Software risk detection method and computing device

Abstract

The invention relates to a software risk detection method and computing equipment, and relates to the technical field of software detection. The method comprises the following steps: acquiring a software material list of to-be-detected software; and determining risk indicator information of the open source module based on the software material list, wherein the risk indicator information comprises a software license risk indicator, a software security risk indicator and a software maintenance risk indicator of the open source module. And determining a risk detection result of the to-be-detected software based on the risk index information of the open source module. According to the method provided by the invention, the risk existing in the open source module of the to-be-detected software can be fully and accurately detected from multiple dimensions according to the risk index information of the open source module in the to-be-detected software, so that the risk detection result of the to-be-detected software is obtained, and the software testing efficiency can be improved. Moreover, in the software development stage, the technicians can repair the risk of the open source module of the software in time based on the risk detection result, so that the maintenance cost of the software can be reduced.

Description

Technical Field

[0001] The present application relates to the technical field of software detection, and in particular to a software risk detection method and computing device. Background Art

[0002] Software usually consists of multiple modules, and different software functions are achieved through the joint action of multiple modules. Among them, the types of software modules include self-developed modules or open source modules. Among them, open source modules have been widely used due to their openness, sharing, commercial free and flexible functions. The use of open source modules can reduce the complexity of software development and improve software development efficiency. However, there are certain risks in the use of open source modules in software. For example, some open source modules may have restrictions on the use of licenses, and some open source modules may have security vulnerabilities.

[0003] In the related art, it is impossible to accurately detect the risks of open source modules in the software. Therefore, it is impossible to promptly repair the risks that may exist in the software. As a result, after the software development is completed, it takes a lot of time and manpower to repair the risks found in the open source modules, resulting in high software maintenance costs. Summary of the invention

[0004] The embodiments of the present application provide a software risk detection method and computing device that can accurately perform multi-dimensional and comprehensive detection of the risks of open source modules included in the software, so that technical personnel can promptly repair the risks of the open source modules of the software during the software development process, thereby reducing the maintenance costs of the software.

[0005] In order to achieve the above-mentioned purpose, the embodiment of the present application adopts the following technical solution.

[0006] In a first aspect, a software risk detection method is provided, the method comprising: obtaining a software bill of materials (SBOM) of the software to be detected, the software bill of materials carrying information of open source modules included in the software to be detected; determining risk indicator information of the open source modules based on the software bill of materials, the risk indicator information including software licensing risk indicators, software security risk indicators and software maintenance risk indicators of the open source modules; determining risk detection results of the software to be detected based on the software licensing risk indicators, software security risk indicators and software maintenance risk indicators of the open source modules.

[0007] The computing device can fully and accurately detect the risks of the open source modules of the software to be detected from multiple dimensions based on the software license risk index, software security risk index and software maintenance risk index of the open source modules in the software to be detected, and then obtain the risk detection results of the software to be detected, which can improve the efficiency of software testing. In addition, during the software development stage, since the technical personnel can promptly repair the risks of the open source modules of the software based on the risk detection results, the maintenance cost of the software can be reduced.

[0008] In a possible implementation of the first aspect, the software license risk index includes one or more of the version information, license name, license type, license compatibility, and copyright statement of the open source module; the software security risk index includes one or more of the encryption code information, security vulnerability information, computer virus information, and security maintenance channels of the open source module; the software maintenance risk index includes one or more of the maturity of the open source module, community activity, and community support channels. The computing device can accurately and comprehensively detect the risks of the open source modules of the software to be detected through the risk indicator information including a plurality of risk indicators for describing the open source modules of the software to be detected, thereby processing the existing risks and improving the software testing efficiency.

[0009] In a possible implementation of the first aspect, a computing device is pre-configured with a plurality of risk assessment items corresponding to risk indicator information, the risk assessment items are used to characterize the risks existing in the open source module, each of the plurality of risk assessment items is respectively configured with a different risk detection score, and the risk detection score is proportional to the risk level of the open source module; based on the software license risk indicator, software security risk indicator, and software maintenance risk indicator of the open source module, the risk detection result of the software to be detected is determined, including: based on the risk indicator information of the open source module, determining the risk assessment item that each open source module does not meet in the plurality of risk assessment items; determining the risk detection score of the software to be detected according to the risk detection score corresponding to the risk assessment item that the open source module does not meet; and determining the risk detection result of the software to be detected according to the risk detection score of the software to be detected. The computing device sets a plurality of risk assessment items, and quantifies the risks of the open source module of the software to be detected based on the plurality of risk assessment items, thereby being able to accurately and comprehensively detect the risks of the open source module of the software to be detected, thereby processing the existing risks, and improving the software testing efficiency.

[0010] In a possible implementation of the first aspect, the risk assessment items include whether the open source module has a license, whether the license type of the open source module is not the target type, whether the open source module has no compatibility issues, whether the open source module has no intellectual property risks, whether the open source module uses encrypted code, whether the number of security vulnerabilities in the open source module is less than a preset value, whether the number of computer viruses in the open source module is less than a preset value, whether the open source module has a security maintenance channel, whether the source of the open source module is credible, whether the open source module has not completed integrity and consistency checks, whether the open source module does not have a copyright statement, whether the life cycle of the open source module is in a mature stage, whether the version update frequency of the open source module is greater than a preset value, and whether the open source module has a community support channel. One or more of the following. The method provided in the embodiment of the present application can accurately and comprehensively detect the risks of the open source modules of the software to be detected by setting multiple risk assessment items that characterize the risks of different dimensions of the software to be detected, thereby processing the existing risks and improving the efficiency of software testing.

[0011] In a possible implementation of the first aspect, the risk detection result includes the risk level of the software to be detected, and different risk levels correspond to different numerical ranges of risk detection scores; the risk detection result of the software to be detected is determined according to the risk detection score of the software to be detected, including: determining the numerical range corresponding to the risk detection score of the software to be detected; determining the risk level of the software to be detected according to the numerical range corresponding to the risk detection score of the software to be detected, and obtaining the risk detection result of the software to be detected. The computing device can determine the risk level of the software to be detected through the numerical range corresponding to the risk detection score. In addition, the technical personnel can intuitively evaluate the risk situation of the open source module of the software to be detected through the risk level, so as to quickly deal with the existing risks.

[0012] In a possible implementation of the first aspect, each of the multiple risk assessment items is configured with multiple weight levels, and different weight levels correspond to different risk detection scores; the above method also includes: receiving an input first instruction, the first instruction carries the weight level of each of the multiple risk assessment items; in response to the first instruction, setting the weight level of each of the multiple risk assessment items. The computing device sets multiple weight levels for each risk assessment item, and can determine the weight of each risk assessment item in the risk detection process of the software to be detected by setting the weight level, thereby meeting the risk detection requirements in different usage scenarios, thereby increasing the flexibility of risk detection.

