Software supply chain risk analysis method

Abstract

The invention provides a software supply chain risk analysis method. A data acquisition and preprocessing module acquires component information from a plurality of software warehouses and performs format unified processing; the components are modeled as nodes through a hypergraph construction module, the dependency relationship is modeled as hyperedges, and a hypergraph structure is dynamically constructed and updated so as to express many-to-many dependency relationship more accurately; performing representation learning on the hypergraph structure through a hypergraph neural network, generating embedded vectors of the components, and fusing context features of the components; based on an embedded vector, risk scoring, anomaly detection and classification are carried out by adopting multi-task learning and a graph attention mechanism, so that the generalization ability of the model and the risk identification precision are improved; online incremental updating of a hypergraph structure and model parameters is achieved through a dynamic updating and feedback mechanism, and the real-time performance and stability of the model are ensured. According to the method, the data transmission security, the transmission efficiency and the compatibility between devices are improved, and the method has higher risk analysis capability and system adaptability.

Description

Technical Field

[0001] This invention relates to the technical field of software security and supply chain risk management, and specifically to a software supply chain risk analysis method. Background Technology

[0002] In the current software development and distribution process, the security of the software supply chain is becoming increasingly prominent. Complex component dependencies, rapid vulnerability propagation, and frequent supply chain attacks pose serious challenges to the security of software systems. Traditional software supply chain risk analysis methods mainly rely on static component inventory analysis and rule-based vulnerability matching mechanisms, which are insufficient to effectively handle large-scale, dynamically changing dependency networks. Existing technologies typically model software components and their dependencies as simple graph structures, with nodes representing components and edges representing direct dependencies between components. However, this modeling approach cannot accurately represent complex many-to-many dependencies, leading to limitations in risk propagation path identification and context-aware analysis. Furthermore, traditional methods often rely on manually extracted metadata or static attributes during feature extraction, lacking in-depth modeling of the semantic roles and contextual relationships of components within the overall supply chain structure, thus limiting the accuracy and generalization ability of risk assessment. Simultaneously, most existing systems lack effective dynamic update mechanisms when facing new vulnerability disclosures, component version updates, and changes in dependencies, making it difficult to maintain the real-time performance and predictive accuracy of the model, thus affecting the continued effectiveness of the risk analysis system. In terms of risk analysis model design, existing methods mostly employ single-task models to handle tasks such as vulnerability scoring and anomaly detection separately, lacking a unified modeling framework. This results in high model redundancy, poor coordination, and difficulty in effectively uncovering potential correlations between tasks. Furthermore, insufficient model interpretability limits the application value of analysis results in practical security responses. Therefore, there is an urgent need for a software supply chain risk analysis method that can integrate multi-source heterogeneous data, model complex dependencies, fuse structural and semantic information, support multi-task collaborative analysis, and possess dynamic update capabilities to address the increasingly complex security challenges of the software supply chain. Summary of the Invention

[0003] Based on this, in order to solve the technical problems of insufficient security, low transmission efficiency and poor compatibility between devices in the data transmission process in the prior art, this invention is proposed.

[0004] This invention protects a software supply chain risk analysis method. The method involves a data acquisition and preprocessing module that collects component information from multiple software repositories and processes it in a standardized format. The component information includes component name, version, dependencies, metadata, and known vulnerability information. A hypergraph construction module models a hypergraph structure based on the software components and their dependencies, and dynamically updates the hypergraph structure. In the hypergraph structure, nodes represent software components, and hyperedges represent many-to-many dependencies between components. The hypergraph structure is dynamically updatable. A hypergraph learning and feature extraction module uses a hypergraph neural network to learn the representation of the hypergraph structure, generating an embedding vector for each component to characterize its contextual features within the supply chain. A risk assessment and anomaly detection module uses the component embedding vectors and employs multi-task learning and graph attention mechanisms for risk scoring, anomaly detection, and classification. A dynamic update and feedback mechanism performs online incremental updates to the hypergraph structure and model parameters based on newly released components, updated vulnerability information, and changing dependencies to maintain the model's real-time performance and accuracy.

[0005] Furthermore, the steps of modeling a hypergraph structure based on software components and their dependencies using a hypergraph building module, and dynamically updating the hypergraph structure, include: modeling software components as nodes in the hypergraph, where software components include npm packages and Javajar packages; modeling the dependencies between software components as hyperedges, where each hyperedge connects multiple nodes to represent a dependency involving multiple components; and using dynamic hypergraph modeling technology to dynamically update the hypergraph structure based on newly released components, updated vulnerability information, and changed dependencies.

[0006] Furthermore, the step of using a hypergraph neural network to perform representation learning on the hypergraph structure and generate an embedding vector for each component to characterize the contextual features of the component in the supply chain includes: modeling multi-order dependencies of nodes and hyperedges in the hypergraph structure using a hypergraph neural network; and learning embedding vectors for components in the hypergraph structure using a hypergraph neural network to generate an embedding vector for each component, wherein the embedding vector reflects the contextual position and behavioral characteristics of the component in the supply chain.

[0007] Furthermore, the risk assessment and anomaly detection module employs multi-task learning and graph attention mechanisms to perform risk scoring, anomaly detection, and classification based on component embedding vectors. This includes: simultaneously performing vulnerability prediction, malicious behavior identification, and anomaly detection using a multi-task learning framework based on the learned component embedding vectors; where the multi-task learning framework shares the underlying component embedding representation and sets independent output layers for different tasks to improve model generalization and task synergy; during anomaly detection, a graph attention mechanism is introduced to model the propagation paths between components in the hypergraph, identifying critical paths and high-risk propagation nodes affecting propagation; and the graph attention mechanism calculates the attention weights between components, dynamically focusing on the dependency paths that have the greatest impact on risk assessment, thereby enhancing the model's ability to identify complex supply chain risks.

[0008] Furthermore, the steps of maintaining the model's real-time performance and accuracy by dynamically updating and responding to new components, updated vulnerability information, and changed dependencies through an online incremental update mechanism include: employing online incremental learning technology to extract and embed new features in real time based on newly released components, updated vulnerability information, and changed dependencies; and dynamically adjusting the hypergraph structure and hypergraph neural network model parameters through a model hot update mechanism without interrupting model services. Dynamic adjustment includes online incremental learning and model hot updates. Online incremental learning includes incremental updates of node embeddings based on new data samples and dynamic reconstruction of the hyperedge structure. Model hot updates include loading updated model parameters on demand while maintaining the model architecture, achieving seamless iteration and real-time response of the risk assessment model.

[0009] Furthermore, the steps of learning embedding vectors for components in the hypergraph structure using a hypergraph neural network to generate the embedding vector for each component include: during the embedding learning process of the current hypergraph, HyperGNN is used to jointly model nodes and hyperedges; in the embedding initialization phase, each node is initialized as a low-dimensional embedding vector, which consists of its metadata and static features; the embedding vector of each hyperedge is aggregated from the embeddings of multiple nodes it connects to, and the aggregation methods include mean aggregation, attention-weighted aggregation, or Gated Recurrent Unit (GRU) aggregation; in the embedding update phase, the node embeddings are updated through a multi-layer propagation mechanism, where each node receives information from the hyperedges it participates in and adjusts its own embedding representation according to the structural weights of the hyperedges; in the information transmission process, a combination of hyperedge-level information transmission and node-level aggregation is used, and the graph attention mechanism GAT is introduced to calculate the attention weights of different paths; in the nonlinear transformation phase, a multilayer perceptron (MLP) is used to perform nonlinear mapping on the aggregated embedding information to capture high-order nonlinear dependency features; in the model optimization process, residual connections and layer normalization techniques are introduced to enhance the training stability and generalization ability of the model.

[0010] Furthermore, the steps for modeling multi-order dependencies between nodes and hyperedges in a hypergraph structure using a hypergraph neural network include: In the information propagation phase, embedding updates are achieved through multi-order bidirectional information flow between nodes and hyperedges; specifically, in the first layer of propagation, nodes receive aggregated information from the hyperedges they participate in and update their embedding representations based on the structural weights of the hyperedges; in the second layer of propagation, the hyperedges re-aggregate based on the updated embedding representations of the nodes they connect to in the first layer to generate new hyperedges; the structural weights are dynamically calculated using the graph attention mechanism GAT to identify the dependency paths that play a dominant role in risk propagation; information aggregation methods include mean aggregation, maximum aggregation, gated recurrent unit (GRU) aggregation, or attention-weighted aggregation; in the nonlinear transformation phase, a multilayer perceptron (MLP) is used to perform nonlinear mapping on the aggregated embedding information to capture higher-order semantic dependencies; in the model enhancement phase, residual connections and layer normalization techniques are introduced to alleviate the gradient vanishing problem in deep networks and improve the training stability and convergence speed of the model.

[0011] Furthermore, the steps of collecting component information from multiple software repositories and performing format unification processing through the data acquisition and preprocessing module include: in the nonlinear transformation stage, in the step of using a multilayer perceptron (MLP) to perform nonlinear mapping on the aggregated embedded information, a residual connection mechanism is introduced to add the input embedding vector of the current layer to the nonlinearly mapped output embedding vector element by element to form a residual output; based on the residual output, an application layer normalization operation is performed to standardize each dimension of the residual output vector to improve the stability of the model training process.

