Component detection method and apparatus, electronic device, and computer-readable storage medium

Abstract

This disclosure provides a component detection method, apparatus, electronic device, and computer-readable storage medium, relating to the field of Internet technology. The method includes: acquiring first attribute information of a plurality of candidate components, the first attribute information being obtained based on vulnerability information data of the candidate components; obtaining association strength information between the candidate component and the plurality of candidate components based on the first attribute information and second attribute information of the candidate component; obtaining target attribute information of a target candidate component based on the association strength information, the target attribute information being the attribute information in the first attribute information; filtering target vulnerability information data of candidate components that match the target attribute information from the plurality of candidate components; and determining whether the candidate component has a vulnerability based on the target vulnerability information data. This disclosure, through association strength information, performs association search to comprehensively discover the association relationships of the candidate components, which can reduce the false negative rate of component detection.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of Internet, and particularly relates to a component detection method and device, electronic equipment and computer readable storage medium. BACKGROUND

[0002] Software development is an indispensable technical process in the technical field of Internet. In the software development process, components need to be detected, vulnerability information data in a vulnerability information library is used to identify vulnerabilities in the components, and the components are repaired to increase the security of the components.

[0003] In related technologies, when detecting components, vulnerability information data is searched according to dependency relationships, and the components are detected according to the searched vulnerability information data. However, the dependency relationships may be false dependency relationships, which leads to the inability to comprehensively and accurately identify vulnerabilities in the components to be detected, and further leads to a high false negative rate of vulnerabilities in the components to be detected.

[0004] It should be noted that the information disclosed in the above background section is only used to strengthen the understanding of the background of the present disclosure, and therefore can include information that does not constitute prior art known to those of ordinary skill in the art. SUMMARY

[0005] The present disclosure provides a component detection method and device, electronic equipment and computer readable storage medium, which at least partially solves the problem of the inability to comprehensively and accurately identify vulnerabilities in the components to be detected, and further solves the problem of a high false negative rate of vulnerabilities in the components to be detected.

[0006] Other characteristics and advantages of the present disclosure will become apparent from the following detailed description, or will be learned by practice of the present disclosure.

[0007] According to one aspect of the present disclosure, a component detection method is provided, which includes: obtaining first attribute information of a plurality of candidate components, the first attribute information being obtained based on vulnerability information data of the candidate components; obtaining correlation strength information between a component to be detected and the plurality of candidate components according to the first attribute information and second attribute information of the component to be detected; obtaining target attribute information of a target candidate component according to the correlation strength information, the target attribute information being attribute information in the first attribute information; filtering, from the plurality of candidate components, target vulnerability information data of a candidate component matching the target attribute information; and determining whether the component to be detected has a vulnerability according to the target vulnerability information data.

[0008] In an embodiment of the present disclosure, before the obtaining of the first attribute information of the plurality of candidate components, the method further comprises: crawling vulnerability information data of the candidate components on a vulnerability publishing platform; and performing information extraction on the vulnerability information data to obtain the first attribute information of the plurality of candidate components.

[0009] In an embodiment of the present disclosure, before the obtaining of the correlation strength information between the to-be-detected component and the plurality of candidate components according to the first attribute information and the second attribute information of the to-be-detected component, the method further comprises: processing the first attribute information to obtain first variation data; and wherein the obtaining of the correlation strength information between the to-be-detected component and the plurality of candidate components according to the first attribute information and the second attribute information of the to-be-detected component comprises: obtaining the correlation strength information between the to-be-detected component and the plurality of candidate components according to the first variation data and the second attribute information of the to-be-detected component.

[0010] In an embodiment of the present disclosure, the processing of the first attribute information to obtain first variation data comprises: performing one or more of combination processing, variation processing and crossover processing on the first attribute information to obtain the first variation data.

[0011] In an embodiment of the present disclosure, the second attribute information at least comprises component name and vulnerability information; and the obtaining of the correlation strength information between the to-be-detected component and the plurality of candidate components according to the first attribute information and the second attribute information of the to-be-detected component comprises: obtaining the correlation strength between the to-be-detected component and the plurality of candidate components according to the first variation data and the second attribute information of the to-be-detected component; sorting the correlation strength based on the component name and the vulnerability information in the second attribute information, and screening the candidate components whose correlation strength satisfies a preset condition; processing the first attribute information of the candidate components whose correlation strength satisfies the preset condition to obtain second variation data; and calculating the correlation strength between the second variation data and the second attribute information of the to-be-detected component to obtain the correlation strength information between the to-be-detected component and the plurality of candidate components.

[0012] In an embodiment of the present disclosure, the processing of the first attribute information of the candidate components whose correlation strength satisfies the preset condition to obtain second variation data comprises: performing one or more of combination processing, variation processing and crossover processing on the first attribute information of the candidate components whose correlation strength satisfies the preset condition to obtain the second variation data.