[0013] In a possible implementation of the first aspect, the computing device also stores a plurality of weight setting schemes, the weight setting schemes including a weight level of each risk assessment item in a plurality of risk assessment items; the above method further includes: displaying a first interface, the first interface including a plurality of controls corresponding to the plurality of weight setting schemes; in response to a selection operation of a target control, setting a weight level of each risk assessment item in a plurality of risk assessment items based on a weight setting scheme corresponding to the target control, the target control being one of the plurality of controls. The computing device sets a plurality of weight setting schemes, each of which corresponds to a different detection scenario. For example, in some detection scenarios, the use license risk of an open source module is more important, so the user can select a weight setting scheme with a higher weight level of the risk assessment item corresponding to the use license risk of the open source module according to the needs, so as to realize a quick setting of the weight levels of the plurality of risk assessment items, and the user does not need to set the weight level of each risk assessment item in turn, thereby improving the detection efficiency.

[0014] In a possible implementation of the first aspect, the weight level of the risk assessment item specifically includes a first weight level, which is the most important level among multiple weight levels; when there is a risk assessment item with a weight level of the first weight level among the risk assessment items that the open source module does not meet, the risk level of the software to be detected is determined to be high risk. The computing device sets a bottom line level in the weight level, which enables the technician to quickly discover the risk with the highest severity level in the software to be detected, and repair it in time to avoid affecting the normal use of the software to be detected.

[0015] In a possible implementation of the first aspect, obtaining the software bill of materials of the software to be tested includes: obtaining a code package of the software to be tested; parsing the code package to determine the open source modules included in the software to be tested; obtaining the software bill of materials of the open source modules; merging the software bill of materials of the open source modules to obtain the software bill of materials of the software to be tested. The computing device parses the code package of the software to be tested to obtain multiple open source modules included in the software to be tested, and then obtains the software bill of materials of the software to be tested. Therefore, the software to be tested can be tested for risks according to the software bill of materials of the software to be tested, so as to deal with the existing risks and improve the efficiency of software testing.

[0016] In a possible implementation of the first aspect, before obtaining the software bill of materials of the software to be detected, the method further includes: obtaining risk indicator information of the open source module; establishing a preset database based on the risk indicator information of the open source module; determining the risk indicator information of the open source module based on the software bill of materials, including: obtaining the risk indicator information of the open source module from the preset database based on the software bill of materials. The computing device establishes a preset database, which can quickly determine the risk indicator information of each open source module based on the software bill of materials of the software to be detected, and then quickly complete the risk detection of the software to be detected, thereby improving the efficiency of risk detection.

[0017] In a possible implementation of the first aspect, the method further includes: displaying the risk detection result of the software to be detected on the second interface. The computing device displays the risk detection result of the software to be detected on the second interface, so that the user can intuitively view the risk detection result on the second interface, thereby quickly repairing the risks existing in the software to be detected, which can improve the user's usage experience.

[0018] In a second aspect, a software risk detection device is provided, which includes: an acquisition unit, used to obtain a software material list of the software to be detected, the software material list carries information about open source modules included in the software to be detected; a processing unit, used to determine risk indicator information of the open source module based on the software material list, the risk indicator information includes software license risk indicators, software security risk indicators and software maintenance risk indicators of the open source module; the processing unit is also used to determine the risk detection result of the software to be detected based on the software license risk indicators, software security risk indicators and software maintenance risk indicators of the open source module.

[0019] In a possible implementation of the second aspect, the software licensing risk indicators include one or more of the version information, license name, license type, license compatibility, and copyright statement of the open source module; the software security risk indicators include one or more of the encryption code information, security vulnerability information, computer virus information, and security maintenance channels of the open source module; the software maintenance risk indicators include one or more of the maturity of the open source module, the community activity, and the community support channels.

[0020] In a possible implementation of the second aspect, a computing device is pre-configured with multiple risk assessment items corresponding to risk indicator information, the risk assessment items are used to characterize the risks existing in the open source module, each of the multiple risk assessment items is respectively configured with a different risk detection score, and the risk detection score is proportional to the risk level of the open source module; a processing unit is specifically used to determine the risk assessment items that each open source module does not meet in the multiple risk assessment items based on the software license risk indicator, software security risk indicator and software maintenance risk indicator of the open source module; according to the risk detection score corresponding to the risk assessment item that the open source module does not meet, determine the risk detection score of the software to be detected; and determine the risk detection result of the software to be detected according to the risk detection score of the software to be detected.

[0021] In a possible implementation of the second aspect, the risk assessment items include whether the open source module has a license, whether the license type of the open source module is not the target type, whether the open source module has no compatibility issues, whether the open source module has no intellectual property risks, whether the open source module uses encrypted code, whether the number of security vulnerabilities in the open source module is less than a preset value, whether the number of computer viruses in the open source module is less than a preset value, whether the open source module has a security maintenance channel, whether the source of the open source module is trustworthy, whether the open source module has not completed integrity and consistency checks, whether the open source module does not have a copyright statement, whether the life cycle of the open source module is in a mature stage, whether the version update frequency of the open source module is greater than a preset value, and whether the open source module has a community support channel. One or more of the following.

[0022] In a possible implementation of the second aspect, the risk detection result includes the risk level of the software to be detected, and different risk levels correspond to different numerical ranges of risk detection scores; a processing unit is specifically used to determine the numerical range corresponding to the risk detection score of the software to be detected; the risk level of the software to be detected is determined according to the numerical range corresponding to the risk detection score of the software to be detected, and the risk detection result of the software to be detected is obtained.

[0023] In a possible implementation of the second aspect, each of the multiple risk assessment items is configured with multiple weight levels, and different weight levels correspond to different risk detection scores; the processing unit is also used to: receive an input first instruction, the first instruction carries the weight level of each of the multiple risk assessment items; and set the weight level of each of the multiple risk assessment items in response to the first instruction.

[0024] In a possible implementation of the second aspect, the computing device also stores multiple weight setting schemes, the weight setting schemes including a weight level for each of the multiple risk assessment items; the above-mentioned apparatus also includes a display unit, the display unit is used to display a first interface, the first interface includes multiple controls corresponding to the multiple weight setting schemes; the processing module is also used to set the weight level for each of the multiple risk assessment items based on the weight setting scheme corresponding to the target control in response to a selection operation of a target control, the target control being one of the multiple controls.

[0025] In a possible implementation of the second aspect, the weight level of the risk assessment item specifically includes a bottom line level; the processing unit is further used to: when there is a risk assessment item with a weight level of the bottom line level among the risk assessment items that the open source module does not meet, determine that the risk level of the software to be detected is high risk.

[0026] In a possible implementation of the second aspect, the acquisition unit is specifically used to: obtain a code package of the software to be tested; parse the code package to determine the open source modules included in the software to be tested; obtain the software material list of the open source modules; merge the software material lists of the open source modules to obtain the software material list of the software to be tested.

