Method and system for identifying open-source software package based on binary files

A system for identifying an open-source software package from a target binary file for which an open-source license is to be checked, the system comprising:

• a storage unit storing an open-source database generated to include a plurality of reference open-source software packages having a plurality of reference open-source files and to include a plurality of reference binary files, based on a plurality of first hash values extracted from the plurality of reference binary files generated from the plurality of reference open-source files;
• a reception unit configured to receive the target binary file;
• a processor configured to extract a plurality of second hash values including at least two general hash values from the target binary file, extract at least two first hash values corresponding to the plurality of second hash values among the plurality of first hash values included in the open-source database, and identify a reference open-source software package corresponding to the at least two first hash values based on the open-source database, among the plurality of reference open-source software packages;
• and
• an output unit configured to output the identified reference open-source software package,
• wherein each of the plurality of first hash values and the plurality of second hash values comprises a plurality of general hash values generated using a general hash function and a similarity hash value generated using a similarity-based hash function, and
• wherein the processor is configured to:
• determine whether the open-source database includes at least two general hash values of the first hash values which match at least two general hash values of the second hash values;
• extract at least two general hash values of the first hash values from the open-source database, if it is determined that the open-source database includes the at least two general hash values of the first hash values matching the extracted at least two general hash values of the second hash values;
• and
• extract at least one similarity hash value associated with at least one reference binary file based on a file name of the target binary file, if it is determined that the open-source database does not include the at least two general hash values matching the extracted at least two general hash values of the second hash values.