Binary software component identification method based on multilevel feature library

Abstract

The invention discloses a binary software component identification method based on a multilevel feature library, and belongs to the technical field of data processing, and the method comprises the following steps: S1, obtaining a first matching result, if the first matching result is successful matching, obtaining a component identification result of binary software, otherwise, executing S2; s2, a second matching result is obtained, if the second matching result shows that matching succeeds, a component recognition result of the binary software is obtained, and if not, S3 is executed; s3, obtaining a third matching result; and S4, based on analysis of the third matching result, if the third matching result shows that matching succeeds, obtaining a component identification result of the binary software, otherwise, executing symbol minimum segmentation length adjustment, and solving the problem that in the prior art, due to nondeterministic offset between the section relocation information and the import table function name mapping, the component identification result of the binary software cannot be obtained. The structural feature matching result is distorted, so that the confidence coefficient of the binary software component recognition result is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and particularly relates to a binary software component identification method based on a multi-level feature library. BACKGROUND

[0002] The existing binary software component identification method based on a multi-level feature library forms a first data set by acquiring all files of the software to be identified, and obtains a second data set by extracting metafile data; then a first open source file set is obtained through first feature matching, a third data set is obtained by deleting the first data set, and the minimum hash signature is calculated based on the program abstract syntax tree and the sub syntax tree to form a second feature set, and a second open source file set is obtained through third feature matching; a fourth data set is obtained by further deleting the third data set, and the updated abstract syntax tree and control flow diagram are constructed, a third open source file set is obtained through fourth feature matching, and finally the open source component total set in the software to be identified is obtained by merging each open source file set to complete the binary software component identification.

[0003] For example, the Chinese invention patent with the publication number CN120256275B discloses a software component identification analysis method and device, medium, which includes: obtaining all files in the software to be identified to obtain a first data set; extracting metafile data to obtain a second data set, and obtaining a first open source file set through first feature matching; deleting the first data set to obtain a third data set, calculating the minimum hash signature based on the program abstract syntax tree and the corresponding sub syntax tree to generate a second feature set, and obtaining a second open source file set through third feature matching; deleting the third data set to obtain a fourth data set, obtaining an updated syntax tree based on the abstract syntax tree and the fourth data set, and constructing a control flow diagram, and obtaining a third open source file set through fourth feature matching of the third feature set and a preset reference database; and merging the first open source file set, the second open source file set and the second open source file set to obtain the open source component total set in the software to be identified.

[0004] For example, the Chinese invention patent with the publication number CN119336637B discloses an operating system kernel fuzz testing method, device and equipment, which includes: obtaining initial input and splitting the initial input to generate an input set; performing fuzz testing on the input set and obtaining a fuzz testing result; storing the fuzz testing result in a key component inference file to generate a key component inference table; and generating a seed selection strategy in a seed library combined with the key component inference table to guide seed mutation selection. By identifying and utilizing the key components in the system call sequence, the coverage of the fuzz testing is improved. The correspondence between the key components in the system call sequence and the corresponding path basic blocks is established to better explore potential security vulnerabilities. According to the selection of mutation points, different mutation strategies are executed to effectively improve the existing fuzz testing method and improve the efficiency and quality of vulnerability mining.

[0005] However, in the process of implementing the technical scheme of the embodiments of the present application, the applicant found that the above-mentioned technology at least has the following technical problems: In the existing binary software component identification technology, a hierarchical matching strategy is usually adopted, including hash matching, code feature matching and structure feature matching, to gradually improve the accuracy and coverage of identification. However, these technologies have significant deficiencies when processing target files generated by different compilers, linkers or custom packaging strategies. However, in actual files, these mapping relationships may have non-deterministic offsets: section address changes, symbol offset inconsistencies, import table function name order rearrangements, etc. If such offsets occur, the traditional method cannot effectively correct the structure features, resulting in misalignment of section and symbol matching, and thus distorting the structure feature similarity calculation results. The direct consequences include: misjudging homologous components as being of different origins, backtracking matches that should have been confirmed in the third layer, reducing the overall identification system confidence, and increasing the misidentification rate. The existing technology usually ignores the impact of such offsets on matching accuracy and cannot provide an effective offset detection and correction mechanism. Therefore, there is a problem of confidence reduction in binary software component identification results due to non-deterministic offsets between section relocation information and import table function name mapping, which distorts the structure feature matching results. SUMMARY

[0006] To solve the problem of confidence reduction in binary software component identification results due to non-deterministic offsets between section relocation information and import table function name mapping, which distorts the structure feature matching results, the embodiments of the present application provide a binary software component identification method based on a multi-level feature library. The technical scheme is as follows: S1, obtain a cryptographic hash value of a target file of a binary software, and match the hash value with hash records in a multi-level feature library to obtain a first matching result, if the first matching result is a matching success, obtain a component recognition result of the binary software, otherwise, execute S2; S2, extract a code feature segment in the target file, and perform a similarity matching with code features in the multi-level feature library to obtain a second matching result, if the second matching result is a matching success, obtain the component recognition result of the binary software, otherwise, execute S3; S3, analyze a structure feature in the target file, and analyze to obtain a symbol offset determination label, if the symbol offset determination label is no obvious offset, directly analyze to obtain a second similarity, otherwise, perform a symbol offset consistency judgment, if the offset is consistent, perform a unified correction processing, otherwise, perform a section pair mapping processing, obtain corrected position information, and thus perform a corrected structure similarity analysis to obtain the second similarity, and thus obtain a third matching result; S4, based on the third matching result analysis, if the third matching result is a matching success, obtain the component recognition result of the binary software, otherwise, execute a symbol minimum segmentation length adjustment, and after the adjustment, update and execute the steps of S3 and S4 to obtain the component recognition result of the binary software.

[0007] The technical scheme provided by the embodiment of the application has at least the following beneficial effects: 1. The binary software component recognition method based on the multi-level feature library provided by the application, by obtaining each section parameter and symbol position of the target file, and performing a one-by-one matching analysis with corresponding section symbols and positions of each reference sample in the multi-level feature library to obtain an average symbol offset, the symbol offset threshold is used to determine whether the target file has a symbol offset, and when the offset is consistent, a unified correction processing is performed, and thus the structure feature of the target file is accurately corrected, effectively solving the problem in the prior art that due to the non-deterministic offset between the section relocation information and the import table function name mapping, the structure feature matching result is distorted, and thus the confidence of the binary software component recognition result is reduced.

