Code and component security risk identification method, equipment and medium

Abstract

The invention relates to the technical field of element security risk identification in an informatization system development process, in particular to a code and component security risk identification method and device and a medium, and the method comprises the following steps: collecting version history of codes and components, auditing security risk characteristics of different programming languages, and evaluating a dependency relationship between the codes and the components; and analyzing static security characteristics of the code and the component, and generating a development security risk model. According to the method, the identification capability of potential development security risks is enhanced through security risk auditing of codes and binary components, and the development security risks are revealed in advance and the accuracy of development security risk assessment is optimized through continuous left shift of the security identification stage of an informatization system; therefore, security vulnerability identification of codes and components does not depend on detection of past data or known vulnerabilities any more, security threat modes of codes and components which emerge newly or have complex logic structures can be identified in real time, and the application security level in a software application development period is remarkably improved.

Description

Technical Field

[0001] The present invention relates to the technical field of element security risk identification in the process of information system development, and in particular to code and component security risk identification methods, equipment and media. Background Art

[0002] The technical field of element security risk identification in the process of information system development focuses on detecting and evaluating potential development security threats to ensure the security of software and software supply chain. This field covers a variety of technologies and methods, including code vulnerability scanning, component vulnerability scanning, security auditing and vulnerability analysis, and source tracking. The development of information technology has prompted the continuous introduction of advanced machine learning algorithms and artificial intelligence technologies in this field to improve the accuracy and efficiency of development security risk identification. In addition, this technical field also focuses on the development and implementation of comprehensive security policies and procedures to prevent unauthorized access and data leakage, and ensure the integrity and availability of information technology systems.

[0003] Among them, the code and component security risk identification method is a technology specifically used to identify and evaluate potential security vulnerabilities in software code and components. This method analyzes the source code and component library of the software to identify known vulnerabilities, unsafe coding development practices, and potential code and component security risks. It is widely used, mainly in the software development and continuous iteration stages, to help developers and security experts discover code and component security issues in advance, take measures to patch or optimize them, thereby improving the security and reliability of software products, which not only helps prevent security incidents, but also significantly reduces economic losses and reputation risks caused by security issues.

[0004] Although existing security risk identification technologies include a variety of detection and assessment tools, they show obvious limitations when dealing with continuous code and component updates. In particular, when identifying new vulnerabilities introduced by rapid iterative development, traditional tools often rely on existing vulnerability signature tags and static analysis patterns, which limits their effectiveness in dealing with unknown threats. In addition, these technologies are weak in simulating actual attack scenarios and often fail to fully simulate the various changing factors in the real operating environment, resulting in deviations between security test results and the actual situation. For example, without comprehensive simulation of real code and component interaction scenario behaviors, the security audit system may not be able to accurately predict and identify security issues caused by specific user operations, which may cause the system to perform poorly in the face of complex or unknown code and component attack patterns, increasing the risk of system damage. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings of the prior art and to propose a code and component security risk identification method, device and medium.

[0006] In order to achieve the above object, the present invention adopts the following technical solution: a method for identifying code and component security risks, comprising the following steps:

[0007] S1: Collect the version history of code and components, audit the security risk characteristics of different programming languages, evaluate the dependencies between code and components, analyze the static security characteristics of code and components, and generate a development security risk model;

[0008] S2: Based on the development security risk model, analyze and monitor the change history of codes and components, analyze the update frequency and change cycle of codes and components and perform risk rating, predict the future security trend of codes and components based on the risk rating results, identify abnormal code and component changes through abnormal behavior detection, and generate abnormal change monitoring results;

[0009] S3: Based on the abnormal change monitoring results, refactor the code and components in a security test environment, simulate potential code and component attack operations, evaluate the performance of the code and components in the actual operating environment, analyze and identify security vulnerabilities in the execution of the code and components, and generate development risk audit results;

[0010] S4: Based on the development risk audit results, identify code and component security vulnerabilities, evaluate the severity and impact of security vulnerabilities, synchronously drive the continuous iteration of the security vulnerability database, and generate code and component security risk assessment records. As a further solution of the present invention, the steps for obtaining the development security risk model are:

[0011] S111: Extract the revision history of all codes and components from the code repository, conduct a comprehensive analysis of each historical version information, and apply the formula.

[0012]

[0013] Get the comprehensive historical information set H, where h i represents the version history information of the i-th component, α is the timestamp weight of the version, and d i The document modification amount for the target version;

[0014] S112: Based on the comprehensive historical information set, analyze the dependency and structure of the code and components in all versions, using the formula,

[0015]

[0016] Generate a dependency structure map S, where deg(h) is the dependency data analyzed from the version history information h, and w h is the importance weight of the version history information h, β is the adjustment coefficient, and f his the number of files, used to adjust the impact of code and component project size;

[0017] S113: Perform static analysis on the dependency structure mapping to analyze the interface complexity between different components and the scale intensity of code component data flow, using the formula:

[0018]

[0019] Calculate the interface and data flow ratio of each binary component to obtain the interface complexity ratio set C, where intf(s) represents the interface complexity of component s, flow(s) represents the data flow intensity of component s, and γ is the weight coefficient of the data flow;

[0020] S114: Component screening is performed according to the interface complexity ratio set, using the formula:

[0021] R={c|c>θ,c∈C}

[0022] Among them, θ is the preset complexity threshold, which is used to screen potential risk code components and generate the development security risk model R.

