Risk assessment method, device, medium and apparatus

Abstract

Embodiments of this application disclose an application risk assessment method, apparatus, medium, and device. The application risk assessment method includes: acquiring the integration objects, step execution parameters, and risk assessment strategies corresponding to multiple integration steps to be assessed during the integration process of a target application; performing security detection on the integration objects of each integration step according to the risk assessment strategy to obtain security detection data corresponding to each integration step; calculating the risk hazard coefficient corresponding to each integration step based on the security detection data; calculating the risk probability coefficient corresponding to each integration step based on the step execution parameters; conducting a multi-faceted security risk assessment for each integration step; and obtaining the risk assessment result corresponding to the target application based on the risk hazard coefficient and risk probability coefficient corresponding to each integration step, thereby comprehensively assessing the security of the target application and obtaining a more accurate risk assessment result.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically, to an application risk assessment method, apparatus, computer-readable storage medium, and electronic device. Background Technology

[0002] Container technology effectively divides the resources of a single operating system into isolated groups, allowing for better balancing of conflicting resource usage demands among these groups, thereby significantly improving work efficiency. Docker is an open-source application container engine that effectively solves application runtime environment and configuration issues, laying a solid foundation for continuous integration and continuous deployment.

[0003] Currently, with the promotion of continuous integration and the increasing emphasis on application security, how to conduct security assessments on applications obtained through continuous integration is an urgent problem to be solved in this field. Summary of the Invention

[0004] To address the aforementioned technical problems, embodiments of this application provide an application risk assessment method, apparatus, computer-readable storage medium, and electronic device for performing security assessments on integrated applications.

[0005] According to one aspect of the embodiments of this application, an application risk assessment method is provided, the method comprising:

[0006] The integration step parameters for each integration step to be evaluated during the integration process of the target application are obtained. The integration step parameters include the integration object, step execution parameters and risk assessment strategy corresponding to each integration step.

[0007] Based on the risk assessment strategy, security testing is performed on the integration objects of each integration step to obtain security testing data corresponding to each integration step;

[0008] Calculate the risk hazard coefficient for each integration step based on the safety test data, and calculate the risk probability coefficient for each integration step based on the step execution parameters.

[0009] Based on the risk hazard coefficient and risk probability coefficient corresponding to each integration step, the risk assessment results corresponding to the target application are obtained.

[0010] In some embodiments, the integration steps to be evaluated include code submission, code compilation, and image packaging; security checks are performed on the integration objects of each integration step according to the risk assessment strategy to obtain security check data corresponding to each integration step, including:

[0011] Obtain the code submitted during the code submission process, perform static code security checks on the code, and obtain the code security check data corresponding to the code submission process.

[0012] In the code compilation step, the code is compiled to obtain intermediate files, and intermediate file security checks are performed on the intermediate files to obtain intermediate file security check data corresponding to the code compilation step;

[0013] In the image packaging step, intermediate files are image packaged to obtain an image file, and the image file security is checked to obtain the image file security check data corresponding to the image packaging step.

[0014] In some embodiments, static code security testing is performed on the code to obtain code security testing data corresponding to the code submission step, including:

[0015] Detect defective codes contained in the detection code;

[0016] The defect types contained in the defect codes and the number of defect codes corresponding to each defect type are counted to obtain the code defect statistics results;

[0017] Based on the code defect statistics, obtain the code security detection data corresponding to the code submission steps;

[0018] Calculate the risk hazard coefficient for each integration step based on the safety testing data, including:

[0019] Identify the risk level corresponding to each defect type, and obtain the weight parameters corresponding to each defect type based on the risk level;

[0020] The risk hazard coefficient corresponding to the code submission step is obtained by weighting the number of defect codes corresponding to each defect type based on the weighting parameters.

[0021] In some embodiments, intermediate file security checks are performed on intermediate files to obtain intermediate file security check data corresponding to the code compilation step, and image file security checks are performed on image files to obtain image file security check data corresponding to the image packaging step, including:

[0022] Scan intermediate files to find vulnerabilities contained within them; and scan image files to find vulnerabilities contained within them.

[0023] The vulnerability score for each intermediate file vulnerability is obtained from the general vulnerability scoring system, thus obtaining the security detection data for the intermediate files corresponding to the code compilation step; and the vulnerability score for each image file vulnerability is obtained from the general vulnerability scoring system, thus obtaining the security detection data for the image file corresponding to the image packaging step.