[0008] 2. The application extracts the cryptographic hash value of the target file, and compares each reference sample hash record in the multi-level feature library one by one, so as to quickly judge the first matching result, and thus efficiently recognize the completely consistent file, effectively solving the problem in the prior art that the recognition speed is slow and misjudgment is easy when matching a large number of files.

[0009] 3、The application extracts the code feature fragments of the target file, inputs them into the code feature similarity analysis model in the multi-level feature library for similarity calculation, selects the reference sample corresponding to the maximum similarity, and performs similarity threshold judgment, thereby realizing accurate matching of the code-level variant file, and effectively solving the problem of difficult identification of homologous files caused by slight modification of code, compilation optimization or confusion processing in the prior art.

[0010] 4、The application vectorizes the section vectors of the target file, accumulates and quantizes the numerical characteristic values of the reference sample section, performs two-norm energyization and symbol matching similarity coupling processing, thereby obtaining the section vector similarity and the reference structure similarity, selects the maximum similarity sample as the target matching sample, and realizes accurate matching of the file with slight deviation or asynchronous structure characteristics, effectively solving the problem of distortion of comprehensive similarity calculation caused by section misplacement or symbol deviation in the prior art, thereby affecting the recognition accuracy. BRIEF DESCRIPTION OF DRAWINGS

[0011] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0012] Figure 1 A flow chart of a binary software component identification method based on a multi-level feature library is provided for the embodiments of the present application. Figure 2 A general flow chart of a binary software component identification method based on a multi-level feature library is provided for the embodiments of the present application. Figure 3 A symbol deviation judgment flow chart of a binary software component identification method based on a multi-level feature library is provided for the embodiments of the present application. Figure 4 A section pair mapping processing and comprehensive similarity calculation flow chart of a binary software component identification method based on a multi-level feature library is provided for the embodiments of the present application. DETAILED DESCRIPTION

[0013] The technical solutions in the present application will be described below in combination with the drawings.

[0014] In the embodiments of the present application, the words such as "for example", "for instance", "such as", or "for example" are used to represent an example, an illustration or an example. Any embodiment or design scheme described as "for example" in the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, the word "for example" is intended to present the concept in a specific manner. In addition, in the embodiments of the present application, the meaning expressed by "and / or" can be both, or can be one of the two.

[0015] In the embodiments of the present application, "image" and "picture" can be used interchangeably at times. It should be pointed out that the meanings expressed are consistent when the distinction is not emphasized. "Of", "corresponding" and "corresponding" can be used interchangeably at times. It should be pointed out that the meanings expressed are consistent when the distinction is not emphasized.

[0016] In the embodiments of the present application, subscripts such as W1 may be written in non-subscript form such as W1 at times. The meanings expressed are consistent when the distinction is not emphasized.

[0017] In order to make the technical problems, technical schemes and advantages to be solved by the present application more clear, the following will be described in detail in conjunction with the drawings and specific embodiments.

[0018] As shown in Figure 1 and Figure 2 , a flowchart of a binary software component identification method based on a multi-level feature library provided by the embodiments of the present application, Figure 2A binary software component identification method based on a multi-level feature library provided by the embodiment of the application has the following steps: S1, obtaining a cryptographic hash value of a target file of a binary software, and matching the cryptographic hash value with hash records in a multi-level feature library to obtain a first matching result; if the first matching result is a matching success, a component identification result of the binary software is obtained; otherwise, S2 is executed; S2, extracting a code feature segment in the target file, and performing a similarity matching of the code feature segment with code features in the multi-level feature library to obtain a second matching result; if the second matching result is a matching success, the component identification result of the binary software is obtained; otherwise, S3 is executed; S3, analyzing a structural feature in the target file, and analyzing to obtain a symbol offset determination label; if the symbol offset determination label is no obvious offset, a second similarity is directly analyzed; otherwise, a symbol offset consistency is judged; if the offset is consistent, a unified correction processing is performed; otherwise, a section pair mapping processing is performed, position information after correction is obtained, a structural similarity after correction is analyzed based on the position information after correction, the second similarity is obtained, and a third matching result is obtained; S4, based on the third matching result analysis, if the third matching result is a matching success, the component identification result of the binary software is obtained; otherwise, a symbol minimum segmentation length adjustment is performed, and the steps of S3 and S4 are updated after the adjustment to obtain the component identification result of the binary software.

[0019] In the embodiment, when it is necessary to perform a security review on an externally obtained binary software package to ensure that the binary software package is from a trusted source, is in compliance with a version, and has not been maliciously tampered with, the cryptographic hash value of the target file can be quickly obtained for preliminary matching through the scheme; if the hash matching fails, a code feature segment similarity analysis, a symbol offset determination, and a structural similarity analysis are performed for deep comparison, so that the real component and version information of the binary file are identified. In the field of information security, security researchers need to analyze whether a specific binary program contains a known vulnerability or whether an official patch has been applied. The scheme can compare the target binary file with known vulnerability samples or patch versions in the multi-level feature library, accurately identify the file component through symbol offset and section structure analysis, and even if the binary is rearranged or slightly modified, the similarity can also be detected through structure and feature vector matching.

[0020] Further, the first matching result is obtained by the following method: obtaining a cryptographic hash value of the target file; comparing the cryptographic hash value of the target file with hash records of each reference sample stored in the multi-level feature library one by one to obtain the first matching result; if the hash record of a certain reference sample is consistent with the cryptographic hash value of the target file, the reference sample is defined as a target sample, and the first matching result is defined as a matching success; otherwise, the first matching result is a matching failure.

[0021] In the embodiment, the cryptographic hash value of the target file is obtained, and is compared with the hash records of each reference sample stored in the multi-level feature library one by one, so that the rapid preliminary identification of the binary software component is realized.

