Program control method, program control device, electronic device, and storage medium

Abstract

The disclosure provides a program management method, a program management device, an electronic device and a storage medium, which are applied to the technical field of computer and the technical field of finance. The method comprises the following steps: analyzing a to-be-analyzed program by using a first program component analysis tool to obtain an analysis result; in the case that the analysis result shows that the to-be-analyzed program comprises an open source program, obtaining first program information corresponding to the open source program, wherein the first program information comprises open source information; comparing the first program information with open source software identifiers recorded in a first knowledge base of the first program component analysis tool to obtain a comparison result; in the case that the comparison result shows that the first knowledge base does not have an open source software identifier matched with the open source information, generating introduction information of the open source program according to the first program information by using a management system; and storing the introduction information of the open source program and the to-be-analyzed program in the management system in association.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a program management method, a program management device, an electronic device, a computer-readable storage medium, and a computer program product. Background Art

[0002] With the rapid development of Internet technology, software development has also entered a period of rapid growth. During software development, other programs are often introduced to reduce the development workload. For example, open source programs and some free, non-open source programs can be introduced.

[0003] In the process of realizing the concept of the present disclosure, the inventors discovered that: in the process of developing a program, the current method of identifying the program to be analyzed mainly relies on manual recognition. When using manual recognition to identify the program to be analyzed that has introduced an external program, the recognizer needs to have a certain understanding of the program language, resulting in a high learning cost. Summary of the Invention

[0004] In view of the above problems, the present disclosure provides a program management method, a program management device, an electronic device, a computer-readable storage medium, and a computer program product.

[0005] According to a first aspect of the present disclosure, a program management method is provided, comprising:

[0006] Analyzing the submitted program to be analyzed using a first program component analysis tool to obtain an analysis result;

[0007] If the analysis result indicates that the program to be analyzed includes an open source program, obtaining first program information corresponding to the open source program, where the first program information includes open source information;

[0008] Comparing the first program information with the open source software identifier recorded in the first knowledge base of the first program component analysis tool to obtain a comparison result;

[0009] If the comparison result indicates that the first knowledge base does not have an open source software identifier that matches the open source information, generating introduction information of the open source program based on the first program information using a management system; and

[0010] The introduction information of the open source program and the program to be analyzed are associated and stored in the management system.

[0011] According to an embodiment of the present disclosure, the program control method further includes:

[0012] If the comparison result indicates that the first knowledge base does not have an open source software identifier that matches the open source information, generating registration information for the open source program based on the first program information using the management system;

[0013] The above registration information is stored in the above management system.

[0014] According to an embodiment of the present disclosure, the program control method further includes:

[0015] If the comparison result indicates that the first knowledge base has an open source software identifier that matches the open source information and the management system has import information corresponding to the open source program, updating the registration information pre-stored in the management system that matches the first program information;

[0016] The updated registration information is stored in the above management system.

[0017] According to an embodiment of the present disclosure, the above-mentioned first program information also includes at least one of the following: program name, program information summary and security vulnerability information; the above-mentioned introduced information includes at least one of the following: program name, program information summary, open source information and security vulnerability information.

[0018] According to an embodiment of the present disclosure, the first program information includes the security vulnerability information;

[0019] The above-mentioned procedural control methods also include:

[0020] Perform a security check on the security vulnerability information to obtain a check result; if the check result indicates that the security vulnerability information meets the risk threshold, use the management system to set the program to be analyzed as a non-compliant code and refuse to store the non-compliant code in the management system.

[0021] According to an embodiment of the present disclosure, the program control method further includes:

[0022] If the analysis result indicates that the program to be analyzed includes a non-open source program, obtaining second program information corresponding to the non-open source program, wherein the second program information includes non-open source information;

[0023] Comparing the non-open source software identifier recorded in the second knowledge base of the second program component analysis tool with the second program information to obtain a second comparison result;

[0024] If the second comparison result indicates that the second knowledge base does not have a non-open source software identifier that matches the non-open source information, the management system is used to generate a suspicious list based on the second program information.

[0025] According to an embodiment of the present disclosure, the program control method further includes:

[0026] If the second comparison result indicates that the second knowledge base contains a non-open source software identifier that matches the non-open source program, updating the registration information that matches the second program information;

[0027] The updated registration information is stored in the above management system.