[0027] In a possible implementation of the second aspect, before the acquisition unit obtains the software bill of materials of the software to be tested, the acquisition unit is also used to obtain risk indicator information of the open source module; the processing unit is also used to establish a preset database based on the risk indicator information of the open source module; the processing unit is specifically used to obtain the risk indicator information of the open source module from the preset database based on the software bill of materials.

[0028] In a possible implementation manner of the second aspect, the display unit is further configured to display risk detection results of the software to be detected on the second interface.

[0029] In a third aspect, a computing device is provided, comprising: a processor and a memory; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions stored in the memory, thereby implementing any one of the methods provided in the first aspect.

[0030] In a fourth aspect, a chip is provided, comprising: a processor and an interface circuit; the interface circuit is used to receive code instructions and transmit them to the processor; the processor is used to run the code instructions to execute any one of the methods provided in the first aspect above.

[0031] In a fifth aspect, a computer-readable storage medium is provided, which stores computer execution instructions. When the computer execution instructions are executed on a computer, the computer executes any one of the methods provided in the first aspect.

[0032] In a sixth aspect, a computer program product is provided, comprising computer execution instructions, which, when executed on a computer, enable the computer to execute any one of the methods provided in the first aspect.

[0033] Among them, the technical effects brought about by any design method in the second to sixth aspects can refer to the technical effects brought about by different implementation methods in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 An application scenario diagram of a software risk detection method provided by an embodiment of the present application is shown;

[0035] Figure 2 A schematic diagram of the structure of a computing device provided in an embodiment of the present application is shown;

[0036] Figure 3 A schematic diagram of a software risk detection method provided in an embodiment of the present application is shown;

[0037] Figure 4 A flowchart of another software risk detection method provided in an embodiment of the present application is shown;

[0038] Figure 5 A schematic diagram of a process flow of another software risk detection method provided in an embodiment of the present application is shown;

[0039] Figure 6 A schematic diagram of a process flow of another software risk detection method provided in an embodiment of the present application is shown;

[0040] Figure 7 A schematic diagram of a first interface provided by an embodiment of the present application is shown;

[0041] Figure 8 A process schematic diagram of a software risk detection method provided by an embodiment of the present application is shown;

[0042] Fig. 9 A structural block diagram of a software risk detection device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0043] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. Wherein, in the description of the embodiments of the present application, unless otherwise specified, "multiple" refers to two or more than two. "At least one of the following" or its similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0044] In addition, in order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, the words "first", "second" and the like are used to distinguish the same items or similar items with substantially the same functions and effects. Those skilled in the art will understand that the words "first", "second" and the like do not limit the quantity and execution order, and the words "first", "second" and the like do not necessarily limit the difference. At the same time, in the embodiments of the present application, the words "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or design solutions. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete manner for easy understanding.

[0045] In order to comprehensively and accurately detect the risks existing in the open source modules in the software, an embodiment of the present application provides a software risk detection method. The computing device obtains risk indicator information of multiple dimensions of each open source module included in the software to be detected. Then the computing device can accurately determine the risks that may exist in the open source modules of the software to be detected in multiple dimensions based on the risk indicator information of the open source modules. Therefore, the computing device can realize multi-dimensional accurate detection of the risks existing in the open source modules of the software to be detected, and then obtain the risk detection results of the software to be detected, which can improve the efficiency of software testing. In addition, in the software development stage, since the technical personnel can quickly repair the risks of different dimensions of the open source modules of the software based on the risk detection results, it can save manpower and maintenance time, thereby reducing the maintenance cost of the software.

[0046] The following is an exemplary description of the application scenario of the software risk detection method provided in the embodiment of the present application.

[0047] Figure 1 This is an application scenario diagram of a software risk detection method shown in an embodiment of the present application, such as Figure 1As shown, it is applied to a computing device 110, wherein the computing device 110 obtains a code package of the software to be tested, and determines a risk detection result of the software to be tested based on the code package of the software to be tested, wherein the risk detection result is used to characterize the risks existing in multiple dimensions of the open source module of the software to be tested.

[0048] As an example, the computing device 110 may be any device with data processing capabilities, such as a general-purpose computer, a personal computer, or a server, etc. The specific implementation of the computing device 110 is not limited herein.

[0049] It is also understandable that Figure 1 The provided application scenario and the functions implemented by each execution entity in the application scenario are only an exemplary implementation in the embodiments of the present application. The application scenario and the functions implemented by each execution entity in the embodiments of the present application include but are not limited to the above description.

[0050] Figure 2 The schematic diagram of the structure of the computing device 110 provided in the embodiment of the present application is shown. The computing device 110 includes a processor 210, a memory 220 and at least one communication interface 230.

[0051] The processor 210 may include one or more processing cores. The processor 210 uses various interfaces and lines to connect various parts within the computing device 110, and executes various functions and processes data of the computing device 110 by running or executing instructions, programs, code sets or instruction sets stored in the memory 220, and calling data stored in the memory 220. Optionally, the processor 210 can be implemented in at least one hardware form of a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processing (DSP), a field-programmable gate array (FPGA), and a programmable logic array (PLA). The memory 220 may include a random access memory (RAM) or a read-only memory (ROM). Optionally, the memory 220 includes a non-transitory computer-readable storage medium. The memory 220 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 220 may include a storage program area. Among them, the program storage area can store instructions for implementing an operating system, instructions for implementing at least one function (such as a data acquisition function, a data processing function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.

[0052] The communication interface 230 is used to communicate with other devices, equipment or communication networks, such as data storage devices, image processing equipment or Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0053] In terms of physical implementation, the above-mentioned devices (such as processor 210, memory 220 and communication interface 230) can be devices in the same computing device (such as a server); or, at least two of the devices can be set in the same computing device, that is, as different devices in a computing device, such as a deployment method similar to devices or devices in a distributed system.

[0054] It is to be understood that the structure illustrated in this embodiment does not constitute a specific limitation on the computing device 110. In other embodiments of the present application, the computing device 110 may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0055] The software risk detection method provided in the embodiment of the present application is described below in conjunction with the drawings of the specification.

[0056] Figure 3 A flowchart of a software risk detection method provided in an embodiment of the present application. Optionally, the method can be applied to Figure 1 The application scenario shown is Figure 2 The method may include the following steps:

[0057] S301. Obtain a software bill of materials of the software to be tested, where the software bill of materials carries information about open source modules included in the software to be tested.

[0058] Specifically, the software to be tested includes multiple modules, and the multiple modules work together to realize different software functions of the software to be tested. Among them, the module types include self-developed modules and open source modules.

[0059] Exemplarily, a self-developed module is a module developed by itself. An open source module is an open source module, which is defined as a module whose source code can be used by the public, that is, a module provided by a third party. It should be understood that the above division of the software to be detected into multiple modules is only for the convenience of explanation. The specific implementation of a module of the software to be detected may refer to a section of code, a component, a program or a file included in the software to be detected. The embodiment of the present application does not place any particular restriction on the specific implementation of the module.