[0022] The one-way and collision resistance characteristics of the cryptographic hash function ensure that even if there is a slight byte difference in the file (such as the compilation timestamp, check field, compiler padding byte difference, etc.), the generated hash value will be significantly different, thereby ensuring the uniqueness and reliability of the comparison result. By analyzing the cryptographic hash value of the target file, it can be determined whether the target file has a complete binary correspondence with the known sample without the need for complete parsing of the target file structure, thereby effectively reducing the computational burden of subsequent structure parsing and symbol offset analysis. When the first matching result is a matching success, the system can directly output the identification conclusion; when the first matching result is a matching failure, the system automatically enters the deep analysis of the code feature and structure feature layer, realizing a multi-level adaptive identification mechanism from full matching to similar matching. By introducing the preliminary matching step based on the cryptographic hash value, the identification efficiency is significantly improved, the structured hierarchical control of identification accuracy is realized, and the efficient screening, accurate positioning and false judgment avoidance of a large-scale binary file set are realized.

[0023] Further, a second matching result is obtained, and the specific method is as follows: the code feature segment in the target file is extracted and input into the code feature similarity analysis model stored in the multi-level feature library, and the similarity between the code feature segment in the target file and each reference sample is output. The reference sample corresponding to the maximum similarity value is selected as the target matching sample, and the similarity between the code feature segment in the target file and the target matching sample is marked as the first matching similarity. The first matching similarity is compared with the preset similarity threshold in the multi-level feature library, if the first matching similarity is above the similarity threshold, the second matching result is a matching success, otherwise the second matching result is a matching failure.

[0024] In the embodiment, the code feature segment of the target file is extracted and input into the code feature similarity analysis model stored in the multi-level feature library, so that the similarity identification based on the semantic structure of the code layer is realized. The consistent underlying logical features under the conditions of compilation optimization, function rearrangement, or binary repackaging can be effectively captured, thereby avoiding the identification omission caused by the hash value comparison. By outputting the similarity distribution between the target file and each reference sample, and selecting the reference sample corresponding to the maximum similarity value as the target matching sample, the transition from "full matching" to "semantic level similar matching" is realized.

[0025] By introducing a similarity threshold for comparison, it is ensured that a match is only determined to be successful when the similarity of the features of the target file and the reference sample reaches a preset intensity, thereby effectively preventing false recognition caused by accidental similarity of code fragments. By introducing code feature similarity analysis and threshold determination mechanism, the structure robust recognition at the code level is realized, and then the precise component recognition and robustness improvement under multi-level features are realized, so as to ensure stable recognition accuracy and interpretability when facing complex software scenarios such as obfuscated compilation, secondary packaging or cross-linking.

[0026] The code fragments of the reference sample and the target sample are subjected to lexical analysis and syntax analysis, and multi-dimensional semantic features such as function call sequence, operation code sequence and control flow path are extracted to convert them into fixed-length numerical feature vectors. The coded vectors are input into a convolutional neural network model, local context features are extracted by convolution operators, and feature dimension reduction and aggregation processing are realized by combining pooling layers, so as to obtain embedded vector representation with high discriminability in semantic space. The cosine similarity operator is used to measure the similarity of the embedded vectors of the target sample and the reference sample to obtain the code feature similarity. Based on the preset similarity threshold, it is judged whether the similarity result meets the matching condition.

[0027] Further, a symbol offset determination label is obtained. The specific method is as follows: obtaining the section parameters of the target file, the section parameters including the section names of the sections, the symbols of the sections and the symbol positions; obtaining the reference symbols and the reference symbol positions of the reference sections in each reference sample stored in the multi-level feature library; based on the symbols and the symbol positions of the sections and the corresponding reference symbols and the reference symbol positions of the reference sections in the reference sample, a one-by-one matching analysis is performed to obtain the average symbol offset, thereby traversing the sections of the target file and the sections of the reference samples, thereby obtaining the average symbol offset of the symbols of the sections in the target file and the reference sections in the reference samples, and marking as the average symbol offset of the reference samples; obtaining the preset symbol offset threshold in the multi-level feature library, and comparing it with the average symbol offset of each reference sample, if the average symbol offset of a certain reference sample is above the symbol offset threshold, the symbol offset determination label of the target file and the reference sample is that the symbols exist offset, if the average symbol offset of a certain reference sample is less than the symbol offset threshold, the symbol offset determination label of the target file and the reference sample is that there is no obvious offset.

[0028] In the present embodiment, as shown in Figure 3 Figure 3 ​A symbol offset judgment flowchart of a binary software component identification method based on a multi-level feature library provided by an embodiment of the present application is provided. The parameters of each section of a target file and the symbol positions are obtained, and the symbols and corresponding positions of each reference section in a reference sample are obtained. Then, the system matches the symbols in the target file and the reference sample one by one, calculates the average symbol offset, and generates a symbol offset judgment label based on the average symbol offset. When there is no symbol offset, the label "no obvious offset" is directly output. When there is a symbol offset, the reference symbol offset is extracted, and the fluctuation value of the symbol offset is calculated. Then, the system determines whether the fluctuation value is less than a preset fluctuation threshold. When the fluctuation is small, "consistent symbol offset" is output. When the fluctuation is large, "inconsistent symbol offset" is output. After the judgment is completed, the flow ends.

[0029] The parameters of each section of the target file include the symbols and symbol positions of each section, which can be obtained by querying the file attributes.

[0030] The average symbol offset is obtained by the following method: In the formula, Doff represents the average symbol offset, N represents the total number of section symbols, tar,i represents the i th symbol position of the partition of the target file, ref,i represents the i th symbol position of the partition of the reference sample, i represents the symbol number, i = 1, 2,..., N, and N represents the total number of symbols.

[0031] By obtaining the symbols and position parameters in each section of the target file and the reference sample, and matching the corresponding symbol positions one by one, the overall drift of the symbol positions caused by the compiler optimization, relocation or load address change in the binary compilation process can be effectively captured. By calculating the average symbol offset and comparing it with the preset threshold, the overall degree of symbol offset can be quantitatively evaluated, so as to determine whether the offset has global consistency or is only a local disturbance. Not only can the matching error caused by directly relying on the absolute address of the symbol be avoided, but also the stability and robustness of the symbol level matching can be maintained in the complex scene with structure rearrangement or section offset. Therefore, by introducing the average symbol offset analysis and symbol offset judgment mechanism, the dynamic perception of the structure difference of the target file is realized, and the accuracy and reliability of the subsequent structure similarity analysis and offset correction processing are improved.