[0012] This invention protects a software supply chain risk analysis method. It collects component information from multiple software repositories through a data acquisition and preprocessing module, and performs standardized format processing. Component information includes component name, version, dependencies, metadata, and known vulnerability information, thereby achieving standardized integration of component data from heterogeneous sources and improving data availability and consistency. A hypergraph construction module models a hypergraph structure based on software components and their dependencies, and dynamically updates this structure. Nodes represent software components, and hyperedges represent many-to-many dependencies between components, enabling a more accurate depiction of complex dependency networks and enhancing structural expressiveness. A hypergraph learning and feature extraction module uses a hypergraph neural network to learn the representation of the hypergraph structure, generating representations for each component. The embedding vectors of components are used to represent the contextual features of components in the supply chain, thereby achieving effective fusion of semantic and structural information of components and improving the depth and accuracy of feature representation. Based on the component embedding vectors, the risk assessment and anomaly detection module uses multi-task learning and graph attention mechanisms to perform risk scoring, anomaly detection and classification, which can complete a variety of risk-related tasks under a unified framework, improving the model's comprehensive judgment ability and interpretability. Through a dynamic update and feedback mechanism, the hypergraph structure and model parameters are updated online incrementally according to newly released components, updated vulnerability information and changing dependencies to maintain the model's real-time performance and accuracy, thereby ensuring that the system maintains efficient and stable risk analysis capabilities in the constantly changing software supply chain environment. Attached Figure Description

[0013] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0014] Figure 1 A flowchart illustrating the steps of a software supply chain risk analysis method provided in this application embodiment;

[0015] Figure 2 This is a schematic diagram of the IKEGCL model structure provided in the embodiments of this application;

[0016] Figure 3 This is a schematic diagram of the DHRec model structure provided in the embodiments of this application;

[0017] Figure 4 This is a schematic diagram of the structure of a software supply chain risk analysis device provided in an embodiment of this application. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. Based on the embodiments of this application, every other embodiment obtained by those skilled in the art without inventive effort falls within the scope of protection of this application.

[0019] Research has revealed significant shortcomings in existing software supply chain risk analysis methods for handling complex dependencies and dynamic changes. Traditional analysis methods, often based on static dependency graphs or simple heuristics, struggle to accurately model many-to-many dependencies between software components, leading to inaccurate identification of risk propagation paths. Furthermore, existing technologies lack effective dynamic update mechanisms when faced with frequently updated component versions, new vulnerability information, and changes in dependencies, making it difficult to guarantee the real-time nature and accuracy of analysis results. Simultaneously, most methods neglect the structural and semantic information of components within the supply chain context during feature extraction and risk assessment, limiting risk identification capabilities and hindering fine-grained risk scoring and anomaly detection.

[0020] Based on this, please refer to Figure 1 This application provides a flowchart of a software supply chain risk analysis method, including the following steps: Step S101: Collect component information from multiple software repositories and perform format unification processing through a data acquisition and preprocessing module; wherein, the component information includes: component name, version, dependency relationship, metadata, and known vulnerability information; Step S102: Model a hypergraph structure based on the software components and their dependencies through a hypergraph construction module, and dynamically update the hypergraph structure, wherein, in the hypergraph structure, nodes represent software components, hyperedges represent many-to-many dependencies between components, and the hypergraph structure can be dynamically updated; Step S103 uses a hypergraph neural network to learn the representation of the hypergraph structure through the hypergraph learning and feature extraction module, generating an embedding vector for each component to represent the contextual features of the component in the supply chain; Step S104 uses a risk assessment and anomaly detection module to perform risk scoring, anomaly detection, and classification based on the embedding vectors of the components using multi-task learning and graph attention mechanisms; Step S105 uses a dynamic update and feedback mechanism to perform online incremental updates to the hypergraph structure and model parameters based on newly released components, updated vulnerability information, and changing dependencies, in order to maintain the real-time performance and accuracy of the model.

[0021] This application provides a software supply chain risk analysis method. By introducing a hypergraph structure to model the complex dependencies between components, it can more accurately capture multi-level and multi-path dependencies in the software supply chain, improving the ability to identify risk propagation paths. Combining hypergraph neural networks for representation learning effectively extracts the contextual features of components, enhancing the model's ability to characterize component behavior and risk patterns. Employing multi-task learning and graph attention mechanisms, it achieves integrated modeling of component risk scoring, anomaly detection, and classification, improving the accuracy and interpretability of the analysis. Simultaneously, through a dynamic update and feedback mechanism, the system can respond in real time to component updates, vulnerability disclosures, and dependency changes, ensuring the model's continuous and effective operation, significantly improving the timeliness, adaptability, and intelligence level of software supply chain risk analysis.

[0022] In step S101, component information is collected from multiple software repositories and processed in a unified format using a data acquisition and preprocessing module. This component information includes component name, version, dependencies, metadata, and known vulnerability information. During this step, in the nonlinear transformation stage, a residual connection mechanism is introduced in the step of using a Multilayer Perceptron (MLP) to perform nonlinear mapping on the aggregated embedding information. The input embedding vector of the current layer is added element-wise to the nonlinearly mapped output embedding vector to form a residual output. Based on the residual output, an application layer normalization operation is performed to standardize each dimension of the residual output vector, thereby improving the stability of the model training process. This step aims to provide structured and standardized input data for subsequent hypergraph modeling and risk analysis, ensuring data quality and consistency.

[0023] In specific implementation, S101 includes the following sub-steps:

[0024] S1011. Connect to multiple software repositories, such as Maven, NPM, and PyPI, through adapter interfaces, and call the API interfaces of each repository or crawl public data sources to obtain raw component information. The component information includes metadata such as component name, version number, publisher, release date, download count, dependency list, and known vulnerabilities (such as CVE numbers).

[0025] S1012. Clean and deduplicate the collected raw data, including missing value filling, abnormal version number filtering, and duplicate component merging, to ensure data integrity and accuracy. For example, for the version number field, it is uniformly converted into a semantic version format (e.g., v1.2.3), and the version range (e.g., ^1.0.0) is parsed into a specific version set.

[0026] S1013. Perform dependency parsing and standardized modeling, convert the dependency description format in different repositories into a unified component version dependency triple (ComponentA, VersionA, DependsOn, ComponentB, VersionB), and construct a directed dependency graph structure to provide a foundation for subsequent hypergraph modeling.

[0027] S1014. Integrate external vulnerability databases (such as NVD and Snyk) with component reputation databases to supplement and update known vulnerability information for components. Use the component name and version number as matching keys to query whether a corresponding CVE entry exists in the external database, and incorporate vulnerability level (such as CVSS score), remediation status, and other information into the component metadata.

[0028] S1015. The cleaned and standardized component information is converted into a unified data representation format, such as JSON-LD or a node-edge structure supported by a graph database, to facilitate efficient reading and processing by subsequent modules. Simultaneously, a versioned storage strategy is adopted to retain historical data snapshots to support model backtracking and incremental updates.

[0029] S1016. In the nonlinear transformation stage, during the step of using a Multilayer Perceptron (MLP) to perform nonlinear mapping on the aggregated embedded information, a residual connection mechanism is introduced. This mechanism adds the input embedding vector of the current layer to the nonlinearly mapped output embedding vector element-wise to form a residual output. This mechanism helps alleviate the gradient vanishing problem in deep networks and improves the training stability and convergence speed of the model.

[0030] S1017. Based on the residual output, an application-layer normalization operation is performed to standardize each dimension of the residual output vector, thereby improving the stability of the model during training. Specifically, the mean and variance of each dimension of each embedding vector are calculated and normalized to ensure that the output vector maintains numerical stability during training, thus enhancing the model's generalization ability and robustness.

[0031] Through the above steps, the data acquisition and preprocessing module can efficiently and accurately obtain component information from multi-source heterogeneous software repositories, and complete format unification and structured processing, providing a high-quality data foundation for subsequent hypergraph construction and risk analysis.

[0032] In step S102, a hypergraph structure is modeled based on software components and their dependencies using a hypergraph construction module, and this structure is dynamically updated. In this hypergraph structure, nodes represent software components, and hyperedges represent many-to-many dependencies between components. The hypergraph structure is dynamically updatable. The core of this step is to abstract the complex dependencies in the software supply chain into a computable hypergraph model and support a dynamic update mechanism that evolves over time, thereby providing accurate structured input for subsequent risk assessment and anomaly detection.

[0033] In specific implementation, S102 includes the following sub-steps:

[0034] S1021. Model the software components as nodes in a hypergraph, wherein the software components include common types of components such as npm packages, Java jar packages, and Python wheels. The initial embedding of each node consists of its metadata, including component name, version, publisher, download count, update frequency, number of known vulnerabilities, etc., used to characterize the basic attributes and historical behavioral features of the component.