[0028] A second aspect of the present disclosure provides a program control device, comprising:

[0029] An analysis module, configured to analyze the submitted program to be analyzed using a first program component analysis tool to obtain an analysis result;

[0030] a first acquisition module configured to, if the analysis result indicates that the program to be analyzed includes an open source program, acquire first program information corresponding to the open source program, wherein the first program information includes open source information;

[0031] A first comparison module is configured to compare the first program information with the open source software identifier recorded in the first knowledge base of the first program component analysis tool to obtain a comparison result;

[0032] a first generating module configured to, when the comparison result indicates that the first knowledge base does not have an open source software identifier that matches the open source information, generate introduction information of the open source program based on the first program information using a management system; and

[0033] The first storage module is used to associate the introduction information of the open source program with the program to be analyzed and store them in the management system.

[0034] The third aspect of the present disclosure provides an electronic device, comprising: one or more processors; a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned program management method.

[0035] A fourth aspect of the present disclosure further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above-mentioned program control method.

[0036] The fifth aspect of the present disclosure further provides a computer program product, including a computer program, which implements the above-mentioned program management method when executed by a processor.

[0037] According to an embodiment of the present disclosure, in the process of developing a program, the open source information obtained after the first program component analysis tool analyzes the program to be analyzed is compared with the first knowledge base of the first program component analysis tool. When there is no open source software identifier matching the open source information in the first knowledge base, the management system is used to generate the introduction information of the open source program, and the introduction information is associated with the program to be analyzed and stored in the management system, thereby avoiding the high learning cost caused by manual analysis of the program to be analyzed and the technical problems of poor accuracy and low efficiency in manual identification, thereby reducing the learning cost and improving the recognition efficiency and accuracy of the program to be analyzed. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0039] Figure 1 The following schematically illustrates an application scenario diagram of the program control method according to an embodiment of the present disclosure;

[0040] Figure 2 A flowchart of a program control method according to an embodiment of the present disclosure is schematically shown;

[0041] Figure 3 A flowchart of a program control method according to an embodiment of the present disclosure is schematically shown;

[0042] Figure 4 The following schematically shows a flow chart of a program control method according to another embodiment of the present disclosure;

[0043] Figure 5 The following schematically shows the overall flow chart of the program control method according to an embodiment of the present disclosure;

[0044] Figure 6 Schematically shows a structural block diagram of a program control device according to an embodiment of the present disclosure; and

[0045] Figure 7 A block diagram of an electronic device for implementing a program control method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0046] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present disclosure. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0047] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise," "include," etc. used herein indicate the presence of the features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0048] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0049] When expressions such as "at least one of A, B and C, etc." are used, they should generally be interpreted in accordance with the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0050] During the life cycle of a program, it is necessary to identify the external programs referenced in the submitted program to be analyzed and establish relevant introduction information. For example, the introduction information of the open source software is established based on the open source information of the referenced open source software to achieve the management and control of external programs.

[0051] However, the identification of external programs is typically done manually, followed by the creation of imported information based on the identified external programs. This manual identification of external programs within the program being analyzed not only requires a certain level of familiarity with the programming language, resulting in a high learning curve, but also leads to low recognition efficiency and accuracy.

[0052] The inventors discovered that the first program component analysis tool can be used to identify the program to be analyzed, and the management system can be used to automatically generate corresponding introduction information based on the identified external program, thereby avoiding the problems of high learning cost, low recognition efficiency and poor accuracy caused by manual recognition methods.

[0053] In view of this, the embodiments of the present disclosure provide a program management method, a program management device, an electronic device, a computer-readable storage medium and a computer program product, which analyzes a submitted program to be analyzed by using a first program component analysis tool to obtain an analysis result. When the analysis result shows that the program to be analyzed includes an open source program, first program information corresponding to the open source program is obtained; the first program information is compared with the open source software identifier recorded in the first knowledge base of the first program component analysis tool to obtain a comparison result; when the comparison result shows that the first knowledge base does not have an open source software identifier that matches the open source information, the management system is used to generate introduction information of the open source program based on the first program information; and the introduction information of the open source program is associated with the program to be analyzed and stored in the management system.

[0054] It should be noted that the program control method and program control device determined in the present disclosure can be used in the financial field, such as banks and other financial institutions, and can also be used in any field other than the financial field, such as hospitals and other fields. Therefore, the application field of the program control method and program control device determined in the present disclosure is not limited.

[0055] Figure 1 The application scenario diagram of the program control method according to an embodiment of the present disclosure is schematically shown.