[0060] The software bill of materials of the software to be tested includes the software bill of materials of each open source module involved in the software to be tested. The open source modules involved include directly introduced open source modules and indirectly introduced open source modules. For example, the software to be tested can directly implement software function a through open source module A, then open source module A is a directly introduced open source module. In another example, the software to be tested cannot directly implement software function b through open source module C, but needs to be supported by open source module B before software function b can be implemented through open source module C, then open source module B is an indirectly introduced open source module.

[0061] The software bill of materials of the software to be tested includes the identification, version information, and file path information of each open source module. That is, the software bill of materials of the software to be tested includes the identification, version information, and file path information of each directly introduced open source module and each indirectly introduced open source module of the software to be tested. Among them, the identification is the name of the open source module, the version information is the version of the open source module used in the software to be tested, and the file path information is the location information of the open source module in the software to be tested.

[0062] In one example, the software bill of materials of the software to be tested is in the software package data exchange (SPDX) format. SPDX is an open standard for software supply chain artifacts, which includes the software's license compliance information and security information. It should be understood that the software bill of materials provided in the embodiment of the present application can also be in other formats, and the embodiment of the present application does not specifically limit this.

[0063] In one possible implementation, see Figure 4 The above S301 specifically includes the following steps:

[0064] S3011. Obtain the code package of the software to be tested.

[0065] Specifically, the code package of the software to be tested is the code file of the software to be tested, including the files corresponding to the open source modules and self-developed modules of the software to be tested.

[0066] The code package of the software to be detected can be pre-stored in a computing device by a user, and the computing device obtains the code package of the software to be detected from the computing device in response to the instruction input by the user. The code package of the software to be detected can also be pre-stored in other devices that communicate with the computing device, and the storage device responds to the instruction input by the user and sends it to the computing device, so that the computing device obtains the code package of the software to be detected. The embodiment of the present application does not particularly limit the specific implementation method of the computing device obtaining the code package of the software to be detected.

[0067] S3012. Analyze the code package to determine the open source modules included in the software to be detected.

[0068] Specifically, the computing device parses the code package of the software to be detected based on the intelligent source code to obtain the identification of each open source module included in the module to be detected. It should be understood that the above intelligent source code is only an example of an implementation method for parsing the code package. The embodiment of the present application can also use other methods or tools to parse the code package to determine the open source modules included in the software to be detected, and the embodiment of the present application does not make any special restrictions on this.

[0069] S3013. Obtain the software bill of materials for the open source module.

[0070] The computing device obtains the software material list of each open source module according to the identifier of each open source module, wherein the software material list of each open source module includes the identifier, version information, and file path information of the open source module.

[0071] Specifically, in one example, the open source module in the software to be detected may exist in the form of code. For example, part of the code in the software to be detected is open source code, and the open source code is combined with the self-developed code to realize the software function of the software to be detected. Therefore, these open source codes combined with the self-developed code can also be understood as a form of expression of the open source module of the software to be detected. In another example, the open source module in the software to be detected may exist in the form of software packaged by the supplier, and the packaged open source module can realize the software function of the software to be detected independently of the self-developed module of the software to be detected. Therefore, the packaged software is also a form of expression of the open source module of the software to be detected.

[0072] The software material list obtained by the computing device may be uploaded in advance by the R&D personnel or provided by the supplier. For example, the software material list provided by the R&D personnel or the supplier is stored in the computing device in advance, and the computing device obtains the software material list corresponding to each directly introduced open source module and each indirectly introduced open source module involved in the software to be detected based on the identifier of each open source module included in the software to be detected.

[0073] S3014. Merge the software material lists of the open source modules to obtain the software material list of the software to be tested.

[0074] As can be seen from the above, the method provided in the embodiment of the present application parses the code package of the software to be detected, determines all the open source modules included in the software to be detected, and then obtains the software material list including all the open source modules of the software to be detected. Thus, the computing device can perform risk detection on each open source module in the software to be detected according to the software material list of the software to be detected, thereby improving the accuracy of risk detection.

[0075] S302. Determine risk indicator information of the open source module based on the software bill of materials.

[0076] Specifically, the risk indicator information includes software license risk indicators, software security risk indicators, and software maintenance risk indicators of open source modules. Among them, the software license risk indicators include multiple indicator information on whether the software to be tested has risks in the legality and compliance dimension of the software license, the software security risk indicators include multiple indicator information on whether the software to be tested has risks in the software security dimension, and the software maintenance risk indicators include multiple indicator information on whether the software to be tested has risks in the software maintenance dimension.

[0077] In one possible implementation, software licensing risk indicators include one or more of the version information, license name, license type, license compatibility, and copyright statement of the open source module; software security risk indicators include one or more of the encryption code information, security vulnerability information, computer virus information, and security maintenance channels of the open source module; software maintenance risk indicators include one or more of the maturity of the open source module, community activity, and community support channels.

[0078] Specifically, community collaboration is the core of open source module development. The community is a collaborative network composed of a group of volunteers, developers, and users. In the community, everyone can obtain and contribute code, recommend the development process of open source modules, and complete the quality and functionality of open source modules.

[0079] Security maintenance channels refer to the channels that the community of an open source module can provide for seeking help, tracking, and repairing security issues of the open source module. The maturity of an open source module describes the stage of the open source module in the development process. For example, the development process of an open source module includes definition, implementation, measurement, control, and improvement. Community activity is used to describe the community activity of an open source module. Community support channels refer to the channels that the community of an open source module can provide for continuous updates and upgrades of the open source module.

[0080] It should be understood that the above risk indicator information is only for illustrative purposes, and the risk indicator information may also include indicator information on whether there are risks in other dimensions of the software to be detected. In addition, the software license risk indicators, software security risk indicators and software maintenance risk indicators provided in the embodiments of the present application may also include more or fewer items than those in the above embodiments, and the embodiments of the present application do not impose any special restrictions on this.

[0081] The method provided in the embodiment of the present application can accurately and comprehensively detect the risks of the open source modules of the software to be tested through the risk indicator information including a variety of risk indicators for describing the open source modules of the software to be tested in different dimensions, thereby dealing with the existing risks and improving software testing efficiency.

[0082] In one possible implementation, before the computing device obtains the software bill of materials of the software to be tested, the method provided in the embodiment of the present application also includes the following steps: obtaining risk indicator information of the open source module, and establishing a preset database based on the risk indicator information of the open source module.

[0083] Specifically, the computing device obtains risk indicator information of multiple open source modules, and stores the risk indicator information corresponding to each open source module in a preset database.

[0084] In one example, the preset database includes metadata of open source modules in multiple languages. The preset database is constructed based on the version of the open source module, which can also be understood as that for the same open source module, the preset database stores risk indicator information corresponding to different versions of the open source module.