[0023] As a further solution of the present invention, the steps of obtaining the risk rating are:

[0024] S211: Extract code and component submission records, add a timestamp to each record, calculate the time interval between code and component submissions, and use the formula:

[0025]

[0026] Generate a time interval dataset T, where c i is the update frequency of the i-th code and component, t i1 and t i2 are the timestamps of adjacent submissions, ∈ is a small amount to prevent the denominator from being zero;

[0027] S212: Using the time interval data set, applying the weighted moving average method, calculate the update frequency of each code and component, using the formula,

[0028]

[0029] Get the update frequency data set F, where t ij is the time interval between the jth submission of code and component i, w j is the weight, δ is a small amount used to enhance the stability of the calculation;

[0030] S213: Combining the update frequency data set with the development security risk model, assessing the risk level of each code and component, using the formula,

[0031]

[0032] Generate risk rating result Q, where f i is the update frequency of the code and component i, κ and λ are parameters that control the shape of the function, adjusting the sensitivity and critical threshold of the risk score.

[0033] As a further solution of the present invention, the steps of obtaining the abnormal change monitoring result are:

[0034] S221: Based on the risk rating results, the exponential smoothing method is used to predict future change trends, using the formula:

[0035]

[0036] Generate a prediction result set P, where r i is the current risk level of the code and component i, p i-1 is the forecast result of the previous period, u and b are the smoothing coefficient and adjustment coefficient, which are used to increase the adaptability of the forecast model;

[0037] S222: Using the prediction result set, applying a statistical threshold method to identify abnormal behaviors that deviate from the normal change pattern, using the formula,

[0038]

[0039] Generate abnormal activity monitoring results Among them, μ P is the average value of the prediction result set P, σ P is the standard deviation, m is the sensitivity coefficient, which is used to adjust the strictness of code and component anomaly detection;

[0040] S223: According to the abnormal activity monitoring results, analyze the abnormally changed codes and components, confirm the change type and location, and use the formula:

[0041] E={(a,loc(a))|a∈A}

[0042] The abnormal change record E is obtained, where a is the activity identified as abnormal and loc(a) is the location where the abnormal activity occurs.

[0043] As a further solution of the present invention, the steps for obtaining the code and component development risk audit results are:

[0044] S311: According to the abnormal change monitoring results, configure the code and component security test environment, adjust each security parameter, and use the formula

[0045]

[0046] Among them, E i is the effectiveness evaluation result of the test environment configuration, N is the total number of security requirements, θ ik is a security configuration parameter, φ ik It is the corresponding weight, which is used to adjust the importance of each security requirement and output the test environment configuration result;

[0047] S312: Using the code and component security test environment configuration results, simulate external attacks and user operations, record the response of each code and component, and use the formula,

[0048]

[0049] Among them, Y i is the reaction data summary, α j and β j is the weight coefficient, z is the adjustment coefficient, which is used to enhance the nonlinear characteristics of the response. is the square of the attack strength, u ij It is the complexity of the user operation and outputs the response data;

[0050] S313: Analyze the response data, calculate the performance fluctuation of each code and component under the difference test, and use the formula:

[0051]

[0052] Evaluate the performance fluctuations of the code and components, where G i represents volatility, g is a small quantity used to ensure the validity of the calculation, indicate potential security vulnerabilities, and output security vulnerability identification results;

[0053] S314: Based on the security vulnerability identification results, the overall security status of each code and component is evaluated using the formula:

[0054]

[0055] Among them, σ(r) represents the stability score of the test result, and ω is the regularization parameter, which avoids the zero division error and generates the development risk audit result.

[0056] As a further solution of the present invention, the steps for obtaining the code and component security risk assessment records are:

[0057] S411: extract security vulnerability data from the development risk audit results, apply the formula,

[0058]

[0059] Where L represents the preliminary impact score of the security vulnerability, M represents the total number of security vulnerabilities, and ωi represents the weight of security vulnerability i, v i represents the initial risk value of security vulnerability i, μ represents the adjustment factor to avoid zero division errors, y represents a small positive number to ensure stability, and x is the adjustment coefficient to emphasize the nonlinear impact of the risk value, generating preliminary security vulnerability impact score data;

[0060] S412: Using the preliminary security vulnerability impact score data, evaluate the severity and potential impact of each security vulnerability using the formula,

[0061]

[0062] Among them, S i represents the severity score of security vulnerability i, U represents the total number of scoring factors, and a ik represents the coefficient of the scoring factor k, b ik It represents the specific performance of security vulnerability i in scoring factor k, and T is the adjustment coefficient, which is used to adjust the shape of the curve, enhance the scoring sensitivity, and generate security vulnerability severity scoring data;

[0063] S413: Combine the preliminary security vulnerability impact score data and the security vulnerability severity score data, and apply the formula:

[0064]

[0065] Calculate the comprehensive score of each security vulnerability, where B i represents the comprehensive score of security vulnerability i, α B and β B represents the weight factor, λ B Represents the harmonic factor, used to balance L i and S i The influence between i and S i Represent the impact score data and severity score data of security vulnerability i, and output the comprehensive security score data;

[0066] S414: Update the security vulnerability database based on the comprehensive security score data, and use a sorting algorithm to

[0067] J=sort(B)

[0068] Sort the security vulnerabilities, where sort represents the sorting function, which is used to organize the comprehensive scores and generate code and component security risk assessment records J.