[0032] Further, if the symbol offset judgment label is "no obvious offset", the second similarity is directly analyzed. The specific method is as follows: the parameters of each section of the target file are vectorized to obtain the section vectors; the numerical feature values of each reference section in the multi-level feature library are obtained; ​The cumulative characteristic quantization value is obtained by multiplying each section vector with the numerical characteristic value of each reference section and then performing cumulative summation processing. The characteristic amplitude value is obtained by performing square cumulative two-norm energy quantization processing on each section vector and the numerical characteristic value of each reference section, respectively, and multiplying the processed values. The section vector similarity between the target file and the reference sample is obtained based on a comparison analysis of the cumulative characteristic quantization value and the characteristic amplitude value. The section vector similarity between the target file and each reference sample is obtained by iterating through each reference sample. The number of successfully matched symbols is obtained by matching the symbols of the target file with the symbols of the reference sample. The symbol matching similarity between the target file and the reference sample is obtained by comparing the number of successfully matched symbols with the total number of imported symbols (specifically, by dividing the number of successfully matched symbols by the total number of imported symbols). The reference structure similarity between the target file and the reference sample is obtained by multiplying the section vector similarity between the target file and the reference sample with the corresponding weight and then performing coupling processing (addition). The reference structure similarity between the target file and each reference sample is obtained by iterating through each reference sample. The reference sample corresponding to the maximum reference structure similarity is selected as the target matching sample, and the reference structure similarity between the target file and the target matching sample is marked as the second similarity.

[0033] In this embodiment, each section parameter of the target file is vectorized to obtain a section vector. Specifically, the section name, symbols, and symbol positions of each section in the target file are obtained. Numerical normalization is performed on the above parameters to map parameters of different dimensions to a unified numerical interval. For symbol position distribution, a combination of position encoding and category encoding is used for vectorization representation. The relative offset proportion of symbol positions within a section and the frequency of symbol types are calculated to construct a symbol feature subvector of the section. All section vectors are arranged in logical order according to the section in the file to form a section vector set of the target file.

[0034] The section vector similarity between the target file and the reference sample is obtained as follows: ; In the formula, Ssec represents the section vector similarity between the target file and the reference sample, j represents the number of section numbers, j = 1, 2,..., M, M represents the total number of sections, Vtar,j represents the numerical characteristic value of the jth section of the target file, and Vref,j represents the numerical characteristic value of the jth section of the reference sample.

[0035] The reference structure similarity between the target file and the reference sample is obtained as follows: ; In the formula, Conf dirSref represents the reference structure similarity of the target file to the reference sample, Ssec represents the section vector similarity of the target file to the reference sample, Ssym represents the symbol matching similarity of the target file to the reference sample, a1 represents the symbol matching similarity weight, and a2 represents the symbol matching similarity weight.

[0036] The symbol matching similarity weight and the symbol matching similarity weight are preset values in the database, and can be obtained by querying the database during use.

[0037] By introducing section parameter vectorization and feature coupling analysis under the condition that the symbol offset determination label is no obvious offset, deep structure matching between the target file and the reference sample in the multi-level feature library is realized. By performing two-norm energy processing and cumulative summation analysis on the numerical characteristic values of each section parameter vector and the reference section, the section structure feature can be accurately represented in a high-dimensional space, thereby improving the accuracy and stability of the section vector similarity calculation. Further, by introducing the symbol matching similarity and coupling the section vector similarity and the symbol matching similarity, the macroscopic structure feature and the microscopic symbol distribution feature of the file can be considered simultaneously, so that the similarity determination is more hierarchical and difference sensitive. Finally, by selecting the reference sample with the maximum reference structure similarity as the target matching sample, accurate identification and matching of the target file structure are realized, thereby effectively improving the accuracy and robustness of binary software component identification and avoiding misjudgment caused by local symbol offset or section difference.

[0038] Further, symbol offset consistency judgment is performed. The specific method is as follows: based on the symbol offset amount, the symbol offset consistency judgment is performed. If the symbol offset amount fluctuation value of a preset proportion of target file symbols is less than the preset fluctuation threshold in the multi-level feature library (for example, the symbol offset amount fluctuation value of a preset proportion of 90% of the target file symbols is 5 bytes, and the preset fluctuation threshold in the multi-level feature library is 10 bytes, at this time, the symbol offset consistency judgment result is offset consistent), the symbol offset consistency judgment result is offset consistent, otherwise the symbol offset consistency judgment result is offset inconsistent. The symbol offset amount fluctuation value is obtained in the following manner: obtaining the mode of the symbol offset amount, which is marked as the reference symbol offset amount, and then performing absolute difference value processing on the symbol offset amounts of the remaining symbols of the target file with the symbol offset amount, and marking the maximum deviation obtained as the symbol offset amount fluctuation value. If the symbol offset consistency judgment result is offset consistent, the reference symbol offset amount is taken as the overall offset value of the symbol offset.

[0039] In the embodiment, by introducing the symbol offset consistency judgment mechanism, the adaptive recognition of the overall symbol offset law in the target file is realized. By calculating the mode of the symbol offset as the reference symbol offset, and determining the symbol offset fluctuation value based on the maximum difference of each symbol offset, the discrete degree of the symbol offset in the global range can be effectively reflected, so as to quantitatively determine the concentration and consistency of the symbol offset of the target file. By combining the preset proportion judgment condition with the fluctuation threshold, the calculation efficiency can be ensured, and the precision and robustness of the symbol offset judgment can be significantly improved; when the judgment result is offset consistent, the reference symbol offset is input as the overall offset value into the subsequent analysis process, which can realize the automatic processing of offset correction and structure alignment, and can also reduce the structure similarity calculation error caused by local symbol abnormal offset.

[0040] Further, a unified correction processing is performed, and the specific method is as follows: based on the overall offset value, the symbols of each section of the target file are uniformly offset corrected to obtain the target file after offset correction processing and the symbol correction value of the target file; the unified offset correction processing is specifically that the symbols of each section of the target file are all moved to the same direction.

[0041] In the embodiment, by performing the unified offset correction processing based on the overall offset value on the symbols of each section of the target file, the global consistency and structure alignment of the section symbol position relationship are realized. By moving all the symbols in the same direction, the overall offset error caused by factors such as differences in compilation environment, linkage address offset or change of loading base address can be effectively eliminated, so as to restore the logical correspondence and structure integrity between the target file and the reference sample. By generating the symbol correction value and synchronously updating the file structure information, the subsequent structure similarity analysis and symbol matching calculation are performed in the unified coordinate system after offset correction, which improves the stability and precision of the similarity calculation.

