Control methods, devices, equipment and storage media used in open source components in software development

Abstract

The embodiments of the present application disclose a method, apparatus, device and storage medium for using open source components in software development. The method includes: real-time monitoring of configuration file changes of the project to be developed to obtain newly introduced open source components in the project; obtaining a recommended target open source component based on the security knowledge data of the newly introduced open source component, the security knowledge data including version information; replacing the newly introduced open source component with the target open source component and introducing it into the project, and obtaining the security information between the target open source component and the components used in the project, so as to perform security detection on the project based on the security information. In this way, not only the security risks brought by the newly introduced open source components are reduced, but also the effect of "developing and repairing at the same time" is achieved, which effectively avoids major security issues caused by the accumulation of security issues, and also effectively ensures the real-time nature of software development.

Description

Technical Field

[0001] The present application relates to the field of Internet security, and specifically to a control method, device, electronic device and computer-readable storage medium for use with open source components in software development. Background Art

[0002] With the continuous development of the Internet, software users have higher and higher demands on software functionality, real-time performance, ease of use, etc., and the competitive pressure in the software market is increasing. This requires developers to complete the development of a large number of functional points in a short period of time, and to carry out continuous high-speed iterations in the later stage to seize and consolidate the market. At present, in the process of software development, a large number of open source libraries will inevitably be used. Due to the openness of its code, open source software has reduced development costs and improved development efficiency to a certain extent, but it also brings security risks.

[0003] Currently, software security testing can be performed after software development is completed, but this implementation will cause a lot of rework and cumbersome operations, and the time cost invested is too high, affecting real-time performance. Summary of the invention

[0004] To solve the above technical problems, the embodiments of the present application provide a control method and device for using open source components in software development, an electronic device, a computer-readable storage medium, and a computer program product.

[0005] According to one aspect of an embodiment of the present application, a method for controlling the use of open source components in software development is provided, comprising: monitoring changes in configuration files of a project to be developed in real time to obtain newly introduced open source components in the project; obtaining a recommended target open source component based on security knowledge data of the newly introduced open source component, wherein the security knowledge data includes version information; replacing the newly introduced open source component with the target open source component and introducing it into the project, and obtaining security information between the target open source component and components used in the project, so as to perform security detection on the project based on the security information.

[0006] According to one aspect of an embodiment of the present application, the target open source component recommended according to the security knowledge data of the newly introduced open source component includes:

[0007] Acquire, based on a pre-built component security knowledge base, a relationship between the newly introduced open source component and a component used in the project, wherein the relationship includes an association relationship or a constraint relationship;

[0008] Based on the association relationship, recommend an open source component version having a version number different from the version number of the newly introduced open source component as a target open source component;

[0009] Or, based on the constraint relationship, other open source components are recommended as target open source components.

[0010] According to one aspect of an embodiment of the present application, before obtaining a recommended target open source component according to the security knowledge data of the newly introduced open source component, the method further includes:

[0011] Acquire security knowledge data of known components, wherein the security knowledge data includes version information of the components and the relationship between the components;

[0012] The component safety knowledge base is constructed based on the safety knowledge data.

[0013] According to one aspect of the embodiment of the present application, the method further includes:

[0014] Establishing a component retrieval engine based on the component security knowledge base, wherein the retrieval engine is used to obtain security information between the component to be retrieved and other components;

[0015] The obtaining of security information between the target open source component and the components used in the project to perform security detection on the project according to the security information includes:

[0016] Input the target open source component into the component search engine to obtain security information between the target open source component and the components used by the project, wherein the security information includes security issues existing in the project and corresponding security repair suggestions;

[0017] The project is repaired based on the security repair suggestion, and a security check is performed on the repaired project.

[0018] According to one aspect of an embodiment of the present application, the target open source component recommended according to the security knowledge data of the newly introduced open source component includes:

[0019] Calculate a corresponding feature vector according to the security knowledge data of the newly introduced open source component;

[0020] Inputting the feature vector into a component intelligent recommendation model to obtain at least one open source component output by the component intelligent recommendation model;

[0021] The target open source component is determined from the at least one open source component.

[0022] According to one aspect of an embodiment of the present application, determining the target open source component from the at least one open source component includes:

[0023] Obtaining a safety factor of each open source component according to a safety relationship between at least one open source component and components used in the project;

[0024] An open source component with the highest safety factor is selected from the at least one open source component as a target open source component.

[0025] According to one aspect of an embodiment of the present application, obtaining the safety factor of each open source component according to the safety relationship between at least one open source component and the components used in the project includes:

[0026] Acquire, according to a pre-built component security knowledge base, a security relationship between each open source component and a component used in the project;

[0027] A safety factor of each open source component is obtained according to the security relationship.