[0035] S1022. Model the dependencies between software components as hyperedges, where each hyperedge connects multiple nodes to represent a dependency involving multiple components. For example, a JavaScript module may depend on three libraries, A, B, and C. In this case, a hyperedge should be used to connect these four nodes to more realistically reflect the actual many-to-many dependency relationship, breaking through the limitation of traditional graph structures that can only express binary relationships.

[0036] S1023. Dynamic hypergraph modeling technology is adopted to dynamically update the hypergraph structure based on newly released components, updated vulnerability information, and changing dependencies. Specifically, this includes: automatically creating nodes for a new component and establishing new hyperedges based on its dependencies when a new component is detected; updating the connection structure of existing components in the hypergraph when their dependencies change; and synchronously updating the attribute information (such as vulnerability level and remediation status) of relevant nodes when the external vulnerability database is updated to ensure the real-time performance and accuracy of the hypergraph structure.

[0037] S1024. During dynamic updates, an incremental update strategy is used to locally adjust the hypergraph structure instead of rebuilding it entirely. For example, when adding a new component, only the corresponding node and hyperedge need to be added to the existing hypergraph, without affecting the structure of existing nodes and hyperedges. This strategy significantly reduces the computational overhead of hypergraph maintenance and improves the system's response speed and scalability.

[0038] S1025. To support efficient storage and querying of hypergraph structures, a graph database (such as Neo4j, JanusGraph) or a custom hypergraph data structure is used for storage management. Graph databases support efficient graph traversal and subgraph querying, facilitating subsequent embedding training of the hypergraph learning module; at the same time, the transaction mechanism of graph databases can ensure data consistency and reliability during dynamic updates.

[0039] S1026. After the hypergraph structure is updated, trigger the model retraining or parameter hot update process, input the latest hypergraph structure into the hypergraph neural network, recalculate the embedding vector and incrementally update the model parameters to ensure that the risk assessment module always analyzes based on the latest supply chain structure.

[0040] Through the above steps, the hypergraph building module can model the components and their complex dependencies in the software supply chain as a dynamically updatable hypergraph structure, support the accurate expression of many-to-many dependencies, and maintain the real-time performance and accuracy of the model through an incremental update mechanism, providing a structural foundation and data support for subsequent risk assessment and anomaly detection.

[0041] In step S103, the hypergraph learning and feature extraction module employs a hypergraph neural network to perform representation learning on the hypergraph structure, generating an embedding vector for each component to characterize the component's contextual features within the supply chain. This step aims to leverage a hypergraph neural network (HyperGNN) to deeply model components and their complex dependencies within the software supply chain, thereby extracting semantic embedding vectors that reflect the component's position and behavior within the global dependency structure, providing high-quality feature input for subsequent risk assessment and anomaly detection.

[0042] In specific implementation, S103 includes the following sub-steps:

[0043] S1031. Model multi-order dependencies of nodes and hyperedges in the hypergraph structure using a hypergraph neural network. In this step, HyperGNN models the nodes (i.e., software components) and hyperedges (i.e. dependencies) in the hypergraph as vector representations in the embedding space, and captures high-order dependencies between components through a multi-layer propagation mechanism.

[0044] S10311. In the information propagation phase, embedding updates are achieved through multi-level bidirectional information flow between nodes and hyperedges. Specifically, in the first layer of propagation, nodes receive aggregated information from the hyperedges they participate in and update their node embedding representations based on the structural weights of the hyperedges; in the second layer of propagation, the hyperedges re-aggregate and generate new hyperedge embeddings based on the updated embedding representations of the nodes they connect to in the first layer, thereby realizing bidirectional information interaction and iterative embedding updates between nodes and hyperedges.

[0045] S10312. Structural weights are dynamically calculated using the Graph Attention (GAT) mechanism to identify dependent paths that play a dominant role in risk propagation. For example, if a hyperedge connects multiple nodes with vulnerabilities or abnormal behavior, the weight of that hyperedge in information propagation will be automatically increased, thereby enhancing the model's ability to identify key risk propagation paths.

[0046] S10313. The information aggregation method includes mean aggregation, maximum aggregation, gated recurrent unit (GRU) aggregation, or attention-weighted aggregation, with the specific selection depending on the complexity of the dependency relationship and the modeling requirements. Among them, attention-weighted aggregation can further improve the modeling accuracy of heterogeneous dependency structures.

[0047] S10314. In the nonlinear transformation stage, a multilayer perceptron (MLP) is used to perform nonlinear mapping on the aggregated embedded information to capture higher-order semantic dependencies. The MLP enhances the model's ability to express complex dependency patterns by introducing nonlinear activation functions (such as ReLU and GELU) to map the aggregated information.

[0048] S10315. In the model enhancement stage, residual connections and layer normalization techniques are introduced to alleviate the gradient vanishing problem in deep networks and improve the training stability and convergence speed of the model. Specifically, residual connections add the input embedding vector and the output embedding vector of the current layer element by element, while layer normalization standardizes each dimension of the output vector to ensure numerical stability during training.

[0049] S1032. Embedding vectors are learned for the components in the hypergraph structure using the hypergraph neural network to generate an embedding vector for each component. The embedding vector reflects the component's contextual position and behavioral characteristics within the supply chain. In this step, after multi-layer propagation and nonlinear transformation, the final embedding vector of each node (component) not only contains its own metadata information but also incorporates its contextual dependency information within the hypergraph structure, thereby effectively representing its semantic role and potential risk attributes within the supply chain.

[0050] S1033. The output component embedding vectors serve as input to the subsequent risk assessment module, used to perform risk scoring, anomaly detection, and classification tasks under multi-task learning and graph attention mechanisms. Simultaneously, the embedding vectors can also be used for visualization analysis, assisting security personnel in understanding the dependency structure between components and risk propagation paths.

[0051] Through the above steps, the Hypergraph Learning and Feature Extraction module can perform deep representation learning on the complex dependency structure in the software supply chain based on the Hypergraph Neural Network, generating high-quality component embedding vectors, providing a semantically rich and structurally sensitive feature foundation for subsequent risk assessment and anomaly detection.

[0052] In step S104, the risk assessment and anomaly detection module uses multi-task learning and graph attention mechanisms to perform risk scoring, anomaly detection, and classification based on the component's embedding vectors. This step aims to utilize the embedding vectors learned by components in the hypergraph structure, combined with a multi-task learning framework and graph attention mechanisms, to comprehensively assess and identify various security risks in the software supply chain, thereby achieving efficient detection of malicious components, vulnerability propagation paths, and abnormal behaviors.

[0053] In specific implementation, S104 includes the following sub-steps:

[0054] S1041. Based on the learned component embedding vectors, a multi-task learning framework is employed to simultaneously perform vulnerability prediction, malicious behavior identification, and abnormal behavior detection. In this multi-task learning framework, the underlying component embedding representation is shared, and independent output layers are set for different tasks to improve the model's generalization ability and task synergy. Specifically, the model backbone receives the component embedding vectors as input, extracts general features through a shared fully connected layer, and then branches out into multiple task-specific sub-networks, respectively used to predict whether a component has known vulnerabilities, whether it is a malicious packet, and whether it exhibits abnormal behavior patterns.

[0055] S1042. During anomaly detection, a graph attention mechanism is introduced to model the propagation paths between components in the hypergraph, identifying critical paths and high-risk propagation nodes that affect propagation. The graph attention mechanism dynamically identifies dependency paths that play a dominant role in risk propagation by calculating attention weights between components. For example, if a component frequently appears in the dependency chains of multiple high-risk components, it will be given higher importance in the attention weights, thereby improving the model's accuracy in identifying potential risk propagation nodes.

[0056] S1043. The attention weights between components are calculated using the graph attention mechanism, dynamically focusing on the dependency paths that have the greatest impact on risk assessment, thereby enhancing the model's ability to identify risks in complex supply chains. In specific implementation, the graph attention mechanism assigns attention coefficients to each hyperedge based on the similarity and structural positional relationships between component embedding vectors, which are used to weight and aggregate the information of its connected nodes, thus prioritizing high-impact paths in the risk scoring and classification process.

[0057] S1044. At the output end of the multi-task learning framework, risk scores and classification results for each task are generated. For example, the vulnerability prediction task outputs a probability score for the existence of unpatched CVE vulnerabilities in the component; the malicious behavior identification task outputs the likelihood that the component is a malicious package; and the abnormal behavior detection task identifies whether it deviates from normal component behavior based on historical behavior patterns. Finally, the results of each task are merged to generate a comprehensive risk score, which is used for sorting and priority ranking.

[0058] S1045. The output risk score and classification results will be transmitted to the visualization and alerting module to generate a list of risk components, a dependency path tracing map, and security recommendations, assisting security personnel in quickly locating and responding to potential threats in the supply chain.

[0059] Through the above steps, the risk assessment and anomaly detection module can achieve joint modeling and accurate identification of multiple risk types in the software supply chain based on component embedding vectors, combined with multi-task learning and graph attention mechanisms, significantly improving the comprehensiveness and accuracy of risk analysis.

[0060] In step S105, a dynamic update and feedback mechanism is used to incrementally update the hypergraph structure and model parameters online based on newly released components, updated vulnerability information, and changed dependencies, in order to maintain the model's real-time performance and accuracy. This step aims to build a closed-loop system with continuous learning capabilities, enabling the entire risk analysis model to respond in real time to dynamic changes in the software supply chain, thereby maintaining the timeliness and reliability of the model's prediction results.

