Software homology analysis method and apparatus, and computer device and readable storage medium

Abstract

A software homology analysis method, comprising: acquiring from a pre-trained target classification model a target family classification result for software to be analyzed; on the basis of the target family classification result, performing explanation and analysis on the target classification model, so as to acquire a family gene of said software; on the basis of the target family classification result, acquiring from a pre-established family gene resource center a family gene library of a target family and software samples in the target family, wherein a family classification result of the software samples in the target family is the same as the target family classification result; and on the basis of the family gene of said software, the family gene library of the target family and the software samples in the target family, determining a homology analysis result between said software and the target family.

Description

Software homology analysis methods, apparatus, computer equipment, and readable storage media

[0001] Related applications

[0002] This application claims priority to Chinese patent application filed on April 16, 2025, with application number 2025104733777, entitled "Software Homology Analysis Method, Apparatus, Computer Equipment and Readable Storage Medium", the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to the field of network security technology, and in particular to a software homology analysis method, apparatus, computer device, and computer-readable storage medium. Background Technology

[0004] The statements herein are provided only as background information in connection with this application and do not necessarily constitute prior art.

[0005] With the development of computer technology, the spread and attacks of malware have become more frequent, making the construction of a network attack defense system crucial. In building such a system, attribution is a vital step. Currently, the common method in attribution analysis is to manually compare and search binary code to identify the cause of an attack. However, for complex samples, this requires a significant amount of time and repeated analysis and comparison, resulting in substantial manual costs. Summary of the Invention

[0006] According to various embodiments of this application, a software homology analysis method, apparatus, computer device, and computer-readable storage medium are provided.

[0007] In a first aspect, this application provides a software homology analysis method, the method comprising:

[0008] Obtain the target family classification results of the pre-trained target classification model in the software to be analyzed;

[0009] Based on the target family classification results, the target classification model is interpreted and analyzed to obtain the family genes of the software to be analyzed;

[0010] Based on the target family classification results, obtain the family gene bank of the target family and software samples from the target family from a pre-established family gene resource center; the family classification results of the software samples in the target family are the same as the target family classification results.

[0011] Based on the family gene of the software to be analyzed, the family gene library of the target family, and the software samples in the target family, the homology analysis results between the software to be analyzed and the target family are determined.

[0012] In one embodiment, the target classification model includes multiple network layers; the step of obtaining the family genes of the software to be analyzed based on the target family classification results includes:

[0013] Background samples are determined from a software sample set; the software sample set is used to train the target classification model; the background samples include at least one software sample from the software sample set.

[0014] Obtain the family classification results of the target classification model for each software sample in the background sample;

[0015] Obtain the propagation difference values ​​of the software to be analyzed and each software sample in the background sample in each network layer of the target classification model;

[0016] Based on the family classification results and propagation difference values ​​of each software sample in the background sample, the contribution of each basic block in the software to be analyzed to the target family classification results is obtained.

[0017] The family genes of the software to be analyzed are obtained based on the contribution of each basic block in the software to the classification results of the target family.

[0018] In one embodiment, the attribute characteristics of the basic block include at least one of string constants, numerical constants, number of transfer instructions, number of call instructions, number of arithmetic instructions, total number of instructions, number of child nodes, and betweenness centrality; the step of obtaining the contribution of each basic block in the software to be analyzed to the target family classification result based on the family classification results and propagation difference values ​​of each software sample in the background sample includes:

[0019] Based on the family classification results of each software sample in the background sample and the propagation difference value, the marginal contribution value corresponding to each attribute feature of each basic block in the software to be analyzed is calculated respectively.

[0020] For each basic block of the software to be analyzed, the corresponding contribution degree is obtained based on the marginal contribution value corresponding to all attribute characteristics of each basic block.

[0021] In one embodiment, the background sample includes multiple software samples; the step of calculating the marginal contribution value corresponding to each attribute feature of each basic block in the software to be analyzed, based on the family classification results and propagation difference values ​​of each software sample in the background sample, includes:

[0022] Based on the family classification results and propagation difference values ​​of each software sample in the background sample, the initial marginal contribution value of each attribute feature of each basic block in the software to be analyzed relative to different software samples is calculated respectively.

