteristics, thus improving the adaptability and robustness of the method in complex deployment scenarios.

[0026] The specific steps for obtaining verification results during the scanning process to verify the scanning positioning accuracy, and determining the need to optimize the scanning recognition strategy based on the verification results are as follows:

[0027] S11. In the initial scan directory monitoring window, the file system monitoring tool (such as inotify) is used to obtain the scan verification parameters that reflect the accuracy of the identification of the installation directory and the deployment instance during the scan directory stage. The scan verification parameters include the directory location success rate, the directory misidentification rate, the instance identification success rate, and the instance misidentification rate.

[0028] S12, obtain the deviation between each item in the scan verification parameters and the corresponding set reference threshold, including the deviation between the directory positioning success rate and the maximum success threshold after processing, the deviation between the directory misidentification rate and the minimum misidentification threshold after processing, the deviation between the instance recognition success rate and the maximum success threshold after processing, and the deviation between the instance misidentification rate and the minimum misidentification threshold after processing. Deviation processing is the difference operation; determine whether each deviation is within the corresponding verification control range.

[0029] It should be noted that the reference threshold is stored in the software component identification database. This database is created first when designing the software component identification method based on installation directory discovery and dynamic-static collaborative analysis. It is specifically used to store core configuration information. This database stores various settings and mapping sets necessary for the operation of the method, such as the maximum success threshold for directory location and the minimum false identification threshold for the directory. The initial settings of these settings are not arbitrarily specified. Technical personnel can manually set, adjust or fine-tune them at any time according to the specific performance of the method in actual testing.

[0030] S13. If all deviations are within the corresponding verification control range, the verification result is determined to be successful, and the scanning verification parameters continue to be monitored.

[0031] S131, if the verification result is successful, it is determined that there is no need for scanning and recognition strategy optimization, and a dynamic and static collaborative parsing instruction is sent to perform dynamic and static collaborative parsing, which includes static file parsing and dynamic runtime parsing.

[0032] S14, if one or more deviations are outside the corresponding verification control range, the verification result is determined to be a failure. The initial scan depth is then adjusted based on the scan adjustment depth, i.e., the scan adjustment depth is set to the initial scan depth. The scan adjustment depth is the result of arithmetic coupling of the deviations outside the corresponding verification control range, input to the output of the scan depth adjustment mapping model. The scan depth adjustment mapping model is pre-trained using historical deviations and scan adjustment depths set by professionals based on empirical rules. Adjusting the scan depth automatically increases the scan depth when recognition accuracy is low, expanding the directory traversal and file parsing range to compensate for hidden components or nested directories that may be missed in static scanning. When recognition accuracy is stable, the scan range is appropriately narrowed to avoid redundant analysis of irrelevant directories and files. This dynamic adjustment method effectively prevents over-scanning and shallow scanning problems present in traditional fixed-depth scanning, achieving dual optimization of recognition accuracy and computational efficiency.

[0033] S141, if the verification result is that the verification fails, it is determined that there is a need to optimize the scanning and recognition strategy. After optimizing the scanning and recognition strategy, a dynamic and static collaborative parsing instruction is sent.

[0034] In the actual execution of software component recognition, the scanning phase typically involves numerous file traversals, feature comparisons, and path verification operations. When the target system is large or there are too many concurrent scanning tasks, problems such as excessively long scanning times and high system resource consumption can easily arise, leading to decreased scanning efficiency and even system performance fluctuations. On the other hand, when the parallelism setting is too low or resource utilization is insufficient, it will result in wasted computing power and reduced recognition efficiency. Therefore, it is necessary to introduce a real-time monitoring and dynamic adjustment mechanism for the total scanning time and memory usage during the scanning process. Specifically, this includes obtaining verification results used to verify the scanning positioning accuracy during the scanning process, and subsequently including:

[0035] First, the execution time of scanning with the initial scan parallelism is monitored in the catalog scanning phase by a task scheduler (such as Celery) to obtain the total scan time. The obtained total scan time is then compared with the stored upper limit threshold for scan time.