[0028] According to one aspect of an embodiment of the present application, a control device for using an open source component in software development is provided, comprising:

[0029] A monitoring module, used to monitor the changes in configuration files of the project to be developed in real time, so as to obtain newly introduced open source components in the project;

[0030] A recommendation module, configured to obtain a recommended target open source component according to the security knowledge data of the newly introduced open source component, wherein the security knowledge data includes version information;

[0031] A detection module is used to replace the newly introduced open source component with the target open source component and introduce it into the project, and obtain security information between the target open source component and the components used in the project, so as to perform security detection on the project based on the security information.

[0032] According to one aspect of an embodiment of the present application, there is provided an electronic device, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the electronic device implements the control method for using open source components in software development as described above.

[0033] According to one aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which computer-readable instructions are stored. When the computer-readable instructions are executed by a processor of a computer, the computer executes the control method used by open source components in software development as described above.

[0034] According to one aspect of an embodiment of the present application, a computer program product is also provided, including a computer program, which, when executed by a processor, implements the steps in the control method for using open source components in software development as described above.

[0035] In the technical solution provided in the embodiments of the present application, on the one hand, by real-time monitoring of changes in configuration files of the project to be developed, newly introduced open source components in the project are obtained therefrom, and target open source components for introduction into the project are recommended based on the security knowledge data of the newly introduced open source components, and the newly introduced open source components in the project are replaced with the recommended target open source components and introduced into the project, thereby reducing the security risks brought by the newly introduced open source components; on the other hand, by obtaining security information between the target open source components and the components used in the project, and performing security detection on the project based on the security information, the effect of "developing and repairing at the same time" is achieved, which effectively avoids major security issues caused by the accumulation of security issues, and also effectively ensures the real-time nature of software development.

[0036] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0038] Figure 1 It is a schematic diagram of a control implementation environment used by open source components in software development, shown in an exemplary embodiment of the present application;

[0039] Figure 2 is a flow chart of a control method for using open source components in software development, shown in an exemplary embodiment of the present application;

[0040] Figure 3 yes Figure 2 Step S220 in the illustrated embodiment is a flow chart in an exemplary embodiment;

[0041] Figure 4 Another exemplary embodiment of the present application shows Figure 2 A flow chart of step S220 in the illustrated embodiment;

[0042] Figure 5 is an overall service flow chart of a control method for using open source components in software development, shown in another exemplary embodiment of the present application;

[0043] Figure 6 is a block diagram of a control device used by an open source component in software development, shown in an exemplary embodiment of the present application;

[0044] Figure 7 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown. DETAILED DESCRIPTION

[0045] Here, exemplary embodiments will be described in detail, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0046] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0047] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0048] The term "multiple" as used in this application refers to two or more than two. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the related objects are in an "or" relationship.

[0049] First of all, it should be noted that the software development mentioned in the embodiment of the present application is the process of building a software system or the software part in the system according to user requirements. Software development is a system engineering including demand capture, demand analysis, design, implementation and testing. Software is generally implemented in a certain programming language. Usually, software development tools can be used for development. Software is divided into system software and application software. It does not only include programs that can be run on computers. Files related to these programs are generally considered to be part of the software. The general process of software design ideas and methods includes designing the functions of the software and the algorithms and methods for implementation, the overall structural design and module design of the software, programming and debugging, program joint debugging and testing, and then writing and submitting the program. The software open process refers to the development life cycle of software development, and its various stages realize the definition and analysis of software requirements, design, implementation, testing, delivery and maintenance. The software process is the steps to be followed when developing and building a system, and it is a roadmap for software development.

[0050] In the prior art, software users have higher and higher demands on the functionality, real-time performance, ease of use, etc. of software, and the competitive pressure in the software market is increasing. This requires developers to complete the development of a large number of functional points in a short period of time, and to carry out continuous high-speed iterations in the later stage to seize and consolidate the market. In the process of software development, a large number of open source libraries will inevitably be used. Due to the openness of its code, open source software has reduced development costs and improved development efficiency to a certain extent, but it also brings security risks. However, most of them currently perform security testing on the software after the software development is completed, but this implementation solution will cause a lot of rework and cumbersome operation, requiring a lot of time investment and cannot guarantee the real-time performance required by software users.

[0051] To solve the above problems, the embodiments of the present application respectively propose a control method for the use of open source components in software development, a control device for the use of open source components in software development, an electronic device, a computer-readable storage medium, and a computer program product. These embodiments will be described in detail below.

[0052] See also Figure 1 , Figure 1 Schematic diagram of an environment involved in the embodiment of the present application. The implementation environment is a control scenario for using open source components in software development. The implementation environment includes: Figure 1 The safety detection system 110 and the software development system 120 shown in FIG. The safety detection system 110 and the software development system 120 communicate with each other via wired or wireless means.

[0053] exist Figure 1In the implementation environment shown, the security detection system 110 is used to detect security issues in the software development process. For example, the security detection system 110 is used to check the newly introduced components in the software development process and the components used in the project to find out the security issues that the newly introduced components will bring to the software. In addition, in order to achieve the effect of developing while detecting in the software development process, the security detection system 110 is also used to intelligently recommend components with higher security based on the newly introduced components to replace the newly introduced components into the software development. The security detection system 110 is also used to detect security issues in the software development process and give corresponding repair suggestions, so as to fix the security issues in the software development process and avoid rework and repair after the software development is completed.

