A software authorization use detection method and device based on multi-dimensional environment perception

Abstract

This invention provides a software license usage detection method and apparatus based on multi-dimensional environmental awareness, comprising: acquiring the environmental characteristics of the software under test during its initial runtime; wherein the environmental characteristics include hardware layer characteristics, network layer characteristics, and system layer characteristics; dynamically generating an initial device fingerprint based on the environmental characteristics; binding the initial device fingerprint with the software license information of the software under test; acquiring the current environmental characteristics and current behavior pattern of the software under test in real time, and dynamically generating a current device fingerprint based on the current environmental characteristics; comparing the initial device fingerprint with the current device fingerprint, and the current behavior pattern with the historical behavior pattern of the software under test, to obtain the detection result. This solution improves the security, flexibility, and user experience of license detection.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method and apparatus for detecting software license usage based on multi-dimensional environmental perception. Background Technology

[0002] When delivering software products, a license certificate is used to authorize users to use the application software. The validity of the activation information is verified by checking the license certificate purchased by the user, thus ensuring the legality of the license certificate. In this way, the complete application and verification of the license certificate guarantees the legitimate use of the software.

[0003] In existing technologies, software license verification mainly relies on the following methods: 1) Static hardware binding: This generates license credentials by collecting unique device identifiers (such as MAC addresses, motherboard serial numbers, hard drive IDs, etc.) and verifies hardware consistency during authorization; however, this method is easily bypassed by hardware emulation tools (such as virtual machines, hardware forgery software) and cannot adapt to scenarios where multiple devices are used collaboratively. 2) Timestamp authorization: Authorization is based on a preset validity period, after which software functionality is restricted; however, reverse engineering can easily modify the system time or crack the time verification logic, causing the authorization to fail. 3) Network activation verification: This verifies the authorization status with the server via the internet, but it cannot be used in offline scenarios and poses a risk of single point of failure for the server. 4) Code obfuscation and encryption: This increases the difficulty of cracking by obfuscating key code or encrypting the authorization logic, but deep reverse engineering can still restore the authorization mechanism, and security depends on algorithm complexity rather than mechanism design. Therefore, the above methods generally suffer from poor environmental adaptability, weak anti-tampering capabilities, and poor user experience.

[0004] Therefore, there is an urgent need for a software licensing detection method and device based on multi-dimensional environmental perception. Summary of the Invention

[0005] To address the aforementioned issues, this invention provides a software license usage detection method and apparatus based on multi-dimensional environmental awareness, which enables real-time verification of license status and abnormal warnings, thereby improving the security, flexibility, and user experience of license detection.

[0006] In a first aspect, embodiments of the present invention provide a software license usage detection method based on multi-dimensional environmental awareness, comprising: The environmental characteristics of the software under test during its initial runtime are obtained; wherein, the environmental characteristics include hardware layer characteristics, network layer characteristics, and system layer characteristics; An initial device fingerprint is dynamically generated based on the environmental characteristics; and the initial device fingerprint is bound to the software authorization information of the software to be tested. The current environmental characteristics and current behavior patterns of the software under test are acquired in real time, and the current device fingerprint is dynamically generated based on the current environmental characteristics. The detection result is obtained by comparing the initial device fingerprint with the current device fingerprint, the current behavior pattern with the historical behavior pattern of the software to be detected.

[0007] Secondly, embodiments of the present invention also provide a software licensing detection device based on multi-dimensional environmental perception, comprising: The acquisition module is used to acquire the environmental characteristics of the software under test during its initial runtime; wherein, the environmental characteristics include hardware layer characteristics, network layer characteristics and system layer characteristics; A dynamic generation module is used to dynamically generate an initial device fingerprint based on the environmental characteristics; and bind the initial device fingerprint with the software authorization information of the software to be tested; The acquisition module is also used to acquire the current environmental characteristics and current behavior patterns of the software under test in real time. The dynamic generation module is also used to dynamically generate the current device fingerprint based on the current environment features; The verification module is used to compare the initial device fingerprint with the current device fingerprint, the current behavior pattern with the historical behavior pattern of the software to be tested, and obtain the detection result.

[0008] Thirdly, embodiments of the present invention also provide a computing device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements the software license use detection method based on multi-dimensional environmental perception described above.

[0009] Fourthly, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the software license usage detection method based on multi-dimensional environment awareness described above.