[0013] In one embodiment of the present disclosure, the determining whether the to-be-detected component has a vulnerability based on the target vulnerability information data comprises: comparing the target vulnerability information data with vulnerability information data of the to-be-detected component; and if a comparison result meets a preset condition, the to-be-detected component has a vulnerability.

[0014] According to another aspect of the present disclosure, there is provided a component detection apparatus, comprising: an acquisition module configured to acquire first attribute information of a plurality of to-be-selected components, the first attribute information being based on vulnerability information data of the to-be-selected components; an association strength generation module configured to obtain association strength information between the to-be-detected component and the plurality of to-be-selected components based on the first attribute information and second attribute information of the to-be-detected component; a selection module configured to obtain target attribute information of a target to-be-selected component based on the association strength information, the target attribute information being attribute information in the first attribute information; a screening module configured to screen, from the plurality of to-be-selected components, target vulnerability information data of a to-be-selected component that matches the target attribute information; and a processing module configured to determine whether the to-be-detected component has a vulnerability based on the target vulnerability information data.

[0015] According to still another aspect of the present disclosure, there is provided an electronic device, comprising:

[0016] a processor; and a memory configured to store executable instructions of the processor; wherein the processor is configured to execute the component detection method described above via execution of the executable instructions.

[0017] According to yet another aspect of the present disclosure, there is provided a computer readable storage medium having stored thereon a computer program, the computer program being executed by a processor to implement the component detection method described above.

[0018] According to yet another aspect of the present disclosure, there is provided a computer program product, the computer program product comprising a computer program or computer instructions, the computer program or the computer instructions being loaded and executed by a processor to cause a computer to implement the component detection method described above.

[0019] The embodiment of the disclosure provides a component detection method, device, electronic equipment and computer readable storage medium. First attribute information of a plurality of candidate components is acquired, the first attribute information is obtained based on vulnerability information data of the candidate components, and the first attribute information is attribute information with high credibility. Then, according to the first attribute information and second attribute information of a component to be detected, correlation strength information between the component to be detected and the plurality of candidate components is obtained. According to the correlation strength information, the disclosure performs correlation search through the correlation strength information, comprehensively discovers the correlation of the component to be detected, obtains target attribute information of a target candidate component through the search, and then obtains target vulnerability information data according to the target attribute information, so as to determine whether the component to be detected has a vulnerability. The disclosure can reduce the false negative rate of component detection.

[0020] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and cannot limit the disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0021] The drawings incorporated into the specification and forming part of the specification, show embodiments consistent with the disclosure, and together with the specification, serve to explain the principles of the disclosure. Obviously, the drawings in the following description are only some embodiments of the disclosure, and other drawings can be obtained by those skilled in the art without creative labor.

[0022] Figure 1 A schematic diagram showing a system architecture in an embodiment of the disclosure is shown;

[0023] Figure 2 A flowchart of a component detection method in an embodiment of the disclosure is shown;

[0024] Figure 3 A flowchart of a component detection method in another embodiment of the disclosure is shown;

[0025] Figure 4 A relationship diagram of a target candidate component in an embodiment of the disclosure is shown;

[0026] Figure 5 A flowchart of a component detection method in another embodiment of the disclosure is shown;

[0027] Figure 6 A relationship diagram of a component to be detected in an embodiment of the disclosure is shown;

[0028] Figure 7 A schematic diagram of a component detection device in an embodiment of the disclosure is shown;

[0029] Figure 8 A structural block diagram of an electronic equipment in an embodiment of the disclosure is shown;

[0030] Figure 9 FIG. 1 shows a schematic diagram of a computer-readable storage medium provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0031] Example implementations are now described with reference to the drawings; however, these descriptions are not intended to limit example implementations to one or more particular embodiments described. On the contrary, these descriptions are intended to cover all example implementations falling within the scope of the disclosure, equivalents thereof, and combinations of features disclosed therein.

[0032] In addition, the drawings are merely schematic and are not drawn to scale. Like reference numerals designate like elements throughout the drawings. To the extent that the figures illustrate diagrams, these diagrams can provide one or more examples of how to implement a system, method or computer program product. The same numbers are used in different drawings to indicate the same or similar elements. Thus, duplicated descriptions can be omitted.

[0033] In the field of Internet technology, software development is an indispensable process. During the software development process, software developers can speed up the development process and reduce development costs by developing software through pre-set open source components. Therefore, open source components are increasingly becoming an important basis for Internet technology research and development. Open source components, a type of third-party components that can be applied to software application development, have characteristics such as openness, diversity, and convenience, and are widely used in software development processes.