[0023] For each basic block in the software to be analyzed, the average of the initial marginal contribution values ​​of each attribute feature relative to different software samples is determined as the marginal contribution value corresponding to each attribute feature.

[0024] In one embodiment, determining the homology analysis results between the software to be analyzed and the target family based on the family gene of the software to be analyzed, the family gene library of the target family, and software samples in the target family includes:

[0025] The family genes of the software to be analyzed are matched with software samples in the target family to obtain the number of successfully matched software samples.

[0026] The family genes in the family gene library of the target family are matched with the family genes of the software to be analyzed to obtain the number of successfully matched genes.

[0027] Based on the number of software programs and the number of genes, obtain the homology analysis results between the software to be analyzed and the target family.

[0028] In one embodiment, the method further includes:

[0029] Obtain the attribute control flowchart for each software sample in the software sample set;

[0030] At least one sample classification model is constructed based on the attribute control flowchart; the at least one sample classification model includes the target classification model;

[0031] The software samples in the software sample set are classified into families using the respective sample classification models to obtain the family classification results of each software sample in the software sample set.

[0032] The family classification results of each software sample in the software sample set are interpreted and analyzed to obtain the family genes of each software sample.

[0033] Based on the family genes of each software sample, a family gene bank for the corresponding family is constructed, and the family gene banks of multiple families constitute the family gene resource center.

[0034] In one embodiment, the method further includes:

[0035] Obtain a pre-trained classification model for multiple samples;

[0036] The software to be analyzed is classified into families using the sample classification models described above, and the target classification model is determined from the sample classification models described above.

[0037] Secondly, this application also provides a software homology analysis apparatus, the apparatus comprising:

[0038] The classification result acquisition module is used to acquire the target family classification results of the pre-trained target classification model in the software to be analyzed;

[0039] The family gene acquisition module is used to interpret and analyze the target classification model based on the target family classification results, and acquire the family gene of the software to be analyzed.

[0040] The homology analysis module is used to obtain the family gene library of the target family and software samples in the target family from a pre-established family gene resource center based on the target family classification results; the family classification results of the software samples in the target family are the same as the target family classification results; and determine the homology analysis results between the software to be analyzed and the target family based on the family gene of the software to be analyzed, the family gene library of the target family, and the software samples in the target family.

[0041] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the software homology analysis method provided in any of the above embodiments.

[0042] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the software homology analysis method provided in any of the above embodiments.

[0043] Details of one or more embodiments of this application are set forth in the following drawings and description. Other features, objects, and advantages of this application will become apparent from the specification, drawings, and claims. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of this application or the conventional technology, the drawings used in the description of the embodiments or the conventional technology will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the disclosed drawings without creative effort.

[0045] Figure 1 is a flowchart illustrating a software homology analysis method in one embodiment;

[0046] Figure 2 is a flowchart illustrating the process of obtaining the family genes of the software to be analyzed based on the target family classification model according to the target family classification results in one embodiment.

[0047] Figure 3 is a flowchart illustrating the process of determining the homology analysis results between the software to be analyzed and the target family based on the family gene of the software to be analyzed, the family gene library of the target family, and software samples in the target family in one embodiment.

[0048] Figure 4 is a schematic diagram of the process of constructing a family gene bank in one embodiment;

[0049] Figure 5 is an architecture diagram of a software homology analysis method in one embodiment;

[0050] Figure 6 is a flowchart illustrating the software homology analysis method in another embodiment;

[0051] Figure 7 is a structural block diagram of a software homology analysis device in one embodiment;

[0052] Figure 8 is an internal structure diagram of a computer device in one embodiment. Detailed Implementation

[0053] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0054] In one embodiment, as shown in FIG1, this application provides a software homology analysis method, including steps 102-108.

[0055] Step 102: Obtain the target family classification results of the pre-trained target classification model in the software to be analyzed.

[0056] The target classification model can be a family classification model obtained after deep training using one-dimensional convolutional neural networks, such as ResNet50, VGG19, and Xception convolutional neural networks. The software to be analyzed is primarily malware that threatens network security or user interests; it can be binary code snippets or computer program products. In this application, malware is classified by referring to a group of malware likely written by the same organization or individual as a "family." The target family classification result includes the family to which the software to be analyzed belongs.