[0036] If the total scan time exceeds the upper limit threshold, a scan time anomaly alert is sent, and the deviation quantization value between the total scan time and the upper limit threshold is input into the scan parallelism adjustment mapping table to output the scan parallelism adjustment value. The output scan parallelism adjustment value is used to set the initial scan parallelism, i.e., the scan parallelism adjustment value is set as the initial scan parallelism. The scan parallelism adjustment mapping table is pre-trained using historical deviation quantization values ​​and scan parallelism adjustment values ​​set by professionals based on experience rules. It is used to describe the mapping relationship between the deviation quantization value and the scan parallelism adjustment value. The deviation quantization value is the absolute value of the difference between the total scan time and the upper limit threshold.

[0037] If the total scan time is not greater than the upper limit threshold for scan time, the resource consumption during the scan process is monitored to obtain the memory usage rate by calling the psutil library and a judgment is made. Specifically, when the obtained memory usage rate is less than the set minimum memory usage limit, a scan resource exception prompt is sent; otherwise, the total scan time and memory usage rate during the directory scanning stage are monitored.

[0038] By introducing a performance monitoring and parallelism adaptive adjustment mechanism based on time consumption and memory usage during the scanning process, intelligent performance control of the scanning process is achieved. This invention monitors time consumption and resource usage in real time during the scanning execution phase and uses this data as feedback for scanning strategy optimization. Through this mechanism, the scanning process achieves dynamic equilibrium under performance constraints, effectively preventing high-load overload or low-load idle phenomena that occur in traditional fixed-parallelism scanning, thereby significantly improving the execution efficiency and resource utilization of the scanning task. Furthermore, the dual-parameter feedback mechanism of time consumption and resources established in this invention enables the scanning process to have self-learning and continuous optimization capabilities, further ensuring the stable and efficient completion of the software component identification task while ensuring accuracy and performance.

[0039] The second step of the software component identification method based on installation directory discovery and dynamic / static co-analysis, namely S2: dynamic / static co-analysis, specifically involves: if it is determined that there is no requirement, a dynamic / static co-analysis command is sent to achieve software component identification through dynamic / static co-analysis; otherwise, a dynamic / static co-analysis command is sent after optimizing the scanning and identification strategy. It should be noted that the specific process for optimizing the scanning and identification strategy is as follows:

[0040] S21, the result of weighted coupling of each deviation quantity through assigned weights is input into the rule base update cycle mapping set, and the output is an update adjustment cycle used to adjust the initial update cycle corresponding to the preset rule base. That is, the update adjustment cycle is set as the update cycle, and the preset rule base is updated with the adjusted update cycle. The rule base update cycle mapping set is obtained by pre-training using the historical weighted coupling results of each deviation quantity and the update adjustment cycle set by professionals based on experience rules. It is used to describe the mapping relationship between the weighted coupling results of each deviation quantity and the update adjustment cycle. Among them, the weighted coupling of each deviation quantity through assigned weights is performed by adding the results of the product operation of directory positioning deviation quantity and directory positioning deviation weight, directory misidentification deviation quantity and directory misidentification deviation weight, instance identification deviation quantity and instance identification deviation weight, and instance misidentification deviation quantity and instance misidentification deviation weight.

[0041] S22, obtain the average update delay of the rule base after the preset rule base is updated through the log collection module (such as ELK Stack), and use the initial average update delay before the update as the set update delay limit. If the rule base update delay is greater than the set update delay limit, send a rule base update exception prompt. Otherwise, obtain the verification result as the quantization result of arithmetic coupling of all deviations that are not in the verification control range when the verification fails.