[0010] Fifthly, embodiments of the present invention also provide a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the method described in any of the first aspects of this specification.

[0011] This invention provides a software license usage detection method and apparatus based on multi-dimensional environmental awareness. The method dynamically generates device fingerprints based on runtime environmental features, overcoming the limitations of traditional single hardware binding. It integrates hardware, network, system, and user layers to generate dynamic device fingerprints, significantly improving anti-forgery capabilities. Then, the initial device fingerprint at the start of runtime is bound to the software license information. The detection result is obtained by comparing the currently dynamically generated device fingerprint with the initial device fingerprint and by comparing the current behavior pattern with historical behavior patterns. Thus, real-time verification of the license status and anomaly warning are achieved, improving the security, flexibility, and user experience of license detection. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a flowchart of a software licensing detection method based on multi-dimensional environmental perception provided in an embodiment of the present invention; Figure 2 This is a hardware architecture diagram of a computing device provided in an embodiment of the present invention; Figure 3 This is a structural diagram of a software licensing detection device based on multi-dimensional environmental perception, provided in an embodiment of the present invention. Detailed Implementation

[0014] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0015] The following is the concept of the present invention, such as Figure 1 As shown, this embodiment of the invention provides a software license usage detection method based on multi-dimensional environmental awareness, the method comprising: Step 100: Obtain the environmental characteristics of the software under test during its initial runtime; wherein, the environmental characteristics include hardware layer characteristics, network layer characteristics, and system layer characteristics; Step 102: Dynamically generate an initial device fingerprint based on environmental characteristics; and bind the initial device fingerprint with the software license information of the software to be tested; Step 104: Real-time acquisition of the current environmental characteristics and current behavior patterns of the software under test, and dynamic generation of the current device fingerprint based on the current environmental characteristics; Step 106: Compare the initial device fingerprint with the current device fingerprint, and the current behavior pattern with the historical behavior pattern of the software to be tested to obtain the detection result.

[0016] In this embodiment of the invention, device fingerprints are dynamically generated based on runtime environmental characteristics, overcoming the limitations of traditional single hardware binding. By integrating hardware, network, system, and user layers to produce dynamic device fingerprints, the anti-forgery capability is significantly improved. Then, the initial device fingerprint generated during initial runtime is bound to software authorization information. The detection result is obtained by comparing the currently dynamically generated device fingerprint with the initial device fingerprint, and by comparing the current behavior pattern with historical behavior patterns. Thus, real-time verification of authorization status and anomaly warnings are achieved, enhancing the security, flexibility, and user experience of authorization detection.

[0017] The following description Figure 1 The execution method of each step is shown.

[0018] In step 100, during software execution, the terminal's built-in acquisition module dynamically collects environmental characteristics across the following dimensions, including but not limited to hardware layer characteristics, network layer characteristics, and system layer characteristics. For example, hardware layer characteristics include the number of CPU cores, GPU model, memory capacity, storage media type and capacity (SSD / HDD), hardware serial number, and some non-sensitive hardware random identifiers (such as the EKPUB value of the TPM chip). Network layer characteristics include: the currently connected WiFi SSID, public IP address location, DNS resolution latency, network operator information, and network environment. System layer characteristics include: operating system version, operating system installation time, list of installed software, and system update records for the last 30 days. All of the above environmental characteristics adhere to the principle of minimum necessity and do not involve user privacy data (such as account passwords), thereby improving the user experience.

[0019] In step 102, an initial device fingerprint is dynamically generated based on environmental features, including: The environmental features are dynamically weighted to obtain the feature vector; The initial device fingerprint is obtained by signing the feature vector using an encryption algorithm.

[0020] Specifically, the software authorization information bound to the initial device fingerprint includes, but is not limited to, authorized user, validity period, and licensed functions, and the initial device fingerprint is stored on the authorization server.

[0021] In step 104, the current device fingerprint is dynamically generated based on the current environmental characteristics, including: The current environmental features are dynamically weighted to obtain the current feature vector; The current device fingerprint is obtained by signing the current feature vector using an encryption algorithm.

[0022] It should be noted that the encryption algorithm in steps 102 and 104 is preferably an asymmetric national cryptographic algorithm (such as SM2). In this way, the product functions of the developer are protected by a high-strength national cryptographic algorithm.