[0042] Further, the section pair mapping processing is performed. The specific method is: the sections of the target file are aligned with the reference sections of each reference sample to obtain section mapping pairs. The section size similarity, permission matching factor and entropy similarity of each section mapping pair are obtained, and the corresponding weight coefficient analysis is introduced to obtain the weight of each section mapping pair. The maximum value of the weight of each section mapping pair is obtained to obtain the section mapping pairs (for example, assuming that the sections of the target file are a1, a2 and a3, and the reference sections of the reference sample are b1, b2 and b3, the first case of section mapping may exist: a1 corresponds to b2, a2 corresponds to b3, and a3 corresponds to b1, or a1 corresponds to b1, a2 corresponds to b2, and a3 corresponds to b3, and other corresponding relationships may exist. However, the weight coefficients obtained by weight coefficient analysis are different under different corresponding relationships, that is, the matching effect and matching similarity are different. Therefore, the maximum weight is obtained to ensure the best mapping effect, and then the section mapping pairs a1 and b1, a2 and b2, and a3 and b3 are obtained). The symbol amount of each section of the target file is compared with the maximum symbol amount in the reference section to obtain the normalized processing value of each section. The reference samples are traversed to obtain the normalized processing value of each reference sample and each section of the target file. The maximum symbol amount in the reference section is the maximum symbol amount of each reference section of the reference sample. The normalized value, Boolean quantization value and probability distribution of each section are used to construct a section comprehensive feature vector. The normalized value, Boolean quantization value and probability distribution of each reference section are used to construct a reference section comprehensive feature vector, thereby completing the section pair mapping processing.

[0043] In the embodiment, the weight of the section mapping pair is obtained. The specific method is: ; In the formula, ω (a, b) represents the weight of the section mapping pair, sizesim (a, b) represents the section size similarity of the section mapping pair, prem match (a, b) represents the permission matching factor of the section mapping pair, entsim (a, b) represents the entropy similarity of the section mapping pair, β1 represents the section size similarity weight, β2 represents the permission matching factor weight, and β3 represents the entropy similarity weight.

[0044] The normalized value of each section under the reference sample is obtained. The specific method is: ; In the formula, normtar, j represents the normalized value of the jth section, sizetar, j represents the size of the jth target section, k represents the number of reference sections, sizeref, k represents the size of the kth reference section, and k represents the number of reference sections.

[0045] The section areas of the target file are aligned with the reference section areas of the reference samples to obtain section mapping pairs, specifically by performing a pair-by-pair mapping process on the section areas of the target file and the reference samples to achieve fine correspondence and multi-dimensional feature fusion analysis at the section level. By aligning the target section areas with the reference section areas, a one-to-one correspondence can be established at the binary structure level, thereby eliminating matching errors caused by differences in section arrangement or paragraph division between different files. By calculating the section size similarity, the permission matching factor and the entropy similarity, and introducing a weight coefficient for comprehensive analysis, it is helpful to comprehensively reflect the differences in structural complexity, access attributes and information entropy characteristics of the section areas, making the section feature representation more robust and distinguishable.

[0046] By performing difference correction on the section symbol addresses based on the overall offset value, the symbol positions can be uniformly corrected, ensuring accurate correspondence between the target file and the reference samples in the symbol space. Then, through symbol normalization processing, different size files can be compared at the section level, thereby avoiding evaluation bias caused by differences in file size or symbol quantity. Finally, by introducing a normalization value, a Boolean quantization value and a probability distribution to jointly construct a section comprehensive feature vector, a three-dimensional fusion quantization representation system of structure-behavior-distribution is established, which improves the recognition accuracy and anti-interference ability of section-level matching, and further provides stable and reliable feature support for subsequent global similarity calculation.

[0047] Further, a third matching result is obtained, specifically by: performing vector similarity analysis based on the section comprehensive feature vector and the reference section comprehensive feature vector to obtain the file section similarity of the corrected target file and the reference sample, thereby traversing each reference sample to obtain the file section similarity of each reference sample and the corrected target file; obtaining the target symbol and the target symbol address of the corrected section, thereby performing mean value processing after coupling processing based on the symbol similarity analysis and the address similarity analysis, respectively, and combining the weights of each section mapping pair to obtain the file symbol similarity of the corrected target file and the reference sample, thereby traversing each reference sample to obtain the file symbol similarity of each reference sample and the corrected target file; performing weighted coupling processing based on the file section similarity and the file symbol similarity of the corrected target file and the reference sample to obtain the comprehensive similarity of the reference sample and the corrected target file, and traversing each reference sample to obtain the comprehensive similarity of each reference sample and the corrected target file; selecting the reference sample corresponding to the maximum comprehensive similarity as the target matching sample, and marking the comprehensive similarity of the target matching sample and the corrected target file as the second similarity; obtaining a preset second similarity threshold in the multi-level feature library and comparing it with the second similarity, if the second similarity is above the second similarity threshold, the third matching result is matching success, otherwise the third matching result is matching failure.

[0048] In the embodiment, the file section similarity of the corrected target file and the reference sample is obtained, and the specific method is as follows: ; In the formula, Ssec,sdj represents the file section similarity of the corrected target file and the reference sample, D represents a mapping logarithm, a represents a section in the mapping pair, b represents a reference section in the mapping pair, mapsec represents a section mapping pair set, vecr,a represents a section comprehensive feature vector of the section in the mapping pair, and vecref,b represents a reference section comprehensive feature vector of the reference section in the mapping pair.

[0049] The file symbol similarity of the corrected target file and the reference sample is obtained, and the specific method is as follows: ; In the formula, Ssym,adj represents the file symbol similarity of the corrected target file and the reference sample, f represents the number of import symbol pairs, f = 1, 2,.., F, F represents the total number of import symbol pairs, simname represents a symbol similarity function, nametar,f represents a target file symbol name in the fth import symbol pair, nameref,f represents a reference sample symbol name in the fth import symbol pair, simaddr represents an address similarity function, addrcor,f represents a target file symbol address in the fth import symbol pair, and addrref,f represents a reference sample symbol address in the fth import symbol pair.