[0034] During the software development process, the security of the developed to-be-detected component is detected through vulnerability information data in the component vulnerability information library. One of the difficulties faced by component detection is that the component vulnerability information library is not perfect, and incomplete information will lead to a high false negative rate of component detection. The current work for maintaining the vulnerability information library is usually implemented by generating a knowledge graph after crawling vulnerability information data by scripts. However, this method cannot have data generalization analysis capability, leading to a high false negative rate of component detection. During component detection, a large number of component dependency relationships and features are often involved. This method cannot identify the relationship between components, and accurately identify component vulnerabilities.

[0035] In addition, when detecting the component, the dependency relationship is searched for vulnerability information data, and the component is detected by using the searched vulnerability information data. However, the dependency relationship can be a false dependency relationship. The false dependency relationship can be caused by that the component code to be detected does not actually refer to the component, that the version of the component to be detected in the component vulnerability information library of the component to be selected is incorrect, or that the dependency is indirect. Therefore, the vulnerability of the component to be detected cannot be comprehensively and accurately identified, and the false negative rate of the vulnerability of the component to be detected is high.

[0036] In order to facilitate understanding of the technical solutions provided by the embodiments of the present disclosure, the specific embodiments of the present disclosure will be described in detail in combination with the drawings.

[0037] Figure 1 A schematic diagram of an exemplary system architecture of a component detection method or a component detection device that can be applied to the embodiments of the present disclosure is shown.

[0038] As shown in Figure 1 , the system architecture can include a network 101, a terminal device 102, and a server 103.

[0039] The network 101 is a medium for providing a communication link between the terminal device 102 and the server 103, and can be a wired network or a wireless network.

[0040] Optionally, the wireless or wired networks described above use standard communications technologies and / or protocols. The network typically provides Internet or Intranet connectivity, but can also be a combination of networks, including, but not limited to, a Local Area Network (LAN), a Metropolitan Area Network (MAN), a Wide Area Network (WAN), a mobile, wired or wireless network, a private network, or a virtual private network (VPN). In some embodiments, the data exchanged over the network is represented using technologies and / or formats including, but not limited to, Hypertext Markup Language (HTML), Extensible Markup Language (XML), etc. In addition, conventional encryption technologies such as the Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPsec), etc. can be used to encrypt all or some links. In other embodiments, custom and / or proprietary data communications technologies and / or protocols can be used in place of, or in addition to, the ones described above.

[0041] The terminal device 102 can be various electronic devices, including but not limited to a smartphone, a tablet computer, a laptop computer, a desktop computer, a wearable device, an augmented reality device, a virtual reality device, etc.

[0042] Optionally, the clients of the application programs installed in different terminal devices 102 are the same, or the clients of the same type of application programs based on different operating systems. Based on the difference of terminal platforms, the specific forms of the clients of the application programs can also be different, for example, the application program client can be a mobile phone client, a PC client, etc.

[0043] The server 103 can be a server providing various services, for example, a background management server providing support for the device operated by the user using the terminal device 102. The background management server can analyze and process the received request data, etc., and feed back the processing result to the terminal device.

[0044] Optionally, the server 103 can be a stand-alone physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and basic cloud computing services such as big data and artificial intelligence platforms.

[0045] Based on at least one of the above problems, an assembly detection method is provided in the embodiments of the present disclosure. The server 103 obtains first attribute information of a plurality of candidate assemblies, and the first attribute information is obtained based on vulnerability information data of the candidate assemblies. According to the first attribute information and second attribute information of a to-be-detected assembly, association strength information between the to-be-detected assembly and the plurality of candidate assemblies is obtained. According to the association strength information, target attribute information of a target candidate assembly is obtained, and the target attribute information is attribute information in the first attribute information. In the plurality of candidate assemblies, target vulnerability information data of a candidate assembly matching the target attribute information is screened. According to the target vulnerability information data, it is determined whether the to-be-detected assembly has a vulnerability. The method can be applied in the scenario of assembly detection, such as security detection, assembly component analysis, and assembly detection of APP (application software) assemblies in the communication field. Through the association strength information, the present disclosure performs association search and comprehensively discovers the association relationship of the to-be-detected assembly. The target attribute information of the target candidate assembly is obtained through the search, and then the target vulnerability information data is obtained according to the target attribute information, so as to determine whether the to-be-detected assembly has a vulnerability. The present disclosure can reduce the false negative rate of assembly detection.

[0046] Next, the technical solutions provided by the embodiments of the present disclosure will be described.

[0047] Those skilled in the art can know that, Figure 1 The number of terminal devices 102, networks 101, and servers 103 in the system shown in FIG. 1 is only illustrative, and there can be any number of terminal devices 102, networks 101, and servers 103 according to actual needs. The embodiments of the present disclosure do not limit this.