[0069] The code and component security risk identification device is used to execute the code and component security risk identification method, and the code and component security risk identification system includes:

[0070] The version history collection module collects the version history of codes and components, audits the security risk characteristics of different programming languages, evaluates the dependencies between codes and components, analyzes the static security characteristics of codes and components, and generates a development security risk model;

[0071] The risk rating module analyzes and monitors the change history of codes and components based on the development security risk model, analyzes the update frequency and change cycle of codes and components and performs risk rating, and predicts the future security trend of codes and components based on the risk rating results to obtain risk rating results;

[0072] The anomaly monitoring module predicts future change trends based on the risk rating results, identifies abnormal changes in codes and components through abnormal behavior detection technology, and generates abnormal change monitoring results;

[0073] The security detection module reconstructs the code and components in the security test environment according to the abnormal change monitoring results, simulates potential code and component attack operations, evaluates the performance of the code and components in the actual operating environment, analyzes and identifies security vulnerabilities in the execution of the code and components, and obtains an operating performance evaluation record;

[0074] The dynamic analysis module identifies security vulnerabilities in code and component execution based on the operational performance evaluation records and generates development risk audit results through behavioral analysis technology;

[0075] The security record update module classifies security vulnerabilities based on the development risk audit results, evaluates the severity and impact of the vulnerabilities, updates the security vulnerability database, and generates code and component security risk assessment records.

[0076] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for identifying code and component security risks as described above.

[0077] Compared with the prior art, the advantages and positive effects of the present invention are:

[0078] In the present invention, the monitoring of code and component change history through time series analysis significantly enhances the early identification capability of potential security risks, can reveal risks in advance, and allow the development team to take preventive measures. By evaluating real-world attacks and operations in a simulated code and component security test environment, the accuracy and practicality of risk assessment are further optimized, so that the identification of security vulnerabilities no longer relies on past data or the detection of known vulnerabilities, but can identify new or complex threat patterns in real time, significantly improving security protection throughout the entire software development life cycle. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] Figure 1 It is a schematic diagram of the workflow of the present invention;

[0080] Figure 2 A flow chart for obtaining a security risk model developed for the present invention;

[0081] Figure 3 A flow chart for obtaining risk rating of the present invention;

[0082] Figure 4 The present invention is a flowchart for obtaining abnormal change monitoring results;

[0083] Figure 5 Develop a flow chart for obtaining risk audit results for the present invention;

[0084] Figure 6 The present invention provides a flowchart for obtaining the code and component security risk assessment records. DETAILED DESCRIPTION

[0085] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0086] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, "multiple" means two or more, unless otherwise clearly and specifically defined.

[0087] Embodiment 1

[0088] See also Figure 1 The present invention provides a technical solution: a method for identifying code and component security risks, comprising the following steps:

[0089] S1: Collect the version history of code and components, integrate the difference programming language data, evaluate the code structure and component dependencies, analyze the static characteristics of code and components, and generate a development security risk model;

[0090] S2: Based on the development security risk model, time series analysis technology is used to monitor the change history of code and components, analyze the update frequency and change cycle and perform risk rating. Based on the risk rating results, the future change trend of code and components is predicted. Abnormal code and component changes are identified through abnormal behavior detection, and abnormal change monitoring results are generated.

[0091] S3: Based on the abnormal change monitoring results, code and refactor components in a secure test environment, simulate external attacks and user operations, evaluate the performance of code and components in the actual operating environment, identify security vulnerabilities in code and component execution through behavioral analysis, and generate development risk audit results;

[0092] S4: Based on the development risk audit results, separate the code and component security vulnerabilities, evaluate the severity and impact of the security vulnerabilities, update the security vulnerability database, and generate code and component security risk assessment records.

[0093] The development security risk model includes structural defect identification records, security issue identification and dependency weakness analysis results. The abnormal change monitoring results include unauthorized change detection results, unexpected change tracking results and risk change point marking results. The development risk audit results include execution path exception analysis records, runtime error identification results and external attack response effect records. The code and component security risk assessment records include vulnerability severity classification files, affected component scope and repair priority sorting results.

[0094] See also Figure 2 ,The acquisition steps for developing a security risk model are:

[0095] S111: Extract the revision history of all codes and components from the code repository, synthesize each historical version information, and apply the formula.