[0061] In specific implementation, S105 includes the following sub-steps:

[0062] S1051. Employing online incremental learning technology, the system performs real-time feature extraction and embedding updates for newly released components, updated vulnerability information, and changed dependencies. In this step, when the data acquisition and preprocessing module detects a new component release, a change in the dependencies of existing components, or an update to the external vulnerability database, the system automatically triggers the incremental update process, performing feature extraction and embedding vector updates only on the affected nodes and hyperedges, rather than retraining the entire model.

[0063] S10511. During the embedding initialization phase, each newly added node is initialized as a low-dimensional embedding vector. The node embedding vector consists of its metadata (such as component name, version, publisher, download count) and static features (such as code hash, signature, file structure). For updates to existing nodes, embedding fine-tuning is performed based on their newly added attribute information.

[0064] S10512. The embedding vector of each newly added hyperedge is formed by the embedding and aggregation of multiple nodes it is connected to. The aggregation method includes mean aggregation, attention-weighted aggregation or gated recurrent unit (GRU) aggregation. The specific selection depends on the complexity of the dependency relationship and the interpretability requirements.

[0065] S10513. During the embedding update phase, node embeddings are updated through a multi-layer propagation mechanism. In each layer, nodes receive information from the hyperedges they participate in and adjust their own embedding representations according to the structural weights of the hyperedges. The structural weights are dynamically calculated using the graph attention mechanism GAT to identify the dependency paths that play a dominant role in risk propagation.

[0066] S10514. In the information transmission process, a combination of hyperedge-level information transmission and node-level aggregation is adopted to realize bidirectional information flow between nodes and hyperedges. For example, in the first layer of propagation, nodes receive aggregated information from the hyperedges they participate in and update their own embeddings; in the second layer of propagation, hyperedges re-aggregate based on the new embeddings of the nodes they connect to generate new hyperedge representations.

[0067] S10515. In the nonlinear transformation stage, a multilayer perceptron (MLP) is used to perform nonlinear mapping on the aggregated embedded information to capture high-order nonlinear dependency features. Simultaneously, residual connections and layer normalization techniques are introduced to alleviate the gradient vanishing problem in deep networks and enhance the model's training stability and generalization ability.

[0068] S1052. Without interrupting model service, dynamically adjust the parameters of the hypergraph structure and hypergraph neural network model through a model hot update mechanism. Dynamic adjustment includes online incremental learning and model hot update.

[0069] S10521. The online incremental learning includes incremental updates of node embeddings based on new data samples and dynamic reconstruction of hyperedge structures. Specifically, the system only performs embedding update operations on newly added or changed nodes and hyperedges, while retaining the embeddings of the remaining parts unchanged, thereby significantly reducing computational overhead while ensuring model accuracy.

[0070] S10522. The aforementioned model hot update includes loading updated model parameters on demand while maintaining the model architecture unchanged, achieving seamless iteration and real-time response of the risk assessment model. In specific implementation, the system maintains a model parameter version library. After incremental training is completed, the new parameters are automatically loaded into the running model and take effect without restarting the service, ensuring that the system continuously provides stable risk assessment services during the update process.

[0071] S1053. After updating the hypergraph structure and model parameters, the system automatically triggers the re-inference process of the risk assessment module, recalculates the risk scores and classification results of each component based on the updated embedding vectors, and synchronizes the updated results to the visualization and alarm module to ensure that security personnel can obtain the latest risk information in a timely manner.

[0072] Through the above steps, the dynamic update and feedback mechanism enables rapid response to continuously changing component, dependency, and vulnerability information in the software supply chain, ensuring that the hypergraph structure and risk assessment model are always up-to-date, thereby maintaining the system's high accuracy and real-time performance in dynamic environments.

[0073] The following specific example illustrates the software supply chain risk analysis method based on dynamic hypergraph learning provided by this invention. The method includes the following steps:

[0074] Step S1: Create an evaluation task.

[0075] Users need to select the type of assessment task, including security vulnerability assessment for scanning for security vulnerabilities in code and dependencies; compliance assessment for verifying whether the software meets the prescribed compliance requirements; performance assessment for analyzing application performance bottlenecks; and dependency risk assessment for checking known vulnerabilities in third-party components and libraries.

[0076] Selecting an evaluation target: Determine the scope of the evaluation target. Possible targets include: a single codebase, evaluating a specific software project or module; multiple codebases, involving dependencies between multiple components or services; and external third-party services, evaluating the security and risks of third-party APIs, libraries, or services.

[0077] Step S2: Configure the pre-release environment address.

[0078] Environment configuration involves collaboration between the development and operations teams to determine the configuration of the pre-release environment, including network, hosts, and operating system versions. It ensures the pre-release environment can simulate the behavior of the production environment and does not have any conflicting configurations. Third-party service integration: Integrate environment variables of third-party services, such as database addresses and API keys, to ensure the pre-release environment can securely connect to these services. This includes interfacing with third-party cloud services, storage services, and authentication services. Environment health checks: Use tools or scripts to perform health checks to ensure that the interfaces and dependencies of third-party services function correctly in the pre-release environment. Use tools such as Postman or Swagger to perform API call checks, verifying the reachability and response time of service endpoints. Access logging and monitoring configuration: Configure access logging and monitoring tools, such as Prometheus and Grafana, to monitor the health status of third-party infrastructure services. Integrate the logging system with alerting mechanisms to ensure real-time monitoring of any anomalies.

[0079] Step S3: Third-party basic service detection, upload code / installation package.

[0080] Connect to third-party basic services and upload the code or installation package to be tested, initiating dependency and interface security checks on these services. Specific implementation steps: Code / Installation Package Upload: Upload code and installation packages to the pre-release environment using automated scripts or manually. Upload files to a secure storage location and generate a unique version identifier for easy tracking and rollback. Third-Party Service Interface Configuration: Configure the API endpoints and authorization information of the third-party services to ensure the interfaces can connect to the uploaded code or installation package and perform related operations. Configure the API gateway to ensure a clear and secure communication path with the third-party services. Basic Service Health Check: Use API Scanner or OWASP ZAP tools to perform automated security scans of the interfaces of third-party basic services, identifying potential API vulnerabilities and permission configuration issues. Detect common attack surfaces such as cross-site scripting (XSS) and SQL injection. Dependency Check: Use OWASP Dependency-Check or Snyk to scan all dependencies in the uploaded code, checking for known vulnerabilities or outdated versions. Perform dependency checks on third-party components to ensure all libraries, modules, and plugins are secure and compatible with the pre-release environment.

[0081] Step S4: Configure application risk discovery rules.

[0082] Third-party component dependency risk scanning: Generate the application's dependency graph using dependency management tools such as Maven, npm, and pip, and scan these dependencies for known vulnerabilities using security tools like Snyk, OWASP Dependency-Check, and WhiteSource. Analyze the potential security risks of each component, especially expired libraries or unpatched dependencies. Vulnerability database integration: Integrate the dependency scanning tool with a vulnerability database to update the security status of third-party component libraries in real time. Configure automated scanning tasks to periodically detect security vulnerabilities in dependencies and trigger notifications or automatically roll back to a secure version when new vulnerabilities are discovered. Application risk discovery rule configuration: Define application security risk discovery rules, such as SQL injection detection rules and cross-site scripting detection rules. Configure corresponding rules to scan code and interfaces based on the application's technology stack. Use static application security testing tools, such as SonarQube and Checkmarx, to scan uploaded code and ensure there are no security vulnerabilities. CI / CD environment integration: Integrate the third-party component risk scanning tool into the CI / CD process so that component dependency checks are automatically triggered every time code is committed, updated, or an installation package is uploaded. Configure automation tools such as Jenkins or GitLab CI for continuous risk monitoring.

[0083] Step S5: Generate a software supply chain security assessment report.

[0084] This step summarizes and presents the results of the assessment, including all risks, vulnerabilities, and compliance issues identified during the security assessment process. The report details a description of each discovered vulnerability or risk, its impact assessment, remediation recommendations, and a risk analysis of dependent components. This report enables development teams and management to quickly understand the current security status of the software supply chain and take appropriate remedial or improvement measures.

[0085] Step S6: Construction of the original software supply chain map.

[0086] Construct a raw knowledge graph containing heterogeneous data such as open-source components, vendor entities, dependencies, vulnerability information, and licenses; this includes collecting SBOM, CVE vulnerability databases, dependency tree information, and component metadata. Implementation method: Automated scripts extract metadata from platforms such as GitHub, NVD, and Maven / NPM; entity recognition and relation extraction technologies are used to unify the data into an entity-relationship-entity structure; a preliminary knowledge graph of triples such as "vendor-component," "component-vulnerability," and "component-license" is formed.

[0087] Step S7: Graph preprocessing and embedding encoding.