[0042] S23, the quantization result and the rule base update delay are arithmetically averaged and then input into the incremental scan time limit mapping set to output the incremental time limit adjustment value used for setting the maximum incremental scan time limit. The incremental scan time limit mapping set is pre-trained using the result of arithmetically averaging historical quantization results and rule base update delays, as well as the incremental time limit adjustment value set by professionals based on empirical rules. It describes the mapping relationship between the result of arithmetically averaging quantization results and rule base update delays and the incremental time limit adjustment value. By setting the maximum incremental scan time limit, dynamic time limit adaptive control of the scan execution process is achieved. This mechanism can effectively prevent excessive system resource consumption or task blocking caused by excessively long scan times, while ensuring the integrity and real-time performance of scan recognition, improving scan efficiency while maintaining high recognition accuracy.

[0043] S24, rescan the target system and obtain the verification result. Determine whether the obtained verification result is a successful verification. If yes, send a qualified prompt for scanning identification strategy optimization. Otherwise, trigger the scan error retry rollback mechanism. Specifically, determine whether the number of scan retries is greater than the set maximum number of retries. If yes, send a scan error prompt and provide feedback. If no, continue scanning the target system until a qualified prompt for scanning identification strategy optimization is sent or the number of scan retries is greater than the set maximum number of retries.

[0044] By introducing a scanning and recognition strategy optimization mechanism, dynamic adaptive control of the rule base update cycle, incremental scanning time limit, and retry rollback process is achieved. Adjusting the rule base update cycle ensures high consistency between the rule base content and the actual system state, thereby improving the real-time performance and effectiveness of the recognition rules. Dynamically setting the maximum incremental scanning time limit in conjunction with the rule base update delay optimizes scanning execution efficiency while ensuring recognition completeness, preventing excessive scanning task usage and performance bottlenecks. Furthermore, by setting a scanning error retry rollback mechanism, safe rollback and task self-recovery can be achieved in the event of anomalies, significantly improving the system's stability and fault tolerance.

[0045] It should also be noted that the specific process for performing dynamic and static collaborative analysis is as follows:

[0046] Q1. Use the ScanCode Toolkit open-source tool to obtain static parsing quantitative data that reflects the quality of static file parsing. The static parsing quantitative data includes package name recognition success rate, version recognition success rate, and license information recognition success rate.

[0047] Q2. Determine whether each item in the static parsing quantification data is greater than the corresponding set recognition success threshold. The recognition success threshold is stored in the software component recognition database, including the minimum threshold for package name recognition, the minimum threshold for version recognition, and the minimum threshold for license information recognition.

[0048] Q3, if yes, indicates that the static file parsing effect is qualified, and the confidence verification result is obtained. Furthermore, in the software component identification process, relying solely on static file parsing often fails to fully reflect the true composition of the system during runtime. Because some software components exist dynamically, reside in memory, or are temporary processes during runtime, static parsing results are prone to omissions or biases, leading to decreased identification accuracy. Therefore, after the static file parsing effect is qualified, the process also includes dynamic adjustment of memory monitoring parameters during dynamic runtime parsing. The specific process is as follows:

[0049] Q31. Obtain the scan verification fluctuation amount, which reflects the degree of fluctuation of the scan verification parameters within a set interval. The scan verification fluctuation amount is the result of the arithmetic mean of the fluctuation score of successful directory positioning and the fluctuation score of successful instance recognition. The fluctuation score of directory positioning is the result of the difference between the maximum and minimum values ​​of the success rate of directory positioning within the set interval and the percentage of the reference maximum directory positioning deviation. The fluctuation score of successful instance recognition is the result of the difference between the maximum and minimum values ​​of the success rate of instance recognition within the set interval and the percentage of the reference maximum instance recognition deviation.