[0096]

[0097] Get the comprehensive historical information set H, where h i represents the version history information of the i-th component, α is the timestamp weight of the version, and d i The document modification amount for the target version;

[0098] S112: Based on the comprehensive historical information set, analyze the dependencies and structures of the code and components in all versions, using the formula,

[0099]

[0100] Generate a dependency structure map S, where deg(h) is the dependency data analyzed from the version history information h, and w h is the importance weight of the version history information h, β is the adjustment coefficient, and f h is the number of files, used to adjust for the impact of project size;

[0101] S113: Perform static code analysis on dependency structure mapping to analyze the interface complexity and data flow intensity between different components, using the formula,

[0102]

[0103] Calculate the interface and data flow ratio of each component to obtain the interface complexity ratio set C, where intf(s) represents the interface complexity of component s, flow(s) represents the data flow intensity of component s, and γ is the weight coefficient of the data flow;

[0104] S114: Component screening is performed based on the interface complexity ratio set, using the formula,

[0105] R={c|c>θ,c∈C}

[0106] Among them, θ is the preset complexity threshold, which is used to screen potential risk components and generate the development security risk model R.

[0107] Assume that there is version history information of three components, among which:

[0108] h 1 =2,d 1 =5

[0109] h 2 =3,d 2 =4

[0110] h 3 =1,d 3 =7

[0111] Set α=0.1 as the timestamp weight (this value is assumed to be a reasonable weight for the amount of document modification, which is commonly used in the impact assessment of document modification in project management).

[0112] The calculation process is as follows:

[0113] For the first component:

[0114] h 1 +α·d 1 =2+0.1×5=2.5

[0115] For the second component:

[0116] h 2 +α·d 2 =3+0.1×4=3.4

[0117] For the third component:

[0118] h 3 +α·d 3 =1+0.1×7=1.7

[0119] The version history information set H of all components is integrated, and the value of this set represents the version history weight adjusted by the document modification amount.

[0120] Consider the value of H obtained in the previous step and the following assumptions:

[0121] dep(2.5)=10,w 2.5 =0.8, f 2.5 =50

[0122] dep(3.4)=15,w 3.4 =0.9, f 3.4 =30

[0123] dep(1.7)=8,w 1.7 =0.7, f 1.7 =20

[0124] Set β = 0.05, then:

[0125] For h = 2.5:

[0126] 10×0.8+0.05×log(50)≈8+0.05×1.7=8.085

[0127] For h = 3.4:

[0128] 15×0.9+0.05×log(30)≈13.5+0.05×1.48=13.574

[0129] For h = 1.7:

[0130] 8×0.7+0.05×log(20)≈5.6+0.05×1.3=5.665

[0131] Dependency structure mapping S = 8.085 + 13.574 + 5.665 = 27.324. This value represents the complexity of the project code that combines the dependency relationship and the number of files.

[0132] The three component dependency structure mappings S={2.5, 3.4, 1.7} obtained according to the above calculations.

[0133] Assume the following data exists:

[0134] intf(2.5)=50, flow(2.5)=25

[0135] intf(3.4)=65, flow(3.4)=20

[0136] intf(1.7)=40, flow(1.7)=30

[0137] Set γ = 1.2. Substituting into the formula, we get:

[0138] For s = 2.5:

[0139]

[0140] For s = 3.4:

[0141]

[0142] For s = 1.7:

[0143]

[0144] Interface complexity ratio set C = {2.4, 3.9, 1.6}. The value of this set represents the ratio of the interface complexity of each component to the data flow intensity after adjusting the weight, reflecting the possible risk level of different components.

[0145] Combined with the above results, the interface complexity ratio set C = {2.4, 3.9, 1.6}.

[0146] Assume that the threshold θ=2.5.

[0147] Check if each element is greater than a threshold θ:

[0148] 2.4<2.5 - Does not meet the requirements

[0149] 3.9>2.5 - meets the requirements

[0150] 1.6<2.5 - Does not meet the requirements

[0151] Therefore, the risk component set R = {3.9}. This set shows the components whose interface complexity ratio exceeds the threshold. These components may face greater risks due to their higher complexity and require further attention and risk management measures.

[0152] See also Figure 3 , the steps to obtain risk rating are:

[0153] S211: Extract code and component submission records, add a timestamp to each record, calculate the time interval between code and component submissions, and use the formula:

[0154]

[0155] Generate a time interval dataset T, where c i is the update frequency of the i-th code and component, t i1 and t i2 are the timestamps of adjacent submissions, ∈ is a small amount to prevent the denominator from being zero;

[0156] S212: Using the time interval data set, apply the weighted moving average method to calculate the update frequency of each code and component, using the formula,

[0157]

[0158] Get the update frequency data set F, where t ij is the time interval between the jth submission of code and component i, w j is the weight, δ is a small amount used to enhance the stability of the calculation;

[0159] S213: Combine the update frequency dataset with the development security risk model to assess the risk level of each code and component using the formula,

[0160]

[0161] Generate risk rating result Q, where f i is the update frequency of the code and component i, κ and λ are parameters that control the shape of the function and adjust the sensitivity and threshold of the risk score.

[0162] Assume there are three timestamps of commit records:

[0163] t 11 =1588005200 (UNIX timestamp, corresponding to April 28, 2020).

[0164] t 12 =1588091600 (UNIX timestamp, corresponding to April 29, 2020).

[0165] Assume ∈=0.001 seconds to ensure that it will not be divided by zero.