[0024] Calculate the risk hazard coefficient for each integration step based on the safety testing data, including:

[0025] The vulnerability scores corresponding to each intermediate file vulnerability are summed to obtain the risk hazard coefficient corresponding to the code compilation step; and the vulnerability scores corresponding to each image file vulnerability are summed to obtain the risk hazard coefficient corresponding to the image packaging step.

[0026] In some embodiments, the risk probability coefficient corresponding to each integration step is calculated based on the step execution parameters, including:

[0027] Obtain the execution frequency and security detection frequency for each integration step;

[0028] Identify the first risk probability level corresponding to the execution frequency of each step, and identify the second risk probability level corresponding to each security detection frequency;

[0029] Based on the first risk probability level and the second risk probability level, the risk probability coefficient corresponding to each integration step is obtained.

[0030] In some embodiments, the method further includes:

[0031] Obtain the historical risk hazard coefficient corresponding to the historical safety detection data for each integration step;

[0032] By comparing the historical risk hazard coefficient with the current risk hazard coefficient for each integration step, the changes in the risk hazard coefficient for each integration step can be obtained.

[0033] Identify the third risk probability level corresponding to the change in the risk hazard coefficient of each integration step;

[0034] Based on the first risk probability level, the second risk probability level, and the third risk probability level, the risk probability coefficient corresponding to each integration step is obtained.

[0035] In some embodiments, the risk assessment result for the target application is obtained based on the risk hazard coefficient and risk probability coefficient corresponding to each integration step, including:

[0036] Calculate the sub-risk coefficient for each integration step based on the risk hazard coefficient and risk probability coefficient corresponding to each integration step;

[0037] The total risk coefficient of application integration is obtained by summing the sub-risk coefficients corresponding to each integration step.

[0038] Risk assessment results are generated based on the total risk coefficient.

[0039] According to one aspect of the embodiments of this application, an application risk assessment apparatus is provided, the apparatus comprising:

[0040] The parameter acquisition module is configured to acquire the integration step parameters of multiple integration steps to be evaluated during the integration process of the target application. The integration step parameters include the integration object, step execution parameters and risk assessment strategy corresponding to each integration step.

[0041] The security detection module is configured to perform security detection on the integration objects of each integration step according to the risk assessment strategy, and obtain the security detection data corresponding to each integration step.

[0042] The calculation module is configured to calculate the risk hazard coefficient corresponding to each integration step based on the safety detection data, and to calculate the risk probability coefficient corresponding to each integration step based on the step execution parameters.

[0043] The results acquisition module is configured to obtain the risk assessment results for the target application based on the risk hazard coefficient and risk probability coefficient corresponding to each integration step.

[0044] According to one aspect of the embodiments of this application, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the application risk assessment method described above.

[0045] According to one aspect of the embodiments of this application, an electronic device is provided, including one or more processors; and a storage device for storing one or more programs, which, when executed by the electronic device, cause the electronic device to implement the application risk assessment method described above.

[0046] In the technical solution provided by the embodiments of this application, the integration objects, step execution parameters and risk assessment strategies corresponding to multiple integration steps to be evaluated in the integration process of the target application are obtained respectively. According to the risk assessment strategy, the integration objects of each integration step are subjected to security detection to obtain security detection data corresponding to each integration step. The risk hazard coefficient corresponding to each integration step is calculated according to the security detection data, and the risk probability coefficient corresponding to each integration step is calculated according to the step execution parameters. Then, a multi-faceted security risk assessment is performed on each integration step. Finally, the risk assessment result corresponding to the target application is obtained according to the risk hazard coefficient and risk probability coefficient corresponding to each integration step, so as to comprehensively assess the security of the target application and obtain a more accurate risk assessment result.

[0047] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0048] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings:

[0049] Figure 1 This is a schematic diagram illustrating an application environment for the application of the risk assessment method, as an exemplary embodiment of this application.

[0050] Figure 2 This is a flowchart illustrating an exemplary embodiment of the application risk assessment method of this application;

[0051] Figure 3 This is a schematic diagram illustrating the integration process of the target application in an exemplary embodiment of this application;

[0052] Figure 4 This is a schematic diagram illustrating a security test of an integration step to be evaluated, as shown in an exemplary embodiment of this application.