[0048] After a preliminary introduction to the system architecture provided by the embodiments of the present disclosure, the assembly detection method provided by the embodiments of the present disclosure will be described next. The method can be executed by any electronic device with computing processing capability. In some embodiments, the assembly detection method provided in the embodiments of the present disclosure can be executed in the server 103 as shown in FIG. 1. Figure 1

[0049] Figure 2 A flowchart of an assembly detection method in the embodiments of the present disclosure is shown in FIG. 2. As shown in FIG. 2, the method includes the following steps. Figure 2 ​As shown, the component detection method provided in the embodiments of the present disclosure includes the following S201 to S205.

[0050] S201. Obtain first attribute information of a plurality of candidate components, the first attribute information being obtained based on vulnerability information data of the candidate components.

[0051] The first attribute information at least includes one or more of a component name, a component source, a release time, vulnerability information, and a license. For the specific first attribute information, the embodiments are not limited. For example, the first attribute information includes the component name, the component source, the release time, the vulnerability information, and the license.

[0052] In one embodiment, as shown, Figure 3 Before the obtaining of the first attribute information of the plurality of candidate components, the component detection method further includes S301 to S302.

[0053] S301. Crawling vulnerability information data of the candidate components on a vulnerability release platform.

[0054] The candidate components are components in a component vulnerability information library. The present disclosure does not limit the specific vulnerability release platforms. For example, the vulnerability release platforms include one or more of NVD (National Vulnerability Database), CVE (Common Vulnerabilities and Exposures), Security Focus, CNNVD (China National Vulnerability Database of Information Security), CNVD (China National Vulnerability Database), and WooYun. The information obtained by crawling the vulnerability release platforms is used to establish the component vulnerability information library. During the establishment, steps such as deduplication, translation, association with projects, association with components, and manual review can be included. The vulnerability information data source is authoritative, and the vulnerability information data is extensive and rich.

[0055] It should be noted that the component vulnerability information library can be updated as needed, and the component vulnerability information library can be updated according to a preset time, for example, the component vulnerability information library is updated once a day; or the component vulnerability information library can be updated the day before detecting the to-be-detected component. The present embodiment does not limit when the component vulnerability information library is updated, and the component vulnerability information library can be updated as needed. The present disclosure crawls multiple vulnerability publishing platforms, and the collected vulnerability information data is more perfect, thereby reducing the false negative rate of the component detection result.

[0056] S302. Information extraction is performed on the vulnerability information data to obtain first attribute information of a plurality of to-be-selected components.

[0057] The first attribute information at least includes one or more of a component name, a component source, a publication time, vulnerability information, and a license. The present embodiment does not limit the first attribute information. For example, the first attribute information includes a component name, a component source, a publication time, vulnerability information, and a license. The license can include Apache (a free software license issued by the Apache Software Foundation), a license derived from the Massachusetts Institute of Technology (MIT), a Lesser General Public License (LGPL), a license derived from the Berkeley Software Distribution (BSD), a General Public License (GPL), a software license derived from the Mozilla group (MPL), a Server Side Public License (SSPL), and the like. The present embodiment does not limit the license.

[0058] The vulnerability information data of the components in the component vulnerability information library is statistically analyzed to extract detailed information related to the vulnerability to obtain the first attribute information. The present disclosure does not limit how to obtain the first attribute information. For example, the first attribute information can be extracted by OpenUE (Open Toolbox). The present disclosure does not limit how to extract the first attribute information. Any method that can extract the first attribute information from the vulnerability information data is acceptable.

[0059] S202. According to the first attribute information and the second attribute information of the to-be-detected component, the correlation strength information between the to-be-detected component and the plurality of to-be-selected components is obtained.

[0060] The second attribute information at least includes one or more of a component name, a component source, a release time, vulnerability information, and a license, and the second attribute information can be the same as the first attribute information or partially the same as the first attribute information.

[0061] It should be noted that the to-be-detected component can depend on multiple to-be-selected components, each to-be-selected component on which the to-be-detected component depends has corresponding second attribute information, the correlation strength information between the to-be-detected component and the multiple to-be-selected components is obtained by counting and analyzing the first attribute information and the second attribute information of the to-be-detected component, the correlation strength information between the to-be-detected component and the multiple to-be-selected components can also be obtained by calculating the Euclidean distance between the first attribute information and the second attribute information, and the correlation strength information between the to-be-detected component and the multiple to-be-selected components can also be obtained by calculating the cosine similarity between the first attribute information and the second attribute information. How to obtain the correlation strength information is not limited in the present disclosure.