[0166] Calculate the time interval:

[0167] Δt=t 12 -t 11 =1588091600-1588005200=86400

[0168] Substituting into the formula:

[0169]

[0170] The calculation result 0.000011579 (in reciprocal seconds) reflects the update frequency of the target code and components. A smaller value means a longer update cycle, that is, the code and components are updated infrequently. This value is used to further analyze the update frequency and change cycle.

[0171] For the same code and component, assume three time intervals, and consider decreasing weights to reflect the importance of recent updates:

[0172] t i1 =86400 seconds

[0173] t i2 =172800 seconds

[0174] t i3 =259200 seconds

[0175] Weight w 1 =0.5, w 2 =0.3, w 3 =0.2.

[0176] Set δ=0.01.

[0177] Weighted average calculation:

[0178]

[0179] The calculated update frequency f i =0.00000829 represents the average update frequency, reflecting the frequency of component changes considering that recent updates are more important, and small values ​​indicate infrequent updates.

[0180] Using the above calculation results: f i =0.00000829, assuming risk factor κ=100000 and risk threshold λ=0.000007.

[0181] Risk level calculation:

[0182]

[0183] r i =0.44 indicates that the risk level of the code and components is at a lower-middle level. This value indicates that under the set model parameters, the update frequency of the code and components is close to the risk threshold, which requires attention, but is not the highest priority risk.

[0184] See also Figure 4 , the steps to obtain abnormal change monitoring results are:

[0185] S221: Based on the risk rating results, the exponential smoothing method is used to predict future change trends, using the formula:

[0186]

[0187] Generate a prediction result set P, where r i is the current risk level of the code and component i, p i-1is the forecast result of the previous period, u and b are the smoothing coefficient and adjustment coefficient, which are used to increase the adaptability of the forecast model;

[0188] S222: Using the prediction result set, apply the statistical threshold method to identify abnormal behaviors that deviate from the normal change pattern, using the formula,

[0189]

[0190] Generate abnormal activity monitoring results Among them, μ P is the average value of the prediction result set P, σ P is the standard deviation, m is the sensitivity coefficient, which is used to adjust the strictness of anomaly detection;

[0191] S223: Based on the abnormal activity monitoring results, analyze the abnormally changed codes and components, confirm the change type and location, and use the formula,

[0192] E={(a,loc(a))|a∈A}

[0193] The abnormal change record E is obtained, where a is the activity identified as abnormal and loc(a) is the location where the abnormal activity occurs.

[0194] Assume that for a code and component, the prediction result p of the previous cycle i-1 =0.45 and the current risk level r i =0.5.

[0195] The smoothing coefficient u=0.7 and the adjustment coefficient b=0.1 are set.

[0196] To perform a prediction calculation:

[0197] p i =0.7·0.5+(1-0.7)·0.45+0.1·0.5 2

[0198] p i =0.35+0.135+0.025=0.51

[0199] The calculated predicted value p i =0.51 indicates the predicted risk level of the code and components in the next assessment cycle. This value is slightly higher than the current cycle, indicating a slight upward trend in risk.

[0200] Assume that the average value μ of the prediction result set P is P = 0.48 and standard deviation σ P =0.05.

[0201] Set the sensitivity coefficient m=4.

[0202] Anomaly detection calculation:

[0203]

[0204] because So 0.6<2, p i = 0.51 is not considered abnormal.

[0205] The results show that although the predicted risk level has increased, the change does not exceed the set anomaly threshold. Therefore, this code and component are not considered anomalies in the current evaluation cycle.

[0206] Assuming that no activity is identified as abnormal, A is an empty set, so the abnormal change record E is also an empty set.

[0207] See also Figure 5 , the steps to obtain the development risk audit results are:

[0208] S311: According to the abnormal change monitoring results, configure the security test environment and adjust each security parameter through the formula

[0209]

[0210] Among them, E i is the effectiveness evaluation result of the test environment configuration, N is the total number of security requirements, θ ik is a security configuration parameter, φ ik It is the corresponding weight, which is used to adjust the importance of each security requirement and output the test environment configuration result;

[0211] S312: Use the test environment configuration results to simulate external attacks and user operations, record the response of each code and component, and use the formula,

[0212]

[0213] Among them, Y i is the reaction data summary, α j and β j is the weight coefficient, z is the adjustment coefficient, which is used to enhance the nonlinear characteristics of the response. is the square of the attack strength, u ij It is the complexity of the user operation and outputs the response data;

[0214] S313: Analyze the response data and calculate the performance fluctuation of each code and component under the difference test.

[0215]

[0216] Evaluate the performance fluctuations of the code and components, where Gi represents volatility, g is a small quantity used to ensure the validity of the calculation, indicate potential security vulnerabilities, and output security vulnerability identification results;

[0217] S314: Based on the security vulnerability identification results, evaluate the overall security status of each code and component using the formula,

[0218]

[0219] Among them, σ(r) represents the stability score of the test result, and ω is the regularization parameter, which avoids the zero division error and generates the audit result for each development risk.

[0220] Assume that for a code and component, there are three security requirements (N=3), and its security parameter θ ik are 0.8, 0.5, 0.3 respectively, and the weight φ ik They are 2, 1.5, and 1 respectively.