[0023] In a preferred embodiment, the methods for dynamically weighting the feature vectors in steps 102 and 104 are the same, only the environmental features used differ. Specifically, dynamically weighting the environmental features to obtain the feature vectors includes: For each environmental characteristic, execute: Determine the weighted influencing factors of this environmental characteristic; among which, the weighted influencing factors include the time decay factor, the environmental risk coefficient, and the characteristic correlation factor; The weights are calculated based on the basic static weights and weight influence factors of this environmental characteristic. The feature vector is obtained by weighting and fusing the feature values ​​and weights of each environmental feature.

[0024] It should be noted that the feature vector is obtained by weighted fusion of the feature values ​​of each environmental feature with their corresponding weights. This process includes: standardizing the feature values ​​of each environmental feature (including normalization, hash mapping, etc.) to eliminate differences and obtain standardized feature values; concatenating the environmental features to obtain a preprocessed feature vector; and then weighted fusion of the standardized feature values ​​of each environmental feature with their corresponding weights to generate the final feature vector. This fixed concatenation order increases the difficulty for attackers to forge a complete vector.

[0025] In this embodiment of the invention, since different environmental features are heterogeneous and their feature value types are not the same, the standardization preprocessing methods (including dimensionality reduction, abstract extraction, numerical normalization, and semantic encoding preservation) for different types of feature values ​​are also different. This invention does not specifically limit the standardization preprocessing methods. For example, feature value types include continuous numerical types, classification / string types, unique identifiers, time series types, etc. For continuous numerical types such as CPU core count, memory capacity, and DNS resolution latency, normalization can be used to map them to the [0,1] interval. For example, for classification / string types such as GPU model and operating system version, semantic encoding / embedding is used. For example, a classification dictionary can be established to assign a unique ID to each model, or lightweight word vectors can be used to convert the string into a small-dimensional vector. For example, for unique identifiers such as the EKPUB value of a TPM chip, a hash value can be calculated, the first 16 or 64 bits can be truncated, and each group of 4 bits can be converted into a [0,1] floating-point number. For example, environmental features include A1, A2, A3, and A4, and their corresponding weight values ​​are respectively Their eigenvalues, after standardization preprocessing, are as follows: The preprocessed feature vector is obtained after receiving the data. The final feature vector is It should be noted that the sum of the weights corresponding to all environmental features here is not equal to 1.

[0026] In one specific implementation, the weights are calculated based on the fundamental static weights and weight influence factors of the environmental characteristics, including: Based on the real-time data within the corresponding sliding time window, the variance at the initial binding time and the variance at the current time are calculated. The time decay factor is calculated based on the variance at the initial binding time, the variance at the current time, and the continuous runtime of the software under test. Based on the current network environment and the detection status of threat intelligence, determine the environmental risk coefficient; The correlation strength between the environmental feature and other environmental features is determined from the preset feature association library, and the feature association factor is determined based on the correlation strength and the weight of the corresponding correlation strength. The weights are calculated based on the basic static weights of the environmental characteristics, the time decay factor, the environmental risk coefficient, and the characteristic correlation factor.

[0027] In a more specific implementation, the weights are determined by the following formula: in, Environmental characteristics i The weights; Environmental characteristics iThe basic static weights; Environmental characteristics i Time decay factor; Environmental risk coefficient; α The strength coefficient; Environmental characteristics i The characteristic correlation factor. The preferred strength coefficient is 0.1 to 0.3.

[0028] In a more specific implementation, the time decay factor is determined by the following formula: in, This is the attenuation sensitivity coefficient; Environmental characteristics i exist t The variance of the values ​​taken within a given time period; Environmental characteristics i Variance at initial binding; The growth coefficient; This refers to the duration of continuous operation. For example, the attenuation sensitivity coefficient is 0.5, and the growth coefficient is 0.02.

[0029] It should be noted that, for the initial weights during the initial runtime, t The timeframe is 0, meaning the initial runtime or initial binding. Regarding the current weights of the current environmental characteristics, t The timeframe is the current moment. Specifically, the environmental features are collected in... t The real-time sampled value sequence within the corresponding sliding time window (e.g., the past 5 minutes) is standardized and preprocessed to obtain real-time data composed of standardized feature values. The variance of this real-time data is then calculated. Here, Ω1 represents volatile features, such as public IP address location and DNS resolution latency; Ω2 represents stable features, such as CPU core count, GPU model, and memory capacity. For volatile features, the greater the difference between the current variance and the initial variance, the more severe the weight decay. For stable features, the longer the running time, the slower the weight increases over time. This reflects the stability changes of various environmental features over time. By introducing a time-varying decay factor, the device fingerprint is strongly bound to time, making it effective only once, preventing replay attacks on intercepted fingerprints, improving tamper resistance and increasing the difficulty of cracking, thereby ensuring the security of authorization detection.