[0062] For example, as shown in FIG. 4, Figure 4 Figure 4 41 indicates a target to-be-selected component, 42 indicates a to-be-detected component, the target to-be-selected component 41 is a to-be-selected component having a strong dependency relationship with the to-be-detected component 42, for example, if the correlation strength information between the to-be-selected component and the to-be-detected component 42 is greater than 0.98, the to-be-selected component is the target to-be-selected component 41 having a strong dependency relationship with the to-be-detected component 42. 43 indicates a to-be-selected component having no strong dependency relationship with the to-be-detected component 42, for example, a to-be-selected component having a correlation strength information less than or equal to 0.98 with the to-be-detected component 42. 44, 45, 46, and 47 are used to indicate the second attribute information of the target to-be-selected component 42.

[0063] S203. Obtain target attribute information of the target to-be-selected component according to the correlation strength information, and the target attribute information is attribute information in the first attribute information.

[0064] The target attribute information at least includes one or more of a component name, a component source, a release time, vulnerability information, and a license, and the target attribute information can be completely the same as the first attribute information or partially the attribute information of the first attribute information, for example, the first attribute information includes a component name, a component source, a release time, vulnerability information, and a license, and the target attribute information includes a component name and vulnerability information. The component name, the component source, the release time, the vulnerability information, and the license can each include one or more of a text, a letter, a number, and a symbol.

[0065] S204. In the multiple to-be-selected components, filter target vulnerability information data of a to-be-selected component matching the target attribute information.

[0066] ​The target vulnerability information data is target vulnerability information data of the target candidate component, and is used for comparison with the vulnerability information data of the component to be detected. The server screens the target vulnerability information data of the target candidate component that matches the target attribute information. How to screen is not limited in the embodiments of the present disclosure. For example, the target vulnerability information data of the target candidate component that matches the target attribute information can be found according to the corresponding relationship table. The target vulnerability information data of the target candidate component that matches the target attribute information can also be found according to the corresponding relationship curve.

[0067] S205. Determine whether the component to be detected has a vulnerability according to the target vulnerability information data.

[0068] In one embodiment, the target vulnerability information data is compared with the vulnerability information data of the component to be detected. If the comparison result meets a preset condition, the component to be detected has a vulnerability.

[0069] For example, whether the target vulnerability information data is the same as the vulnerability information data of the component to be detected is compared. If yes, it is indicated that the component to be detected has a vulnerability.

[0070] It should be noted that there can be multiple target candidate components, and there are multiple target vulnerability information data corresponding to the target candidate components. The multiple target vulnerability information data is compared with the vulnerability information data of the component to be detected. If all are the same, the sum of the vulnerabilities of the multiple target vulnerability information data is the number of vulnerabilities of the component to be detected.

[0071] In another embodiment, the target vulnerability information data is compared with the vulnerability information data of the component to be detected. If the comparison result does not meet a preset condition, the component to be detected does not have a vulnerability.

[0072] For example, whether the target vulnerability information data is the same as the vulnerability information data of the component to be detected is compared. If no, it is indicated that the component to be detected does not have a vulnerability.

[0073] As shown in FIG. 6, the component to be detected 42 obtains the target candidate component 41 according to the correlation strength information, thereby obtaining the first attribute information indicated by 61, 62, 63 and 64 in FIG. 6, and then obtains the target vulnerability information data through the first attribute information, and further determines whether the component to be detected has a vulnerability. Figure 4 Figure 6 The present disclosure comprehensively discovers the correlation relationship of the component to be detected through correlation search based on the correlation strength information, obtains the target attribute information of the target candidate component through search, and then obtains the target vulnerability information data according to the target attribute information, so as to determine whether the component to be detected has a vulnerability. The present disclosure realizes search based on correlation degree by combining the vulnerability information data in the component vulnerability information library and the target vulnerability information data, and can reduce the false negative rate of component detection. ​

[0074] The disclosure establishes a dependency relationship between the extracted first attribute information and the second attribute information of the to-be-detected component, the dependency relationship being a real dependency relationship, i.e., association strength information, thereby detecting the to-be-detected component according to the real dependency relationship, and reducing the false negative rate of the to-be-detected component.

[0075] In one embodiment, before obtaining the association strength information between the to-be-detected component and the plurality of candidate components according to the first attribute information and the second attribute information of the to-be-detected component, the method further comprises: processing the first attribute information to obtain first mutation data.

[0076] The association strength information between the to-be-detected component and the plurality of candidate components is obtained according to the first attribute information and the second attribute information of the to-be-detected component, comprising:

[0077] The association strength information between the to-be-detected component and the plurality of candidate components is obtained according to the first mutation data and the second attribute information of the to-be-detected component.

[0078] For example, one or more of the combination processing, mutation processing, and crossover processing of the first attribute information is performed to obtain the first mutation data.

[0079] One or more of the combination processing, mutation processing, and crossover processing of the first attribute information can improve the generalization analysis capability of the data and reduce the false negative rate of the component detection.