[0050] Q32. If the scan verification fluctuation is not greater than the set fluctuation reference value, then continue to monitor the scan verification fluctuation. Otherwise, dynamically adjust the memory monitoring parameters during the dynamic operation and parsing process. Specifically, set the target process memory image acquisition frequency based on the acquired memory image acquisition reference frequency. That is, set the memory image acquisition reference frequency to the memory image acquisition frequency. The memory image acquisition reference frequency is the output result corresponding to the input static parsing quantitative data arithmetic mean to the memory image acquisition mapping table. The memory image acquisition mapping table is pre-trained using the historical static parsing quantitative data arithmetic mean and the memory image acquisition reference frequency set by professionals based on experience rules. It is used to describe the mapping relationship between the static parsing quantitative data arithmetic mean and the memory image acquisition reference frequency.

[0051] Q33, after setting up, the initial process monitoring lifecycle is adjusted according to the process benchmark monitoring lifecycle, that is, the initial process monitoring lifecycle is set as the process benchmark monitoring lifecycle. Based on the adjusted process monitoring lifecycle, the target process memory image data collected at the memory image acquisition benchmark frequency is recorded. The process benchmark monitoring lifecycle is the result of the static parsing quantization data being processed by arithmetic mean and input into the process monitoring lifecycle mapping table. The process monitoring lifecycle mapping table is pre-trained using the result of the arithmetic mean of historical static parsing quantization data and the process benchmark monitoring lifecycle set by professionals based on experience rules. It is used to describe the mapping relationship between the result of the arithmetic mean of static parsing quantization data and the process benchmark monitoring lifecycle.

[0052] By dynamically adjusting the frequency of memory image acquisition of the target process in coordination with the initial process monitoring lifecycle, adaptive optimization control of the dynamic and static collaborative analysis phase is achieved. When fluctuations in scanning verification or changes in recognition accuracy are detected, the memory image acquisition frequency can be automatically adjusted based on static analysis quantization data, ensuring timely capture of the dynamic loading behavior and transient dependencies of running processes. Simultaneously, by dynamically adjusting the process monitoring lifecycle, the monitoring time window is ensured to match the system's operational characteristics, thus fully covering the process's startup and termination phases. This dual-parameter collaborative adjustment mechanism effectively avoids monitoring blind spots and resource waste caused by fixed parameter configurations. While ensuring the completeness and accuracy of recognition, it significantly improves analysis efficiency and system stability, thereby achieving high efficiency, intelligence, and adaptability in the software component recognition process.

[0053] Q4. If not, it indicates that the static file parsing effect is unsatisfactory. Correct the memory monitoring parameter settings during dynamic parsing and obtain the confidence verification results. Memory monitoring parameters include memory image acquisition frequency and process monitoring lifecycle. The specific process for correcting the memory monitoring parameter settings during dynamic parsing is as follows:

[0054] Q41, adjust the memory image acquisition base frequency based on the acquired memory image acquisition setting frequency, that is, set the memory image acquisition setting frequency to the memory image acquisition base frequency. When the static file parsing effect is unqualified, input the arithmetic coupling result of all items in the static parsing quantized data that are not greater than the corresponding set recognition success threshold into the output result corresponding to the memory leak detection mapping set.

[0055] Q42, when the static file parsing effect is unqualified, arithmetically couple all items in the static parsing quantization data that are not greater than the corresponding set recognition success threshold, and then input them into the process monitoring lifecycle mapping table to output the process monitoring setting cycle used to adjust the process baseline monitoring lifecycle.

[0056] By adjusting memory monitoring parameters during dynamic parsing, an adaptive compensation mechanism is implemented to address insufficient static file parsing performance. When the recognition success rate in the static parsing quantified data falls below a set threshold, a memory image acquisition frequency and a process monitoring cycle are generated to specifically correct the monitoring parameters during the dynamic parsing phase. This mechanism effectively compensates for blind spots in static recognition by increasing the memory image acquisition frequency and extending the process monitoring lifecycle when static parsing results are incomplete. It enhances the ability to capture runtime dependencies, temporary loaded modules, and implicit components, achieving closed-loop optimization through dynamic and static collaboration, and further improving the completeness and reliability of the overall recognition results.