[0054] The software development system 120 is used to provide a software development environment. For example, the software development system 120 is used to build a software system or a software part of a development system according to user requirements. Software development is a system engineering including demand capture, demand analysis, design, implementation and testing. Software is generally implemented in a certain programming language. In other words, the software development system 120 can implement compilation and debugging of multiple languages.

[0055] In addition, the security detection system 110 can be, for example, an independent physical server, or a server cluster or distributed system composed of multiple physical servers. It can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms, and there is no limitation here.

[0056] It should be understood that cloud technology refers to a hosting technology that unifies hardware, software, network and other resources within a wide area network or local area network to achieve data computing, storage, processing and sharing. Cloud technology is also a general term for network technology, information technology, integration technology, management platform technology, application technology, etc. based on the cloud computing business model application, which can form a resource pool and be used on demand, flexibly and conveniently.

[0057] Figure 2 is a flowchart of a control method for using open source components in software development, shown in an exemplary embodiment of the present application. The method can be applied to Figure 1 The implementation environment shown in Figure 1 The security detection system 110 in the implementation environment shown is specifically implemented. Of course, the method can also be applied to other implementation environments and executed by devices in other implementation environments, and this embodiment does not limit this.

[0058] The following will Figure 1 The security detection system 110 in the implementation environment shown is used as a specific execution subject to describe the method in detail. Figure 2 As shown, in an exemplary embodiment, the method may include steps S210 to S230, which are described in detail as follows:

[0059] Step S210: monitor the changes of the configuration files of the project to be developed in real time to obtain the newly introduced open source components in the project.

[0060] First of all, it should be noted that software developers will inevitably use a large number of open source libraries and non-public libraries provided by outsourcing suppliers during the development process. According to the "Status of Open Source Vulnerability Management" released by White Source, 96.8% of developers rely on open source software. The open, shared and free characteristics of open source software are bound to bring new security risks to the software supply chain. For example, the Log4Shell vulnerability in the Log4j log framework is the most serious open source system security vulnerability in recent years. Open source security issues are receiving more and more attention. Due to the openness of its code, open source software has reduced development costs and improved development efficiency to a certain extent, but it also brings security risks. The security vulnerability management of open source software is quite different from other commercial software. After discovering a vulnerability, commercial software usually automatically pushes the repair patch to the user, while open source software is a passive "pull mode" and the relevant patches need to be installed manually. If developers do not regularly check the open source code they use, the corresponding security vulnerabilities will always exist. With the addition of new code, the vulnerabilities will accumulate more and more in the code base, and the average age of the vulnerabilities will gradually increase, and repairing the vulnerabilities will become time-consuming and labor-intensive.

[0061] During the software development process, the newly introduced open source components in the current project can be monitored in real time. The project component change information can be obtained by monitoring the md5 value of the pom file in real time. Pom is the abbreviation of Project Object Model, which defines the basic information of the project and is mainly used to manage: source code, configuration files, developer information and roles, issue tracking system, organization information, project authorization, project URL, project dependencies, etc. md5 is an information digest algorithm, which can generate a special string from the data to be encrypted according to certain rules, and the md5 digest corresponding to a file is fixed. When the file content changes, its md5 value will also be different. Therefore, md5 values ​​are often used in applications to verify whether a piece of data has been tampered with. When the md5 value of the pom file is found to have changed, it means that the project content has changed. According to the changes in the project content, the newly introduced open source components of the project are obtained.

[0062] Step S220: obtaining a recommended target open source component based on the security knowledge data of the newly introduced open source component, where the security knowledge data includes version information.

[0063] It should be noted that the security knowledge data of open source components includes known security issues. In this embodiment, corresponding target open source components with higher security are recommended based on factors such as the security knowledge data of the newly introduced open source components in the project, the security issues caused by the combination of components used in the project, and the functions of the newly introduced open source components.

[0064] Exemplarily, by monitoring the changes in the md5 value in the pom file during the software development process, the newly introduced open source component A in the project is obtained, and the target open source component B that is more suitable for introduction into the project is recommended based on the security knowledge data of the newly introduced open source component A. That is, based on the purpose of the newly introduced open source component A and the security issues of the open source component A known from the security knowledge data of the open source component A, the target open source component B with higher security and more in line with the current software development needs is recommended.

[0065] Step S230, replacing the newly introduced open source component with the target open source component and introducing it into the project, and obtaining security information between the target open source component and the components used in the project, so as to perform security detection on the project according to the security information.

[0066] After the target open source component is determined, the newly introduced open source component is replaced with the target open source component, and the security relationship between the components in the current project is established based on the security knowledge data of the target open source component and the security knowledge data of the components used in the project to generate the corresponding repair plan for the project. For example, after the target open source component is introduced into the project, if a vulnerability is found after security testing, the corresponding repair patch is installed according to the vulnerability in the project. In this way, it can be ensured that the security issues brought by the new open source component are fixed when it is introduced, avoiding the problem of more and more vulnerabilities and increasingly complex relationships between vulnerabilities as new codes are added.