[0085] It should be understood that the preset database can be constructed and maintained by using a data capture tool in combination with manual evaluation. For example, the computing device obtains the labels and fields corresponding to the risk indicator information of each version of each open source module through a preset algorithm, and then stores the labels and fields corresponding to the risk indicator information in the preset database to obtain the risk indicator information corresponding to each version of each open source module.

[0086] Exemplarily, the open source module A has two versions, version 1.0 and version 1.1. The computing device obtains the risk indicator information corresponding to the open source module A of version 1.0, and obtains the risk indicator information corresponding to the open source module A of version 1.1. The risk indicator information corresponding to the two versions of the open source module A is then stored in a preset database to obtain the risk indicator information of the open source module A.

[0087] It should be understood that the preset algorithm may be a Bloom filter query algorithm or other algorithms, and the embodiments of the present application do not impose any particular limitation on this.

[0088] It should be understood that the above-mentioned methods of constructing and maintaining the preset database are merely exemplary. The preset database provided in the embodiment of the present application may also be constructed and maintained in other ways, and the embodiment of the present application does not impose any particular limitation on this.

[0089] Furthermore, the above S302 specifically includes the following steps: based on the software bill of materials, obtaining risk indicator information of the open source module from a preset database.

[0090] It should be understood that the above method of obtaining risk indicator information of open source modules from a preset database is only an exemplary description, and the computing device can also obtain risk indicator information of open source modules in other ways, and the embodiments of the present application do not impose any special restrictions on this.

[0091] The method provided in the embodiment of the present application establishes a preset database, which can quickly obtain risk indicator information of each open source module from the preset database according to the software material list of the software to be tested, and then can realize rapid detection of possible risks of the software to be tested, thereby improving the risk detection efficiency of the software to be tested.

[0092] S303: Determine the risk detection result of the software to be detected based on the software license risk index, software security risk index and software maintenance risk index of the open source module.

[0093] In some embodiments, the computing device is pre-configured with multiple risk assessment items corresponding to the risk indicator information, the risk assessment items are used to characterize the risks existing in the open source module, each of the multiple risk assessment items is respectively configured with a different risk detection score, and the risk detection score is proportional to the risk level of the open source module.

[0094] Exemplarily, the higher the risk detection score of the software to be detected, the higher the risk level of the software to be detected. For example, the risk assessment item is whether the open source module has a license. In the case where the open source module does not have a license, the software to be detected does not meet this risk assessment item, and the open source module of the software to be detected has the risk corresponding to this risk assessment item, and the software to be detected obtains the risk detection score corresponding to this risk assessment item.

[0095] In a possible implementation, the software license risk indicator, software security risk indicator, and software maintenance risk indicator in the risk indicator information may each correspond to a risk assessment item. For example, the risk assessment items may include whether the open source module has a license, whether the license type of the open source module is not the target type, whether the open source module does not have compatibility issues, whether the open source module does not have intellectual property risks, whether the open source module uses encryption code, whether the number of security vulnerabilities in the open source module is less than a preset value, whether the number of computer viruses in the open source module is less than a preset value, whether the open source module has a security maintenance channel, whether the open source module is from a credible source, whether the open source module has not completed integrity and consistency checks, whether the open source module does not have a copyright statement, whether the life cycle of the open source module is in a mature stage, whether the version update frequency of the open source module is greater than a preset value, and whether the open source module has a community support channel. One or more of the following.

[0096] Specifically, the target type is the XGPL type. When the license type of the open source module is the XGPL type, the open source module is contagious. Whether there is a compatibility problem with the open source module can be understood as whether the licenses of multiple open source modules of the software to be tested are compatible with each other, that is, for each open source module, whether the licenses of other open source modules in the software to be tested are compatible with this open source module. Whether there is an intellectual property risk in the open source module can be understood as whether there are restrictive clauses on intellectual property rights in the license of the open source module. Whether the source of the open source module is credible can be understood as whether the open source module is obtained through the official website of the open source module.

[0097] In one example, the above encryption code is a code whose EC classification code may be 5D002.

[0098] For example, see Table 1, which is a schematic table of risk assessment items provided in an embodiment of the present application. The following schematic table includes multiple risk assessment items pre-configured by a computing device. As can be seen from Table 1, the more risk assessment items that the open source modules of the software to be detected do not meet, the higher the risk detection score of the software to be detected, that is, the higher the risk level of the software to be detected.

[0099] Table 1

[0100]

[0101]

[0102] It should be understood that the above risk assessment items are merely exemplary, and the risk assessment items may also include more or fewer items than those in the above embodiments, and the embodiments of the present application do not impose any particular limitation on this.

[0103] For further information, see Figure 5 The above S303 specifically includes the following steps:

[0104] S3031. Based on the risk indicator information of the open source module, determine the risk assessment items that each open source module does not meet from multiple risk assessment items.

[0105] Specifically, the computing device determines the risk assessment items that each open source module does not meet based on the risk indicator information of the software to be detected, and then obtains the risk detection score corresponding to each open source module. Exemplarily, risk assessment item a is whether the open source module has a license. When the risk indicator information of open source module A does not include the license of the open source module, risk assessment item a is determined to be a risk assessment item that is not met by open source module A. Risk assessment item b is whether the open source module uses encryption code. When the risk indicator information of open source module A includes that the open source module uses encryption code, risk assessment item b is determined to be a risk assessment item that is met by the open source module.

[0106] In combination with the above example, the software to be detected includes open source module A and open source module B. The computing device is pre-configured with risk assessment item a and risk assessment item b. Among them, the risk detection score corresponding to risk assessment item a is 5, and the risk detection score corresponding to risk assessment item b is 5. In the case where the risk indicator in the risk indicator information of open source module A does not meet the risk assessment item a, the risk detection score of open source module a is 5. In the case where the risk indicator in the risk indicator information of open source module B does not meet the risk assessment item a and the risk assessment item b, the risk detection score of open source module B is 10.

[0107] S3032. Determine the average of the sum of the risk detection scores corresponding to the risk assessment items that are not satisfied by each open source module as the risk detection score of the software to be detected.

[0108] In combination with the above example, the risk detection score of the software to be detected is the average of the risk detection scores of open source module A and open source module B, that is, 7.5.

[0109] S3033. Determine the risk detection result of the software to be detected according to the risk detection score of the software to be detected.

[0110] In some embodiments, the risk detection result includes the risk level of the software to be detected, and different numerical ranges of risk detection scores correspond to different risk levels. The risk level of the software to be detected is positively correlated with the numerical range of the risk detection score. Figure 6 The above S3033 specifically includes the following steps:

[0111] S601: Determine a numerical range of a risk detection score of the software to be detected.

[0112] Exemplarily, the risk level of the software to be detected includes high, medium and low. The risk level corresponding to the numerical range of the risk detection score greater than level 8 is high, the risk level corresponding to the numerical range of the risk detection score greater than 5 and less than 8 is medium, and the risk level corresponding to the numerical range of the risk detection score less than or equal to 5 is low.