[0057] The third step of the software component identification method based on installation directory discovery and dynamic-static co-analysis, namely S3: component identification result output, specifically involves obtaining the confidence verification results used for dynamic-static co-analysis correlation comparison, and determining whether to output the software component identification results based on these results. For example... Figure 3 The diagram shows the flowchart for obtaining the confidence verification result of the software component identification method based on installation directory discovery and dynamic-static collaborative analysis provided in this embodiment of the invention. The corresponding logic is as follows: The obtained static-dynamic time-series synchronization deviation is compared with the stored time-series synchronization deviation threshold. If the static-dynamic time-series synchronization deviation is not less than the time-series synchronization deviation threshold, the confidence verification result is determined to be abnormal, the software component identification result is not output, and dynamic-static collaborative analysis is performed again. If the static-dynamic time-series synchronization deviation is less than the time-series synchronization deviation threshold, the static-dynamic information completion rate is obtained. When the static-dynamic information completion rate is greater than the information completion setting value, the confidence verification result is determined to be normal, and the software component identification result is output. Otherwise, the confidence verification result is determined to be abnormal, and collaborative analysis optimization is performed.

[0058] refer to Figure 3 The confidence level verification results are obtained through the following steps:

[0059] S31, obtain the static-dynamic time synchronization deviation used for confidence determination between static file parsing and dynamic runtime parsing through a time series difference algorithm.

[0060] S32, compare the acquired static-dynamic timing synchronization deviation with the stored timing synchronization deviation threshold to determine the confidence verification result. The specific process is as follows:

[0061] S33. If the static-dynamic timing synchronization deviation is not less than the timing synchronization deviation threshold, the confidence verification result is determined to be abnormal, the software component identification result is not output, and the dynamic-static collaborative analysis is performed again.

[0062] S34. If the static-dynamic timing synchronization deviation is less than the timing synchronization deviation threshold, the static-dynamic information completion rate is obtained through an open-source analysis tool (such as ScanCode) and compared with the information completion setting value. Specifically, when the static-dynamic information completion rate is greater than the information completion setting value, the confidence verification result is determined to be normal, and the software component identification result is output. Otherwise, the confidence verification result is determined to be abnormal, and collaborative analysis and optimization are performed to enhance the effectiveness of dynamic loading information in supplementing the missing parts of static parsing, thereby improving the collaborative effect of dynamic and static parsing.

[0063] Among them, such as Figure 4The diagram shown illustrates the collaborative analysis optimization logic of the software component identification method based on installation directory discovery and dynamic-static collaborative analysis provided in this embodiment of the invention. The corresponding logic is as follows: The obtained completion deviation value is compared with the controllable completion deviation range. If the completion deviation value is within the controllable range, the dynamic library monitoring and adjustment granularity is obtained based on the arithmetic average of the static-dynamic timing synchronization deviation and the static-dynamic information completion rate. Otherwise, the dynamic library monitoring and adjustment granularity is obtained based on the static-dynamic information completion rate, and the initial dynamic library monitoring granularity is set according to the output dynamic library monitoring and adjustment granularity. (Refer to...) Figure 4 Collaborative analysis and optimization, the specific steps are as follows:

[0064] S341, obtain the completion deviation value, which is the difference between the static-dynamic information completion rate and the information completion setting value, and compare the obtained completion deviation value with the controllable completion deviation range.

[0065] S342, if the completion deviation value is within the controllable range of completion deviation, the result of the arithmetic average of the static-dynamic timing synchronization deviation and the static-dynamic information completion rate is input into the dynamic library monitoring granularity mapping model to output the dynamic library monitoring adjustment granularity; otherwise, the static-dynamic information completion rate is input into the dynamic library adjustment granularity mapping model to output the dynamic library monitoring adjustment granularity. The dynamic library monitoring granularity mapping model is pre-trained using the result of the arithmetic average of the historical static-dynamic timing synchronization deviation and the static-dynamic information completion rate, as well as the dynamic library monitoring adjustment granularity set by professionals based on empirical rules. The dynamic library adjustment granularity mapping model is pre-trained using the historical static-dynamic information completion rate and the dynamic library monitoring adjustment granularity set by professionals based on empirical rules.