[0057] If the software to be analyzed contains a shell, it needs to be unpacked before performing family classification on the software using a pre-trained target classification model. In one embodiment, the Unipacker tool can be used to unpack the software.

[0058] Step 104: Based on the target family classification results, interpret and analyze the target classification model to obtain the family genes of the software to be analyzed.

[0059] The "family gene" of the software to be analyzed actually refers to the binary code segments within the software. The software can be divided into multiple consecutive binary code segments. By interpreting and analyzing the target classification model based on the target family classification results, the degree of influence of each binary code segment on the output of the target classification model can be obtained. Thus, the binary code segment with the greatest influence can be considered the family gene of the software. In one embodiment, the SHAP (SHapley Additive exPlanations) framework can be used to interpret and analyze the target classification model to obtain the family gene of the software.

[0060] Step 106: Based on the target family classification results, obtain the family gene bank of the target family and the software samples in the target family from the pre-established family gene resource center; the family classification results of the software samples in the target family are the same as the target family classification results.

[0061] The Family Gene Resource Center is a database that includes family gene banks and software samples from different families, built upon previously accumulated data. The genes in the family gene bank are binary code fragments from malware within the same family that exhibit similar behaviors, such as using the same IP address or domain name.

[0062] Step 108: Based on the family genes of the software to be analyzed, the family gene library of the target family, and the software samples in the target family, determine the homology analysis results between the software to be analyzed and the target family.

[0063] After obtaining the family gene of the software to be analyzed, the family gene library of the target family and the software sample can be matched with the family gene of the software to be analyzed to determine the homology analysis results between the software to be analyzed and the target family, thereby achieving the tracing of the origin of the software to be analyzed.

[0064] In this embodiment, the software to be analyzed is classified into families using a "model + gene" approach. Specifically, a pre-trained target classification model is used to obtain the target family classification results of the software to be analyzed. Based on the target family classification results, the target classification model is interpreted and analyzed to obtain the degree of influence of each binary code segment in the software to be analyzed on the output results of the target classification model, thereby obtaining the family genes of the software to be analyzed. Then, based on the target family classification results, the family gene library of the target family and software samples in the target family are obtained from a pre-established family gene resource center. Based on the family genes of the software to be analyzed, the family gene library of the target family, and the software samples in the target family, the homology analysis results between the software to be analyzed and the target family are determined, thereby achieving the tracing of the source of the software to be analyzed, shortening the time for tracing the source of the software to be analyzed, and improving the efficiency of homology analysis.

[0065] In one embodiment, as shown in Figure 2, based on the target family classification results, the family genes of the software to be analyzed are obtained from the target classification model, including steps 202-210.

[0066] Step 202: Determine background samples from the software sample set, which is used to train the target classification model. The background samples include at least one software sample from the software sample set.

[0067] The software sample set includes benign software and known families of malware. Benign software obtained through official channels can be installed in batches via software installation, and binary files with extensions such as .exe, .sys, and .dll on the disk after installation can be collected. Malware carrying family tags can be obtained using threat intelligence sharing platforms and practical collection methods. If the obtained benign and malware samples contain packers, they can be unpacked using the Unipacker tool. A software sample set is constructed based on the obtained benign and malware. The software sample set can be used to train a target classification model. When training the target classification model using the software sample set, it can be divided into a training set and a test set. The training set is used to train the target classification model, and the test set is used to verify the accuracy of the family classification results output by the target classification model. In one embodiment, the software sample set can be divided into training and test sets in an 8:2 ratio, shuffled, and the data in the software sample set redistributed before using the test set to train the target classification model. At least one piece of malware can be randomly selected from the software sample set as a background sample.

[0068] Step 204: Obtain the family classification results of each software sample in the background samples by the target classification model.

[0069] Let the background sample be X. ′In the background samples, each software sample is denoted as x0, where x0∈X. ′ The target classification model outputs the family classification result f(x0) for each software sample in the background samples.

[0070] Step 206: Obtain the propagation difference values ​​of each software sample in the target classification model in each network layer between the software to be analyzed and the background samples.