[0053] Figure 5 This is a schematic diagram illustrating the risk hazard coefficient corresponding to the code submission step in an exemplary embodiment of this application;

[0054] Figure 6 This is a schematic diagram illustrating the acquisition of risk assessment results, as shown in an exemplary embodiment of this application;

[0055] Figure 7 This is a block diagram illustrating an application risk assessment device in an exemplary embodiment of this application;

[0056] Figure 8 This is a schematic diagram of the structure of a computer system suitable for implementing the electronic devices of the present application embodiments. Detailed Implementation

[0057] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments identical to those described in this application. Rather, they are merely examples of apparatuses and methods identical to some aspects of this application as detailed in the appended claims.

[0058] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented as application programs, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0059] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily need to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0060] It should be noted that "multiple" as mentioned in this application refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0061] Optionally, in this embodiment, the risk assessment method can be applied to, for example... Figure 1 In the environment shown. For example... Figure 1 As shown, the implementation environment includes a terminal 110 and a server 120. The terminal 110 and the server 120 can be connected directly or indirectly through wired or wireless communication, which is not limited in this application.

[0062] In this embodiment, terminal 110 is the device used by developers to write application code. Terminal 110 can be a smartphone, tablet, laptop, desktop computer, etc., but is not limited to these. The term "terminal" can refer to one of multiple terminals. This embodiment uses terminal 110 as an example only. Those skilled in the art will understand that the aforementioned terminal can be only one, or there can be dozens, hundreds, or even more terminals. In this case, the implementation environment of the application risk assessment method may also include other terminals. This application embodiment does not limit the number or type of terminals.

[0063] Server 120 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. Server 120 is used to execute container build tasks based on the application code sent by terminal 110 and the build rules preset by the developers, in order to integrate applications based on the container build tasks. The build rules specify the code repository, image name, etc., during container image build.

[0064] Optionally, the aforementioned wireless or wired networks use standard communication technologies and / or protocols. The network is typically the Internet, but can also be any network, including but not limited to Local Area Networks (LANs), Metropolitan Area Networks (MANs), Wide Area Networks (WANs), mobile, wired or wireless networks, private networks, or any combination of virtual private networks. In some embodiments, technologies and / or formats, including Hypertext Markup Language (HTML), Extensible Markup Language (XML), etc., are used to represent data exchanged over the network. Furthermore, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Networks (VPNs), and Internet Protocol Security (IPsec) can be used to encrypt all or some links. In other embodiments, custom and / or dedicated data communication technologies can be used to replace or supplement the aforementioned data communication technologies.

[0065] Please see Figure 2 , Figure 2 This is a flowchart illustrating an exemplary embodiment of the application risk assessment method of this application. This application risk assessment method can be applied to… Figure 1 The implementation environment shown is specifically executed by server 120 within that implementation environment. It should be understood that this method can also be applied to other exemplary implementation environments and executed by devices in other implementation environments; this embodiment does not limit the implementation environment to which the method is applicable.

[0066] The following section will describe in detail the application risk assessment method proposed in this application embodiment, using the server as the specific execution entity.

[0067] like Figure 2 As shown, in an exemplary embodiment, the application of the risk assessment method includes at least steps S210 to S240, which are described in detail below:

[0068] Step S210: Obtain the integration step parameters of the multiple integration steps to be evaluated during the integration process of the target application. The integration step parameters include the integration object, step execution parameters and risk assessment strategy corresponding to each integration step.

[0069] It should be noted that the target application of this application refers to an application based on Continuous Integration (CI). Continuous Integration involves calling on all development teams to align their development copies to a unified mainline version and frequently merging them into the mainline version. After the merged code is compiled, integrated, and automatically tested, a quality-assured version can be quickly output, providing subsequent approval and deployment options. It controls code quality by continuously and automatically compiling and testing the application.

[0070] The integration process of the target application includes multiple integration steps, such as... Figure 3 As shown, the integration steps may include code submission, code compilation, image packaging, application deployment, and functional testing.