[0066] S343 sets the initial dynamic library monitoring granularity based on the output dynamic library monitoring adjustment granularity, that is, sets the initial dynamic library monitoring granularity to the dynamic library monitoring adjustment granularity; based on static parsing quantization data and historical operation characteristics, the dynamic library monitoring granularity is reasonably set, including monitoring frequency and coverage, so that the loading and running behavior of key dynamic libraries are fully captured. This mechanism can ensure that dynamic dependencies and transient loading modules are fully identified, while avoiding the system performance burden caused by excessive monitoring. It achieves an optimized balance between recognition accuracy and system resource consumption, and improves the efficiency, stability and adaptability of the software component recognition system.

[0067] Overall, by incrementally scanning and locating the software installation directory and deployment instances of the target system, and acquiring verification results in real time during the scanning process, this invention achieves dynamic evaluation and adaptive optimization of scanning and positioning accuracy, thereby improving recognition accuracy and efficiency. Compared to traditional fixed scanning strategies, this invention introduces a verification result-driven strategy optimization, forming a closed-loop feedback mechanism that effectively reduces false positives and false negatives. Combining dynamic and static collaborative analysis, it fully integrates static file features and dynamic operational behaviors to achieve comprehensive identification of software components, compensating for the blind spots of single analysis methods. Simultaneously, a confidence verification mechanism is introduced, outputting results only when they reach a high level of confidence, further enhancing the reliability of the results. This approach boasts significant advantages in high recognition accuracy, excellent resource utilization, and high result reliability.

[0068] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0069] This invention is described with reference to flowchart illustrations and / or block diagrams of systems, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0070] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0071] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0072] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0073] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

[0074] The above are merely specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A software component identification method based on installation directory discovery and dynamic / static collaborative analysis, characterized in that, Includes the following steps: Incremental scanning is performed on the target system to locate the installation directory and deployment instances of the software it hosts. Verification results are obtained during the scanning process to check the scanning accuracy, and the results are used to determine the need for optimizing the scanning identification strategy. The requirement determination process is as follows: If the verification result is that the verification fails, it is determined that there is a need to optimize the scanning and recognition strategy. After optimizing the scanning and recognition strategy, a dynamic and static collaborative parsing instruction is sent. If the verification result is successful, it is determined that there is no need for scanning and recognition strategy optimization, and a dynamic and static collaborative parsing instruction is sent to perform dynamic and static collaborative parsing, which includes static file parsing and dynamic runtime parsing. If it is determined that there is no demand, a dynamic-static collaborative parsing instruction is sent to achieve software component identification through dynamic-static collaborative parsing; otherwise, a dynamic-static collaborative parsing instruction is sent after optimizing the scanning and identification strategy. Obtain the confidence verification results for dynamic and static collaborative analysis and association comparison, and determine whether to output the software component identification results based on these results; the specific implementation is as follows: Obtain the static-dynamic timing synchronization deviation used for confidence determination between static file parsing and dynamic runtime parsing; The obtained static-dynamic timing synchronization deviation is compared with the stored timing synchronization deviation threshold to determine the confidence verification result. The specific process is as follows: If the static-dynamic timing synchronization deviation is not less than the timing synchronization deviation threshold, the confidence verification result is determined to be abnormal, the software component identification result is not output, and the dynamic-static collaborative analysis is performed again. If the static-dynamic timing synchronization deviation is less than the timing synchronization deviation threshold, the static-dynamic information completion rate is obtained and compared with the information completion setting value. Specifically, when the static-dynamic information completion rate is greater than the information completion setting value, the confidence verification result is determined to be normal and the software component identification result is output. Otherwise, the confidence verification result is determined to be abnormal, and collaborative analysis and optimization are performed to enhance the effectiveness of dynamic loading information in supplementing the missing parts of static parsing, thereby improving the collaborative effect of dynamic and static parsing. The specific steps of the collaborative analysis optimization are as follows: obtain the completion deviation value, which is the degree of deviation between the static-dynamic information completion rate and the information completion set value, and compare the obtained completion deviation value with the controllable completion deviation range. If the completion deviation is within the controllable range of completion deviation, the result of the arithmetic average of the static-dynamic timing synchronization deviation and the static-dynamic information completion rate is input into the dynamic library monitoring granularity mapping model to output the dynamic library monitoring adjustment granularity. Otherwise, the static-dynamic information completion rate is input into the dynamic library adjustment granularity mapping model to output the dynamic library monitoring adjustment granularity. The initial dynamic library monitoring granularity is set according to the output dynamic library monitoring adjustment granularity.