[0071] The target classification model comprises multiple network layers. In one embodiment, the target classification model may include an input layer, an output layer, and at least one hidden layer. To attribute the difference in output results between the target classification model and the background samples to input features, it is necessary to first obtain the propagation difference values ​​of each software sample in the target classification model at each network layer.

[0072] Assuming the target classification model has L network layers, for the software x to be analyzed and the software sample x0, the propagation difference value Δa at layer l is... l For: Δa l =a l (x)-a l (x0) (1)

[0073] Among them, a l a is the activation value of layer l. l This can be obtained by reverse propagation of the propagation difference from the next layer: a l+1 (x)=g(W l a l (x)+b l (2)

[0074] Among them, W l b represents the weight of layer l. l represents the bias of layer l, and g() represents the activation function.

[0075] Step 208: Based on the family classification results and propagation difference values ​​of each software sample in the background sample, obtain the contribution of each basic block in the software to be analyzed to the target family classification results.

[0076] In this application, when analyzing the software to be analyzed, the control flow information of the code in the software is represented in the form of a directed graph. The directed graph consists of a series of basic blocks. Each basic block consists of a series of code statements. Basic blocks have two characteristics during execution: first, execution can only begin from the first jump statement; it is not possible to jump into the middle of a basic block in any way; second, statements within a basic block must exit from the last statement during execution, and cannot jump to other basic blocks halfway through execution. The attribute characteristics of basic blocks include at least one of the following: string constants, numeric constants, number of jump instructions, number of call instructions, number of arithmetic instructions, total number of instructions, number of child nodes, and betweenness centrality. In one embodiment, the Radare2 tool can be used to parse the software to be analyzed and extract the Attributed Control Flow Graph (ACFG) of the sample to be analyzed.

[0077] When obtaining the contribution of each basic block in the software to be analyzed to the classification results of the target family, the input differences between the software to be analyzed and the background samples can be decomposed into each attribute feature of the basic block, and the marginal contribution value of each attribute feature can be calculated.

[0078] Specifically, based on the family classification results and propagation difference values ​​of each software sample in the background sample, the marginal contribution value corresponding to each attribute feature of each basic block in the software to be analyzed can be calculated. The marginal contribution value C of attribute feature i is... i It can be calculated using the following formula:

[0079] in, It is the partial derivative of the target classification model with respect to feature i at software sample x0, and is approximated by the following formula:

[0080] If the background sample includes multiple software samples, then based on equation (3), according to the family classification results and propagation difference values ​​of each software sample in the background sample, the initial marginal contribution value C of each attribute feature of each basic block in the software to be analyzed relative to different software samples can be calculated. i ′ For each basic block in the software to be analyzed, the average of the initial marginal contribution values ​​of each attribute feature relative to different software samples is used to determine the marginal contribution value corresponding to each attribute feature. In one embodiment, for attribute feature i in a single basic block, the marginal contribution value C can be obtained by the following formula. i :

[0081] Among them, |X ′ | indicates the number of software samples x0 in the background samples.

[0082] After obtaining the marginal contribution value corresponding to each attribute feature of each basic block, the marginal contribution value can be stored as a NumPy file in a one-to-one correspondence with the attribute features of the basic blocks.

[0083] Furthermore, for each basic block of the software to be analyzed, the corresponding contribution degree is obtained based on the marginal contribution values ​​corresponding to all attribute features of each basic block. A NumPy file can be read, and the weighted average of the marginal contribution values ​​of each dimension attribute feature within the same basic block can be calculated to obtain the contribution degree corresponding to the basic block. The weights of each dimension attribute feature within the same basic block can be set manually, and this embodiment of the application does not impose any restrictions on this.

[0084] Step 210: Obtain the family genes of the software to be analyzed based on the contribution of each basic block in the software to the target family classification results.

[0085] The contribution of each basic block to the target family classification result reflects the degree of influence of each basic block on the target family classification result. The basic blocks in the software to be analyzed can be sorted in descending order of contribution, and the binary data corresponding to the top-ranked preset number of basic blocks can be used as the family genes of the software to be analyzed. The preset number can be reasonably set according to empirical rules. In one embodiment, the preset number can be one, two, five, or more, etc.