[0071] The code submission step may include: a continuous integration tool configured on the server, such as Jenkins, Buddy, or TeamCity, is used to retrieve the code submitted by developers during the code submission step. The submitted code can be the target application code or a branch of the target application corresponding to the product or project. This code can be stored in a specified location. When retrieving the code using the continuous integration tool, the tool can obtain the target application's code based on its storage location. For example, the target application's code can be stored in a Git repository. The continuous integration tool can retrieve the target application's code based on its address in the Git repository. Git is a distributed version control software.

[0072] The code compilation steps may include: compiling the obtained code using a continuous integration tool to obtain intermediate compiled files. Alternatively, the continuous integration tool may call other software project build tools to compile the code. For example, if the target application is a Java project, the continuous integration tool may call Maven to compile the target application's code; if the application to be integrated is a Node.js project, the continuous integration tool may call NPM to compile the target application's code.

[0073] The image packaging process can include adding the compiled intermediate files to the base image of the application container engine to generate an image file. The base image is an image template that includes the data required to run the container. For example, after obtaining the compiled intermediate files, the Docker container can generate the corresponding Docker image based on the Dockerfile pre-configured in the startup parameters.

[0074] Application deployment steps may include: deploying the application to a Docker cluster based on the obtained image file. When deploying the application to a container created by the Docker cluster, the image file corresponding to the target application can be mounted to the Docker container to instantiate the container, so as to automatically complete the deployment process of the target application.

[0075] Functional testing steps may include: calling functional testing tools to perform functional testing on the target application. The functional testing tools are used to verify whether the application can work normally for the target users. They test the deployed target application according to the functional requirements of the target application to ensure that the program runs in the expected way. By testing all the characteristics and functions of the system, the consistency of the program with the specifications is ensured.

[0076] The integration steps to be evaluated during the integration process of the target application can be flexibly selected according to the actual application scenario. For example, the integration steps to be evaluated may include code submission steps, code compilation steps, and image packaging steps. This application does not limit this.

[0077] Integration step parameters include the integration object, execution parameters, and risk assessment strategy for each integration step. The integration object refers to the target application representation involved in the integration step; for example, the integration object for the code submission step is the code written by the developer, and the integration object for the code compilation step is the intermediate file after the code is compiled. Execution parameters refer to relevant data for executing the integration step, such as the execution time and frequency of the corresponding integration step. It is understandable that different integration steps correspond to different integration objects, and consequently, different risk assessment strategies. Therefore, corresponding risk assessment strategies can be pre-configured for each integration step.

[0078] Step S220: Perform security testing on the integration objects of each integration step according to the risk assessment strategy to obtain security testing data corresponding to each integration step.

[0079] Based on the risk assessment strategy, each integration step to be evaluated in continuous integration is subjected to corresponding security tests to assess the security level of the integration objects of these integration steps and obtain security test data.

[0080] This application combines the advantages of directly obtaining code and image files during continuous integration to conduct a multi-faceted security assessment of the target application itself, thereby obtaining more complete and accurate security detection data and identifying security risks of the target application.

[0081] Step S230: Calculate the risk hazard coefficient for each integration step based on the safety detection data, and calculate the risk probability coefficient for each integration step based on the step execution parameters.

[0082] It should be noted that the risk hazard coefficient is used to characterize the severity of the impact when a hazardous accident occurs. In other words, the larger the risk hazard coefficient, the greater the impact when the hazardous accident occurs; conversely, the smaller the risk hazard coefficient, the smaller the impact when the hazardous accident occurs. The risk probability coefficient is used to characterize the probability of a hazardous accident occurring. In other words, the larger the risk probability coefficient, the greater the probability of a hazardous accident occurring; conversely, the smaller the risk probability coefficient, the smaller the probability of a hazardous accident occurring.

[0083] By calculating the risk hazard coefficient for each integration step using safety testing data, the severity of the risk in each integration step to be evaluated is obtained. Furthermore, by calculating the risk probability coefficient for each integration step using the step execution parameters, the likelihood of the risk occurring in each integration step to be evaluated is obtained.

[0084] Step S240: Based on the risk hazard coefficient and risk probability coefficient corresponding to each integration step, obtain the risk assessment result corresponding to the target application.

[0085] Based on the risk hazard coefficient and risk probability coefficient corresponding to each integration step, the sub-risk coefficient corresponding to each integration step to be evaluated is calculated. Then, by combining the sub-risk coefficients corresponding to all integration steps to be evaluated, the risk assessment result corresponding to the target application is obtained.