[0088] The nodes and edges in the original heterogeneous graph are converted into vector representations to prepare for subsequent graph neural network modeling. Implementation methods include: independent embedding of different node types such as "supplier," "component," "vulnerability," and "license"; weighting of heterogeneous edges using a graph attention network; optimization of embedding complex relationships such as "component-vulnerability" using relationship-aware models like TransR; and denoising by introducing a graph contrastive learning mechanism to handle noise in the graph (such as mismatched vulnerability information).

[0089] Step S8: Supply chain dependency graph embedding.

[0090] Construct a bipartite graph between suppliers and components to capture multi-level dependency features; model structural risk factors including version, license, and repository. Implementation method: Use GCN (Graph Convolutional Neural Network) to model the dependency graph between suppliers and components; aggregate features of different neighbor nodes to achieve multi-hop information propagation; construct and normalize the adjacency matrix to improve the expression of multi-level risk features; output "supplier embedding matrix" and "component embedding matrix".

[0091] Step S9: Risk hypergraph generation.

[0092] Two types of hypergraph structures are constructed to capture complex high-order risk paths: a vendor-side attack surface hypergraph and a component-side hidden vulnerability chain hypergraph. Implementation methods include: dynamically generating hyperedges to avoid inefficiency and redundancy caused by relying on fixed rules; vendor-side: forming hyperedges with similar vulnerability patterns, such as those involving dependency obfuscation attacks; component-side: identifying hidden attack paths across projects and versions based on multi-hop dependency paths; and using a soft max aggregation function to generate a multi-risk dimension threat membership distribution for each node.

[0093] Step S10: Hypergraph embedding and convolution.

[0094] This paper utilizes hypergraph convolutional neural networks to learn higher-order dependencies in hypergraph structures and achieves bidirectional information propagation from hyperedges to nodes and from nodes to hyperedges. The implementation method includes: constructing a hyperedge matrix; performing embedding propagation; modeling higher-order coupling relationships between nodes that share security attributes; and introducing residual connections to achieve information fusion between the original graph information and the hypergraph structure.

[0095] Step S11: Multi-loss joint training.

[0096] Three types of loss functions are introduced to jointly optimize the model and improve robustness and security awareness: Implementation methods: BPR ranking loss: ensures that the risk score of trusted components is higher than that of unknown or malicious components; adversarial contrast loss: brings user-positive samples closer and moves away from negative samples; super Figure 1 Consistency loss: Constraining the representation of nodes within the same hyperedge to be similar improves higher-order semantic consistency.

[0097] Step S12: Node threat assessment vector generation.

[0098] The outputs of a multi-layer graph neural network are aggregated to form a node-level security posture representation, providing input for subsequent risk prediction and recommendation. Implementation method: The L-layer graph embedding results are summed or weighted averaged; the final score vector of the "supplier-component pair" is output; this is used to quantify the potential attack surface size under dependencies.

[0099] Step S13: Graph Embedded Data Storage and Index Construction.

[0100] After generating the graph embedding knowledge graph, the graph embedding representations are first stored in a graph embedding database to save and manage the graph structure data. Next, a vector embedding database is built to store low-dimensional vector representations of nodes and edges, supporting efficient similarity calculation and retrieval. Finally, an embedding index structure is created to optimize query performance through indexing techniques, ensuring the rapid retrieval of relevant nodes and edges in large-scale data, thereby improving system response speed and processing capacity.

[0101] Model preprocessing that integrates knowledge embedding and graph contrastive learning:

[0102] This paper proposes a collaborative recommendation model, IKEGCL, which integrates knowledge embedding and graph contrastive learning. On one hand, unlike traditional recommendation models, IKEGCL does not use a unified training approach for all nodes via a knowledge collaboration graph. Instead, it employs a dual-encoder architecture to handle the supply chain knowledge graph separately, including heterogeneous relationships such as component vulnerabilities, license conflicts, and dependency levels. On the other hand, IKEGCL uses a graph contrastive learning mechanism to mitigate noise issues in the knowledge graph. Furthermore, to enable IKEGCL to better acquire information from higher-order neighbor nodes, embedding space decoupling effectively isolates noise in the knowledge graph, such as erroneous CVE associations and ghost dependencies, avoiding interference with supplier risk assessment.

[0103] IKEGCL model structure as follows Figure 2 As shown, the system mainly consists of two parts: a graph contrastive learning framework and the IKEGCL encoder. In the node embedding stage, IKEGCL first uses a relation-aware graph attention network to embed the relationships in the knowledge graph. This step ensures that the relational information in the graph is fully utilized. Differential attention weights are assigned to heterogeneous edges such as "supplier-component" supply relationships and "component-CVE" vulnerability associations in the supply chain knowledge graph, providing a deeper semantic understanding. However, considering the potential information gaps in the knowledge graph for user nodes, IKEGCL uses a simplified graph convolutional neural network to efficiently propagate information from item nodes to user nodes, thus balancing the information representation gap between the two and ensuring the completeness and accuracy of user nodes during the embedding process. Subsequently, based on knowledge embedding, IKEGCL uses a multi-layer graph convolutional neural network to embed the collaborative information between user nodes and item nodes in the user-item interaction matrix, thereby obtaining the collaborative embedding of user nodes and item nodes. Finally, to optimize the node vectors learned by the model, a contrastive learning framework that integrates knowledge embedding is adopted to enhance the model's robustness.

[0104] The main function of the knowledge embedding layer is to map the knowledge graph into low-dimensional spatial vectors. Unlike the AKGE method, which constructs a high-order subgraph through data sampling and then performs KGE embedding, this paper argues that while this approach effectively preserves explicit security dependency links, it also amplifies the impact of noise in the knowledge graph on node representation learning, especially when using deep graph convolutional neural networks. Therefore, the IKEGCL proposed in this chapter encodes the knowledge graph and the supplier-component dependency graph independently. A single-layer GAT network is used for encoding in the knowledge graph embedding layer, while a multi-layer GCN network is used in the supplier relationship graph embedding layer to obtain information about high-order neighbor nodes, thereby controlling noise in the knowledge graph.

[0105] IKEGCL treats all component nodes as head nodes and all connected nodes as entity nodes to reduce the difficulty of model training. In traditional GCN methods, neighboring nodes usually have the same aggregation weight, but this may overlook the important impact of vulnerability dependencies in the knowledge graph. Given that different software components may have different levels of concern for different security relationships, this paper employs a relationship-aware knowledge graph attention graph encoder to embed nodes, in order to better capture the subtle differences in these security attributes.

[0106] After embedding the component-side nodes into the knowledge graph, the model faces another challenge: supplier nodes are often missing from the knowledge graph, leading to a lack of awareness of vulnerability knowledge graph information on the supplier side. To address this issue, IKEGCL introduces a lightweight graph convolutional neural network to propagate security attribute information from the knowledge graph from the component side to the supplier side. The propagation process is shown in the following formula:

[0107]

[0108]

[0109] in, , represents the vector representation of the relationship r between supplier i and component e, and tanh is the activation function used in the calculation process. The larger the value, the greater the influence that entity has on the current item.

[0110] To enhance the learning capability of multi-semantic security representations between entities and components, IKEGCL employs a widely recognized knowledge graph embedding model—TransR—for alternating training. Before each training round, IKEGCL uses the TransR model to optimize the vector representations of entity and component nodes. This allows the model to more effectively capture the complex and rich security semantic relationships (such as vulnerability propagation paths and security dependencies) between vulnerable entities and supply chain components, thereby improving the accuracy of software supply chain threat modeling and risk perception. The core idea of ​​TransR is to improve the representation learning effect by making the sum of the vector representations of head entities (such as software components) and relationships (such as vulnerability exploit chains) close to the vector representation of tail entities (such as affected dependent modules). Therefore, the formula for calculating the credibility score of a given knowledge graph is as follows:

[0111]

[0112] in, A lower confidence score indicates a closer distance between the head and tail nodes in the relation space, suggesting that the associated triples are more plausible and likely to be true. Furthermore, to more effectively distinguish between positive samples (real-world triples) and negative samples (non-existent or incorrect triples), TransR employs a pairwise ranking loss. This function ensures that the confidence score of positive samples is higher than that of negative samples, thereby continuously optimizing model parameters during training and improving the model's ability to capture complex semantic relationships between entities and relations. The loss calculation formula is as follows:

[0113]

[0114] in, The confidence score represents the correct positive sample in the knowledge graph, and is converted into a probability value using the sigmoid function. t' is a negative sample randomly generated from the knowledge graph. By minimizing the loss function, the model can learn more accurate entity-item representations.