[0221] Substitute into the formula to calculate:

[0222]

[0223] E i =0.934 indicates that the effectiveness of the test environment configuration is very high and close to the optimal conditions, ensuring that the code and components are tested under strict conditions.

[0224] Assume that three tests are performed, where α j =1.2,1.1,1.0,β j =0.8, 0.9, 1.0, z = 1.5, attack strength a ij =0.5, 0.6, 0.7, user operation complexity u ij =0.4, 0.5, 0.6.

[0225] The calculation process is as follows:

[0226]

[0227] Y i ≈(0.806) 1.5 +(1.032) 1.5 +(1.265) 1.5

[0228] Y i ≈0.724+1.048+1.423=3.195

[0229] The calculated result is 3.195, which quantifies the nonlinearity and complexity of the code and component reactions in each test. 3.195 means that the nonlinearity and complexity of the reactions are at a medium level.

[0230] Assume max({Y i})=5.0 and min({Y i})=2.0,g=0.01. Then:

[0231]

[0232] G i =2.48 means that under extreme test conditions, the code and components exhibit large performance fluctuations, which may indicate potential security vulnerabilities.

[0233] Assume that from G i The r values ​​obtained are 2.48, 1.5, 1.8, σ(r) are 0.8, 0.5, 0.6, and ω=0.05. Then:

[0234]

[0235] D i =0.65 represents the risk assessment value of the code and components after integrating all test results. Higher values ​​indicate security vulnerabilities that require further attention.

[0236] See also Figure 6 , the steps to obtain code and component security risk assessment records are:

[0237] S411: Extract security vulnerability data from development risk audit results and apply formulas.

[0238]

[0239] Where L represents the preliminary impact score of the security vulnerability, M represents the total number of security vulnerabilities, and ω i represents the weight of security vulnerability i, v i represents the initial risk value of security vulnerability i, μ represents the adjustment factor to avoid zero division errors, y represents a small positive number to ensure stability, and x is the adjustment coefficient to emphasize the nonlinear impact of the risk value, generating preliminary security vulnerability impact score data;

[0240] S412: Using the preliminary security vulnerability impact score data, assess the severity and potential impact of each security vulnerability using the formula,

[0241]

[0242] Among them, S i represents the severity score of security vulnerability i, U represents the total number of scoring factors, and a ik represents the coefficient of the scoring factor k, b ikIt represents the specific performance of security vulnerability i in scoring factor k, and T is the adjustment coefficient, which is used to adjust the shape of the curve, enhance the scoring sensitivity, and generate security vulnerability severity scoring data;

[0243] S413: Combine the preliminary security vulnerability impact score data and the security vulnerability severity score data, and apply the formula,

[0244]

[0245] Calculate the comprehensive score of each security vulnerability, where B i represents the comprehensive score of security vulnerability i, α B and β B represents the weight factor, λ B Represents the harmonic factor, used to balance L i and S i The influence between i and S i Represent the impact score data and severity score data of security vulnerability i, and output the comprehensive security score data;

[0246] S414: Update the security vulnerability database based on the comprehensive security score data, and use the sorting algorithm to

[0247] J=sort(B)

[0248] Sort the security vulnerabilities, where sort represents the sorting function, which is used to organize the comprehensive scores and generate code and component security risk assessment records J.

[0249] Assume there are three security vulnerabilities, and their weights (ω i ) are 0.3, 0.5, 0.2 respectively, and the initial risk value (v i ) are 10, 15, 5 respectively, and μ=1, y=0.1, x=2 are set.

[0250] Calculate the sub-score for each risk:

[0251] First risk score:

[0252]

[0253] Second risk score:

[0254]

[0255] Third risk score:

[0256]

[0257] Overall score:

[0258] L = 24.3 + 93 + 4.2 = 121.5

[0259] The comprehensive score L = 121.5 represents the overall security risk score of the system after considering the weight, initial risk and adjustment factors. This high score indicates that the system may face greater security risks.

[0260] Assume that for a security vulnerability, there are two scoring factors, and their weights (a ik ) is 0.6 and 0.4, showing (b ik ) are 0.8 and 0.7, and T=1.5 is set.

[0261] Calculate the severity score:

[0262]

[0263] Score S i =0.529 means that given the weight and performance, the severity score of the security vulnerability is 0.562, which indicates that the vulnerability is of medium severity.

[0264] Assume α B =0.7,β B =0.3,λ B = 0.05, using the previously calculated L i =121.5 and S i =0.562,

[0265] Calculate the overall safety score:

[0266]

[0267] The comprehensive score B=84.80545 shows that after considering the severity and impact of the security vulnerability, the overall security risk score is 84.80545, which is a relatively high risk level, indicating that measures need to be taken to reduce these risks.

[0268] Assume that there are three security vulnerabilities with the following comprehensive scores: B 1 =84.81, B 2 =75.25, B 3 =92.10.