[0030] In a more specific implementation, the environmental risk factor is determined by the following formula: in, This represents the basic risk level of the current network environment. for t Time of the first k Boolean instruction function for real-time threat intelligence; For the corresponding number k Risk penalty value for real-time threat intelligence; N This represents the total amount of real-time threat intelligence.

[0031] In this embodiment of the invention, a pre-generated network environment risk level library stores a one-to-one correspondence between network environments and basic risk levels. For example, the basic risk level of a company intranet is 1.0, the basic risk level of a home network is 1.2, and the basic risk level of public WiFi is 1.5. Risk is directly proportional to the basic risk level. The basic risk level of the current network environment can be determined from the network environment risk level library. The Boolean indicator function is 1 or 0. When the detection status of the k-th real-time threat intelligence item is present, the Boolean indicator function is 1; otherwise, when it is absent, the Boolean indicator function is 0. The risk penalty value is, for example, 0.1. Thus, for the environmental risk coefficient, for each threat triggered, the total weight will be amplified accordingly, making the system more sensitive to changes in all characteristics in a risky environment.

[0032] It should be noted that threat intelligence refers to signals that may indicate security risks or abnormal states, obtained during software operation through local detection or simple interaction with an authorized server. For example, threat intelligence includes whether the software is running in a virtualized or containerized environment, whether the process has been attached to by a debugger, whether critical memory areas have been modified, whether the login IP's geographical location differs from its usual location, and whether multiple verification requests have been made within a very short period.

[0033] In a more specific implementation, the feature association factor is determined by the following formula: in, Environmental characteristics i With environmental characteristics j The expected correlation strength between them; ∈[0,1]; for t Time and environmental characteristics i With environmental characteristics j The actual strength of the correlation between them; For feature pairs ( i , j Importance weight of relevance ,and .

[0034] It should be noted that, tanhThe hyperbolic tangent function is used to compress the output, preventing a single anomalous association from having an excessive impact on the weights and enhancing system robustness. The expected association strength is statistically derived from historical normal data obtained during the normal operation of the software under test, for example, by using covariance normalization or collinearity probability calculation, and stored in the association database to directly obtain the association strength between feature pairs from the association data. Specifically, for environmental features with numerical features, the Pearson correlation coefficient is used as the expected association strength in historical normal data; for environmental features with non-numerical features, the co-occurrence probability is used as the expected association strength, i.e., the Jaccard similarity coefficient is used as the expected association strength. Similarly, based on the current dataset obtained within the sliding time window corresponding to the current moment, the Pearson correlation coefficient is calculated as the real-time association strength of numerical environmental features, and the Jaccard similarity coefficient is calculated as the real-time association strength of non-numerical environmental features. The importance weight is assigned based on the importance of the feature pair to the security of software licensing. For example, a feature pair consisting of GPU model and operating system version is stable and difficult to forge, so it should be given a high importance weight; a feature pair consisting of the current connected WiFi SSID and the location of the public IP address, although unstable, has a reasonable geographical logical relationship between the two and can be given a medium importance weight.

[0035] In this embodiment of the invention, global prior knowledge is provided by historical normal data, real-time evidence is provided based on the current dataset, and the difference between the two is used as a signal for security risk control. When the correlation at the current moment deviates significantly from the global prior knowledge, the correlation factor of the feature increases, which in turn leads to an increase in weight. The corresponding current feature vector deviates from the feature vector at the initial runtime, resulting in an increase in the difference between the current device fingerprint and the initial device fingerprint, so that users can detect anomalies in a timely manner.

[0036] In this embodiment of the invention, the three influencing factors of time, environment, and correlation are decoupled, making the weight calculation model easier to understand, debug, and optimize. Simultaneously, the weights of each environmental feature are no longer fixed but are adjusted in real time based on the feature's own performance, environmental risk, and correlation with other features, achieving dynamic weighting and improving anti-tampering capabilities and authorization verification security. Furthermore, by setting an environmental risk coefficient, the entire authorization system possesses basic risk perception capabilities.

