Constraint-restricted clustering and information metric software birthmark feature selection method, computer

Abstract

The invention belongs to the technical field of birthmark-based software identification, and discloses a software birthmark feature extraction method based on constraint clustering and information measurement, which adopts constraint-limited cluster analysis, and measures feature homogeneity and inter-category distances based on mutual information. In software feature selection, the equivalent semantic transformation of the software is performed first, and then the feature segmentation is performed, combined with the program slicing technology to classify the limited groups of features, and construct gain function and penalty function evaluation for the segmented feature fragment set, based on different structural groups Hierarchical clustering selection, which screens out invariant features in the same class and eliminates common features in different classes. The present invention considers the correlation between features, and the set of selected birthmark features has the largest amount of information and the smallest redundancy; it not only ensures the anti-attack performance of the birthmark features, but also ensures the uniqueness. The invention improves the robustness and reliability of the software birthmark feature, and greatly improves the feature-based recognition rate of the software.

Description

technical field [0001] The invention belongs to the technical field of software birthmarks, and in particular relates to a feature selection method of constraint-defined clustering and information measurement software birthmarks and a computer. Background technique [0002] Traditional software feature extraction techniques are summarized into two categories: one is segmental extraction, which is a fixed-length or variable-length segmentation mode combined with grammar. After feature extraction, it can be cut into segments by static word segmentation. Segmented feature selection, or selection based on variable-length P-gram segmentation; without combining semantic analysis and analyzing the correlation between features, the obtained birthmark features are less robust to software encryption, deformation, polymorphic attacks, etc. ; The other is slicing extraction, combined with the selection method of software semantic structure, the program slicing is based on the program de...

AI Technical Summary

Problems solved by technology

[0003] To sum up, the existing problems in the prior art are as follows: First, the traditional software feature acquisition method without clustering and screening is characterized by a large feature library, which contains relatively large feature redundant information, and feature-based software identification The rate is low; or there is no contextual semantic analysis feature group combined with software, lack of dynamic feature selection

Images