[0050] The comprehensive similarity of the reference sample and the corrected target file is obtained, and the specific method is as follows: ; In the formula, confadf represents the comprehensive similarity of the reference sample and the corrected target file, τ1 represents the file section similarity weight of the corrected target file and the reference sample, Ssec,sdj represents the file section similarity of the corrected target file and the reference sample, τ2 represents the file symbol similarity of the corrected target file and the reference sample, and Ssym,adj represents the file symbol similarity of the corrected target file and the reference sample.

[0051] The similarity of the target file in section layout and content distribution is quantified through vector similarity analysis based on the comprehensive feature vector of the section and the comprehensive feature vector of the reference section. By traversing each reference sample, the matching degree of the target file with diversified reference samples can be comprehensively evaluated, thereby improving the coverage and accuracy of the identification. The corrected section target symbol and symbol address are obtained, and symbol similarity analysis and address similarity analysis are performed respectively. The mapping of each section is introduced to couple the weight processing, which not only considers the consistency of the symbol itself, but also takes into account the spatial position relationship of the symbol in the file, thereby enhancing the reliability and anti-interference ability of the matching result.

[0052] By coupling the file section similarity and the file symbol similarity with weighting, the comprehensive similarity is obtained. The reference sample corresponding to the maximum value is selected as the target matching sample, and compared with the preset threshold, which can determine whether the matching is successful or not, and realize the accurate and quantifiable third matching result judgment.

[0053] Further, the minimum symbol segmentation length adjustment is performed. The specific method is as follows: the minimum symbol segmentation length when performing symbol consistency judgment is obtained; the preset symbol segmentation upper limit value and symbol segmentation lower limit value in the multi-level feature library are obtained, and the difference processing is performed with the minimum symbol segmentation length, to obtain the symbol segmentation upper limit value distance and the symbol segmentation lower limit value distance. If the symbol segmentation upper limit value distance is greater than the symbol segmentation lower limit value distance (too fine, the obtained byte is small), the minimum symbol segmentation length increasing processing is performed. If the symbol segmentation upper limit value distance is less than the symbol segmentation lower limit value distance (too coarse, the obtained byte is large), the minimum symbol segmentation length decreasing processing is performed. If the symbol segmentation upper limit value distance is equal to the symbol segmentation lower limit value distance, a warning prompt is issued. The third matching result after the minimum symbol segmentation length adjustment is obtained. If the third matching result after the minimum symbol segmentation length adjustment is matching success, the component identification result of the binary software is obtained. Otherwise, a warning prompt is issued.

[0054] In the present embodiment, as shown in Figure 4 , the minimum symbol segmentation length adjustment is performed. Figure 4The section pair mapping processing and comprehensive similarity calculation flowchart of a binary software component identification method based on a multi-level feature library provided by the embodiment of the application maps each section of a target file to a reference sample section, then the system calculates the weight of the section mapping pair, and on this basis, performs overall offset correction on the target symbol address. Next, the section symbol quantity is normalized, and then the target section comprehensive feature vector and the reference section comprehensive feature vector are constructed. The system calculates the section vector similarity and the symbol matching similarity respectively, and fuses the two to obtain a second similarity. According to the similarity result, the system selects a target matching sample, and compares the second similarity with a preset threshold. When the second similarity exceeds the threshold, the output is "third matching result: matching success"; if the threshold is not exceeded, the output is "third matching result: matching failure", and the process ends.

[0055] The absolute difference distance is obtained by subtracting the symbol segmentation lower limit distance from the symbol segmentation upper limit distance and taking the absolute value. If the symbol segmentation upper limit distance is greater than the symbol segmentation lower limit distance, the symbol minimum segmentation length increasing processing is performed, specifically: the absolute difference distance is divided by the symbol segmentation upper limit distance to obtain a first proportion, and the symbol minimum segmentation length is added to the product of the symbol minimum segmentation length and the first proportion to obtain the symbol minimum segmentation length after the increasing processing. If the symbol segmentation upper limit distance is less than the symbol segmentation lower limit distance, the symbol minimum segmentation length decreasing processing is performed, specifically: the absolute difference distance is divided by the symbol segmentation lower limit distance to obtain a second proportion, and the symbol minimum segmentation length is subtracted from the product of the symbol minimum segmentation length and the second proportion to obtain the symbol minimum segmentation length after the decreasing processing.

[0056] It should be noted that the symbol segmentation upper limit value represents the maximum single segment byte length (such as 1024 bytes) allowed by the system when performing symbol division in the section, and the symbol segmentation lower limit value represents the minimum single segment byte length (such as 128 bytes) allowed by the system when performing section division.

[0057] In the binary software component identification process, the second layer code feature matching and the third layer structure feature matching stage both depend on the division accuracy of the section boundary, symbol segmentation interval and import table mapping range of the target file. If there is irrationality in the section boundary division or symbol segmentation threshold setting process, it is easy to cause the misplacement, overlap or redundancy of the symbols inside the section, thereby causing the non-deterministic offset of the structure features. When the offset accumulates to the section relocation information and import table function name mapping layer, it will cause the distortion of the structure feature matching result, that is, the algorithm mistakenly judges the logically homologous symbols as heterologous symbols, or identifies the real corresponding sections as mismatched sections, resulting in the decrease of the recognition result confidence. Therefore, the symbol minimum segmentation length adjustment is introduced in the structure feature analysis stage. When performing symbol consistency judgment, the system will count the symbol minimum segmentation length of the target file, and compare the difference between the preset upper limit value and lower limit value of the symbol segmentation in the multi-level feature library. If the symbol segmentation upper limit value distance is greater than the symbol segmentation lower limit value distance, it means that the current segmentation granularity is too fine, that is, the section is cut too small, causing the boundary drift of the symbols in the section to intensify, so that the section relocation information cannot be accurately corresponded to the section index of the reference sample; at this time, the system performs symbol minimum segmentation length increasing processing to reduce the number of section boundaries, restore the integrity of the section structure, and reduce the offset influence. Conversely, if the symbol segmentation upper limit value distance is less than the symbol segmentation lower limit value distance, it means that the segmentation granularity is too coarse, and the symbols inside the section are too concentrated, causing the import table function name mapping to be compressed to a single section, resulting in information overlap or weight imbalance, at this time, the system performs symbol minimum segmentation length decreasing processing to make the symbol segmentation more refined, so as to improve the accuracy of the section mapping and symbol correspondence.