[0067] In this embodiment, the configuration file changes of the project to be developed are monitored in real time to obtain the newly introduced open source components in the project, and the target open source components that are more suitable for the current software development project are recommended based on the security knowledge data of the newly introduced open source components. The newly introduced open source components are then replaced with the target open source components and introduced into the project, and the security issues and corresponding repair plans between the target open source components and the components used in the project are obtained, and the project is repaired according to the repair plan. In this way, not only is it ensured that the security risks brought by the newly introduced open source components are reduced, but also the effect of "repairing while developing" is achieved, which effectively avoids the cumbersome repair process caused by the accumulation of security issues and ensures the real-time nature of software development.

[0068] Based on the above examples, please refer to Figure 3 In an exemplary embodiment shown in the present application, the above Figure 2 The specific implementation process of step S220 in the embodiment further includes steps S310 to S330, which are described in detail as follows:

[0069] Step S310, based on the pre-built component security knowledge base, obtain the relationship between the newly introduced open source component and the components used in the project, where the relationship includes an association relationship or a constraint relationship.

[0070] First of all, it should be noted that the component security knowledge base in the embodiment of the present application includes a component vulnerability knowledge base, a component dependency knowledge base, a component association knowledge base, a component constraint knowledge base, and a component vulnerability repair knowledge base, etc. In this embodiment, the component security knowledge base can be used to query security issues caused by the combination of components and the repair solutions corresponding to the security issues.

[0071] Exemplarily, the newly introduced open source components are input into a pre-built component security knowledge base, where the component security knowledge base can be constructed by crawling relevant information of each open source component and the usage of the components in the open source project. Of course, the component security knowledge base can also be constructed through other technical solutions, and this application does not impose any limitations on this.

[0072] The relationship between the target open source component and the components used in the software development project is obtained through the component relationship network included in the pre-built component security knowledge base, where the relationship between components includes the dependency relationship between components, the association relationship between components, the constraint relationship between components, the vulnerability security relationship between components, and the vulnerability repair plan corresponding to the vulnerability security relationship.

[0073] Step S320: recommending, based on the association relationship, an open source component version whose version number is different from the version number of the newly introduced open source component as a target open source component.

[0074] As mentioned above, the newly introduced open source components in the project are used to obtain the association relationship between the newly introduced components and the projects used in the project based on the pre-built component security knowledge base, and at least one open source component with a different version number from the newly introduced open source component is recommended as the target open source component based on the association relationship.

[0075] Exemplarily, by monitoring the changes in the md5 value in the pom file in the software development project, the newly introduced open source component A1.0 in the project is obtained, and the newly introduced open source component A1.0 is input into the component security knowledge base. After the component security knowledge base is tested, the association relationship between the newly introduced open source component A1.0 and the components used in the project is obtained, and a target open source component A2.0 that is more suitable for the project and relatively secure is recommended.

[0076] Step S320': recommending other open source components as target open source components based on the constraint relationship.

[0077] In this embodiment, regarding obtaining the target open source component based on the pre-built component security knowledge base, other open source components may be recommended as the target open source component through the constraint relationship between the newly introduced open source component and the components used in the project.

[0078] Exemplarily, the newly introduced open source component A in the project is obtained by monitoring the changes in the md5 value in the pom file in the software development project, and the newly introduced open source component A is passed through a pre-built component security knowledge base, and the component security knowledge base is used to detect the association relationship between the newly introduced open source component A and the components used in the project, and then a target open source component B that is more suitable for the project and relatively secure is recommended.

[0079] In this embodiment, the relationship between the newly introduced open source component and the components used in the project is obtained through a pre-built component security knowledge base, and through the association relationship between the newly introduced open source component and the components used in the project, an open source component version different from the newly introduced open source component version number is recommended as the target open source component, or, through the constraint relationship between the newly introduced open source component and the components used in the project, other open source components are recommended as the target open source component, thereby achieving that the recommended target component is more suitable for the project and has higher security.

[0080] Based on the above embodiment, in one of the exemplary embodiments provided in the present application, before implementing the process of obtaining a recommended target open source component according to the security knowledge data of the newly introduced open source component, step S410 and step S420 are further included, which are described in detail as follows:

[0081] Step S410, obtaining security knowledge data of known components, the security knowledge data including version information of the components and the relationship between the components;

[0082] Step S420: construct a component security knowledge base based on the security knowledge data.

[0083] Component vulnerability features are collected through distributed crawlers, anti-crawlers, and update strategies. Vulnerability features include one or more of CVE (Common Vulnerabilities and Exposures) number, title, type, solution, component name, version, and license information. Of course, manual import can also be used to import specific component information or import data without the Internet, and the platform repositories are linked through the preset open source security and compliance governance management platform system. Among them, the platform repositories include one or more of Github (a hosting platform for open source and private software projects), Gitee (Code Cloud), and Gitlab (a project management and code hosting platform).