[0056] like Figure 1 As shown, an application scenario 100 according to this embodiment may include terminal devices 101, 102, and 103, a network 104, and a server 105 equipped with a management system. The management system may be integrated with a first program component analysis tool. Network 104 is a medium for providing a communication link between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0057] The user can use the terminal devices 101, 102, 103 to transmit the developed program to be analyzed to the management system in the server 105 via the network 104. The terminal devices 101, 102, 103 can be installed with various program development applications, communication client applications, etc.

[0058] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0059] Server 105 may be a server that provides various services, such as a background management server (for example only) that analyzes programs to be analyzed submitted by users using terminal devices 101, 102, and 103. The background management server may analyze and process the received programs to be analyzed, and feed back the processing results (e.g., import information or registration information generated based on the programs to be analyzed submitted by users) to the terminal devices.

[0060] It should be noted that the program control method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the program control device provided in the embodiment of the present disclosure can generally be set in the server 105. The program control method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the program control device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0061] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0062] The following will be based on Figure 1 The scene described by Figures 2 to 5 The program control method of the disclosed embodiment is described in detail.

[0063] Figure 2 The flowchart of the program control method according to the embodiment of the present disclosure is schematically shown.

[0064] like Figure 2 As shown, the program control method of this embodiment may include operations S210 to S250.

[0065] In operation S210 , a first program component analysis tool is used to analyze the submitted program to be analyzed to obtain an analysis result.

[0066] In operation S220 , when the analysis result indicates that the program to be analyzed includes an open source program, first program information corresponding to the open source program is acquired. The first program information may include open source information.

[0067] In operation S230 , the first program information is compared with the open source software identifier recorded in the first knowledge base of the first program component analysis tool to obtain a comparison result.

[0068] In operation S240 , if the comparison result indicates that the first knowledge base does not have an open source software identifier that matches the open source information, the management system generates introduction information of the open source program according to the first program information.

[0069] In operation S250 , the introduction information of the open source program and the program to be analyzed are associated and stored in the management system.

[0070] According to an embodiment of the present disclosure, the first program component analysis tool may be a tool known to those skilled in the art that can analyze the program to be analyzed, and the first program component analysis tool includes a first knowledge base, and the first knowledge base may record open source software identifiers of multiple open source information, wherein the open source software identifiers in the above-mentioned first knowledge base may be updated in real time from a server that is in communication with the first knowledge base. The management system may include a system integrated with the first program component analysis tool, for example, it may include an SPMS management system and other systems such as Subversion (SVN), wherein the SPMS management system is a unified authority management system that can realize remote authorization of users and authorization management across application systems, and the Subversion system is an open source version control system that can integrate the first program component analysis tool to realize the identification and storage of the program to be analyzed.

[0071] According to an embodiment of the present disclosure, the first program component analysis tool obtains corresponding first program information by analyzing the program to be analyzed, and compares the open source information in the first program information with the open source software identifier recorded in the first knowledge base in the first program component analysis tool, wherein the first knowledge base records the open source software identifiers of multiple open source software.

[0072] According to an embodiment of the present disclosure, when there is no open source software identifier in the first knowledge base that matches the open source in the program to be analyzed, the management system can generate corresponding introduction information based on the open source program, so that the management system associates the introduction information and the program to be analyzed corresponding to the introduction information and stores it in the management system, where it can be stored in a database of the management system, for example, it can be a Git repository.

[0073] According to an embodiment of the present disclosure, in the process of developing a program, the open source information obtained after the first program component analysis tool analyzes the program to be analyzed is compared with the first knowledge base of the first program component analysis tool. When there is no open source software identifier matching the open source information in the first knowledge base, the management system is used to generate the introduction information of the open source program, and the introduction information is associated with the program to be analyzed and stored in the management system, thereby avoiding the high learning cost caused by manual analysis of the program to be analyzed and the technical problems of poor accuracy and low efficiency in manual identification, thereby reducing the learning cost and improving the recognition efficiency and accuracy of the program to be analyzed.

[0074] The inventors also found that as the scope of the introduction of other programs expands, requirements for ledger management are put forward for the introduced other programs, that is, the content of the introduction of other programs needs to be clearly recorded in the management requirements. However, in the face of a large number of introduced other programs, how to accurately identify the introduced other programs becomes a difficulty in ledger management.

[0075] Furthermore, in the related art, when an external program is referenced but not registered, it is necessary to manually create the program's registration information. Alternatively, if the program is already registered, the program's registration information must be manually updated, which is time-consuming and laborious. To address these issues, the inventors discovered that a management system can be used to automatically generate registration information based on referenced external programs, and that the management system can automatically update the registration information of registered external programs. For a large number of imported programs, these can be identified using a first program component analysis tool and a second program component analysis tool, and registered using the management system.