[0080] For example, the publication time in the first attribute information is not complete, and the combination processing is performed on the publication time to complete the publication time in the first attribute information, so as to prevent incomplete or insufficient data from causing deviation of the association strength information.

[0081] For another example, the mutation processing is performed on the first attribute information to obtain new first attribute information, i.e., the first mutation data, thereby improving the generalization capability of the data. For example, the Gaussian approximation mutation processing is performed on the first attribute information by using a genetic algorithm to obtain the first mutation data.

[0082] In one embodiment, the second attribute information at least includes component name and vulnerability information; the association strength information between the to-be-detected component and the plurality of candidate components is obtained according to the first attribute information and the second attribute information of the to-be-detected component, comprising the following S501 to S504.

[0083] S501. The association strength between the to-be-detected component and the plurality of candidate components is obtained according to the first mutation data and the second attribute information of the to-be-detected component.

[0084] The method of obtaining the correlation strength according to the first variation data and the second attribute information of the component to be detected is the same as in S202, and this embodiment will not be described here.

[0085] It should be noted that the correlation strength is the correlation strength between the attribute information included in the second attribute information and the attribute information included in the first variation data. For example, the attribute information of the second attribute information includes component name, component source, release time, vulnerability information and license; and the attribute information of the first variation data includes component name, component source, release time, vulnerability information and license.

[0086] The attribute information of the second attribute information corresponds to the attribute information of the first variation data, and the correlation strength is the correlation strength between the attribute information of the second attribute information and the corresponding attribute information of the first variation data. The correlation strength between the second attribute information and the first variation data is calculated by cosine similarity, and the correlation strength between the second attribute information and the first variation data is shown in Table 1:

[0087] Table 1 Correlation strength between second attribute information and first variation data

[0088]

[0089] It should be noted that the greater the value of the correlation strength, the greater the correlation similarity between the attribute information, and vice versa. When the correlation strength is 1, it means that the attribute information is the same; and when the correlation strength is 0, it means that the attribute information is completely different. Table 1 is an example of the correlation strength between a selected component and the second attribute information, and the correlation strength is an association array, i.e. {1, 0.33, 1, 1, 1}. When there are multiple selected components, the attribute information of the multiple selected components is respectively associated with the second attribute information to obtain multiple association arrays.

[0090] S502. Based on the component name and the vulnerability information in the second attribute information, the correlation strength is sorted, and the selected component satisfying the preset condition is filtered.

[0091] For example, based on the component name in the second attribute information, the correlation strength is sorted from large to small. In the case that the correlation strength of the component name is the same, the correlation strength of the component name with the same correlation strength is sorted from large to small according to the correlation strength of the vulnerability information. The selected component is selected in the first three and / or the correlation strength of the attribute information is greater than 0.9. Through sorting, the data is filtered, the data operation amount is reduced, the operation speed is improved, and the efficiency of component security detection is improved.

[0092] For example, the component names in the second attribute information are sorted from smallest to largest in terms of association strength. When the association strength of component names is the same, the component names with the same association strength are sorted from smallest to largest according to the vulnerability information. The last three components and / or the components with an association strength greater than 0.9 in the attribute information are selected as candidates. By sorting, the data is filtered, the amount of data processing is reduced, the processing speed is improved, and thus the efficiency of component security detection is improved.

[0093] S503. Process the first attribute information of the components to be selected whose correlation strength meets the preset conditions to obtain the second variation data.

[0094] The second mutation data includes the correlation strength, and also includes at least one or more of the following: component name, component source, release time, vulnerability information, and license, so as to obtain the target attribute information of the target component to be selected based on the second mutation data.

[0095] In one embodiment, the first attribute information of the candidate components whose association strength meets the preset conditions is subjected to one or more of the following processes: combination processing, mutation processing, and cross processing, to obtain the second mutation data.

[0096] By performing one or more of the following processing methods on the first attribute information of candidate components whose association strength meets the preset conditions: combination processing, mutation processing, and cross processing, the generalization analysis capability of the data can be improved and the false negative rate of component detection can be reduced.

[0097] S504. Calculate the association strength between the second variant data and the second attribute information of the component to be detected, and obtain the association strength information between the component to be detected and multiple components to be selected.

[0098] The method for calculating the correlation strength between the second variant data and the second attribute information of the component to be detected is the same as in S202, and will not be repeated here in this embodiment.

[0099] Based on the same inventive concept, this disclosure also provides a component detection device, as described in the following embodiments. Since the principle by which this device embodiment solves the problem is similar to that of the above-described method embodiment, the implementation of this device embodiment can refer to the implementation of the above-described method embodiment, and repeated details will not be elaborated further.