[0037] In step 106, the initial device fingerprint and the current device fingerprint, the current behavior pattern and the historical behavior pattern of the software to be detected are compared to obtain the detection results, including: Determine whether the key bits in the current device fingerprint are the same as the key bits in the initial device fingerprint; If the judgment result is yes, calculate the similarity between the current device fingerprint and the initial device fingerprint; Input the current behavior pattern into the detection model trained from historical behavior patterns, and output the anomaly probability; Determine whether the similarity is greater than a preset similarity threshold, and determine whether the anomaly probability is lower than a preset probability threshold; If all the judgment results are yes, then the test result is determined to be normal operation.

[0038] It should be noted that the current behavior pattern and historical behavior pattern refer to the operating habits of the currently logged-in user, including but not limited to frequently used function modules, operation time distribution, and input method preferences. The input to the detection model is the current behavior pattern, and the output is the anomaly probability. A normal behavior sequence is constructed based on the historical behavior pattern, and the LSTM model is trained to obtain the trained detection model.

[0039] In this embodiment of the invention, by setting key bits in the device fingerprint and prioritizing comparison of whether the key bits in the current device fingerprint are the same as those in the initial device fingerprint, anomalies are quickly determined. If they are different, an anomaly is directly determined to exist at the current moment. If the key bits are the same, two more subsequent judgments are performed to further determine whether the software under test is running normally by comparing the similarity between the current device fingerprint and the initial device fingerprint, and the probability of anomalies appearing in the current behavior pattern compared to historical behavior patterns. In this way, by combining user behavior patterns during software operation with dynamic device fingerprints, a two-dimensional compliance assessment of environment and behavior is achieved, reducing the false alarm rate, successfully realizing real-time detection of the software under test, significantly improving the security of software operation, and achieving efficient security detection without requiring user privacy information, thus enhancing the user experience.

[0040] In this invention, the initial device fingerprint is stored in both a local cache and an authorization server. The aforementioned software authorization detection method can still operate smoothly offline, effectively detecting the software's running status after authorization, thus protecting the software's operation process. This solves the problem that existing software cannot effectively restrict authorized operation, prevents software theft, and safeguards the rights of developers.

[0041] Following step 106, if the detection result indicates an abnormality, the following steps are also included: Analyze the test results to determine the current anomaly and its severity level; When the level is Level 1, an adjustment strategy is generated based on the current abnormal situation, so as to enable the authorized use of the software to be tested through the adjustment strategy; When the level is Level 2, an adjustment strategy is generated based on the current abnormal situation in order to shorten the detection and verification cycle. When the level is Level 3, an adjustment strategy is generated based on the current abnormal situation, and the authorized use of the software to be detected is stopped through the adjustment strategy; the risk increases progressively from Level 1 to Level 3.

[0042] In this embodiment of the invention, the anomaly database stores the level of each anomaly and the corresponding adjustment strategy, enabling adaptive adjustments based on the current anomaly to ensure software security while protecting the rights of software developers, and to satisfy users' software functionality as much as possible. For example, if the current anomaly is that the user changes their network environment due to business trips (e.g., public IP address changes but other device characteristics remain the same), it is determined to be a low-risk level one, and the adjustment strategy is to generate a temporary device fingerprint based on a historically trusted environment to allow short-term use. If the current anomaly is that the user changes their device, it is determined to be a medium-risk level two, and the adjustment strategy is for the user to submit an appeal and upload supporting evidence (e.g., device purchase certificate), and the server will manually review and update the authorization binding information. If the current anomaly is that a virtual machine is used to simulate hardware characteristics, it is determined to be a medium-risk level two, and the adjustment strategy is to shorten the verification cycle. If the current anomaly is that the network environment and device have changed, and the public IP address is located overseas, it is determined to be a high-risk level three, and the adjustment strategy is to stop the authorized use of the software under test.