[0076] In view of this, the above-mentioned program control method may also include the following operations.

[0077] If the comparison result shows that the first knowledge base does not have an open source software identifier that matches the open source information, the management system generates registration information of the open source program according to the first program information, and stores the registration information in the management system.

[0078] According to an embodiment of the present disclosure, since the first knowledge base of the first program component analysis tool stores limited open source software identifiers, the open source software identifiers of the open source programs in the program to be analyzed are not recorded in the first knowledge base when performing comparison. The management system can be used to establish registration information of the open source programs not included in the first knowledge base, so that subsequent developers can update the registration information of the open source programs in a timely manner when using the open source programs to develop programs, thereby establishing a registration-first-then-use access control mechanism for open source programs.

[0079] According to an embodiment of the present disclosure, the above-mentioned program control method may further include the following operations.

[0080] If the comparison result indicates that the first knowledge base has an open source software identifier that matches the open source information and the management system has import information corresponding to the open source program, the registration information pre-stored in the management system that matches the first program information is updated and the updated registration information is stored in the management system.

[0081] According to an embodiment of the present disclosure, when the comparison results show that the first knowledge base has an open source software identifier that matches the open source information, it is matched with the introduction information in the management system. When there is no introduction information that matches the open source program in the management system, the management system is used to generate introduction information and registration information of the open source program based on the first program information. When there is introduction information that matches the open source program in the management system, the introduction information and registration information of the open source program are updated.

[0082] According to an embodiment of the present disclosure, registration information corresponding to the open source software identifier in the first knowledge base is pre-stored in the management system. When the open source program used in the program to be analyzed is an open source program recorded in the first knowledge base, the registration information corresponding to the open source program in the management system is updated, thereby achieving the purpose of registering the open source program before use. The method of updating the registration information may include recording the development information of the current program to be analyzed in the usage record of the registration information or updating the number of uses. The development information may include the program name, developer information, submission time, etc. corresponding to the program to be analyzed.

[0083] According to an embodiment of the present disclosure, the first program information may further include at least one of the following: a program name, a program information summary, and security vulnerability information. The imported information may include at least one of the following: a program name, a program information summary, open source information, and security vulnerability information.

[0084] According to an embodiment of the present disclosure, the program information digest may include but is not limited to MD5 message digest (MD5 Message-Digest 5). The open source information may include but is not limited to the open source protocol name, open source protocol identifier, and open source program introduction.

[0085] According to an embodiment of the present disclosure, the first program information may include security vulnerability information.

[0086] The above-mentioned program control method may further include the following operations.

[0087] Perform a security check on the security vulnerability information and obtain the inspection results; if the inspection results show that the security vulnerability information meets the risk threshold, use the management system to set the program to be analyzed as non-compliant code and refuse to store the non-compliant code in the management system.

[0088] According to an embodiment of the present disclosure, security vulnerabilities may be divided into low-risk vulnerabilities, medium-risk vulnerabilities, and high-risk vulnerabilities according to the numerical range of the risk threshold, wherein the specific classification basis may be set by the developer.

[0089] According to an embodiment of the present disclosure, a security check is performed on the security vulnerability information obtained by analyzing the program to be analyzed by the first program component analysis tool. When the check result indicates that the security vulnerability information of the program to be analyzed is a high-risk vulnerability, the management system is used to set the program to be analyzed as a non-compliant code, and the program to be analyzed is refused to be stored in the management system.

[0090] Figure 3 The flowchart of the program control method according to the embodiment of the present disclosure is schematically shown.

[0091] like Figure 3 As shown, the above program control method may further include operations S310 to S330.

[0092] In operation S310 , when the analysis result indicates that the program to be analyzed includes a non-open source program, second program information corresponding to the non-open source program is acquired. The second program information may include non-open source information.

[0093] In operation S320, the non-open source software identifier recorded in the second knowledge base of the second program component analysis tool is compared with the second program information to obtain a second comparison result.

[0094] In operation S330, if the second comparison result indicates that the second knowledge base does not have a non-open source software identifier that matches the non-open source information, a suspicious list is generated according to the second program information using the management system.

[0095] According to an embodiment of the present disclosure, the second knowledge base of the second program component analysis tool has a storage function, which stores non-open source software identifiers of multiple non-open source programs. For example, it can be a non-open source program referenced by developers according to actual needs during the development process, and the non-open source software identifier of the non-open source program is stored in the second knowledge base. At the same time, the development process includes but is not limited to the current development process and the historical development process.