[0086] In this embodiment, the difference between the output results of the target classification model and the background samples is attributed to the input features through layer-by-layer reverse transmission. By obtaining the contribution of each basic block in the software to the target family classification result, the key basic blocks in the software that affect the target family classification result are obtained. The binary data corresponding to the key basic blocks are used as the family genes of the software to be analyzed, thus realizing the automated extraction of the family genes of the software to be analyzed.

[0087] In one embodiment, as shown in Figure 3, the homology analysis results between the software to be analyzed and the target family are determined based on the family gene of the software to be analyzed, the family gene library of the target family, and the software samples in the target family, including steps 302-306.

[0088] Step 302: Match the family genes of the software to be analyzed with software samples in the target family to obtain the number of successfully matched software.

[0089] A successful match between the genealogy of the software to be analyzed and the software sample can be defined as a genealogy overlap rate exceeding a first preset value. This first preset value can be set reasonably based on experience.

[0090] Based on the binary data of the software family gene after removing positional information, a first YARA (Yet Another Recursive Acronym) rule can be defined. This first YARA rule is then used to match software samples from the target family, obtaining the number of successfully matched software samples. The definition process of the first YARA rule can refer to the definition of a conventional YARA rule, and will not be described in detail here.

[0091] Step 304: Match the family genes in the target family's family gene bank with the family genes in the software to be analyzed, and obtain the number of successfully matched genes.

[0092] If the family genes in the target family's family gene bank match successfully with the family genes in the software to be analyzed, it means that the overlap rate between the family genes in the target family's family gene bank and the family genes in the software to be analyzed exceeds a second preset value. The second preset value can be reasonably set based on experience.

[0093] A second YARA rule can be defined based on the binary data of family genes (after removing positional information) in the target family's family gene database. This second YARA rule is then used to perform matching in the analysis software to obtain the number of successfully matched genes. The definition process of the second YARA rule can refer to the definition of a regular YARA rule, and will not be described in detail here.

[0094] Step 306: Based on the number of software programs and the number of genes, obtain the homology analysis results between the software to be analyzed and the target family.

[0095] Specifically, if either the number of software programs or the number of genes exceeds a corresponding preset value, the correlation between the software being analyzed and the target family is considered high; conversely, if both the number of software programs and the number of genes are below their respective preset values, the correlation between the software being analyzed and the target family is considered low. The preset values ​​for the number of software programs and the number of genes can be reasonably set based on empirical rules. In one embodiment, the preset values ​​for the number of software programs and the number of genes can be 0 or 1, respectively.

[0096] In this embodiment, the family genes of the software to be analyzed are matched with software samples in the target family, and the family genes in the family gene library of the target family are matched with the family genes of the software to be analyzed. The homology analysis results between the software to be analyzed and the target family are determined by cross-validation, which ensures the accuracy of the homology analysis results.

[0097] In one embodiment, as shown in FIG4, the software homology analysis method of this application further includes steps 402-410.

[0098] Step 402: Obtain the attribute control flowchart for each software sample in the software sample set.

[0099] The attribute control flow graph is a directed graph composed of a series of basic blocks with attribute characteristics. The attribute characteristics of the basic blocks include eight features: string constants, numeric constants, number of transfer instructions, number of call instructions, number of arithmetic instructions, total number of instructions, number of child nodes, and betweenness centrality. The software sample set has been described previously and will not be repeated here. It should be noted that in this embodiment, the software sample set can be used to train multiple sample classification models.

[0100] Step 404: Construct at least one sample classification model based on the attribute control flowchart, wherein the at least one sample classification model includes a target classification model.

[0101] First, the basic blocks in multiple ACFG diagrams can be arranged according to the non-jump priority, resulting in multiple ACFG feature sequences. Non-jump priority applies to basic blocks that end with conditional jump instructions. For example, if basic block A ends with a conditional jump instruction, jumping to execute basic block C, and not jumping to execute basic block B, then basic block B will be positioned before basic block C in the ACFG feature sequence.

[0102] Multiple ACFG feature sequences can be learned using commonly used one-dimensional convolutional neural network algorithms to obtain multiple sample classification models. That is, each one-dimensional convolutional neural network algorithm corresponds to a sample classification model.

[0103] Step 406: Use the classification models of each sample to perform family classification on each software sample in the software sample set, and obtain the family classification results of each software sample in the software sample set.