[0084] Furthermore, the open source project is uploaded through the command line or compressed package, or the open source project is pulled by logging into Github, Gitee, or Gitlab, and the dependent files in the open source project are parsed, the dependencies with vulnerabilities are screened out and marked, and stored in the database to form a component dependency knowledge base; similarly, by parsing the associated files in the open source project, a knowledge base of association relationships between components and a knowledge base of constraints between components are obtained. At the same time, the process of analyzing the dependent components used in the source code is to mark the dependent components with vulnerabilities after finding them, so as to facilitate tracing and finding vulnerabilities, and analyze the vulnerabilities found to obtain the affected scope of the vulnerabilities, whether there are solutions, etc., and record the vulnerability information, and analyze the risks and compliance of the open source licenses in the open source projects. The component security knowledge data obtained above is constructed to obtain a component security knowledge base.

[0085] In addition, the component security knowledge base can also be continuously updated by using the Scrapy crawler framework as a basic implementation for secondary development and optimization. Afterwards, crawlers are managed through gerapy (distributed crawler management framework), and information, component information, and vulnerability information of millions of open source projects around the world are continuously updated through daily scheduled tasks of docker (open source application container engine).

[0086] Based on the above embodiment, in one of the exemplary embodiments provided in this application, the method further includes:

[0087] Step S430: Establish a component retrieval engine based on the component security knowledge base, where the retrieval engine is used to obtain security information between the component to be retrieved and other components.

[0088] The component detection engine is established through the component security knowledge base. The engine mainly includes the mapping relationship between known security issues, components, repair suggestions, risk levels, etc. It is used to match whether a component has some vulnerabilities. This module will record the components that have been imported into this project and their security information, and on this basis, detect the newly introduced components, fully consider the potential security issues caused by the combination of components, and finally return the security-related issues and repair suggestions of the component in this project environment to the developer.

[0089] Based on the above embodiment, in one of the exemplary embodiments provided in the present application, the process of obtaining security information between the target open source component and the component used in the project to perform security detection on the project according to the security information further specifically includes step S231 and step S232, which are described in detail as follows:

[0090] Step S231, inputting the target open source component into a component search engine to obtain security information between the target open source component and the components used in the project, the security information including security issues existing in the project and corresponding security repair suggestions;

[0091] Step S232: Repair the project based on the security repair suggestion, and perform security detection on the repaired project.

[0092] By inputting the recommended target open source components into the component retrieval engine and collecting the component information used in the software development project, the component retrieval engine obtains the security information between the target open source components and the components already imported into the project (components used in the project) based on the component security knowledge base. The security information includes the security issues caused by the introduction of the target open source components and the corresponding security repair suggestions. The security issues include the vulnerabilities existing in the current project, and the vulnerability related information including the vulnerability number, vulnerability version and vulnerability release time, components and compliance, etc. are obtained from the vulnerability library of the security knowledge base, and the repair solutions corresponding to the vulnerability information are crawled and packaged and sent to the developers. The developers immediately repair the project according to the patches in the repair solution or if there are no relevant repair suggestions, and perform security tests on the repaired project to ensure that all security issues have been repaired. The overall security information of the components of the project at this moment is recorded and updated in real time, and an online report is generated for developers to view the overall component security status of the project in real time during or after the development process.

[0093] In this embodiment, after the target component that is more suitable for the software development project is introduced, security detection is performed on the target component and the components used in the project, and the repair solutions corresponding to the vulnerability information are crawled and packaged and sent to the developer. The developer immediately repairs the project according to the patch in the repair solution or if there is no relevant repair suggestion, and performs security detection on the repaired project to ensure that all security issues have been fixed, so as to realize the discovery and resolution of security issues during development, reduce the economic losses and unnecessary waste of resources caused by security issues in the later stage, and ensure the safe operation of the application.

[0094] Further, based on the above embodiment, please refer to Figure 4 In one of the exemplary embodiments provided in this application, Figure 2 Step S220 in the illustrated embodiment further specifically includes steps S2201 to S2203, which are described in detail as follows:

[0095] Step S2201, calculating a corresponding feature vector according to the security knowledge data of the newly introduced open source component.

[0096] By monitoring the changes in the md5 values ​​of the pom files in the software development projects, we can obtain the newly introduced open source components in the projects, and calculate the feature vectors of the intelligent recommendation model corresponding to the newly introduced legal person open source components through a preset calculation method.

[0097] Exemplarily, a component A newly introduced into the project is obtained by monitoring the change of the md5 value of the pom file in the software development project, and the characteristic vector of A is calculated as L=x1, x2, ... xn by a preset calculation method.

[0098] Step S2202: input the feature vector into the component intelligent recommendation model to obtain at least one open source component output by the component intelligent recommendation model.