[0269] Applying the sorting algorithm, we get

[0270] J=sort(92.10,84.81,75.25)

[0271] The sorted score table J = [92.10, 84.81, 75.25] indicates that the security risks were prioritized according to their severity. The final security risk assessment record shows that the second security vulnerability has the highest risk and needs to be dealt with first, followed by the first security vulnerability, and finally the third security vulnerability. This ranking helps the security team prioritize the response measures and ensure that resources are allocated most effectively to mitigate or eliminate these risks.

[0272] Code and component security risk identification equipment, including:

[0273] The version history collection module collects the version history of codes and components, audits the security risk characteristics of different programming languages, evaluates the dependencies between codes and components, analyzes the static security characteristics of codes and components, and generates a development security risk model;

[0274] The risk rating module is based on the development security risk model, analyzes the change history of the monitoring code and components, analyzes the update frequency and change cycle of the code and components and performs risk rating. Based on the risk rating results, it predicts the future security trend of the code and components and obtains the risk rating results.

[0275] The anomaly monitoring module predicts future change trends based on risk rating results, identifies abnormal changes in code and components through abnormal behavior detection technology, and generates abnormal change monitoring results;

[0276] The security detection module reconstructs the code and components in the security test environment according to the abnormal change monitoring results, simulates potential code and component attack operations, evaluates the performance of the code and components in the actual operating environment, analyzes and identifies security vulnerabilities in the execution of the code and components, and generates operating performance evaluation records;

[0277] The dynamic analysis module uses behavioral analysis technology to identify security vulnerabilities in code and component execution based on operational performance evaluation records and generate development risk audit results;

[0278] The security record update module classifies security vulnerabilities based on the development risk audit results, evaluates the severity and impact of the vulnerabilities, updates the security vulnerability database, and generates code and component security risk assessment records.

[0279] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A method for identifying code and component security risks, characterized in that: The following steps are involved: Collect the version history of code and components, audit the security risk characteristics of different programming languages, evaluate the dependencies between code and components, analyze the static security characteristics of code and components, and generate a development security risk model; Based on the development security risk model, analyze and monitor the change history of codes and components, analyze the update frequency and change cycle of codes and components and perform risk rating, predict the future security trend of codes and components based on the risk rating results, identify abnormal code and component changes through abnormal behavior detection, and generate abnormal change monitoring results; Based on the abnormal change monitoring results, code and component refactoring is performed in a security test environment to simulate potential code and component attack operations, evaluate the performance of code and components in the actual operating environment, analyze and identify security vulnerabilities in code and component execution, and generate development risk audit results; Based on the development risk audit results, code and component security vulnerabilities are identified, the severity and impact of security vulnerabilities are assessed, the security vulnerability database is continuously iterated, and code and component security risk assessment records are generated.

2. The method for identifying code and component security risks according to claim 1, characterized in that: The steps for obtaining the development security risk model are: Extract the revision history of all codes and components from the code repository, conduct a comprehensive analysis of each historical version information, and apply the formula. Get the comprehensive historical information set H, where h i represents the version history information of the i-th component, α is the timestamp weight of the version, and d i The document modification amount for the target version; Based on the comprehensive historical information set, the dependencies and structures of the codes and components in all versions are analyzed, using the formula, Generate a dependency structure map S, where deg(h) is the dependency data analyzed from the version history information h, and w h is the importance weight of the version history information h, β is the adjustment coefficient, and f h is the number of files, used to adjust the impact of code and component project size; Static analysis is performed on the dependency structure mapping to analyze the interface complexity between different components and the scale intensity of code component data flow, using the formula, Calculate the interface and data flow ratio of each binary component to obtain the interface complexity ratio set C, where intf(s) represents the interface complexity of component s, flow(s) represents the data flow intensity of component s, and γ is the weight coefficient of the data flow; According to the interface complexity ratio set, component screening is performed using the formula, R={c|c>θ,c∈C} Among them, θ is the preset complexity threshold, which is used to screen potential risk code components and generate the development security risk model R.

3. The method for identifying code and component security risks according to claim 2, characterized in that: The steps for obtaining the risk rating are: Extract code and component submission records, add timestamps to each record, calculate the time interval between code and component submissions, and use the formula: Generate a time interval dataset T, where c i is the update frequency of the i-th code and component, t i1 and t i2 are the timestamps of adjacent submissions, ∈ is a small amount to prevent the denominator from being zero; Using the time interval data set, the weighted moving average method is applied to calculate the update frequency of each code and component, using the formula, Get the update frequency data set F, where t ij is the time interval between the jth submission of code and component i, w j is the weight, δ is a small amount used to enhance the stability of the calculation; The update frequency dataset is combined with the development security risk model to evaluate the risk level of each code and component using the formula, Generate risk rating result Q, where f i is the update frequency of the code and component i, κ and λ are parameters that control the shape of the function, adjusting the sensitivity and critical threshold of the risk score.