[0104] Step 408: Interpret and analyze the family classification results of each software sample in the software sample set to obtain the family genes of each software sample.

[0105] Specifically, the classification performance of each sample classification model in classifying the software samples in the software sample set into families can be statistically analyzed first. In one embodiment, the F1 score can be used to measure the classification performance of each sample classification model for the same family. The F1 score is a statistical indicator used to measure the precision of a binary classification model, taking into account both precision and recall. For the same family, the higher the F1 score, the better the classification performance of the sample classification model. When interpreting and analyzing the family classification results of each software sample in the software sample set, only the sample classification model with the best classification performance needs to be interpreted and analyzed based on the same principles as steps 202-210 to obtain the family genes of each software sample.

[0106] Step 410: Based on the family genes of each software sample, construct the corresponding family gene bank. The family gene banks of multiple families constitute a family gene resource center.

[0107] It is understandable that a family gene bank can be constructed based on the family genes of software samples belonging to the same family among various software samples. Then, a family gene resource center can be constructed based on the family gene banks of different families.

[0108] In this embodiment, by interpreting and analyzing the family classification results of each software sample in the software sample set, the family genes of each software sample are obtained. Based on the family genes of each software sample, a family gene library for the corresponding family is constructed, achieving rapid construction of the family gene library without the need for one-to-one comparison of samples from malicious software families. Furthermore, when training the sample classification model, the software training set used includes not only malicious software but also benign software. Including benign software in the scope of consideration for the sample classification model can reduce the false positive rate when matching the family genes of the software to be analyzed extracted based on the sample classification model with the family gene library and software samples of the target family.

[0109] In one embodiment, the software homology analysis method of this application further includes the steps of obtaining multiple pre-trained sample classification models, using each sample classification model to classify the software to be analyzed into a family, and determining the target classification model from each sample classification model.

[0110] It can be understood that the target classification model is the best-performing classification model among multiple sample classification models for the software to be analyzed. In one embodiment, model A classifies the software to be analyzed into family X, and model B classifies it into family Y. Model A has an F1 score of 0.75 for family X, and model B has an F1 score of 0.91 for family Y. In this case, model B will be selected as the target classification model for the software to be analyzed.

[0111] In one embodiment, as shown in Figures 5 and 6, a software homology analysis method is provided, which includes the following steps 602-618.

[0112] Step 602: Unpack the software sample set. The software sample set includes benign software and known families of malware.

[0113] Step 604: Extract the ACFG features of each basic block in the software sample.

[0114] Step 606: Arrange the basic blocks in each software sample in a non-jump priority manner to obtain multiple ACFG feature sequences.

[0115] Step 608: Train sample classification models with different convolutional neural network architectures using multiple ACFG feature sequences.

[0116] Step 610: Statistically analyze the classification performance of multiple sample classification models to determine the sample classification model with the best classification performance for each family.

[0117] Step 612: For the software to be explained, analyze the key basic blocks that affect the family classification results of the sample classification model. The software to be explained is one of the software samples in the software sample set that have not been analyzed and the sample to be analyzed.

[0118] Step 614: Use the binary data corresponding to the key basic blocks as the family genes of the software to be interpreted.

[0119] Step 616: If the software to be explained is a software sample in the software sample set that has not been interpreted or analyzed, construct a corresponding family gene library based on the family genes of the software to be explained.

[0120] Step 618: If the software to be interpreted is the software to be analyzed, the extracted family genes of the software to be analyzed are converted into the first YARA rule and matched with the genes in the family gene library of the target family. In addition, the genes in the family gene library of the target family are converted into the second YARA rule and matched with the family genes of the software to be analyzed to determine the homology analysis results.

[0121] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0122] Based on the same inventive concept, this application also provides a software homology analysis apparatus for implementing the software homology analysis method described above. The solution provided by this apparatus is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more embodiments of the software homology analysis apparatus provided below can be found in the limitations of the software homology analysis method described above, and will not be repeated here.

[0123] In one embodiment, as shown in FIG7, a software homology analysis device is provided, comprising: a classification result acquisition module 702, a family gene acquisition module 704, and a homology analysis module 706, wherein:

[0124] The classification result acquisition module 702 is used to acquire the target family classification results of the pre-trained target classification model in the software to be analyzed;

[0125] The family gene acquisition module 704 is used to interpret and analyze the target classification model based on the target family classification results, and to acquire the family genes of the software to be analyzed.