[0096] According to an embodiment of the present disclosure, when the first program component analysis tool analyzes the submitted program to be analyzed, it can not only analyze the open source programs in the program to be analyzed, but also analyze the non-open source programs. For example, code with certain specific formats can be set as non-open source programs. The specific formats can include but are not limited to data packets in jar format.

[0097] According to an embodiment of the present disclosure, the second knowledge base of the second program component analysis tool is compared with the second program information of the non-open source program analyzed by the first program component analysis tool. When the second program component analysis tool performs the comparison, the non-open source information in the second program information can be compared and matched one by one with the multiple non-open source software identifiers in the second knowledge base. In the case that there is no non-open source software identifier that matches the non-open source information in the second knowledge base, a suspicious list is generated based on the second program information using a management system, wherein the suspicious list may include multiple different second program information, and the multiple different second program information are not recorded in the second knowledge base of the second program component analysis tool.

[0098] According to an embodiment of the present disclosure, for multiple second program information recorded in the suspicious list, the management system is used to push the second program information in the suspicious list to the developer for manual identification to determine whether the above-mentioned second program information meets the preset requirements, where the preset requirements may include the risk threshold of security vulnerabilities or free use conditions.

[0099] According to an embodiment of the present disclosure, the above-mentioned program control method may further include the following operations.

[0100] If the second comparison result indicates that the second knowledge base contains a non-open source software identifier that matches the non-open source program, the registration information that matches the second program information is updated, and the updated registration information is stored in the management system.

[0101] According to an embodiment of the present disclosure, the management system pre-stores registration information corresponding to the non-open source software identifier in the second knowledge base. When a non-open source program used in a program to be analyzed is one of the non-open source programs recorded in the second knowledge base, the registration information corresponding to the non-open source program in the management system is updated, and the program to be analyzed is stored in the management system, establishing an access control mechanism that requires non-open source programs to be registered before use.

[0102] According to an embodiment of the present disclosure, the above-mentioned program control method may further include the following operations.

[0103] If the second comparison result indicates that the second knowledge base contains a non-open source software identifier that matches the non-open source program, the management system generates second introduction information of the non-open source program based on the second program information. The second introduction information of the non-open source program is associated with the program to be analyzed and stored in the management system.

[0104] Figure 4 A flowchart of a program control method according to another embodiment of the present disclosure is schematically shown.

[0105] like Figure 4 As shown, the above program control method may also include the following operations.

[0106] Submit a program submission application for the program to be analyzed to the R&D and operation and maintenance pipeline. If it is determined that the program submission application has been submitted, use the management system to transmit the submitted program to be analyzed corresponding to the program submission application to the first program component analysis tool, so that the first program component analysis tool analyzes the program to be analyzed.

[0107] According to an embodiment of the present disclosure, the R&D and operation pipeline may include a DevOps integration / compilation pipeline developed based on a Jenkins environment.

[0108] According to an embodiment of the present disclosure, Windows desktop software is identified using TMS to obtain corresponding free software, wherein TMS is a free and open source team collaboration web tool that can implement collaborative management functions. Free software is obtained from the application store, and free software is identified from the production environment of the development program using an image scanning tool and a system software identification tool. A software list is generated based on the obtained free software, such as an open source software list including an open source software identifier or a non-open source software list including a non-open source software identifier, so that the open source software list or the non-open source software list can be used to identify the program to be analyzed in the above-mentioned program management and control method.

[0109] According to an embodiment of the present disclosure, the above-mentioned program management method can perform real-time management of incremental programs during the program development process, such as incremental programs submitted by developers within a first preset time interval, and can also perform unified inspections on incremental programs or full programs after a second preset time interval, wherein the first preset time interval can include one day and the second preset time interval can include one month.

[0110] According to the embodiments of the present disclosure, the above-mentioned program management method can achieve the purpose of timely ledger management and risk control of the analyzed programs during the program development process by identifying open source software and non-open source software, updating software registration information and scanning related security vulnerability information.

[0111] Figure 5 The overall flow chart of the program control method according to an embodiment of the present disclosure is schematically shown.

[0112] like Figure 5 As shown, after the developer submits a program submission application for the program to be analyzed to the R&D and operation and maintenance pipeline, the first program component analysis tool obtains the program to be analyzed.