[0100] Figure 7 This diagram illustrates a component detection device according to an embodiment of the present disclosure, such as... Figure 7 As shown, the device includes an acquisition module 71, a correlation strength generation module 72, a selection module 73, a filtering module 74, and a processing module 75.

[0101] The acquisition module 71 is used to acquire the first attribute information of multiple components to be selected. The first attribute information is obtained based on the vulnerability information data of the components to be selected.

[0102] The association strength generation module 72 is used to obtain the association strength information between the component to be detected and multiple components to be selected based on the first attribute information and the second attribute information of the component to be detected;

[0103] The selection module 73 is used to obtain the target attribute information of the target component to be selected based on the association strength information. The target attribute information is the attribute information in the first attribute information.

[0104] The filtering module 74 is used to filter target vulnerability information data of candidate components that match the target attribute information from multiple candidate components.

[0105] Processing module 75 is used to determine whether the component to be detected has a vulnerability based on the target vulnerability information data.

[0106] In one embodiment, the acquisition module 71 is further configured to crawl vulnerability information data of the components to be selected from the vulnerability release platform; extract information from the vulnerability information data to obtain first attribute information of multiple components to be selected.

[0107] In one embodiment, the acquisition module 71 is further configured to process the first attribute information to obtain first mutation data; the association strength generation module 72 is further configured to obtain association strength information between the component to be detected and multiple components to be selected based on the first mutation data and the second attribute information of the component to be detected.

[0108] In one embodiment, the acquisition module 71 is further configured to perform one or more of the following processes on the first attribute information: combination processing, mutation processing, and cross processing, to obtain the first mutated data.

[0109] In one embodiment, the second attribute information includes at least the component name and vulnerability information;

[0110] The association strength generation module 72 is also used to obtain the association strength between the component to be detected and multiple components to be selected based on the first mutation data and the second attribute information of the component to be detected;

[0111] The association strength is sorted based on the component name and vulnerability information in the second attribute information, and the components that meet the preset conditions for association strength are selected.

[0112] The first attribute information of the candidate components whose correlation strength meets the preset conditions is processed to obtain the second variation data;

[0113] Calculate the association strength between the second variant data and the second attribute information of the component to be detected, and obtain the association strength information between the component to be detected and multiple components to be selected.

[0114] The association strength generation module 72 is also used to perform one or more of the following processes on the first attribute information of the candidate components whose association strength meets the preset conditions: combination processing, mutation processing, and cross processing, to obtain the second mutation data.

[0115] The processing module 75 is also used to compare the target vulnerability information data with the vulnerability information data of the component to be detected;

[0116] If the comparison result meets the preset conditions, then the component to be tested has a vulnerability.

[0117] Those skilled in the art will understand that various aspects of this disclosure can be implemented as a system, method, or program product. Therefore, various aspects of this disclosure can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "system."

[0118] The following reference Figure 8 To describe an electronic device 800 according to such an embodiment of the present disclosure. Figure 8 The electronic device 800 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0119] like Figure 8 As shown, the electronic device 800 is manifested in the form of a general-purpose computing device. The components of the electronic device 800 may include, but are not limited to: at least one processing unit 810, at least one storage unit 820, and a bus 830 connecting different system components (including storage unit 820 and processing unit 810).

[0120] The storage unit stores program code that can be executed by the processing unit 810, causing the processing unit 810 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure. For example, the processing unit 810 can perform the following steps of the above method embodiment: obtaining first attribute information of a plurality of candidate components, the first attribute information being obtained based on vulnerability information data of the candidate components; obtaining association strength information between the candidate component and the plurality of candidate components based on the first attribute information and second attribute information of the candidate component to be detected; obtaining target attribute information of the target candidate component based on the association strength information, the target attribute information being the attribute information in the first attribute information; filtering the candidate components among the plurality of candidate components that match the target attribute information; and determining whether the candidate component to be detected has a vulnerability based on the target vulnerability information data.

[0121] Storage unit 820 may include a readable medium in the form of a volatile storage unit, such as random access memory (RAM) 8201 and / or cache memory 8202, and may further include a read-only memory (ROM) 8203.

[0122] The storage unit 820 may also include a program / utility 8204 having a set (at least one) of program modules 8205, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0123] Bus 830 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0124] Electronic device 800 can also communicate with one or more external devices 840 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 800, and / or with any device that enables electronic device 800 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 850. Furthermore, electronic device 800 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 860. As shown, network adapter 860 communicates with other modules of electronic device 800 via bus 830. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0125] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0126] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. Figure 9 This illustration shows a schematic diagram of a computer-readable storage medium provided in an embodiment of the present disclosure, such as... Figure 9 As shown, the computer-readable storage medium 900 stores a program product capable of implementing the methods described above. In some possible embodiments, various aspects of this disclosure may also be implemented as a program product comprising program code that, when run on a terminal device, causes the terminal device to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure.