[0126] The homology analysis module 706 is used to obtain the family gene library of the target family and software samples in the target family from a pre-established family gene resource center based on the target family classification results; the family classification results of the software samples in the target family are the same as the target family classification results; and determine the homology analysis results between the software to be analyzed and the target family based on the family gene of the software to be analyzed, the family gene library of the target family, and the software samples in the target family.

[0127] In one embodiment, the family gene acquisition module is further configured to determine background samples from a software sample set; the software sample set is used to train the target classification model; the background samples include at least one software sample from the software sample set; obtain the family classification results of the target classification model for each software sample in the background samples; obtain the propagation difference values ​​of the software to be analyzed and each software sample in the background samples at each network layer of the target classification model; based on the family classification results and propagation difference values ​​of each software sample in the background samples, obtain the contribution of each basic block in the software to be analyzed to the target family classification results; and obtain the family gene of the software to be analyzed based on the contribution of each basic block in the software to the target family classification results.

[0128] In one embodiment, the family gene acquisition module is further configured to calculate the marginal contribution value corresponding to each attribute feature of each basic block in the software to be analyzed based on the family classification results and propagation difference values ​​of each software sample in the background sample; and for each basic block of the software to be analyzed, obtain the corresponding contribution degree based on the marginal contribution values ​​corresponding to all attribute features of each basic block.

[0129] In one embodiment, the family gene acquisition module is further configured to calculate the initial marginal contribution value of each attribute feature of each basic block in the software to be analyzed relative to different software samples based on the family classification results and propagation difference values ​​of each software sample in the background sample; and for each basic block in the software to be analyzed, determine the average value of the initial marginal contribution value of each attribute feature relative to different software samples as the marginal contribution value corresponding to each attribute feature.

[0130] In one embodiment, the homology analysis module is further configured to match the family genes of the software to be analyzed with software samples in the target family to obtain the number of successfully matched software samples; match the family genes in the family gene library of the target family with the family genes of the software to be analyzed to obtain the number of successfully matched genes; and obtain the homology analysis results between the software to be analyzed and the target family based on the number of software samples and the number of genes.

[0131] In one embodiment, the software homology analysis device further includes a model training module and a gene bank construction module.

[0132] The model training module is used to obtain the attribute control flowchart of each software sample in the software sample set; to construct at least one sample classification model based on the attribute control flowchart; and the at least one sample classification model includes a target classification model.

[0133] The gene bank construction module is used to classify the software samples in the software sample set into families using the classification models of each sample, and obtain the family classification results of each software sample in the software sample set; interpret and analyze the family classification results of each software sample in the software sample set, and obtain the family genes of each software sample; based on the family genes of each software sample, construct the family gene bank of the corresponding family, and the family gene banks of multiple families constitute the family gene resource center.

[0134] In one embodiment, the software homology analysis apparatus further includes a target model determination module for acquiring multiple pre-trained sample classification models; classifying the software to be analyzed into families using each sample classification model; and determining the target classification model from among the sample classification models.

[0135] Each module in the aforementioned software homology analysis device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0136] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram is shown in Figure 8. The computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is connected to the system bus via the I / O interfaces. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database of the computer device stores extracted family genes, etc. The I / O interfaces of the computer device are used for exchanging information between the processor and external devices. The communication interface of the computer device is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a software homology analysis method.

[0137] Those skilled in the art will understand that the structure shown in Figure 8 is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or may combine certain components, or may have different component arrangements.

[0138] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the software homology analysis method provided in any of the above embodiments.

[0139] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the software homology analysis method provided in any of the above embodiments.

[0140] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the software homology analysis method provided in any of the above embodiments.

[0141] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0142] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0143] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A software homology analysis method, wherein, The method includes: Obtain the target family classification results of the pre-trained target classification model in the software to be analyzed; Based on the target family classification results, the target classification model is interpreted and analyzed to obtain the family genes of the software to be analyzed; Based on the target family classification results, obtain the family gene bank of the target family and software samples from the target family from a pre-established family gene resource center; the family classification results of the software samples in the target family are the same as the target family classification results. Based on the family gene of the software to be analyzed, the family gene library of the target family, and the software samples in the target family, the homology analysis results between the software to be analyzed and the target family are determined.