[0113] S602: Determine the risk level of the software to be detected according to the numerical range of the risk detection score of the software to be detected, and obtain the risk detection result of the software to be detected.

[0114] In combination with the above example, when the risk detection score of the software to be detected is 7.5, it is determined that the risk level of the software to be detected is medium.

[0115] The method provided in the embodiment of the present application can determine the risk level of the software to be detected by the numerical range corresponding to the risk detection score, thereby enabling technicians to intuitively evaluate the risk situation of the open source module of the software to be detected through the risk level, so as to quickly deal with the existing risks.

[0116] It should be understood that the above division of the numerical ranges of risk detection scores corresponding to different risk levels is only an exemplary illustration, and different methods can also be used to divide more levels of risk levels and the numerical ranges corresponding to each risk level. The embodiments of the present application do not impose any particular restrictions on this.

[0117] From the above S301-S303, it can be seen that the method provided in the embodiment of the present application can achieve full and accurate detection of the risks existing in the open source modules of the software to be detected, and then obtain the risk detection results of the software to be detected, which can improve the efficiency of software testing. In addition, during the software development stage, since the technicians can quickly repair the risks of the open source modules of the software based on the risk detection results, it can save manpower and maintenance time, thereby reducing the maintenance cost of the software.

[0118] In one possible implementation, each of the multiple risk assessment items is configured with multiple weight levels, and different weight levels correspond to different risk detection scores; the above method also includes: receiving a first input instruction, the first instruction carries the weight level of each of the multiple risk assessment items; in response to the first instruction, setting the weight level of each of the multiple risk assessment items.

[0119] Exemplarily, risk assessment item A is configured with weight level a, weight level b, and weight level c. The risk detection score corresponding to weight level a is 10. The risk detection score corresponding to weight level b is 5. The risk detection score corresponding to weight level c is 1. The computing device sets the weight level of risk assessment item A in response to the instruction input by the user.

[0120] In another possible implementation, each of the multiple risk assessment items is configured with a risk score q, each of the multiple risk assessment items is configured with multiple weight levels, different weight levels correspond to different risk detection weights, and the risk detection score of each risk assessment item is equal to the product of the risk detection weight corresponding to the weight level of the risk assessment item and the risk score.

[0121] Exemplarily, risk assessment item A is configured with weight level a, weight level b, and weight level c. Among them, the risk score q is 1, and the risk detection weight corresponding to weight level a is 10. The risk detection weight corresponding to weight level b is 5. The risk detection weight corresponding to weight level c is 1, and the computing device determines that the risk detection score corresponding to weight level a is 10. The risk detection score corresponding to weight level b is 5. The risk detection score corresponding to weight level c is 1.

[0122] Exemplarily, see Table 2, which is a schematic table of risk assessment items provided in an embodiment of the present application. The following schematic table includes multiple risk assessment items pre-configured by the computing device. As shown in Table 2, each risk assessment item has a corresponding weight level. Different weight levels correspond to different risk detection scores. The more risk assessment items that the open source modules of the software to be detected do not meet, the higher the risk detection score of the software to be detected, that is, the higher the risk level of the software to be detected.

[0123] Table 2

[0124]

[0125]

[0126] Exemplarily, risk assessment item A is configured with weight level a, weight level b, and weight level c. The risk detection score corresponding to weight level a is 10. The risk detection score corresponding to weight level b is 5. The risk detection score corresponding to weight level c is 1. The computing device sets the weight level of risk assessment item A in response to the instruction input by the user.

[0127] The method provided in the embodiment of the present application sets multiple weight levels for each risk assessment item. It can determine the weight of each risk assessment item in the risk detection process of the software to be detected by setting the weight level, thereby meeting the risk detection needs in different usage scenarios, thereby increasing the flexibility of risk detection.

[0128] Specifically, users have different risk detection requirements for the software to be tested in different usage scenarios. For example, in a scenario where the software is only used internally, the risk weight of the software to be tested is higher in the software security dimension, and lower in the software license dimension. When users set the weight levels of multiple risk assessment items, the process of setting the weight levels of the risk assessment items is more cumbersome due to the large number of risk assessment items, which affects the user's experience.

[0129] In order to solve the above problem, the computing device pre-stores multiple weight setting schemes, each weight setting scheme corresponding to a different usage scenario. The weight setting scheme includes a weight level of each risk assessment item in the multiple risk assessment items.

[0130] The method provided in the embodiment of the present application also includes the following steps:

[0131] A first interface is displayed, which includes multiple controls corresponding to multiple weight setting schemes; in response to a selection operation of a target control, a weight level of each risk assessment item in multiple risk assessment items is set based on the weight setting scheme corresponding to the target control, and the target control is one of the multiple controls.

[0132] Specifically, different weight setting schemes correspond to different usage scenarios of the software to be detected. For example, the usage scenarios of the software to be detected may be internal products, products applied to Internet technology (IT) products, products applied to terminal products, products applied to external sales, or applications to open source products, etc. The above usage scenarios are only illustrative descriptions, and the embodiments of the present application do not impose any special restrictions on this.

[0133] For example, see Figure 7 , Figure 7 A schematic diagram of a first interface shown in an embodiment of the present application, the first interface includes multiple controls, each control corresponds to a different weight setting scheme, respectively, control 701 corresponds to weight setting scheme 1, control 702 corresponds to weight setting scheme 2, and control 703 corresponds to weight setting scheme 3. The computing device responds to the user's selection operation on any control, and the computing device sets the weight level of multiple risk assessment items based on the weight setting scheme corresponding to the control. In addition, the first interface also includes a risk assessment item display control 704, which is used to display multiple risk assessment items that have been configured by the computing device. Among them, different weight setting schemes can correspond to different detection scenarios, for example, the usage scenario corresponding to weight setting scheme 1 is internal products, and the usage scenario corresponding to weight setting scheme 2 is terminal products.

[0134] The method provided in the embodiment of the present application sets multiple weight setting schemes, each weight setting scheme corresponds to a different usage scenario. For example, in some usage scenarios, the usage license risk of the open source module is more important. Therefore, the user can select a weight setting scheme with a higher weight level of the risk assessment item corresponding to the usage license risk of the open source module according to the needs, and realizes the quick setting of the weight levels of multiple risk assessment items through the multiple controls displayed on the first interface. The user does not need to set the weight level of each risk assessment item in turn, thereby improving the detection efficiency and enhancing the user experience.

[0135] However, for the software to be tested, some risks may affect the normal use of the software to be tested, and the risk of affecting the normal use of the software to be tested is relatively high. Therefore, in the process of risk detection, it is necessary to pay attention to this type of risk to avoid affecting the normal use of the software to be tested.

[0136] In one possible implementation, the weight levels of the risk assessment items specifically include a first weight level, which is the most important level among multiple weight levels; when there are risk assessment items with a weight level of the first weight level among the risk assessment items that are not satisfied by the open source module, the risk level of the software to be tested is determined to be high risk.