[0086] For example, the formula for calculating the sub-risk coefficient corresponding to each integration step to be evaluated is as follows:

[0087] R i =L i ×S i

[0088] Among them, R i L represents the risk level corresponding to step i. i S represents the risk hazard coefficient corresponding to step i. i This represents the risk probability coefficient corresponding to step i.

[0089] This application obtains the integration objects, execution parameters, and risk assessment strategies corresponding to multiple integration steps to be evaluated during the integration process of the target application. Based on the risk assessment strategies, it performs security testing on the integration objects of each integration step to obtain security testing data for each integration step. Based on the security testing data, it calculates the risk hazard coefficient for each integration step and the risk probability coefficient for each integration step based on the execution parameters. This allows for a multi-faceted security risk assessment of each integration step. Finally, based on the risk hazard coefficient and risk probability coefficient for each integration step, it obtains the risk assessment result for the target application, thus providing a comprehensive assessment of the target application's security and obtaining a more accurate risk assessment result.

[0090] In some implementations, the integration steps to be evaluated include code submission, code compilation, and image packaging. Security checks are performed on the integration objects of each integration step according to the risk assessment strategy, resulting in security check data for each integration step, including:

[0091] Obtain the code submitted during the code submission process, perform static code security checks on the code, and obtain the code security check data corresponding to the code submission process.

[0092] In the code compilation step, the code is compiled to obtain intermediate files, and intermediate file security checks are performed on the intermediate files to obtain intermediate file security check data corresponding to the code compilation step;

[0093] In the image packaging step, intermediate files are image packaged to obtain an image file, and the image file security is checked to obtain the image file security check data corresponding to the image packaging step.

[0094] For example, please refer to Figure 4 , Figure 4 This is a schematic diagram illustrating security testing of an integration step to be evaluated, provided as an exemplary embodiment. Figure 4As shown, the integration steps to be evaluated during continuous integration include code submission, code compilation, and image packaging. Static code security testing is performed on the target application code obtained in the code submission step to obtain code security testing data corresponding to this step. Intermediate file security testing is performed on the compiled intermediate files obtained in the code compilation step to obtain intermediate file security testing data corresponding to this step. Image file security testing is performed on the image file obtained in the image packaging step to obtain image file security testing data corresponding to this step. Then, the code security testing data, intermediate file security testing data, and image file security testing data are combined to obtain the risk assessment result for the target application. This comprehensive security risk assessment of the application, integrating the results of static code testing, compiled file testing, and image file testing, provides a multi-faceted security risk assessment.

[0095] For example, static code security testing is performed on the code to obtain code security testing data corresponding to the code submission step, including: detecting defective code contained in the code; statistically analyzing the defect types contained in the defective code and the number of defective codes corresponding to each defect type to obtain code defect statistics; and obtaining code security testing data corresponding to the code submission step based on the code defect statistics.

[0096] The integration object corresponding to the code submission step is the code of the target application submitted by the developer. The code of the target application is subjected to security testing using a risk assessment strategy that matches the code submission step, so as to obtain the code security test data corresponding to the code submission step.

[0097] For example, static code analysis tools can be used to detect defects in the code of the target application submitted by the developer. It should be understood that the corresponding static code analysis tool can be selected according to the computer language used in the target application code. For example, if the computer language used in the target application code is C++, the static code analysis tool can be Klocwork; if the computer language used in the target application code is Java, the static code analysis tool can be Checkstyle. This application does not limit this.

[0098] By performing defect detection on the target application's code, defective code is identified. Then, the defect types and the number of defective codes for each type are statistically analyzed to obtain code security detection data corresponding to the code submission step. For example, defect types include Application Program Interface (API) misuse, error and exception handling defects, dead code, null pointer dereferences, and so on.

[0099] Furthermore, the risk level corresponding to each defect type is identified, and the weight parameter corresponding to each defect type is obtained based on the risk level. The number of defect codes corresponding to each defect type is weighted and calculated based on the weight parameter to obtain the risk hazard coefficient corresponding to the code submission step.