[0127] More specific examples of computer-readable storage media in this disclosure may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0128] In this disclosure, a computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting a program for use by or in connection with an instruction execution system, apparatus, or device.

[0129] Optionally, the program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0130] In practical implementation, program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0131] The disclosed embodiments also provide a computer program product, which includes a computer program or computer instructions that are loaded and executed by a processor to enable a computer to perform the steps of the various exemplary embodiments according to the present disclosure described in the "Detailed Description" section above.

[0132] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0133] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0134] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0135] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope of this disclosure is indicated by the appended claims.

Claims

1. A component detection method, characterized in that, include: Obtain first attribute information of multiple candidate components, the first attribute information being obtained based on vulnerability information data of the candidate components; Based on the first attribute information and the second attribute information of the component to be detected, the association strength information between the component to be detected and the plurality of components to be selected is obtained; Based on the association strength information, the target attribute information of the target component to be selected is obtained, wherein the target attribute information is the attribute information in the first attribute information; Among the plurality of candidate components, target vulnerability information data of candidate components that match the target attribute information are filtered; Based on the target vulnerability information data, determine whether the component to be detected has a vulnerability; Before obtaining the association strength information between the component to be detected and the plurality of selected components based on the first attribute information and the second attribute information of the component to be detected, the method further includes: processing the first attribute information to obtain first mutation data; wherein, processing the first attribute information to obtain the first mutation data includes: performing one or more of the following: combination processing, mutation processing and cross processing on the first attribute information to obtain the first mutation data; The step of obtaining the association strength information between the component to be detected and the plurality of candidate components based on the first attribute information and the second attribute information of the component to be detected includes: obtaining the association strength information between the component to be detected and the plurality of candidate components based on the first mutation data and the second attribute information of the component to be detected.

2. The component detection method according to claim 1, characterized in that, Before obtaining the first attribute information of the multiple components to be selected, the method further includes: Crawl vulnerability information data of the components to be selected from the vulnerability disclosure platform; Information is extracted from the vulnerability information data to obtain the first attribute information of the multiple candidate components.

3. The component detection method according to claim 1, characterized in that, The second attribute information includes at least the component name and vulnerability information; The step of obtaining the association strength information between the component to be detected and the plurality of selectable components based on the first attribute information and the second attribute information of the component to be detected includes: Based on the first mutation data and the second attribute information of the component to be detected, the correlation strength between the component to be detected and the plurality of components to be selected is obtained; The association strength is sorted based on the component name and vulnerability information in the second attribute information, and the components whose association strength meets the preset conditions are selected. The first attribute information of the candidate components whose correlation strength meets the preset conditions is processed to obtain the second variation data; Calculate the association strength between the second variant data and the second attribute information of the component to be detected, and obtain the association strength information between the component to be detected and multiple components to be selected.

4. The component detection method according to claim 3, characterized in that, The first attribute information of the candidate components whose association strength meets the preset conditions is processed to obtain the second mutation data, including: The first attribute information of the candidate components whose correlation strength meets the preset conditions is subjected to one or more of the following processes: combination processing, mutation processing, and cross processing, to obtain the second mutation data.

5. The component detection method according to claim 1, characterized in that, The step of determining whether the component to be detected has a vulnerability based on the target vulnerability information data includes: Compare the target vulnerability information data with the vulnerability information data of the component to be detected; If the comparison result meets the preset conditions, then the component to be tested has a vulnerability.

6. A component testing device, characterized in that, include: The acquisition module is used to acquire the first attribute information of multiple components to be selected, the first attribute information being obtained based on the vulnerability information data of the components to be selected; The association strength generation module is used to obtain the association strength information between the component to be detected and the plurality of components to be selected based on the first attribute information and the second attribute information of the component to be detected; The selection module is used to obtain target attribute information of the target component to be selected based on the association strength information, wherein the target attribute information is the attribute information in the first attribute information; The filtering module is used to filter target vulnerability information data of the candidate components that match the target attribute information from the plurality of candidate components; The processing module is used to determine whether the component to be detected has a vulnerability based on the target vulnerability information data; The acquisition module is further configured to process the first attribute information to obtain first variant data; wherein, processing the first attribute information to obtain the first variant data includes: performing one or more of the following: combination processing, mutation processing, and cross processing on the first attribute information to obtain the first variant data; The association strength generation module is further configured to obtain association strength information between the component to be detected and the plurality of components to be selected based on the first mutation data and the second attribute information of the component to be detected.

7. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the component detection method of any one of claims 1-5 by executing the executable instructions.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the component detection method according to any one of claims 1-5.

Images