[0113] In the case where an open source program is introduced into the program to be analyzed, first program information is generated, and the first program information includes open source information. The first program information is compared with the open source software identifier recorded in the first knowledge base of the first program component analysis tool. If there is no open source software identifier matching the open source information in the first knowledge base, it means that there is no introduced information in the management system, and the management system can be used to generate corresponding introduced information, and then determine whether it has registration information. If there is no open source software identifier matching the open source information in the first knowledge base, the management system is used to generate registration information of the open source program. If there is an open source software identifier matching the open source information in the first knowledge base, the management system is used to update the registration information of the open source program.

[0114] In the case that a non-open source program is introduced into the program to be analyzed, a second program information is generated, and the second program information includes the non-open source information. The second program information is compared with the non-open source software identifier recorded in the second knowledge base of the second program component analysis tool. If there is no non-open source software identifier that matches the non-open source information in the second knowledge base, it means that the management system does not have the introduced information, and the management system can be used to generate the corresponding introduced information, and then determine whether it has registration information. If there is no non-open source software identifier that matches the non-open source information in the second knowledge base, the management system is used to generate the registration information of the non-open source program. If there is an open source software identifier that matches the open source information in the second knowledge base, the management system is used to update the registration information of the non-open source program.

[0115] The program to be analyzed, registration information and introduction information are stored in the database of the management system.

[0116] Based on the above program control method, the present disclosure also provides a program control device. Figure 6 The device is described in detail.

[0117] Figure 6 The structural block diagram of the program control device according to an embodiment of the present disclosure is schematically shown.

[0118] like Figure 6 As shown, the program control device 600 of this embodiment may include an analysis module 610 , a first acquisition module 620 , a first comparison module 630 , a first generation module 640 and a first storage module 650 .

[0119] The analysis module 610 is used to analyze the submitted program to be analyzed using the first program component analysis tool to obtain an analysis result. In one embodiment, the analysis module 610 can be used to perform the operation S210 described above, which will not be repeated here.

[0120] The first acquisition module 620 is configured to acquire first program information corresponding to the open source program if the analysis results indicate that the program to be analyzed includes an open source program. The first program information may include open source information. In one embodiment, the first acquisition module 620 may be configured to perform operation S220 described above, which will not be further described here.

[0121] The first comparison module 630 is used to compare the first program information with the open source software identifier recorded in the first knowledge base of the first program component analysis tool to obtain a comparison result. In one embodiment, the first comparison module 630 can be used to perform the operation S230 described above, which will not be repeated here.

[0122] The first generation module 640 is configured to generate, using the management system, the introduction information of the open source program based on the first program information if the comparison result indicates that the first knowledge base does not contain an open source software identifier that matches the open source information. In one embodiment, the first generation module 640 can be configured to perform operation S240 described above, which will not be further described here.

[0123] The first storage module 650 is used to associate the introduction information of the open source program with the program to be analyzed and store it in the management system. In one embodiment, the first storage module 650 can be used to perform the operation S250 described above, which will not be repeated here.

[0124] According to an embodiment of the present disclosure, the program control apparatus 600 of this embodiment may further include a second generating module and a second storage module.

[0125] The second generating module is configured to generate registration information of the open source program according to the first program information using the management system if the comparison result indicates that the first knowledge base does not have an open source software identifier that matches the open source information.

[0126] The second storage module is used to store the registration information in the management system.

[0127] According to an embodiment of the present disclosure, in the process of developing a program, the open source information obtained after the first program component analysis tool analyzes the program to be analyzed is compared with the first knowledge base of the first program component analysis tool. When there is no open source software identifier matching the open source information in the first knowledge base, the management system is used to generate the introduction information of the open source program, and the introduction information is associated with the program to be analyzed and stored in the management system, thereby avoiding the high learning cost caused by manual analysis of the program to be analyzed and the technical problems of poor accuracy and low efficiency in manual identification, thereby reducing the learning cost and improving the recognition efficiency and accuracy of the program to be analyzed.

[0128] According to an embodiment of the present disclosure, the program control apparatus 600 of this embodiment may further include a first update module and a third storage module.

[0129] The first updating module is configured to update registration information pre-stored in the management system that matches the first program information if the comparison result indicates that the first knowledge base has an open source software identifier that matches the open source information.

[0130] The third storage module is used to store the updated registration information in the management system.

[0131] According to an embodiment of the present disclosure, the first program information may further include at least one of the following: a program name, a program information summary, and security vulnerability information. The imported information may include at least one of the following: a program name, a program information summary, open source information, and security vulnerability information.

[0132] According to an embodiment of the present disclosure, the program control device 600 of this embodiment may further include a security scanning module.