[0100] For example, please see Figure 5 , Figure 5 This is a schematic diagram illustrating the risk hazard factor corresponding to the code submission step in an exemplary embodiment. Figure 5 As shown, defect detection is performed on the code submitted by developers to obtain defective code. Then, the risk level corresponding to the defect type of the defective code is determined. Risk levels include, but are not limited to, severe, high-risk, medium-risk, low-risk, and warning. The risk level corresponding to each defect type is confirmed. This can be achieved by pre-storing a mapping table between defect types and risk levels on the server. By statistically analyzing the defect types of the obtained code, the mapping table is queried to obtain the risk level corresponding to each defect type.

[0101] Then, based on the risk level, the weight parameters corresponding to each defect type are obtained. The number of defect codes corresponding to each defect type is weighted according to the weight parameters to obtain the risk hazard coefficient corresponding to the code submission step.

[0102] Optionally, since the application development process involves a large number of lines of code, resulting in a large total number of defects, risk assessments of the target application can be conducted in units of thousands of lines of code. For example, the formula for calculating the risk severity coefficient can be as follows:

[0103]

[0104] There are n types of code defects, E j N represents the weight parameter corresponding to defect type j. j This indicates the number of defect codes corresponding to defect type j, and M represents the number of lines of code.

[0105] For example, the code submission step involves 1000 lines of code from the target application. Static code analysis is performed on this code to detect defects. The risk level of each defect type is determined, and the number of defects at each risk level is calculated as follows: 1 critical, 2 high-risk, 3 medium-risk, 10 low-risk, and 12 warnings. Based on the risk level, a weight parameter is obtained for each defect type, and L is calculated. code = (1*5+2*4+3*3+10*2+12) / 1=54, meaning the risk factor for the code submission step is 54.

[0106] In some implementations, intermediate file security checks are performed on intermediate files to obtain intermediate file security check data corresponding to the code compilation step, and image file security checks are performed on image files to obtain image file security check data corresponding to the image packaging step, including:

[0107] Scan intermediate files to find vulnerabilities contained within them; and scan image files to find vulnerabilities contained within them.

[0108] The vulnerability score for each intermediate file vulnerability is obtained from the general vulnerability scoring system, thus obtaining the security detection data for the intermediate files corresponding to the code compilation step; and the vulnerability score for each image file vulnerability is obtained from the general vulnerability scoring system, thus obtaining the security detection data for the image file corresponding to the image packaging step.

[0109] Intermediate files are files compiled from the source code submitted by developers. They can be scanned using intermediate file detection tools such as binary static analysis tools (CoBOT-Binary) and intelligent fuzzing tools (CoBOT-GUIFuzz) to identify intermediate file vulnerabilities.

[0110] After packaging the intermediate files into an image, perform image file security checks on the resulting image file. For example, using an image file detection tool like Aqua Security can scan the image files in the image repository and discover image file vulnerabilities.

[0111] Then, based on the general vulnerability scoring system, the vulnerability score of each intermediate file vulnerability is obtained, and the security detection data of the intermediate file corresponding to the code compilation step is obtained. Also, based on the general vulnerability scoring system, the vulnerability score of each image file vulnerability is obtained, and the security detection data of the image file corresponding to the image packaging step is obtained.

[0112] For example, intermediate file vulnerabilities contained in intermediate files and image file vulnerabilities contained in image files are specifically vulnerabilities recorded in the Common Weakness Enumeration (CWE) and Common Vulnerabilities & Exposures (CVE). The vulnerability scoring system is the Common Vulnerability Scoring System (CVSS). CVSS is used to assess the severity of vulnerabilities and help determine the urgency and importance of the required response. Based on CVSS, vulnerability scores are obtained for intermediate file vulnerabilities and image file vulnerabilities. Then, based on the vulnerability scores, the risk severity coefficients corresponding to the code compilation step and the image packaging step are obtained.

[0113] Furthermore, based on the security testing data, the risk hazard coefficient corresponding to each integration step is calculated, including: summing the vulnerability scores corresponding to each intermediate file vulnerability to obtain the risk hazard coefficient corresponding to the code compilation step; and summing the vulnerability scores corresponding to each image file vulnerability to obtain the risk hazard coefficient corresponding to the image packaging step.

[0114] For example, the formula used to calculate the risk factor corresponding to the code compilation step can be:

[0115] L comp =∑ k＝1...m CVSS_comp k

[0116] The intermediate files contain m intermediate file vulnerabilities, CVSS_comp k This represents the vulnerability score corresponding to the k-th intermediate file vulnerability.