[0043] like Figure 2 , Figure 3 As shown, this embodiment of the invention provides a software licensing detection device based on multi-dimensional environmental perception. The device embodiment can be implemented through software, hardware, or a combination of both. From a hardware perspective, such as... Figure 2 The diagram shown is a hardware architecture diagram of a computing device containing a software licensing detection device based on multi-dimensional environmental perception, according to an embodiment of the present invention. (Except for...) Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown, the computing device in the embodiment may also include other hardware, such as a forwarding chip responsible for processing packets. Taking software implementation as an example, such as... Figure 3 As shown, a device in a logical sense is formed by the CPU of its computing device reading the corresponding computer program from non-volatile memory into memory for execution. This embodiment provides a software licensing detection device based on multi-dimensional environmental awareness, comprising: The acquisition module 300 is used to acquire the environmental characteristics of the software under test during its initial runtime; wherein, the environmental characteristics include hardware layer characteristics, network layer characteristics and system layer characteristics; The dynamic generation module 302 is used to dynamically generate an initial device fingerprint based on the environmental characteristics; and bind the initial device fingerprint with the software authorization information of the software to be tested; The acquisition module 300 is also used to acquire the current environmental characteristics and current behavior patterns of the software to be detected in real time. The dynamic generation module 302 is also used to dynamically generate the current device fingerprint based on the current environment features; The verification module 304 is used to compare the initial device fingerprint with the current device fingerprint, the current behavior pattern with the historical behavior pattern of the software to be detected, and obtain the detection result.

[0044] In some specific implementations, the acquisition module 300 can be used to perform the above step 100, the dynamic generation module 302 can be used to perform the above step 102, the acquisition module 300 and the dynamic generation module 302 are used to perform the above step 104, and the verification module 304 can be used to perform the above step 106.

[0045] Since the contents of the above-described apparatus are based on the same concept as the method embodiments of the present invention, the specific contents can be found in the descriptions in the method embodiments of the present invention, and will not be repeated here.

[0046] It is understood that the structures illustrated in the embodiments of the present invention do not constitute a specific limitation on a software licensing detection device based on multi-dimensional environmental awareness. In other embodiments of the present invention, a software licensing detection device based on multi-dimensional environmental awareness may include more or fewer components than illustrated, or combine some components, or split some components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0047] The information interaction and execution process between the modules in the above-mentioned device are based on the same concept as the method embodiment of the present invention, and the specific details can be found in the description of the method embodiment of the present invention, and will not be repeated here.

[0048] This invention also provides a computing device, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements a software license usage detection method based on multi-dimensional environmental perception according to any embodiment of this invention.

[0049] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform a software license usage detection method based on multi-dimensional environment awareness according to any embodiment of this invention.

[0050] Embodiments of this application also provide a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium and executes the computer program, causing the computer device to perform a software license usage detection method based on multi-dimensional environmental awareness as described in any of the above embodiments.

[0051] Specifically, a system or apparatus equipped with a storage medium may be provided, on which software program code implementing the functions of any of the embodiments described above is stored, and the computer (or CPU or MPU) of the system or apparatus may read and execute the program code stored in the storage medium.

[0052] In this case, the program code read from the storage medium can itself implement the function of any of the above embodiments, and therefore the program code and the storage medium storing the program code constitute part of the present invention.

[0053] Storage media embodiments for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, program code can be downloaded from a server computer via a communication network.

[0054] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, system, or device.

[0055] The program code contained on a computer-readable medium may be transmitted using any suitable medium, including, but not limited to, wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0056] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0057] Furthermore, it should be clear that not only can the program code read by the computer be executed, but also the operating system or other components operating on the computer can be instructed based on the program code to perform some or all of the actual operations, thereby realizing the function of any of the embodiments described above.

[0058] Furthermore, it is understood that the program code read from the storage medium is written to the memory set in the expansion board inserted into the computer or to the memory set in the expansion module connected to the computer. Then, based on the instructions of the program code, the CPU or other components installed on the expansion board or expansion module execute some and all of the actual operations, thereby realizing the function of any of the above embodiments.

[0059] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0060] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as ROM, RAM, magnetic disk, or optical disk.

[0061] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A software licensing detection method based on multi-dimensional environmental awareness, characterized in that, include: The environmental characteristics of the software under test during its initial runtime are obtained; wherein, the environmental characteristics include hardware layer characteristics, network layer characteristics, and system layer characteristics; An initial device fingerprint is dynamically generated based on the environmental characteristics; and the initial device fingerprint is bound to the software authorization information of the software to be tested. The current environmental characteristics and current behavior patterns of the software under test are acquired in real time, and the current device fingerprint is dynamically generated based on the current environmental characteristics. The detection result is obtained by comparing the initial device fingerprint with the current device fingerprint, the current behavior pattern with the historical behavior pattern of the software to be detected.