2. The software component identification method based on installation directory discovery and dynamic / static collaborative analysis according to claim 1, characterized in that, The specific steps for obtaining the verification results used to verify the scanning positioning accuracy during the scanning process are as follows: Within the initial scan directory monitoring window, obtain scan verification parameters that reflect the accuracy of identifying the installation directory and deployment instance during the scan directory phase. These scan verification parameters include directory location success rate, directory misidentification rate, instance identification success rate, and instance misidentification rate. Each item in the scan verification parameter is obtained and its deviation from the corresponding set reference threshold is determined. It is then determined whether each deviation is within the corresponding verification control range. If all deviations are within the corresponding verification control range, the verification result is determined to be successful, and the monitoring and scanning of verification parameters continues. If one or more of the deviations are not within the corresponding verification control range, the verification result is determined to be verification failure, and the initial scan depth is extended and adjusted according to the scan adjustment depth. The scan adjustment depth is the result of arithmetic coupling of each deviation that is not within the corresponding verification control range, which is input to the output result of the scan depth adjustment mapping model.

3. The software component identification method based on installation directory discovery and dynamic / static collaborative analysis according to claim 2, characterized in that, The process of acquiring the verification results used to verify the scanning positioning accuracy during the scanning process further includes: The execution time of scanning with the initial scanning parallelism during the catalog scanning phase is monitored to obtain the total scanning time. The obtained total scanning time is then compared with the stored upper limit threshold for scanning time. If the total scan time exceeds the upper limit threshold of scan time, a scan time abnormality prompt is sent, and the deviation quantization value between the total scan time and the upper limit threshold of scan time is input into the scan parallelism adjustment mapping table to output the scan parallelism adjustment value. The initial scan parallelism is set with the output scan parallelism adjustment value. If the total scan time is not greater than the upper limit threshold for scan time, the resource consumption during the scan process is monitored to obtain the memory usage rate and a judgment is made. Specifically, when the obtained memory usage rate is less than the set minimum memory usage limit, a scan resource abnormality prompt is sent; otherwise, the total scan time and memory usage rate during the scan directory stage are monitored.