[0115] Recommendation methods based on dynamic hypergraph learning:

[0116] The proposed DHRec model structure is as follows: Figure 3 As shown, the system is mainly divided into three parts: a supply chain dependency graph embedding module, a risk hypergraph inference module, and a security awareness optimization module. The entire process is based on graph embedding neural networks to achieve software supply chain threat modeling. First, the supply chain dependency graph embedding module uses a heterogeneous graph convolutional network to explicitly model the multi-level security dependencies between supplier nodes (such as those in open-source communities) and component nodes, including version compatibility constraints, vulnerability association paths, and license conflict chains. It learns the risk propagation characteristics of supply chain entities through neighborhood aggregation. Next, the risk hypergraph inference module generates two types of hypergraph structures based on a dynamically constructed supply chain knowledge graph: a supplier-side attack surface hypergraph, which models supplier clusters sharing the same vulnerability pattern, such as dependency obfuscation attacks, as hyperedges to capture lateral risk diffusion paths; and a component-side hidden link hypergraph, which uses a hypergraph convolutional neural network to mine potential multi-hop vulnerability chains across component dependency trees, such as malicious package penetration paths introduced through indirect dependencies via npm, quantifying the reachability of hidden attack chains. Finally, in the model optimization phase, DHRec proposed two types of losses: Dependency Compliance Loss: Based on hypergraph learning, constrain the mapping consistency between component versions and the CVE vulnerability database to block illegal dependency injection; Adversarial Contrast Loss: Align normal supply chain behaviors, such as security version upgrades, with known attack patterns, such as malicious code injection, in the embedding space to improve the early warning capability of supply chain poisoning attacks.

[0117] The supply chain threat analysis method based on graph embedding neural networks uses heterogeneous graph convolutional networks to model historical security dependency records between suppliers and components, capturing multi-level vulnerability associations and dependency topology risks between entities in the software bill of materials. Further applications... and Represent the security posture embedding vectors of vendor nodes (such as the Apache Software Foundation) and component nodes, respectively, and construct a vendor embedding matrix. With component embedding matrix Inspired by the lightweight supply chain analysis paradigm, DHRec abandons the nonlinear activation functions and feature transformation operations in traditional GCNs that may ambiguize security semantics. Its bipartite graph-dependent embedding formula is as follows:

[0118]

[0119]

[0120] in, and This represents the output of the convolutional neural network in layer l. The adjacency matrix after Laplace normalization is calculated as follows:

[0121]

[0122] in, and These represent the degree matrices for users and items, respectively. Through information propagation across multiple graph convolutional layers, the model is able to capture explicit high-order relationships between nodes and optimize the embedding representations of user nodes and items.

[0123] In the field of software supply chain security, nodes exhibit complex high-order relationships such as component dependencies and vulnerability propagation, which traditional graph structures struggle to fully represent. Hypergraph structures, however, demonstrate superior representation capabilities compared to traditional graph structures due to their ability to meticulously capture these complex high-order relationships. Graph embedding neural networks, as effective tools for mining features from graph structure data, face challenges in data representation and optimization when processing hypergraph data in the software supply chain. In hypergraph learning, hyperedge matrices are typically used to represent the relationships between nodes and hyperedges, where N represents the number of nodes and K represents the number of hyperedges. In the software supply chain scenario, nodes encompass various open-source components and software modules, resulting in a vast number of nodes with intricate relationships. Directly learning from the hyperedge matrix requires graph embedding neural networks to optimize a large number of parameters, which becomes particularly difficult when dealing with software supply chain graph structures containing massive numbers of nodes. A large number of parameters not only increases the computational burden but also easily leads to model overfitting, making it difficult to accurately identify security risks in the software supply chain. Therefore, this paper proposes a lightweight hypergraph construction method for application in graph embedding neural network models for software supply chain security. This approach allows the hypergraph structure and node embedding vectors to be co-optimized during model training. By dynamically adjusting the hypergraph structure and reducing redundant parameters, while leveraging graph embedding neural networks to learn node features, it more efficiently captures high-order relationships between nodes in the software supply chain, such as potential security dependencies between components and vulnerability propagation paths. Ultimately, this improves the model's performance in predicting and recommending software supply chain security risks, helping to promptly identify and prevent security vulnerabilities in the supply chain. The construction method is as follows:

[0124]

[0125]

[0126] in, and Learnable security weight matrices characterize the vendor risk pattern hyperedge and the component attack surface hyperedge, respectively. These matrices adaptively adjust the correlation strength of security attributes such as CVE vulnerability patterns and dependency obfuscation attack characteristics in the hyperedge.

[0127] By using a Softmax function tailored to the supply chain scenario, the model generates a threat membership distribution for each supplier / component, quantifying the probability weights of their affiliation to different risk clusters, such as zero-day vulnerability propagation groups, license conflict groups, and malicious package injection groups. This flexible association mechanism allows a single component to simultaneously represent composite risks across hyperedges, thereby accurately capturing the hidden attack chains in the software supply chain that rely on the intertwining of obfuscation attacks and vulnerability cascading effects. Finally, through the collaborative optimization of hyperedge weights and node embedding, the model achieves quantitative assessment of the supply chain attack surface and interpretable reasoning of multi-hop threat propagation paths.

[0128] In the field of software supply chain security, the DHRec model leverages hypergraph convolutional neural networks to capture high-order information within the hypergraph structure. This process deeply integrates the feature learning capabilities of graph embedding neural networks. In the software supply chain scenario, complex relationships such as dependencies between components and vulnerability propagation paths can be abstracted as a hypergraph structure, where hyperedges can represent multi-dimensional relationships between multiple components. Drawing inspiration from the hypergraph convolution concept proposed in HGNN, DHRec performs hypergraph convolution in the following manner:

[0129]

[0130]

[0131] in, and These represent the degree matrices of the supplier hypergraph and the component hypergraph, respectively, and are used to rescale the embedding. and These represent the outputs of the bipartite graph embedding layer. The feature transition matrix and non-linear activation function used in the convolution process have been removed. and The convolution representing the hyperedge of a node is mainly used to propagate information from the node to the hyperedge. The subsequent matrix multiplication represents the convolution from the hyperedge to the node, which is mainly used to propagate information from the hyperedge to the node.

[0132] In the field of software supply chain security, graph-embedded neural networks face challenges such as complex component dependencies and difficulties in accurately modeling vulnerability propagation paths. The DHRec model, by integrating hypergraph structures and multi-loss optimization mechanisms, provides an effective solution to these problems.

[0133] In the software supply chain security analysis framework based on graph embedding neural networks, the introduction of residual connections enables the aggregation of security information across views, including the vendor-component dependency view and the vulnerability propagation hypergraph view. This mechanism ensures that the node embedding at each layer retains its inherent security attributes, such as the CVE vulnerability density of components and the compliance certification level of vendors, while also incorporating risk propagation characteristics from the topological neighborhood, such as license conflicts introduced by upstream dependencies and 0-day vulnerability patterns shared by peer components, significantly enhancing the representation capability of node security posture. After multi-level risk transmission modeling through the L-layer DHRec layer, each node obtains an embedding representation set containing threat intelligence of different granularities, and finally, a comprehensive security assessment vector is generated through a summation operation.

[0134]

[0135] Here, the Bayesian Personalized Ranking (BPR) loss function is used as the core loss function of the model. The goal of the BPR loss function is to ensure that the predicted score of positive samples is higher than that of negative samples.

[0136]

[0137] in, , This represents the positive samples in the training set. This represents negative samples in the test set.

[0138] In the supply chain risk prediction phase, the model quantifies the risk association strength by calculating the dot product of the final security embedding vectors of supplier s and component c:

[0139] This score reflects the potential risk value of a specific component introducing a supply chain attack surface (e.g., the risk score of the current version of the Log4j2 component due to historical vulnerability patterns). Consistent with traditional security analysis methods, the model uses an improved Bayesian Personalized Ranking (BPR) loss function as the core optimization. Its objective function ensures that the risk score of known security dependencies (positive samples, such as audited Apache component versions) is always higher than that of potential threat dependencies (negative samples, such as third-party libraries containing unpatched CVEs).

[0140] Although hypergraph matrices, such as component feature vectors and user action vectors, are dynamically constructed using node embedding vectors, including component dependency hypergraphs and security risk propagation hypergraphs, relying solely on traditional recommendation losses may not effectively optimize the hypergraph structure learning process. Therefore, DHRec introduces a hypergraph loss function to constrain the hypergraph learning process, which is crucial for improving the accuracy of software supply chain security analysis.

[0141]

[0142]

[0143] Here, and represent the final embedding vectors of the supplier and component, respectively, while represents the trace of the matrix. In the software supply chain security scenario, this loss function not only quantifies the consistency between node embedding vectors and the hypergraph structure, such as the degree of matching between component security features and dependency hypergraphs, but also promotes the tight integration of node embeddings within the same hyperedge by minimizing this loss. For example, when analyzing vulnerability propagation paths, component node embeddings within the same hyperedge are constrained to have similar security feature representations, thereby strengthening the consistency of vector representations between nodes and enabling the model to more accurately identify potential security risk propagation paths.

[0144] Previous recommendation systems based on contrastive learning have focused on capturing the differences in vector representations of the same nodes (such as software components and user actions) across different views. Although such methods have proven their effectiveness in many application scenarios, they often require two rounds of encoding to obtain node embedding vectors from two different views. This leads to a significant increase in training time and inefficiency when processing large-scale software supply chain data.