[0099] It should be noted that, in this embodiment, the component intelligent recommendation model is trained by using component security knowledge data and the matching relationship between components as data sources to obtain the corresponding component intelligent recommendation model, and the feature vector L=x1,x2,…xn corresponding to the newly introduced open source component A in the project is input into the component intelligent recommendation model to obtain at least one corresponding version of component A's open source component or component A's alternative open source component B, so that the open source personnel can choose according to the actual situation.

[0100] Step S2203: determine a target open source component from at least one open source component.

[0101] As mentioned above, by inputting the feature vector corresponding to the newly introduced open source component in the project into the pre-trained component intelligent recommendation model to obtain at least one open source component output by the component intelligent recommendation model, the software developer selects an open source component as the target open source component according to the actual situation. In one aspect of this embodiment, when the intelligent recommendation model outputs at least one open source component, it is sorted according to the security level, and the software developer selects the most suitable open source component as the target open source component based on the actual situation.

[0102] In this embodiment, the feature vector of the newly introduced open source component in the project obtained according to a preset algorithm is input into a component intelligent recommendation model that has been pre-trained based on component security knowledge data and component matching relationships, and at least one open source component is recommended by the component intelligent recommendation model, so that developers can select the most suitable open source component as the target open source component to introduce into the project according to actual conditions, thereby ensuring that the newly introduced open source component does not cause security risks to the project.

[0103] Based on the above embodiment, in one of the exemplary embodiments provided in the present application, the above implementation process of determining the target open source component from at least one open source component further includes step S531 and step S532, which are described in detail as follows:

[0104] Step S531, obtaining a safety factor of each open source component according to a safety relationship between at least one open source component and components used in the project;

[0105] Step S532: Select an open source component with the highest safety factor from at least one open source component as a target open source component.

[0106] As mentioned above, the feature vectors corresponding to the newly introduced open source components in the project are input into the component intelligent recommendation model to obtain the recommended open source components A1, A2, ...An or open source components B, C, ... By collecting the components used in the project, and obtaining the security relationship between the recommended open source components A1, A2, ...An or open source components B, C, ... and the components used in the project, and selecting the open source components with the highest security factor from the recommended open source components A1, A2, ...An or open source components B, C, ... as the target open source components.

[0107] Further, based on the above embodiment, in an exemplary embodiment provided in the present application, the specific implementation process of the above step S532 includes step S5321 and step S5322, which are described in detail as follows:

[0108] Step S5321, obtaining the security relationship between each open source component and the components used in the project according to the pre-built component security knowledge base;

[0109] Step S5322, obtaining the safety factor of each open source component according to the security relationship.

[0110] In this embodiment, component vulnerability features can be collected through distributed crawlers, anti-crawlers and update strategies as mentioned above. The vulnerability features include one or more of CVE number, title, type, solution, component name, version, and license information to build a component security knowledge base, and then at least one open source component output by the component intelligent recommendation model is used based on the component security knowledge base to obtain the security relationship between the components used in the project, and the safety factor of each open source component is calculated according to a preset scoring strategy.

[0111] See also Figure 5 , Figure 5 This is a control overall service flow chart for the use of open source components in software development, shown in an exemplary application scenario of the present application.

[0112] like Figure 5 As shown, during the software development process, the changes of the md5 values ​​in the pom files in the software development project are monitored in real time, and the newly introduced open source components in the project are obtained according to the changes of the md5 values, and the newly introduced open source components are pre-built in the component security knowledge base to obtain the relationship between the newly introduced open source components and the components used in the project, wherein the component security knowledge base can collect component vulnerability features through distributed crawlers, anti-crawlers and update strategies, and the vulnerability features include one or more of CVE number, title, type, solution, component name, version, and license information. Of course, manual import can also be used to cooperate with the import of specific component information or data import without Internet conditions, and each platform warehouse is associated through the preset open source security and compliance governance management platform system. Among them, the platform warehouse includes one or more of Github, Gitee, and Gitlab. According to the pre-built component security knowledge base, the association relationship between the newly introduced open source component and the components used in the project is obtained, and according to the association relationship, the open source component with a different version number from the newly introduced open source component is recommended as the target open source component; or according to the pre-built component security knowledge base, the constraint relationship between the newly introduced open source component and the components used in the project is obtained, and according to the constraint relationship, other open source components are recommended as the target open source component.

[0113] Furthermore, in another aspect of this embodiment, a pre-trained component intelligent recommendation model can be used to calculate the feature vector corresponding to the newly introduced open source component according to a preset calculation method, and the feature vector corresponding to the newly introduced open source component can be input into the component intelligent recommendation model to obtain at least one open source component outputted by the model, and then an open source component is determined from the at least one open source component as the target open source component. The solution for determining an open source component from at least one open source component as the target open source component can be to calculate the safety factor of each component in at least one open source component relative to the project, or to send at least one open source component to the developer so that the developer can select the most suitable open source component as the target open source component based on the actual situation, and so on.

[0114] Replace the newly introduced open source components with the identified target open source components, and after the target open source components are introduced into the project, detect the current security status of the project and provide corresponding repair plans for the existing security vulnerabilities so that developers can repair the project based on the repair plans.