4. The software component identification method based on installation directory discovery and dynamic / static collaborative analysis according to claim 1, characterized in that, The specific process for optimizing the scanning and recognition strategy is as follows: The result of weighting and coupling each deviation through the assigned weights is input into the rule base update cycle mapping set, and the output is an update adjustment cycle used to adjust the initial update cycle corresponding to the preset rule base. The preset rule base is then updated using the adjusted update cycle. Get the average update delay of the rule base after the preset rule base is updated, and use the initial average update delay before the update as the set update delay limit. If the rule base update delay is greater than the set update delay limit, send a rule base update exception prompt. Otherwise, get the verification result as the quantization result of arithmetic coupling of all deviations that are not in the verification control range when the verification fails. The quantification results and rule base update delay are arithmetically averaged and then input into the incremental scan time limit mapping set to output the incremental time limit adjustment value used for setting the maximum incremental scan time limit. The target system is scanned again to obtain the verification results. It is then determined whether the verification passed. If so, a successful scan identification strategy optimization prompt is sent; otherwise, a scan error retry and rollback mechanism is triggered, specifically: Determine if the number of scan retries exceeds the set maximum number of retries. If yes, send a scan error message and provide feedback. If no, continue scanning the target system until a scan identification strategy optimization success message is sent or the number of scan retries exceeds the set maximum number of retries.

5. The software component identification method based on installation directory discovery and dynamic / static collaborative analysis according to claim 1, characterized in that, The specific process for performing dynamic and static collaborative analysis is as follows: Obtain static parsing quantification data to reflect the quality of static file parsing, including package name recognition success rate, version recognition success rate, and license information recognition success rate; Check each item in the statically analyzed quantized data to see if it is greater than the set recognition success threshold: If so, it indicates that the static file parsing effect is satisfactory, and the confidence verification result is obtained; If not, it indicates that the static file parsing effect is unqualified. In the process of dynamic running parsing, the memory monitoring parameter settings are corrected and the confidence verification results are obtained. The memory monitoring parameters include the memory image acquisition frequency and the process monitoring life cycle.

6. The software component identification method based on installation directory discovery and dynamic / static collaborative analysis according to claim 5, characterized in that, The static file parsing results are satisfactory. The next step involves dynamically adjusting memory monitoring parameters during the dynamic parsing process. The specific process is as follows: The scanning verification fluctuation amount is obtained within a set interval to reflect the degree of fluctuation of the scanning verification parameters. The scanning verification fluctuation amount is the result of the arithmetic mean of the fluctuation score of successful directory positioning and the fluctuation score of successful instance identification. The fluctuation score of directory positioning is the result of the difference between the maximum and minimum values ​​of the directory positioning success rate within the set interval and the percentage of the reference maximum directory positioning deviation. The fluctuation score of successful instance identification is the result of the difference between the maximum and minimum values ​​of the instance identification success rate within the set interval and the percentage of the reference maximum instance identification deviation. If the scan verification fluctuation is not greater than the set fluctuation reference value, then the scan verification fluctuation will continue to be monitored; otherwise, the memory monitoring parameters during the dynamic operation and parsing process will be dynamically adjusted as follows: The target process memory image acquisition frequency is set based on the acquired memory image acquisition reference frequency. The memory image acquisition reference frequency is the result of the arithmetic mean of the input static parsing quantization data to the output result corresponding to the memory image acquisition mapping table. After setting up, the initial process monitoring lifecycle is adjusted according to the process benchmark monitoring lifecycle. Based on the adjusted process monitoring lifecycle, the target process memory image data collected at the memory image acquisition benchmark frequency is recorded. The process benchmark monitoring lifecycle is the result of inputting the static parsed quantized data into the process monitoring lifecycle mapping table after arithmetic averaging.

7. The software component identification method based on installation directory discovery and dynamic / static collaborative analysis according to claim 5, characterized in that, The specific process for correcting memory monitoring parameter settings during dynamic runtime parsing is as follows: The memory image acquisition base frequency is adjusted based on the acquired memory image acquisition set frequency. When the static file parsing effect is unqualified, the arithmetic coupling result of all items in the static parsing quantized data that are not greater than the corresponding set recognition success threshold is input to the output result corresponding to the memory image acquisition mapping table. When the static file parsing effect is unsatisfactory, all items in the static parsing quantization data that are not greater than the corresponding set recognition success threshold are arithmetically coupled, and then input into the process monitoring lifecycle mapping table to output the process monitoring setting cycle used to adjust the process baseline monitoring lifecycle.

Images