[0145] To address this issue, DHRec, an optimized graph embedding neural network model, focuses on capturing the differences between supplier nodes and positive samples such as security components in software supply chain security analysis. This strategy enables contrastive learning between nodes during a single training round, significantly improving model training efficiency. Specifically, in the software supply chain security scenario, DHRec defines security components previously interacted with by the user as positive samples, while defining components not previously interacted with, especially those posing security risks, as negative samples. The contrastive loss between user representations and item representations is defined using the InfoNCE method, as shown below:

[0146]

[0147] Here, s() is the similarity function used to measure the degree of similarity between different nodes. In DHRec, this paper chooses cosine similarity as the similarity function because it can effectively capture the directional consistency between vectors while ignoring their magnitude differences. Furthermore, Temperature is used as a hyperparameter in the softmax function to adjust the distribution of similarity scores, thereby improving the model's discriminative ability. Similar to the IKEGCL proposed earlier, this paper introduces the softplus function as a weight in the loss function. By introducing softplus as a similarity weight, the model can focus more on positive samples with high similarity during the learning process, thus improving the model's training performance.

[0148] This specific example presents a dynamic hypergraph learning framework based on knowledge graphs, achieving a significant breakthrough in the field of software supply chain security. In open-source component dependency analysis and multi-level vulnerability propagation detection scenarios, this solution improves the accuracy of vulnerability propagation path identification by over 10%, and the efficiency of covert attack early warning by over 20%. It effectively reduces the risk of missed detections of high-risk Log4j vulnerabilities and blocks malicious packages from penetrating production environments, overcoming the shortcomings of traditional models in modeling heterogeneous information such as component version differences and dependency types. Addressing the real-time analysis needs of enterprise-level software bills of materials, this solution can reduce dynamic scanning time to 30% of the original time and memory consumption by 65%, successfully overcoming the technical bottleneck of traditional methods in handling nested dependencies exceeding 15 levels, and meeting the practical requirements of minute-level risk response and deep dependency tree monitoring. By capturing multi-component collaborative threats through graph-embedded neural networks, this solution adds nine quantitative indicators, including dependency obfuscation risk and vulnerability recurrence probability. This reduces the false positive rate of cross-ecosystem risks by 42%, improves the accuracy of threat root cause tracing by 58%, and accurately models the cascading propagation path of vulnerabilities in dependency hyperedges (such as npm packages injecting backdoors through multi-level indirect dependencies). It completely solves the problem of the failure of traditional binary interaction models in modeling high-order collaborative threats, providing interpretable decision-making basis for software supply chain attack surface governance. In software component analysis, the improved vulnerability identification rate drives a reduction in operation and maintenance costs by more than 30%; the efficiency of supply chain compliance auditing due to license conflict detection is improved by 50%, significantly reducing the risk of legal disputes; the lightweight architecture supports minute-level interception in CI / CD pipelines, blocking more than 90% of high-risk components from entering the production environment; and finally, it empowers ecosystem security governance, enhancing the resilience of the supply chain in multi-source mixed-use scenarios by more than 50%.

[0149] Please see Figure 4 , Figure 4 This is a schematic diagram of a software supply chain risk analysis device provided in an embodiment of this application. Figure 4 As shown, the software supply chain risk analysis device includes the following functional modules:

[0150] The data acquisition and preprocessing module 410 is used to acquire component information from multiple software repositories and perform format-unified processing; wherein, the component information includes: component name, version, dependency relationship, metadata and known vulnerability information;

[0151] The hypergraph construction module 420 is used to model a hypergraph structure based on software components and their dependencies, and to dynamically update the hypergraph structure. In the hypergraph structure, nodes represent software components, hyperedges represent many-to-many dependencies between components, and the hypergraph structure can be dynamically updated.

[0152] The hypergraph learning and feature extraction module 430 is used to learn the representation of the hypergraph structure by using a hypergraph neural network to generate an embedding vector for each component to represent the contextual features of the component in the supply chain.

[0153] The risk assessment and anomaly detection module 440 is used to perform risk scoring, anomaly detection and classification based on the embedding vector of the components by employing multi-task learning and graph attention mechanisms.

[0154] The dynamic update and feedback module 450 is used to perform online incremental updates to the hypergraph structure and model parameters based on newly released components, updated vulnerability information, and changed dependencies through a dynamic update and feedback mechanism, so as to maintain the real-time performance and accuracy of the model.

[0155] Furthermore, when the hypergraph building module is used to model the hypergraph structure based on software components and their dependencies, and to dynamically update the hypergraph structure, the hypergraph building module is used to:

[0156] The software components are modeled as nodes in a hypergraph, wherein the software components include npm packages and Java jar packages;

[0157] The dependencies between software components are modeled as hyperedges, where each hyperedge connects multiple nodes to represent a dependency involving multiple components;

[0158] Dynamic hypergraph modeling technology is used to dynamically update the hypergraph structure based on newly released components, updated vulnerability information, and changing dependencies.

[0159] Furthermore, when the hypergraph learning and feature extraction module is used to perform representation learning on the hypergraph structure using a hypergraph neural network to generate an embedding vector for each component to characterize the contextual features of the component in the supply chain, the hypergraph learning and feature extraction module is used to:

[0160] The hypergraph neural network is used to model multi-order dependencies between nodes and hyperedges in the hypergraph structure.

[0161] The embedding vectors of the components in the hypergraph structure are learned by the hypergraph neural network to generate an embedding vector for each component, wherein the embedding vector reflects the contextual position and behavioral characteristics of the component in the supply chain.

[0162] Furthermore, when the risk assessment and anomaly detection module is used to perform risk scoring, anomaly detection, and classification based on the embedding vectors of the components using multi-task learning and graph attention mechanisms, the risk assessment and anomaly detection module is used to:

[0163] Based on the learned component embedding vectors, a multi-task learning framework is adopted to simultaneously perform vulnerability prediction, malicious behavior identification, and abnormal behavior detection. In the multi-task learning framework, the underlying component embedding representation is shared, and independent output layers are set for different tasks to improve the model's generalization ability and task synergy.

[0164] During anomaly detection, a graph attention mechanism is introduced to model the propagation paths between components in the hypergraph, identifying critical paths and high-risk propagation nodes that affect propagation.

[0165] The graph attention mechanism calculates the attention weights between components, dynamically focusing on the dependency path that has the greatest impact on risk assessment, thereby enhancing the model's ability to identify risks in complex supply chains.

[0166] Furthermore, when the dynamic update and feedback module is used to perform online incremental updates to the hypergraph structure and model parameters based on newly released components, updated vulnerability information, and changed dependencies to maintain the model's real-time performance and accuracy, the dynamic update and feedback module is used to:

[0167] Online incremental learning technology is used to extract and embed features of newly released components, updated vulnerability information, and changed dependencies in real time.

[0168] Without interrupting model services, the parameters of the hypergraph structure and hypergraph neural network model are dynamically adjusted through a model hot update mechanism; the dynamic adjustment includes: online incremental learning and model hot update.

[0169] The online incremental learning includes incremental updates of node embeddings based on new data samples and dynamic reconstruction of hyperedge structures;

[0170] The model hot update includes loading updated model parameters on demand while keeping the model architecture unchanged, so as to achieve seamless iteration and real-time response of the risk assessment model.

[0171] Furthermore, when the hypergraph learning and feature extraction module uses HyperGNN to jointly model nodes and hyperedges during the embedding learning process of the current hypergraph, the hypergraph learning and feature extraction module is used for:

[0172] During the embedding initialization phase, each node is initialized as a low-dimensional embedding vector, which consists of its metadata and static features.

[0173] The embedding vector of each hyperedge is formed by the aggregation of the embeddings of the multiple nodes it connects to. The aggregation methods include mean aggregation, attention-weighted aggregation, or gated recurrent unit (GRU) aggregation.

[0174] During the embedding update phase, the node embedding is updated through a multi-layer propagation mechanism. In each layer, the node receives information from the hyperedge it participates in and adjusts its own embedding representation according to the structural weight of the hyperedge.

[0175] During the information transmission process, a combination of hyperedge-level information transmission and node-level aggregation is adopted, and the graph attention mechanism GAT is introduced to calculate the attention weights of different paths.

[0176] In the nonlinear transformation stage, a multilayer perceptron (MLP) is used to perform nonlinear mapping on the aggregated embedded information in order to capture high-order nonlinear dependency features.

[0177] During model optimization, residual connections and layer normalization techniques are introduced to enhance the model's training stability and generalization ability.

[0178] Furthermore, when the hypergraph learning and feature extraction module 130 is used to model multi-order dependencies between nodes and hyperedges in the hypergraph structure using the hypergraph neural network, the hypergraph learning and feature extraction module 130 is used to:

[0179] During the information propagation phase, embedding updates are achieved through multi-level bidirectional information flow between nodes and hyperedges. Specifically, in the first layer of propagation, nodes receive aggregated information from the hyperedges they participate in and update their node embedding representations based on the structural weights of the hyperedges. In the second layer of propagation, the hyperedges re-aggregate and generate new hyperedge embeddings based on the updated embedding representations of the nodes they connect to in the first layer.

[0180] The structural weights are dynamically calculated using the graph attention mechanism GAT to identify dependency paths that play a dominant role in risk propagation.

[0181] The information aggregation methods include mean aggregation, maximum value aggregation, gated recurrent unit (GRU) aggregation, or attention-weighted aggregation.

