Security vulnerability early warning method and system based on software source code analysis

Abstract

The invention discloses a security vulnerability early warning method and system based on software source code analysis, and the method comprises the steps: collecting and storing software basic information, selecting software for source code management according to the software basic information, and building an incidence relation between the software and a source code; selecting a source code according to the association relationship, automatically analyzing the third-party technical component file, establishing a technical component library, establishing an association relationship between software and the third-party technical component, detecting a vulnerability database in the global information security field in real time, and automatically synchronizing vulnerability information; matching the automatically synchronized vulnerability information with a technical component library, establishing an association relationship between the vulnerability information and a third-party technical component, automatically generating early warning information according to the association relationship, displaying the early warning information and recording vulnerability processing information corresponding to the early warning information, and after vulnerability processing is completed, automatically canceling early warning information, newly adding a vulnerability processing record, visually displaying a vulnerability information analysis result, and achieving timely active early warning.

Description

technical field [0001] The invention relates to the technical field of network information security, in particular to a security vulnerability early warning method and system based on software source code analysis. Background technique [0002] With the in-depth development of Internet technology, topics such as system security and application security have become unavoidable challenges for software companies and information system construction units. How to proactively warn technical security vulnerabilities during software operation and actively prevent software security risks, It is a problem that both software companies and construction units need to consider. The existing vulnerability security scanning, static detection technology (source code scanning), and dynamic detection technology can only find vulnerabilities during the scanning and detection period. The software cannot perform normal real-time vulnerability scanning and detection during the running process. Vul...

AI Technical Summary

Problems solved by technology

Source code scanning is mainly aimed at open source programs, and usually only needs to be scanned once, although it is possible to find possible hidden security flaws in the program by checking the file structure, naming rules, functions, stack pointers, etc. in the program that do not comply with security rules , but cannot effectively scan third-party technical components, let alone predict future vulnerabilities of technical components

Images