[0115] In this embodiment, newly introduced open source components in the project are obtained by monitoring changes in project configuration files, and target open source components are recommended based on the security knowledge data of the newly introduced open source components through a component security knowledge base pre-constructed by crawling, and the newly introduced open source components are replaced with target open source components. After the target open source components are introduced, security checks are performed on the projects, and security issues of the components are repaired. In this way, not only is it ensured that the security risks brought by the newly introduced open source components are reduced, but also the effect of "repairing while developing" is achieved, which effectively avoids the tedious repair process caused by the accumulation of security issues and ensures the real-time nature of software development.

[0116] Figure 6 is a control block diagram of the use of open source components in software development shown in an exemplary embodiment of the present application. The device can be applied to Figure 1 The device may also be applicable to other exemplary implementation environments and specifically configured in other devices, and this embodiment does not limit the implementation environment to which the device is applicable.

[0117] The device includes:

[0118] A monitoring module 610 is used to monitor the configuration file changes of the project to be developed in real time to obtain the newly introduced open source components in the project;

[0119] A recommendation module 620, configured to obtain a recommended target open source component according to security knowledge data of a newly introduced open source component, wherein the security knowledge data includes version information;

[0120] The detection module 630 is used to replace the newly introduced open source component with the target open source component and introduce it into the project, and obtain the security information between the target open source component and the components used in the project, so as to perform security detection on the project according to the security information.

[0121] According to one aspect of the embodiment of the present application, the recommendation module 620 is further specifically configured to:

[0122] Based on the pre-built component security knowledge base, the relationship between the newly introduced open source components and the components used in the project is obtained, and the relationship includes an association relationship or a constraint relationship;

[0123] Based on the association relationship, recommend an open source component version with a different version number from the newly introduced open source component as the target open source component;

[0124] Or, other open source components are recommended as target open source components based on the constraint relationship.

[0125] According to one aspect of the embodiment of the present application, the device further includes a building module, which is used to:

[0126] Acquire security knowledge data of known components, including version information of components and relationships between components;

[0127] Build a component safety knowledge base based on safety knowledge data.

[0128] According to one aspect of the embodiment of the present application, the building block is also used to:

[0129] A component retrieval engine is established based on a component security knowledge base, and the retrieval engine is used to obtain security information between a component to be retrieved and other components.

[0130] According to one aspect of the embodiment of the present application, the detection module is used to:

[0131] Input the target open source component into the component search engine to obtain security information between the target open source component and the components used in the project. The security information includes security issues existing in the project and corresponding security repair suggestions.

[0132] Repair the project based on the security repair suggestions and perform security testing on the repaired project.

[0133] According to one aspect of the embodiment of the present application, the recommendation module 620 is used to:

[0134] Calculate the corresponding feature vector based on the security knowledge data of the newly introduced open source component;

[0135] Inputting the feature vector into the component intelligent recommendation model to obtain at least one open source component output by the component intelligent recommendation model;

[0136] A target open source component is determined from at least one open source component.

[0137] According to one aspect of the embodiment of the present application, the recommendation module 620 is used to:

[0138] Obtaining a safety factor for each open source component based on a safety relationship between at least one open source component and components used in the project;

[0139] An open source component with the highest security factor is selected from at least one open source component as a target open source component.

[0140] According to one aspect of the embodiment of the present application, the recommendation module 620 is further configured to:

[0141] Obtain the security relationship between each open source component and the components used in the project based on the pre-built component security knowledge base;

[0142] The safety factor of each open source component is obtained based on the security relationship.

[0143] It should be noted that the control device used by the open source component in software development provided in the above embodiment and the control method used by the open source component in software development provided in the above embodiment belong to the same concept, wherein the specific manner in which each module and unit performs the operation has been described in detail in the method embodiment and will not be repeated here. In actual applications, the control device used by the open source component in software development provided in the above embodiment can distribute the above functions to different functional modules as needed, that is, divide the internal structure of the device into different functional modules to complete all or part of the functions described above, and this is not limited here.

[0144] An embodiment of the present application also provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by one or more processors, the electronic device implements the control method for using open source components in software development provided in the above-mentioned embodiments.

[0145] Figure 7 The structure diagram of the computer system suitable for implementing the electronic device of the embodiment of the present application is shown. It should be noted that: Figure 7 The computer system 700 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0146] like Figure 7As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 702 or the program loaded from the storage part 708 to the random access memory (RAM) 703, such as executing the method in the above embodiment. In the RAM 703, various programs and data required for system operation are also stored. The CPU 1201, ROM 702 and RAM 703 are connected to each other through a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0147] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, a mouse, etc.; an output section 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed so that a computer program read therefrom is installed into the storage section 708 as needed.

[0148] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 709, and / or installed from a removable medium 711. When the computer program is executed by a central processing unit (CPU) 701, various functions defined in the system of the present application are executed.