[0133] The security scanning module is used to perform security checks on security vulnerability information and obtain inspection results. If the inspection results show that the security vulnerability information meets the risk threshold, the management system will be used to set the program to be analyzed as non-compliant code and refuse to store the non-compliant code in the management system.

[0134] According to an embodiment of the present disclosure, the program control device 600 of this embodiment may further include a second acquisition module, a second comparison module, and a third generation module.

[0135] The second acquisition module is used to acquire second program information corresponding to the non-open source program when the analysis result shows that the program to be analyzed includes a non-open source program. The second program information may include non-open source information.

[0136] The second comparison module compares the non-open source software identifier recorded in the second knowledge base of the second program component analysis tool with the second program information to obtain a second comparison result.

[0137] The third generating module is configured to generate a suspicious list based on the second program information by using the management system if the second comparison result indicates that the second knowledge base does not have a non-open source software identifier that matches the non-open source information.

[0138] According to an embodiment of the present disclosure, the program control apparatus 600 of this embodiment may further include a second update module and a fourth storage module.

[0139] The second updating module is configured to update registration information that matches the second program information if the second comparison result indicates that the second knowledge base contains a non-open source software identifier that matches the non-open source program.

[0140] The fourth storage module is used to store the updated registration information in the management system.

[0141] According to an embodiment of the present disclosure, any multiple modules among the analysis module 610, the first acquisition module 620, the first comparison module 630, the first generation module 640, and the first storage module 650 can be combined into a single module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in a single module. According to an embodiment of the present disclosure, at least one of the analysis module 610, the first acquisition module 620, the first comparison module 630, the first generation module 640, and the first storage module 650 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware in any other reasonable manner of integrating or packaging the circuit, or can be implemented in any one of the three implementation modes of software, hardware, and firmware, or in an appropriate combination of any of them. Alternatively, at least one of the analysis module 610 , the first acquisition module 620 , the first comparison module 630 , the first generation module 640 and the first storage module 650 may be at least partially implemented as a computer program module, which may perform corresponding functions when executed.

[0142] Figure 7 A block diagram of an electronic device suitable for implementing a program control method according to an embodiment of the present disclosure is schematically shown.

[0143] like Figure 7 As shown, the electronic device 700 according to an embodiment of the present disclosure includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 into a random access memory (RAM) 703. The processor 701 may, for example, include a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 701 may also include an onboard memory for caching purposes. The processor 701 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0144] Various programs and data required for the operation of the electronic device 700 are stored in the RAM 703. The processor 701, ROM 702, and RAM 703 are connected to each other via a bus 704. The processor 701 executes the various operations of the method flow according to the embodiment of the present disclosure by executing the programs in the ROM 702 and / or RAM 703. It should be noted that the programs may also be stored in one or more memories other than the ROM 702 and RAM 703. The processor 701 may also execute the various operations of the method flow according to the embodiment of the present disclosure by executing the programs stored in the one or more memories.

[0145] According to an embodiment of the present disclosure, the electronic device 700 may further include an input / output (I / O) interface 705, which is also connected to the bus 704. The electronic device 700 may further include one or more of the following components connected to the I / O interface 705: an input portion 706 including a keyboard, a mouse, etc.; an output portion 707 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and a speaker; a storage portion 708 including a hard disk; and a communication portion 709 including a network interface card such as a LAN card or a modem. The communication portion 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed in the drive 710 as needed, so that a computer program read therefrom can be installed into the storage portion 708 as needed.

[0146] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently and not be incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, and when executed, implements the method according to the embodiments of the present disclosure.

[0147] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 702 and / or RAM 703 described above and / or one or more memories other than ROM 702 and RAM 703.

[0148] The embodiments of the present disclosure also include a computer program product, which includes a computer program containing program code for executing the method shown in the flowchart. When the computer program product is executed in a computer system, the program code is used to cause the computer system to implement the item recommendation method provided by the embodiments of the present disclosure.

[0149] The computer program executes the above functions defined in the system / device of the embodiment of the present disclosure when the processor 701 executes the computer program. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0150] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal on a network medium, downloaded and installed via the communication portion 709, and / or installed from a removable medium 711. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0151] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 709, and / or installed from a removable medium 711. When the computer program is executed by the processor 701, the above-described functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the systems, devices, means, modules, units, etc. described above can be implemented by computer program modules.

[0152] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, python, "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect via the Internet).

[0153] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0154] Those skilled in the art will appreciate that the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways, even if such combinations and / or couplings are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or couplings are intended to fall within the scope of this disclosure.