2. The method according to claim 1, characterized in that, The dynamic generation of the initial device fingerprint based on the environmental features includes: The environmental features are dynamically weighted to obtain a feature vector; The feature vector is signed using an encryption algorithm to obtain the initial device fingerprint; And / or, The dynamic generation of the current device fingerprint based on the current environment features includes: The current environmental features are dynamically weighted to obtain the current feature vector; The current feature vector is signed using an encryption algorithm to obtain the current device fingerprint.

3. The method according to claim 2, characterized in that, The dynamic weighting of the environmental features to obtain the feature vector includes: For each of the aforementioned environmental characteristics, the following is executed: Determine the weighting factors for this environmental characteristic; wherein, the weighting factors include a time decay factor, an environmental risk coefficient, and a characteristic correlation factor; The weights are calculated based on the basic static weights of this environmental characteristic and the weight influence factors. The feature vector is obtained by weighting and fusing the feature values ​​of each environmental feature with the weights.

4. The method according to claim 3, characterized in that, Also includes: Based on the real-time data within the corresponding sliding time window, the variance at the initial binding time and the variance at the current time are calculated. The time decay factor is calculated based on the variance at the initial binding time, the variance at the current time, and the continuous runtime of the software to be tested. The environmental risk coefficient is determined based on the current network environment and the detection status of threat intelligence. The correlation strength between the environmental feature and other environmental features is determined from a preset feature association library, and the feature association factor is determined based on the correlation strength and the weight corresponding to the correlation strength; The weight is calculated based on the basic static weight of the environmental feature, the time decay factor, the environmental risk coefficient, and the feature correlation factor; preferably, the weight is determined by the following formula: in, Environmental characteristics i The weights; Environmental characteristics i The aforementioned basic static weights; Environmental characteristics i The time decay factor; The environmental risk coefficient is mentioned above; α The strength coefficient; Environmental characteristics i The aforementioned feature correlation factor.

5. The method according to claim 1, characterized in that, The comparison of the initial device fingerprint and the current device fingerprint, the current behavior pattern and the historical behavior pattern of the software to be detected, yields the detection result, including: Determine whether the key bits in the current device fingerprint are the same as the key bits in the initial device fingerprint; When the determination result is yes, calculate the similarity between the current device fingerprint and the initial device fingerprint; The current behavior pattern is input into the detection model trained from the historical behavior patterns, and the abnormality probability is output. Determine whether the similarity is greater than a preset similarity threshold, and determine whether the anomaly probability is lower than a preset probability threshold; If all the judgment results are yes, then the detection result is determined to be normal operation.

6. The method according to any one of claims 1 to 5, characterized in that, When the detection result indicates an abnormality, the following is also included: The detection results are analyzed to determine the current anomaly and its level. When the level is the first level, an adjustment strategy is generated based on the current abnormal situation, so as to enable the authorized use of the software to be detected through the adjustment strategy; When the level is the second level, an adjustment strategy is generated based on the current abnormal situation in order to shorten the detection and verification cycle through the adjustment strategy; When the level is the third level, an adjustment strategy is generated based on the current abnormal situation to stop the authorized use of the software to be detected; wherein the risk increases progressively from the first level to the third level.

7. A software licensing detection device based on multi-dimensional environmental perception, characterized in that, include: The acquisition module is used to acquire the environmental characteristics of the software under test during its initial runtime; wherein, the environmental characteristics include hardware layer characteristics, network layer characteristics and system layer characteristics; A dynamic generation module is used to dynamically generate an initial device fingerprint based on the environmental characteristics; and bind the initial device fingerprint with the software authorization information of the software to be tested; The acquisition module is also used to acquire the current environmental characteristics and current behavior patterns of the software under test in real time. The dynamic generation module is also used to dynamically generate the current device fingerprint based on the current environment features; The verification module is used to compare the initial device fingerprint with the current device fingerprint, the current behavior pattern with the historical behavior pattern of the software to be tested, and obtain the detection result.

8. A computing device comprising a memory and a processor, wherein the memory stores a computer program, and the processor, when executing the computer program, implements the method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of any one of claims 1-6.

10. A computer program product, characterized in that, Includes computer instructions that, when executed by a processor, implement the steps of the method as described in any one of claims 1-6.

Images