[0149] It should be noted that the computer-readable medium shown in the embodiment of the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable computer program is carried. This propagated data signal can take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. A computer program contained on a computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0150] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0151] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0152] Another aspect of the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the control method used by the open source component in the software development as described above. The computer-readable storage medium may be included in the electronic device described in the above embodiment, or may exist independently without being assembled into the electronic device.

[0153] Another aspect of the present application also provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the control method used by the open source component in software development provided in the above-mentioned various embodiments.

[0154] The above content is only a preferred exemplary embodiment of the present application and is not intended to limit the implementation scheme of the present application. A person skilled in the art can easily make corresponding changes or modifications based on the main concept and spirit of the present application. Therefore, the scope of protection of the present application shall be based on the scope of protection required by the claims.

Claims

1. A method for controlling the use of open source components in software development, characterized in that: include: Monitor the configuration file changes of the project to be developed in real time to obtain the newly introduced open source components in the project; Obtaining a recommended target open source component according to the security knowledge data of the newly introduced open source component, wherein the security knowledge data includes version information; Replace the newly introduced open source component with the target open source component and introduce it into the project, and obtain security information between the target open source component and the components used in the project, so as to perform security detection on the project according to the security information; The obtaining of the recommended target open source component according to the security knowledge data of the newly introduced open source component includes: obtaining the relationship between the newly introduced open source component and the components used in the project based on a pre-built component security knowledge base, wherein the relationship includes an association relationship or a constraint relationship; recommending an open source component version having a version number different from that of the newly introduced open source component as the target open source component based on the association relationship; or, recommending other open source components as the target open source component based on the constraint relationship; Before obtaining the recommended target open source component according to the security knowledge data of the newly introduced open source component, the method further includes: obtaining security knowledge data of known components, the security knowledge data including version information of the components and the relationship between the components; and constructing the component security knowledge base based on the security knowledge data; The method further includes: establishing a component retrieval engine based on the component security knowledge base, the retrieval engine being used to obtain security information between the component to be retrieved and other components; the retrieval engine includes a mapping relationship between known security issues, components, repair suggestions, and risk levels; The obtaining of security information between the target open source component and the components used in the project to perform security detection on the project according to the security information includes: Inputting the target open source component into the component search engine to obtain security information between the target open source component and the components used by the project, wherein the security information includes security issues existing in the project and corresponding security repair suggestions; The project is repaired based on the security repair suggestion, and a security check is performed on the repaired project.

2. The method according to claim 1, characterized in that The target open source component recommended according to the security knowledge data of the newly introduced open source component includes: Calculate a corresponding feature vector according to the security knowledge data of the newly introduced open source component; Inputting the feature vector into a component intelligent recommendation model to obtain at least one open source component output by the component intelligent recommendation model; The target open source component is determined from the at least one open source component.

3. The method according to claim 2, characterized in that The determining the target open source component from the at least one open source component includes: Obtaining a safety factor of each open source component according to a safety relationship between at least one open source component and components used in the project; An open source component with the highest safety factor is selected from the at least one open source component as a target open source component.

4. The method according to claim 3, characterized in that The obtaining the safety factor of each open source component according to the safety relationship between at least one open source component and the components used in the project respectively includes: Acquire, according to a pre-built component security knowledge base, a security relationship between each open source component and a component used in the project; A safety factor of each open source component is obtained according to the security relationship.

5. A control device for use of open source components in software development, characterized in that: The device comprises: A monitoring module, used to monitor the changes in configuration files of the project to be developed in real time, so as to obtain newly introduced open source components in the project; A recommendation module, configured to obtain a recommended target open source component according to the security knowledge data of the newly introduced open source component, wherein the security knowledge data includes version information; a detection module, configured to replace the newly introduced open source component with the target open source component and introduce it into the project, and obtain security information between the target open source component and the components used in the project, so as to perform security detection on the project according to the security information; The recommendation module is further used to obtain, based on a pre-built component security knowledge base, a relationship between the newly introduced open source component and a component used in the project, the relationship including an association relationship or a constraint relationship; based on the association relationship, recommend an open source component version having a version number different from that of the newly introduced open source component as a target open source component; or, based on the constraint relationship, recommend other open source components as target open source components; The device also includes a construction module, which is used to obtain security knowledge data of known components, wherein the security knowledge data includes version information of components and relationships between components; and construct the component security knowledge base based on the security knowledge data; The construction module is also used to establish a component retrieval engine based on the component security knowledge base, and the retrieval engine is used to obtain security information between the component to be retrieved and other components; the retrieval engine includes a mapping relationship between known security issues, components, repair suggestions, and risk levels; The detection module is used to input the target open source component into the component retrieval engine to obtain security information between the target open source component and the components used in the project, the security information including the security issues existing in the project and the corresponding security repair suggestions; repair the project based on the security repair suggestions, and perform security detection on the repaired project.

6. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the electronic device to implement the control method used by open source components in software development as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that: Computer-readable instructions are stored thereon, and when the computer-readable instructions are executed by a processor of a computer, the computer is caused to execute the control method used by open source components in software development according to any one of claims 1 to 4.

Images