[0155] The embodiments of the present disclosure are described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although each embodiment has been described separately above, this does not mean that the measures in each embodiment cannot be used in combination to advantage. The scope of the present disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A program control method, comprising: Submit program submissions to the R&D and operations pipeline for programs to be analyzed; In the case where it is determined that a program submission application has been submitted, the management system is used to transmit the submitted program to be analyzed corresponding to the program submission application to the first program component analysis tool; Analyzing the submitted program to be analyzed using a first program component analysis tool to obtain an analysis result; If the analysis result indicates that the program to be analyzed includes an open source program, obtaining first program information corresponding to the open source program, where the first program information includes open source information; Comparing the first program information with the open source software identifier recorded in the first knowledge base of the first program component analysis tool to obtain a comparison result; If the comparison result indicates that the first knowledge base does not have an open source software identifier that matches the open source information, generating, using a management system, introduction information for the open source program based on the first program information, wherein the introduction information includes at least one of the following: a program name, a program information summary, open source information, and security vulnerability information; and Associating the introduction information of the open source program with the program to be analyzed and storing them in the management system; If the analysis result indicates that the program to be analyzed includes a non-open source program, obtaining second program information corresponding to the non-open source program, where the second program information includes non-open source information; Comparing the non-open source software identifier recorded in the second knowledge base of the second program component analysis tool with the second program information to obtain a second comparison result; If the second comparison result indicates that the second knowledge base does not have a non-open source software identifier that matches the non-open source information, the management system is used to generate a suspicious list based on the second program information, and the management system is used to push the second program information in the suspicious list to developers for manual identification.

2. The method according to claim 1, further comprising: If the comparison result indicates that the first knowledge base does not have an open source software identifier that matches the open source information, generating registration information for the open source program based on the first program information using the management system; The registration information is stored in the management system.

3. The method according to claim 1, further comprising: If the comparison result indicates that the first knowledge base has an open source software identifier that matches the open source information and the management system has introduction information corresponding to the open source program, updating registration information pre-stored in the management system that matches the first program information, wherein the updating includes recording development information of the current program to be analyzed or updating the number of times it has been used in the usage record of the registration information; The updated registration information is stored in the management system.

4. The method according to claim 1, wherein The first program information further includes at least one of the following: a program name, a program information summary, and security vulnerability information.

5. The method according to claim 4, wherein The first program information includes the security vulnerability information; The method further comprises: Perform a security check on the security vulnerability information to obtain a check result; if the check result indicates that the security vulnerability information meets the risk threshold, use the management system to set the program to be analyzed as non-compliant code and refuse to store the non-compliant code in the management system.

6. The method according to claim 1, further comprising: If the second comparison result indicates that the second knowledge base has a non-open source software identifier that matches the non-open source program, updating registration information that matches the second program information; The updated registration information is stored in the management system.

7. A program control device, comprising: An analysis module, configured to analyze the submitted program to be analyzed using a first program component analysis tool to obtain an analysis result; a first acquisition module, configured to, if the analysis result indicates that the program to be analyzed includes an open source program, acquire first program information corresponding to the open source program, the first program information including open source information; a first comparison module, configured to compare the first program information with the open source software identifier recorded in the first knowledge base of the first program component analysis tool to obtain a comparison result; a first generating module configured to, if the comparison result indicates that the first knowledge base does not have an open source software identifier that matches the open source information, generate, using a management system, introduction information of the open source program based on the first program information, wherein the introduction information includes at least one of the following: a program name, a program information summary, open source information, and security vulnerability information; and A first storage module is used to associate the introduction information of the open source program with the program to be analyzed and store it in the management system; The program control device is further configured to submit a program submission application for the program to be analyzed to the R&D and operation and maintenance pipeline; and when it is determined that the program submission application has been submitted, the management system is configured to transmit the submitted program to be analyzed corresponding to the program submission application to the first program component analysis tool. The second acquisition module is configured to acquire second program information corresponding to the non-open source program if the analysis result shows that the program to be analyzed includes a non-open source program, the second program information including the non-open source information; The second comparison module compares the non-open source software identifier recorded in the second knowledge base of the second program component analysis tool with the second program information to obtain a second comparison result; The third generation module is used to generate a suspicious list based on the second program information using the management system when the second comparison result shows that there is no non-open source software identifier matching the non-open source information in the second knowledge base, and push the second program information in the suspicious list to the developer for manual identification using the management system.

8. An electronic device comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are enabled to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to perform the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images