[0058] In the ideal state, the symbol segmentation upper limit value distance and the lower limit value distance should be close, that is, the symbol minimum segmentation length is in the balance interval between the two, at this time, the section boundary division is the most reasonable, and there is no offset error caused by the cutting strategy in the structure layer matching of the system. If it is detected that the symbol minimum segmentation length has been in the balance interval, but the matching confidence is still decreased, it means that the problem may come from non-structural factors, such as the target file being maliciously tampered with, shelled, obfuscated, or the version of the target file exceeding the coverage range of the multi-level feature library (such as the target file is version 2.0 while the feature library only contains version 1.0). At this time, the system cannot be corrected by cutting length adjustment, so a warning is issued to remind that there may be abnormal structures or unknown versions for subsequent manual review or feature library update. The symbol minimum segmentation length adjustment process forms an adaptive closed-loop adjustment in the third layer structure feature analysis, so that the system can automatically adjust the structure division granularity according to the section offset features, effectively eliminate the feature misplacement caused by the section relocation and import table mapping offset, and ensure the stability and confidence of the binary software component identification result.

[0059] By acquiring the symbol minimum segmentation length when judging the symbol consistency, and comparing it with the preset upper limit value and lower limit value of the symbol segmentation in the multi-level feature library, it can be judged whether the current segmentation length is reasonable, so as to dynamically adjust the symbol minimum segmentation length. By increasing or decreasing the symbol minimum segmentation length, noise interference caused by too fine symbol segmentation or matching precision caused by too coarse symbol segmentation can be effectively avoided, so as to improve the reliability of the symbol consistency analysis and the overall accuracy of the binary software component identification. At the same time, when the symbol minimum segmentation length is close to the threshold boundary, a warning is issued to prompt the operator to intervene or adjust the parameters in time, thereby enhancing the controllability and robustness of the identification process. This adjustment step ensures that the basic data for subsequent symbol matching and structural similarity analysis is more reasonable, which helps to improve the accuracy and stability of the entire component identification process.

[0060] Those skilled in the art will appreciate that embodiments of the application can be supplied as methods, systems, or computer program products. Accordingly, the application can be embodied in the form of complete hardware embodiments, complete software embodiments, or embodiments combining software and hardware aspects. Furthermore, the application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage, etc.) having computer-usable program code embodied thereon.

[0061] The present application is described in reference to flowcharts and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, as well as combinations of flows and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus produce an apparatus that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in a flow or multiple flows and / or blocks Figure 1 The functions specified in a flow or multiple flows and / or blocks

[0062] These computer program instructions can also be stored in a computer-readable memory that can direct the computer or other programmable data processing apparatus to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including instruction apparatus, which implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in a flow or multiple flows and / or blocks Figure 1 The functions specified in a flow or multiple flows and / or blocks

[0063] These computer program instructions can also be loaded into a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 one or more flowcharts and / or blocks

[0064] Although preferred embodiments of the application have been described herein, substitutions and modifications of these preferred embodiments made by those skilled in the art who are familiar with the inventive subject matter are to be considered within the scope of the present application. Accordingly, the attached claims are intended to embrace all such substitutions and modifications of the preferred embodiments as fall within the scope of the present application.

[0065] Obviously, numerous modifications and variations of the present application are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described herein.

Claims

1. A method for binary software component identification based on multi-level feature library, characterized in that, The method comprises the following steps: S1, obtaining a cryptographic hash value of an object file of a binary software and matching the hash value with hash records in a multi-level feature library to obtain a first matching result, if the first matching result is a matching success, obtaining a component identification result of the binary software, otherwise, performing S2; S2, extracting a code feature segment in the object file and performing similarity matching with code features in the multi-level feature library to obtain a second matching result, if the second matching result is a matching success, obtaining the component identification result of the binary software, otherwise, performing S3; S3, analyzing a structure feature in the object file and obtaining a symbol offset determination tag, if the symbol offset determination tag is no obvious offset, directly analyzing to obtain a second similarity, otherwise, performing symbol offset consistency judgment, if the offset is consistent, performing unified correction processing, otherwise, performing section-by-section mapping processing to obtain corrected position information, and then performing corrected structure similarity analysis to obtain the second similarity, and thus obtaining a third matching result; S4, based on the third matching result analysis, if the third matching result is a matching success, obtaining the component identification result of the binary software, otherwise, performing symbol minimum segmentation length adjustment, and updating and performing S3 and S4 steps after the adjustment to obtain the component identification result of the binary software.

2. The binary software component identification method based on multi-level feature library according to claim 1, characterized in that: The first matching result is obtained by: obtaining a cryptographic hash value of the object file; comparing the cryptographic hash value of the object file with hash records of each reference sample stored in the multi-level feature library one by one to obtain the first matching result, if the hash record of a certain reference sample is consistent with the cryptographic hash value of the object file, the reference sample is defined as a target sample, and the first matching result is defined as a matching success, otherwise, the first matching result is a matching failure.

3. The binary software component identification method based on multi-level feature library according to claim 1, characterized in that: The second matching result is obtained by: extracting a code feature segment in the object file and inputting it into a code feature similarity analysis model stored in the multi-level feature library, outputting the similarity of the code feature segment in the object file and each reference sample, selecting the reference sample corresponding to the maximum similarity value as a target matching sample, and marking the similarity of the code feature segment in the object file and the target matching sample as a first matching similarity; comparing the first matching similarity with a pre-set similarity threshold value in the multi-level feature library, if the first matching similarity is above the similarity threshold value, the second matching result is a matching success, otherwise, the second matching result is a matching failure.

4. The method of claim 1, wherein the method further comprises: The symbol offset determination tag is obtained by: obtaining each section parameter of the object file, the section parameters including section names of each section, each symbol and each symbol position; obtaining each reference symbol and each reference symbol position of each reference section in each reference sample stored in the multi-level feature library; The average symbol offset of each section of the target file and each reference section of each reference sample is obtained by matching each symbol and each symbol position of each section of the target file with each symbol and each symbol position of the corresponding reference section in each reference sample, and the average symbol offset of each section of the target file and each reference section of each reference sample is marked as the average symbol offset of each reference sample; The symbol offset threshold value in the multi-level feature library is obtained and compared with the average symbol offset of each reference sample, and if the average symbol offset of a certain reference sample is greater than the symbol offset threshold value, the symbol offset determination label of the target file and the reference sample is symbol offset, and if the average symbol offset of a certain reference sample is less than the symbol offset threshold value, the symbol offset determination label of the target file and the reference sample is no obvious offset.