[0137] Specifically, the risk assessment items of the first weight level are risk assessment items that may affect the normal use of the software to be tested.

[0138] The method provided in the embodiment of the present application can quickly determine the risk indicator information of each open source module based on the software material list of the software to be tested by establishing a preset database, and then can quickly complete the risk detection of the software to be tested, thereby improving the risk detection efficiency.

[0139] In a possible implementation, the method further includes: displaying risk detection results of the software to be detected on the second interface.

[0140] Optionally, the second interface may also display risk assessment items that the risk level of the software to be detected does not meet, and the risk solution corresponding to each unsatisfied risk assessment item. The second interface may also display the software material list of the software to be detected, and the risk indicator information of each open source module included in the software to be detected. The embodiment of the present application does not place any particular restriction on the specific content displayed on the second interface.

[0141] Optionally, the second interface also displays a processing control corresponding to each unsatisfied risk assessment item, and the computing device responds to the selection operation of any processing control and eliminates the unsatisfied risk assessment items of the software to be tested based on the risk solution.

[0142] After the elimination is completed, the second interface also displays a re-detection control for re-detecting the software to be detected in response to the user's selection operation to obtain the corresponding risk detection result. The method provided in the embodiment of the present application enables the user to intuitively view the risk detection result on the second interface by displaying the risk detection result of the software to be detected on the second interface, and based on the disposal control and re-detection control displayed on the second interface, the risks existing in the software to be detected can be quickly repaired, which can improve the user's experience.

[0143] For easier understanding, see Figure 8 , Figure 8 This is a schematic diagram of a software risk detection method according to an embodiment of the present application. The specific process is as follows:

[0144] S801: A computing device receives a code package of software to be detected.

[0145] S802: The computing device obtains a software material list of the software to be tested based on the code package.

[0146] S803: The computing device obtains risk indicator information of the open source module of the software to be detected from the preset database 800 according to the software material list.

[0147] S804: The computing device obtains risk detection results of the software to be detected based on the risk indicator information and a plurality of pre-set risk assessment items.

[0148] S805: The computing device displays the risk detection result of the software to be detected.

[0149] The above mainly introduces the scheme of the embodiment of the present application from the perspective of the method. It is understandable that, in order to realize the above functions, the computing device 110 includes at least one of the hardware structure and software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the embodiments of the present application.

[0150] The embodiment of the present application can divide the computing device 110 into functional units according to the above method example. For example, the software risk detection device corresponding to the computing device 110 can be divided into functional units corresponding to each function, or two or more functions can be integrated into one processing unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional units. It should be noted that the division of units in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0151] For example, Fig. 9 A structural block diagram of a software risk detection device provided by an embodiment of the present application is shown. The software risk detection device includes an acquisition unit 910 and a processing unit 920. The acquisition unit 910 is used to acquire the software bill of materials of the software to be detected, and the software bill of materials carries information about the open source modules included in the software to be detected; the processing unit 920 is used to determine the risk indicator information of the open source module based on the software bill of materials, and the risk indicator information includes the software license risk indicator, software security risk indicator and software maintenance risk indicator of the open source module; the processing unit 920 is also used to determine the risk detection result of the software to be detected based on the software license risk indicator, software security risk indicator and software maintenance risk indicator of the open source module.

[0152] Optionally, software licensing risk indicators include one or more of the version information, license name, license type, license compatibility, and copyright statement of the open source module; software security risk indicators include one or more of the encryption code information, security vulnerability information, computer virus information, and security maintenance channels of the open source module; software maintenance risk indicators include one or more of the maturity of the open source module, community activity, and community support channels.

[0153] Optionally, the computing device is pre-configured with multiple risk assessment items corresponding to the risk indicator information, the risk assessment items are used to characterize the risks existing in the open source module, each of the multiple risk assessment items is respectively configured with a different risk detection score, and the risk detection score is proportional to the risk level of the open source module; the processing unit 920 is specifically used to determine, based on the risk indicator information of the open source module, the risk assessment items that each open source module does not meet in the multiple risk assessment items; determine the risk detection score of the software to be detected according to the risk detection score corresponding to the risk assessment item that the open source module does not meet; and determine the risk detection result of the software to be detected according to the risk detection score of the software to be detected.

[0154] Optionally, the risk assessment items include whether the open source module has a license, whether the license type of the open source module is not the target type, whether the open source module has no compatibility issues, whether the open source module has no intellectual property risks, whether the open source module uses encrypted code, whether the number of security vulnerabilities in the open source module is less than a preset value, whether the number of computer viruses in the open source module is less than a preset value, whether the open source module has a security maintenance channel, whether the source of the open source module is trustworthy, whether the open source module has not completed integrity and consistency checks, whether the open source module does not have a copyright statement, whether the life cycle of the open source module is in a mature stage, whether the version update frequency of the open source module is greater than a preset value, and whether the open source module has one or more of the community support channels.

[0155] Optionally, the risk detection result includes the risk level of the software to be detected, and different risk levels correspond to different numerical ranges of risk detection scores; the processing unit 920 is specifically used to determine the numerical range corresponding to the risk detection score of the software to be detected; the risk level of the software to be detected is determined according to the numerical range corresponding to the risk detection score of the software to be detected, and the risk detection result of the software to be detected is obtained.

[0156] Optionally, each of the multiple risk assessment items is configured with multiple weight levels, and different weight levels correspond to different risk detection scores; the processing unit 920 is also used to: receive an input first instruction, the first instruction carries the weight level of each of the multiple risk assessment items; in response to the first instruction, set the weight level of each of the multiple risk assessment items.

[0157] Optionally, the computing device also stores multiple weight setting schemes, which include a weight level for each risk assessment item in multiple risk assessment items; the above-mentioned device also includes a display unit 930, which is used to display a first interface, and the first interface includes multiple controls corresponding to multiple weight setting schemes; the processing module is also used to set the weight level of each risk assessment item in the multiple risk assessment items based on the weight setting scheme corresponding to the target control in response to a selection operation of a target control, and the target control is one of the multiple controls.

[0158] Optionally, the weight level of the risk assessment item specifically includes a first weight level, which is the most important level among multiple weight levels; the processing unit 920 is also used to: when there is a risk assessment item with a weight level of the first weight level among the risk assessment items that are not satisfied by the open source module, determine that the risk level of the software to be detected is high risk.

[0159] Optionally, the acquisition unit 910 is specifically used to: obtain the code package of the software to be tested; parse the code package to determine the open source modules included in the software to be tested; obtain the software material list of the open source modules; merge the software material lists of the open source modules to obtain the software material list of the software to be tested.

[0160] Optionally, before obtaining the software bill of materials of the software to be tested, the acquisition unit 910 is also used to obtain risk indicator information of the open source module; the processing unit 920 is also used to establish a preset database based on the risk indicator information of the open source module; the processing unit 920 is specifically used to obtain the risk indicator information of the open source module from the preset database based on the software bill of materials.