2. The method according to claim 1, wherein, The target classification model includes multiple network layers; the step of obtaining the family genes of the software to be analyzed based on the target family classification results includes: Background samples are determined from a software sample set; the software sample set is used to train the target classification model; the background samples include at least one software sample from the software sample set. Obtain the family classification results of the target classification model for each software sample in the background sample; Obtain the propagation difference values ​​of the software to be analyzed and each software sample in the background sample in each network layer of the target classification model; Based on the family classification results and propagation difference values ​​of each software sample in the background sample, the contribution of each basic block in the software to be analyzed to the target family classification results is obtained. The family genes of the software to be analyzed are obtained based on the contribution of each basic block in the software to the classification results of the target family.

3. The method according to claim 2, wherein, The attribute characteristics of the basic block include at least one of string constants, numerical constants, number of transfer instructions, number of call instructions, number of arithmetic instructions, total number of instructions, number of child nodes, and betweenness centrality; the step of obtaining the contribution of each basic block in the software to be analyzed to the target family classification result based on the family classification results and propagation difference values ​​of each software sample in the background sample includes: Based on the family classification results of each software sample in the background sample and the propagation difference value, the marginal contribution value corresponding to each attribute feature of each basic block in the software to be analyzed is calculated respectively. For each basic block of the software to be analyzed, the corresponding contribution degree is obtained based on the marginal contribution value corresponding to all attribute characteristics of each basic block.

4. The method according to claim 3, wherein, The background sample includes multiple software samples; the step of calculating the marginal contribution value corresponding to each attribute feature of each basic block in the software to be analyzed, based on the family classification results and propagation difference values ​​of each software sample in the background sample, includes: Based on the family classification results and propagation difference values ​​of each software sample in the background sample, the initial marginal contribution value of each attribute feature of each basic block in the software to be analyzed relative to different software samples is calculated respectively. For each basic block in the software to be analyzed, the average of the initial marginal contribution values ​​of each attribute feature relative to different software samples is determined as the marginal contribution value corresponding to each attribute feature.

5. The method according to claim 1, wherein, The step of determining the homology analysis results between the software to be analyzed and the target family based on the family gene pool of the target family and software samples in the target family includes: The family genes of the software to be analyzed are matched with software samples in the target family to obtain the number of successfully matched software samples. The family genes in the family gene library of the target family are matched with the family genes of the software to be analyzed to obtain the number of successfully matched genes. Based on the number of software programs and the number of genes, obtain the homology analysis results between the software to be analyzed and the target family.

6. The method according to any one of claims 1-5, wherein, The method further includes: Obtain the attribute control flowchart for each software sample in the software sample set; At least one sample classification model is constructed based on the attribute control flowchart; the at least one sample classification model includes the target classification model; The software samples in the software sample set are classified into families using the respective sample classification models to obtain the family classification results of each software sample in the software sample set. The family classification results of each software sample in the software sample set are interpreted and analyzed to obtain the family genes of each software sample. Based on the family genes of each software sample, a family gene bank for the corresponding family is constructed, and the family gene banks of multiple families constitute the family gene resource center.

7. The method according to any one of claims 1-5, wherein, The method further includes: Obtain a pre-trained classification model for multiple samples; The software to be analyzed is classified into families using the sample classification models described above, and the target classification model is determined from the sample classification models described above.

8. A software homology analysis device, wherein, The device includes: The classification result acquisition module is used to acquire the target family classification results of the pre-trained target classification model in the software to be analyzed; The family gene acquisition module is used to interpret and analyze the target classification model based on the target family classification results, and acquire the family gene of the software to be analyzed. The homology analysis module is used to obtain the family gene library of the target family and software samples in the target family from a pre-established family gene resource center based on the target family classification results; the family classification results of the software samples in the target family are the same as the target family classification results; and determine the homology analysis results between the software to be analyzed and the target family based on the family gene of the software to be analyzed, the family gene library of the target family, and the software samples in the target family.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein... When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, wherein, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images