5. The method of claim 1, wherein the method further comprises: If the symbol offset determination label is no obvious offset, the second similarity is directly analyzed, and the specific method is: The section parameters of the target file are vectorized to obtain section vectors; The numerical feature values of each reference section in each reference sample in the multi-level feature library are obtained; The section vectors and the numerical feature values of each reference section are multiplied and then accumulated and summed to obtain accumulated feature quantization values, the section vectors and the numerical feature values of each reference section are respectively subjected to square accumulation and two-norm energy quantization processing, and then multiplied to obtain feature amplitude values, and the accumulated feature quantization values and the feature amplitude values are compared and analyzed to obtain the section vector similarity of the target file and the reference sample, and the section vector similarity of the target file and each reference sample is obtained by traversing each reference sample; The symbols of the target file and the reference sample are matched to obtain the number of successfully matched symbols, and the number of successfully matched symbols and the total number of imported symbols are compared to obtain the symbol matching similarity of the target file and the reference sample; The reference structure similarity of the target file and the reference sample is obtained by multiplying the section vector similarity of the target file and the reference sample and the symbol matching similarity and then coupling, and the reference structure similarity of the target file and each reference sample is obtained by traversing each reference sample; The reference sample corresponding to the maximum reference structure similarity is selected as the target matching sample, and the reference structure similarity of the target file and the target matching sample is marked as the second similarity.

6. The method of claim 4, wherein the method further comprises: The specific method of the symbol offset consistency judgment is: The symbol offset consistency judgment is based on the symbol offset, and if the symbol offset fluctuation value of a preset proportion of the symbols of the target file is less than the fluctuation threshold value preset in the multi-level feature library, the symbol offset consistency judgment result is offset consistent, otherwise the symbol offset consistency judgment result is offset inconsistent; The symbol offset fluctuation value is obtained by: obtaining the mode of the symbol offset, which is marked as the reference symbol offset, and then performing absolute difference processing on the symbol offset of the remaining symbols of the target file, and marking the maximum deviation obtained as the symbol offset fluctuation value; If the symbol offset consistency judgment result is offset consistent, the reference symbol offset is taken as the overall offset value of the symbol offset.

7. The method of claim 1, wherein the method further comprises: determining a feature library based on the binary software component; and determining a feature library based on the binary software component. The unified correction processing is specifically as follows: Based on the overall offset value, the symbols of each section of the target file are uniformly offset corrected to obtain the target file after offset correction and the symbol correction value of the target file. The unified offset correction processing is specifically moving the symbols of each section of the target file to the same direction.

8. The method of claim 1, wherein the method further comprises: The section-by-section mapping processing is specifically as follows: ​ Each section of the target file is mapped and aligned with each reference section of each reference sample. The section size similarity, the permission matching factor and the entropy similarity of each section mapping pair are obtained, and a corresponding weight coefficient analysis is introduced to obtain the weight of each section mapping pair. The maximum value of the weight of each section mapping pair is obtained to obtain each section mapping pair. The symbol amount of each section of the target file is compared with the maximum symbol amount in the reference section to obtain the normalized processing value of each section, and the normalized processing value of each reference sample and each section of the target file is obtained by traversing each reference sample. The maximum symbol amount in the reference section is specifically the maximum symbol amount of each reference section of the reference sample. The normalized value, the Boolean quantization value and the probability distribution of each section are used to construct a section comprehensive feature vector. The normalized value, the Boolean quantization value and the probability distribution of each reference section are used to construct a reference section comprehensive feature vector, thereby completing the section-by-section mapping processing.

9. The method of claim 8, wherein the method further comprises: The third matching result is obtained by: Based on the vector similarity analysis of the section comprehensive feature vector and the reference section comprehensive feature vector, the file section similarity of the corrected target file and the reference sample is obtained, and the file section similarity of each reference sample and the corrected target file is obtained by traversing each reference sample. The target symbol and the target symbol address of the corrected section are obtained, and the file symbol similarity of the corrected target file and the reference sample is obtained by coupling processing based on the symbol similarity analysis and the address similarity analysis and combining the weight of each section mapping pair, and the file symbol similarity of each reference sample and the corrected target file is obtained by traversing each reference sample. Based on the file section similarity and the file symbol similarity of the corrected target file and the reference sample, the comprehensive similarity of the reference sample and the corrected target file is obtained by weighting coupling processing, and the comprehensive similarity of each reference sample and the corrected target file is obtained by traversing each reference sample. The reference sample corresponding to the maximum comprehensive similarity is selected as the target matching sample, and the comprehensive similarity of the target matching sample and the corrected target file is marked as the second similarity. The second similarity threshold value in the multi-level feature library is obtained, and compared with the second similarity. If the second similarity is above the second similarity threshold value, the third matching result is matching success, otherwise the third matching result is matching failure.

10. The method of claim 1, wherein the method further comprises: determining a feature library based on the binary software component; and determining a feature library based on the binary software component. 10 The symbol minimum segmentation length adjustment is specifically as follows: The symbol minimum segmentation length when the symbol consistency judgment is performed is obtained. The preset upper limit value and lower limit value of symbol segmentation in the multi-level feature library are acquired, and absolute difference values are processed with the minimum symbol segmentation length respectively to obtain an upper limit value distance of symbol segmentation and a lower limit value distance of symbol segmentation. If the upper limit value distance of symbol segmentation is greater than the lower limit value distance of symbol segmentation, the minimum symbol segmentation length increasing processing is performed. If the upper limit value distance of symbol segmentation is less than the lower limit value distance of symbol segmentation, the minimum symbol segmentation length decreasing processing is performed. If the upper limit value distance of symbol segmentation is equal to the lower limit value distance of symbol segmentation, a pre-warning is issued. The third matching result after the minimum symbol segmentation length is adjusted is acquired. If the third matching result after the minimum symbol segmentation length is adjusted is a matching success, the component recognition result of the binary software is obtained. Otherwise, a pre-warning is issued.

Images