[0182] In the nonlinear transformation stage, a multilayer perceptron (MLP) is used to perform nonlinear mapping on the aggregated embedded information in order to capture higher-order semantic dependencies.

[0183] During the model enhancement stage, residual connections and layer normalization techniques are introduced to alleviate the gradient vanishing problem in deep networks and improve the training stability and convergence speed of the model.

[0184] Furthermore, when the data acquisition and preprocessing module is used to collect component information from multiple software repositories and perform format unification processing, the data acquisition and preprocessing module is used for:

[0185] In the nonlinear transformation stage, in the step of using a multilayer perceptron (MLP) to perform nonlinear mapping on the aggregated embedded information, a residual connection mechanism is introduced to add the input embedding vector of the current layer to the nonlinearly mapped output embedding vector element by element to form a residual output.

[0186] Based on the residual output, an application layer normalization operation is performed to standardize each dimension of the residual output vector in order to improve the stability of the model training process.

[0187] The software supply chain risk analysis device provided in this application embodiment collects component information from multiple software repositories and performs format-unified processing through a data acquisition and preprocessing module; models a hypergraph structure based on software components and their dependencies through a hypergraph construction module and dynamically updates the hypergraph structure; performs representation learning on the hypergraph structure using a hypergraph neural network through a hypergraph learning and feature extraction module to generate an embedding vector for each component; performs risk scoring, anomaly detection, and classification based on the component embedding vectors using multi-task learning and graph attention mechanisms; and performs online incremental updates to the hypergraph structure and model parameters through a dynamic update and feedback mechanism based on newly released components, updated vulnerability information, and changed dependencies, thereby achieving real-time, dynamic, and fine-grained analysis of software supply chain risks and improving the accuracy and response speed of risk identification.

[0188] This application also provides an electronic device, which includes a processor, a memory, and a bus.

[0189] The memory stores machine-readable instructions that can be executed by the processor. When the electronic device is running, the processor communicates with the memory via a bus. When the machine-readable instructions are executed by the processor, the steps of the software supply chain risk analysis method in the above method embodiment can be performed. For specific implementation details, please refer to the method embodiment, which will not be repeated here.

[0190] This application also provides a computer-readable storage medium storing a computer program. When the computer program is run by a processor, it can execute the steps of the software supply chain risk analysis method as described in the above method embodiments. For specific implementation details, please refer to the method embodiments, which will not be repeated here.

[0191] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0192] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the shown or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0193] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0194] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0195] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0196] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The scope of protection of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A software supply chain risk analysis method, characterized in that, The data acquisition and preprocessing module collects component information from multiple software repositories and performs standardized format processing; the component information includes: component name, version, dependencies, metadata, and known vulnerability information; The hypergraph construction module models a hypergraph structure based on software components and their dependencies, and dynamically updates the hypergraph structure. In the hypergraph structure, nodes represent software components, hyperedges represent many-to-many dependencies between components, and the hypergraph structure can be dynamically updated. The hypergraph learning and feature extraction module uses a hypergraph neural network to perform representation learning on the hypergraph structure, generating an embedding vector for each component to represent the contextual features of the component in the supply chain. The risk assessment and anomaly detection module uses the embedding vectors of the components to perform risk scoring, anomaly detection and classification, employing multi-task learning and graph attention mechanisms. The hypergraph structure and model parameters are updated online incrementally based on newly released components, updated vulnerability information, and changed dependencies through a dynamic update and feedback mechanism.

2. The software supply chain risk analysis method according to claim 1, characterized in that, The steps of modeling a hypergraph structure based on software components and their dependencies using a hypergraph building module, and dynamically updating the hypergraph structure, include: Model software components as nodes in a hypergraph; The dependencies between software components are modeled as hyperedges, where each hyperedge connects multiple nodes to represent a dependency involving multiple components; Dynamic hypergraph modeling technology is used to dynamically update the hypergraph structure based on newly released components, updated vulnerability information, and changing dependencies.

3. The software supply chain risk analysis method according to claim 1, characterized in that, The step of employing a hypergraph neural network to perform representation learning on the hypergraph structure and generating an embedding vector for each component to characterize the contextual features of the component in the supply chain includes: The hypergraph neural network is used to model multi-order dependencies between nodes and hyperedges in the hypergraph structure. The embedding vectors of the components in the hypergraph structure are learned by the hypergraph neural network to generate an embedding vector for each component, wherein the embedding vector reflects the contextual position and behavioral characteristics of the component in the supply chain.

4. The software supply chain risk analysis method according to claim 1, characterized in that, The risk assessment and anomaly detection module, based on the embedding vectors of the components, employs multi-task learning and graph attention mechanisms to perform risk scoring, anomaly detection, and classification, including the following steps: Based on the learned component embedding vectors, a multi-task learning framework is adopted to simultaneously perform vulnerability prediction, malicious behavior identification, and abnormal behavior detection. In the multi-task learning framework, the underlying component embedding representation is shared, and independent output layers are set for different tasks to improve the model's generalization ability and task synergy. During anomaly detection, a graph attention mechanism is introduced to model the propagation paths between components in the hypergraph, identifying critical paths and high-risk propagation nodes that affect propagation. The graph attention mechanism calculates the attention weights between components, dynamically focusing on the dependency path that has the greatest impact on risk assessment, thereby enhancing the model's ability to identify risks in complex supply chains.

5. The software supply chain risk analysis method according to claim 1, characterized in that, The steps involved in maintaining the model's real-time performance and accuracy include: using a dynamic update and feedback mechanism to incrementally update the hypergraph structure and model parameters online based on newly released components, updated vulnerability information, and changed dependencies. Online incremental learning technology is used to extract and embed features of newly released components, updated vulnerability information, and changed dependencies in real time. Without interrupting model service, the parameters of the hypergraph structure and hypergraph neural network model are dynamically adjusted through a model hot update mechanism; the dynamic adjustment includes: online incremental learning and model hot update. The online incremental learning includes incremental updates of node embeddings based on new data samples and dynamic reconstruction of hyperedge structures; The model hot update includes loading updated model parameters on demand while keeping the model architecture unchanged, so as to achieve seamless iteration and real-time response of the risk assessment model.

6. The software supply chain risk analysis method according to claim 5, characterized in that, The steps of learning embedding vectors for components in the hypergraph structure using the hypergraph neural network to generate the embedding vector for each component include: In the process of embedding learning of the current hypergraph, HyperGNN is used to jointly model nodes and hyperedges; During the embedding initialization phase, each node is initialized as a low-dimensional embedding vector, which consists of its metadata and static features. The embedding vector of each hyperedge is formed by the aggregation of the embeddings of the multiple nodes it connects to. The aggregation methods include mean aggregation, attention-weighted aggregation, or gated recurrent unit (GRU) aggregation. During the embedding update phase, the node embedding is updated through a multi-layer propagation mechanism. In each layer, the node receives information from the hyperedge it participates in and adjusts its own embedding representation according to the structural weight of the hyperedge. During the information transmission process, a combination of hyperedge-level information transmission and node-level aggregation is adopted, and the graph attention mechanism GAT is introduced to calculate the attention weights of different paths. In the nonlinear transformation stage, a multilayer perceptron (MLP) is used to perform nonlinear mapping on the aggregated embedded information in order to capture high-order nonlinear dependency features. During model optimization, residual connections and layer normalization techniques are introduced to enhance the model's training stability and generalization ability.

7. The software supply chain risk analysis method according to claim 3, characterized in that, The steps of modeling multi-order dependencies between nodes and hyperedges in a hypergraph structure using the hypergraph neural network include: During the information propagation phase, embedding updates are achieved through multi-level bidirectional information flow between nodes and hyperedges. Specifically, in the first layer of propagation, nodes receive aggregated information from the hyperedges they participate in and update their node embedding representations based on the structural weights of the hyperedges. In the second layer of propagation, the hyperedges re-aggregate and generate new hyperedges based on the updated embedding representations of the nodes they connect to in the first layer. The structural weights are dynamically calculated using the graph attention mechanism GAT to identify dependency paths that play a dominant role in risk propagation. The information aggregation methods include mean aggregation, maximum value aggregation, gated recurrent unit (GRU) aggregation, or attention-weighted aggregation. In the nonlinear transformation stage, a multilayer perceptron (MLP) is used to perform nonlinear mapping on the aggregated embedded information in order to capture higher-order semantic dependencies. During the model enhancement stage, residual connections and layer normalization techniques are introduced to alleviate the gradient vanishing problem in deep networks and improve the training stability and convergence speed of the model.

8. The software supply chain risk analysis method according to claim 1, characterized in that, The steps of collecting component information from multiple software repositories and performing format standardization processing through the data acquisition and preprocessing module include: In the nonlinear transformation stage, in the step of using a multilayer perceptron (MLP) to perform nonlinear mapping on the aggregated embedded information, a residual connection mechanism is introduced to add the input embedding vector of the current layer to the nonlinearly mapped output embedding vector element by element to form a residual output. Based on the residual output, an application layer normalization operation is performed to standardize each dimension of the residual output vector in order to improve the stability of the model training process.

Images