[0161] Optionally, the display unit 930 is further configured to display the risk detection result of the software to be detected on the second interface.

[0162] For the detailed description of the above optional methods, please refer to the above method embodiments, which will not be repeated here. In addition, the explanation of any software risk detection device provided above and the description of the beneficial effects can refer to the above corresponding method embodiments, which will not be repeated here.

[0163] The embodiment of the present application also provides a computer-readable storage medium, in which at least one computer instruction is stored, and the at least one computer instruction is loaded and executed by a processor to implement the software risk detection method of each embodiment above. For the explanation of the relevant content and the description of the beneficial effects in any of the above-mentioned computer-readable storage media, reference can be made to the above-mentioned corresponding embodiments, and no further description is given here.

[0164] The embodiment of the present application also provides a chip. The chip integrates a control circuit and one or more ports for realizing the functions of the above-mentioned software risk detection device. Optionally, the functions supported by the chip can be referred to above and will not be repeated here. A person of ordinary skill in the art can understand that all or part of the steps of implementing the above-mentioned embodiment can be completed by instructing the relevant hardware through a program. The program can be stored in a computer-readable storage medium. The storage medium mentioned above can be a read-only memory, a random access memory, etc. The above-mentioned processing unit or processor can be a central processing unit, a general-purpose processor, a specific circuit structure (application specific integrated circuit, ASIC), a microprocessor (digital signal processor, DSP), a field programmable gate array (field programmable gatearray, FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof.

[0165] The embodiment of the present application also provides a computer program product including instructions, when the instructions are run on a computer, the computer executes any one of the methods in the above embodiments. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that can be accessed by the computer or a data storage device such as a server or data center that includes one or more media integrated therein. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., an SSD), etc.

[0166] It should be noted that the above-mentioned device for storing computer instructions or computer programs provided in the embodiments of the present application, such as but not limited to, the above-mentioned memory, computer-readable storage medium and communication chip, etc., all have non-volatile (non-transitory). Those skilled in the art should be aware that in the above one or more examples, the functions described in the embodiments of the present application can be implemented with hardware, software, firmware or any combination thereof. When implemented using software, these functions can be stored in a computer-readable storage medium or transmitted as one or more instructions or codes on a computer-readable storage medium. Computer-readable storage media include computer storage media and communication media, wherein the communication medium includes any medium that is convenient for transmitting a computer program from one place to another. The storage medium can be any available medium that a general or special-purpose computer can access.

[0167] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A software risk detection method, characterized in that: The method comprises: Obtaining a software material list of the software to be detected, wherein the software material list carries information about open source modules included in the software to be detected; Determine risk indicator information of the open source module based on the software bill of materials, wherein the risk indicator information includes a software license risk indicator, a software security risk indicator, and a software maintenance risk indicator; Based on the software license risk index, the software security risk index and the software maintenance risk index of the open source module, a risk detection result of the software to be detected is determined.

2. The method according to claim 1, characterized in that The software license risk indicator includes one or more of the version information, license name, license type, license compatibility, and copyright statement of the open source module; The software security risk indicator includes one or more of the encrypted code information, security vulnerability information, computer virus information, and security maintenance channels of the open source module; The software maintenance risk indicators include one or more of the maturity of the open source module, the community activity, and the community support channels.

3. The method according to claim 1 or 2, characterized in that: The computing device is pre-configured with a plurality of risk assessment items corresponding to the risk indicator information, the risk assessment items are used to characterize the risks existing in the open source module, each of the plurality of risk assessment items is respectively configured with a different risk detection score, and the risk detection score is proportional to the risk level of the open source module; The step of determining the risk detection result of the software to be detected based on the software license risk indicator, the software security risk indicator and the software maintenance risk indicator of the open source module includes: Based on the software license risk index, the software security risk index, and the software maintenance risk index of the open source module, determining, from the multiple risk assessment items, a risk assessment item that each open source module does not satisfy; Determine, according to the risk detection score corresponding to the risk assessment item not satisfied by the open source module, the risk detection score of the software to be detected; The risk detection result of the software to be detected is determined according to the risk detection score of the software to be detected.

4. The method according to claim 3, characterized in that The risk assessment items include whether the open source module has a license, whether the license type of the open source module is not the target type, whether the open source module has no compatibility issues, whether the open source module has no intellectual property risks, whether the open source module uses encrypted code, whether the number of security vulnerabilities in the open source module is less than a preset value, whether the number of computer viruses in the open source module is less than a preset value, whether the open source module has a security maintenance channel, whether the source of the open source module is credible, whether the open source module has not completed integrity and consistency checks, whether the open source module does not have a copyright statement, whether the life cycle of the open source module is in a mature stage, whether the version update frequency of the open source module is greater than a preset value, and whether the open source module has a community support channel. One or more of the following.

5. The method according to any one of claims 1 to 4, characterized in that The risk detection result includes the risk level of the software to be detected, and different risk levels correspond to different numerical ranges of risk detection scores; The step of determining the risk detection result of the software to be detected according to the risk detection score of the software to be detected includes: Determine a numerical range corresponding to the risk detection score of the software to be detected; The risk level of the software to be detected is determined according to the numerical range corresponding to the risk detection score of the software to be detected, and the risk detection result of the software to be detected is obtained.

6. The method according to any one of claims 1 to 5, characterized in that The computing device further stores a plurality of weight setting schemes, wherein the weight setting schemes include a weight level of each risk assessment item in the plurality of risk assessment items; The method further comprises: Displaying a first interface, wherein the first interface includes a plurality of controls corresponding to the plurality of weight setting schemes; In response to a selection operation on a target control, a weight level of each risk assessment item in the multiple risk assessment items is set based on a weight setting scheme corresponding to the target control, and the target control is one of the multiple controls.

7. The method according to any one of claims 1 to 6, characterized in that: The weight levels of the risk assessment items specifically include a first weight level, which is the level with the highest importance among the multiple weight levels; In the case that there is a risk assessment item with a weight level of the first weight level among the risk assessment items that the open source module does not satisfy, it is determined that the risk level of the software to be detected is high risk.

8. The method according to any one of claims 1 to 7, characterized in that: The step of obtaining the software material list of the software to be tested includes: Obtaining a code package of the software to be detected; Parsing the code package to determine the open source modules included in the software to be detected; Obtaining a software bill of materials for the open source module; The software material lists of the open source modules are merged to obtain the software material list of the software to be detected.

9. The method according to any one of claims 1 to 8, characterized in that: Before obtaining the software material list of the software to be detected, the method further includes: Obtain risk indicator information of open source modules; Establish a preset database based on risk indicator information of open source modules; The determining the risk indicator information of the open source module based on the software bill of materials includes: Based on the software bill of materials, risk indicator information of the open source module is obtained from a preset database.

10. A computing device, characterized in that include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the software risk detection method according to any one of claims 1 to 9.

Images