The invention relates to a
software similarity measurement method and device. The method comprises the following steps: acquiring an
intermediate code through disassembly for a binary program, and carrying out the normalization and
standardization on the
intermediate code; counting semantic features of functions, screening first M similarity functions through coarse-grained similarity calculation,and adding the first M similarity functions to a candidate function set; conducting backward
slicing on the functions in the candidate function set through data flow dependence and
program control flow, and acquiring a constraint derivation formula set used for representing key
semantics of the functions; acquiring a final similarity
score of the target function and the comparison function by comparing the constraint derivation formula set; and according to the similarity
score, selecting the first N functions as expert
verification analysis contents. According to the method, differences of programs under different
system architectures, operating systems, compilers and optimization options are reduced by preprocessing codes, patch upgrading functions similar to
vulnerability function
semantics are screened out through extraction and comparison of a function constraint derivation formula, and accuracy is improved.