4. The method for identifying code and component security risks according to claim 3, characterized in that: The steps for obtaining the abnormal change monitoring result are: Based on the risk rating results, the exponential smoothing method is used to predict the future change safety risk trend, using the formula, Generate a prediction result set P, where r i is the current risk level of the code and component i, p i-1 is the prediction result of the previous cycle, u and b are the smoothing coefficient and adjustment coefficient, which are used to increase the adaptability of the development process code and component security prediction model; Using the predicted result set, a statistical threshold method is applied to identify abnormal behaviors that deviate from the normal change pattern, using the formula, Generate abnormal activity monitoring result A, where μ P is the average value of the prediction result set P, σ P is the standard deviation, and m is the sensitivity coefficient, which is used to adjust the strictness and granularity of code and component anomaly detection; According to the abnormal activity monitoring results, analyze the abnormally changed codes and components, confirm the change type and location, and use the formula: E={(a,loc(a))|a∈A} The abnormal change record E is obtained, where a is the activity identified as abnormal and loc(a) is the location where the abnormal activity occurs.

5. The method for identifying code and component security risks according to claim 4, characterized in that: The steps for obtaining the development risk audit results are as follows: According to the abnormal change monitoring results, configure the security test environment, adjust each security parameter, and use the formula: Among them, E i is the effectiveness evaluation result of the test environment configuration, N is the total number of security requirements, θ ik is a security configuration parameter, φ ik It is the corresponding weight, which is used to adjust the importance of each security requirement and output the configuration results of the code and component test environment; Using the test environment configuration results, simulate the code and components in the compilation process or the user's potential operation behavior, record the response of each code and component, and use the formula, Among them, Y i is the reaction data summary, α j and β j is the weight coefficient, z is the adjustment coefficient, which is used to enhance the nonlinear characteristics of the response. is the square of the attack strength, u ij It is the complexity of the user operation and outputs the response data; Analyze the response data, calculate the performance fluctuation of each code and component under the difference test, and use the formula, Evaluate the performance fluctuations of code and components under different test scenarios, where G i represents volatility, g is a small quantity used to ensure the validity of the calculation, indicate potential security vulnerabilities in the code and components, and output security vulnerability identification results; Based on the security vulnerability identification results, the overall security status of the code and components is evaluated using the formula: Among them, σ(r) represents the stability score of the test result, and ω is the regularization parameter, which avoids the zero division error and generates the development risk audit result.

6. The method for identifying code and component security risks according to claim 5, characterized in that: The steps for obtaining the code and component security risk assessment records are as follows: Extract code and component security vulnerability data from the development risk audit results, and apply the formula: Where L represents the preliminary impact score of the security vulnerability, M represents the total number of security vulnerabilities, and ω i represents the weight of security vulnerability i, v i represents the initial risk value of security vulnerability i, μ represents the adjustment factor to avoid zero division errors, y represents a small positive number to ensure stability, and x is the adjustment coefficient to emphasize the nonlinear impact of the risk value, generating preliminary code and component security vulnerability impact score data; Using the preliminary code and component security vulnerability impact score data, each security vulnerability is evaluated for severity and potential impact using the formula, Among them, S i represents the severity score of security vulnerability i, U represents the total number of scoring factors, and a ik represents the coefficient of the scoring factor k, b ik It represents the specific performance of security vulnerability i in scoring factor k, and T is the adjustment coefficient, which is used to adjust the shape of the curve, enhance the scoring sensitivity, and generate code and component security vulnerability severity scoring data; Combine the preliminary code and component security vulnerability impact score data and security vulnerability severity score data, and apply the formula: Calculate the comprehensive score of each code and component security vulnerability, where B i represents the comprehensive score of security vulnerability i, α B and β B represents the weight factor, λ B Represents the harmonic factor, used to balance L i and S i The influence between i and S i Represents the impact score data and severity score data of security vulnerability i, and outputs the comprehensive security score data of code and components; According to the comprehensive security score data, the code and component security vulnerability database is updated, and the sorting algorithm is used to J = sort(B) Sort the code and component security vulnerabilities, where sort represents a sorting function, which is used to organize the comprehensive scores and generate code and component security risk assessment records J.

7. Code and component security risk identification equipment, characterized in that: The code and component security risk identification system is used to execute the code and component security risk identification method according to any one of claims 1 to 6, and the device includes: The version history collection module collects the version history of codes and components, audits the security risk characteristics of different programming languages, evaluates the dependencies between codes and components, analyzes the static security characteristics of codes and components, and generates a development security risk model; The risk rating module analyzes and monitors the change history of codes and components based on the development security risk model, analyzes the update frequency and change cycle of codes and components and performs risk rating, and predicts the future security trend of codes and components based on the risk rating results to obtain risk rating results; The anomaly monitoring module predicts future change trends based on the risk rating results, identifies abnormal changes in codes and components through abnormal behavior detection technology, and generates abnormal change monitoring results; The security detection module reconstructs the code and components in the security test environment according to the abnormal change monitoring results, simulates potential code and component attack operations, evaluates the performance of the code and components in the actual operating environment, analyzes and identifies security vulnerabilities in the execution of the code and components, and generates an operating performance evaluation record; The dynamic analysis module identifies security vulnerabilities in code and component execution based on the operational performance evaluation records and generates development risk audit results through behavioral analysis technology; The security record update module classifies security vulnerabilities based on the development risk audit results, evaluates the severity and impact of the vulnerabilities, updates the security vulnerability database, and generates code and component security risk assessment records.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the code and component security risk identification method described in any one of claims 1 to 6 are implemented.

Images