[0117] For example, the formula used to calculate the risk factor corresponding to the code compilation step can be:

[0118] L image =∑ t＝1...q CVSS_image t

[0119] The number of image file vulnerabilities contained in the image file is q, CVSS_image t This represents the vulnerability score corresponding to the vulnerability in the t-th image file.

[0120] In some implementations, the risk probability coefficient for each integration step is calculated based on the execution parameters, including:

[0121] Obtain the execution frequency and security detection frequency for each integration step;

[0122] Identify the first risk probability level corresponding to the execution frequency of each step, and identify the second risk probability level corresponding to each security detection frequency;

[0123] Based on the first risk probability level and the second risk probability level, the risk probability coefficient corresponding to each integration step is obtained.

[0124] It should be noted that the execution frequency of an integration step refers to the number of times that integration step is executed within a preset time period, and the security detection frequency of an integration step refers to the number of times security checks are performed within that preset time period. In other words, the lower the execution frequency of the steps corresponding to the target application, the lower the operation frequency of the target application, and the more likely it is to experience a risk incident. Furthermore, the lower the security detection frequency of each integration step during the integration of the target application, the more likely the target application is to experience a risk incident.

[0125] Then, the first risk probability level corresponding to the execution frequency of each step is obtained, and the second risk probability level corresponding to each security detection frequency is obtained, so as to obtain the risk probability coefficient corresponding to each integration step according to the first risk probability level and the second risk probability level.

[0126] For example, the first risk probability level and the second risk probability level can be weighted according to a preset weighting coefficient to obtain the risk probability coefficient corresponding to each integration step; or the maximum value between the first risk probability level and the second risk probability level corresponding to the integration step can be used as the risk probability coefficient of the integration step, which is not limited in this application.

[0127] In some implementations, it further includes:

[0128] Obtain the historical risk hazard coefficient corresponding to the historical safety detection data for each integration step;

[0129] By comparing the historical risk hazard coefficient with the current risk hazard coefficient for each integration step, the changes in the risk hazard coefficient for each integration step can be obtained.

[0130] Identify the third risk probability level corresponding to the change in the risk hazard coefficient of each integration step;

[0131] Based on the first risk probability level, the second risk probability level, and the third risk probability level, the risk probability coefficient corresponding to each integration step is obtained.

[0132] This application saves historical security testing data of the integration steps to be evaluated for the target application. After calculating the risk hazard coefficient corresponding to each integration step to be evaluated at the current time, the risk hazard coefficient is compared with the historical risk hazard coefficient of the corresponding integration step to obtain the change of the risk hazard coefficient of each integration step.

[0133] If the historical risk hazard coefficient of an integration step is greater than the current risk hazard coefficient, it indicates that the risk hazard coefficient of that integration step is decreasing; if the historical risk hazard coefficient of an integration step is equal to the current risk hazard coefficient, it indicates that the risk hazard coefficient of that integration step is unchanged; if the historical risk hazard coefficient of an integration step is less than the current risk hazard coefficient, it indicates that the risk hazard coefficient of that integration step is increasing.

[0134] Then, the third risk probability level corresponding to the change in risk hazard coefficient of each integration step is identified, so that the risk probability coefficient corresponding to each integration step can be obtained according to the first risk probability level, the second risk probability level and the third risk probability level.

[0135] For example, as shown in Table 1 below, Table 1 is a risk probability level lookup table. Through this risk probability level lookup table, you can look up the first risk probability level corresponding to the execution frequency of each step, the second risk probability level corresponding to each safety inspection frequency, and the third risk probability level corresponding to the change in risk hazard coefficient.

[0136]

[0137] Table 1

[0138] For example, if the target application performs continuous integration on average once a day, then the first risk probability level corresponding to the execution frequency of each integration step is 1; if a security check is performed on the code submission step on average once every 5 days, then the second risk probability level corresponding to the security check frequency of the code submission step is 2; if the risk severity coefficient obtained from the current security check of the code submission step is the same as the historical risk severity coefficient obtained from the last security check, then the third risk probability level corresponding to the change in the risk severity coefficient of the code submission step is 2. Then, the maximum value among the first, second, and third risk probability levels of the code submission step is taken as the risk probability coefficient corresponding to the code submission step, i.e., the risk probability coefficient corresponding to the code submission step is 2.

[0139] In some implementations, the risk assessment results for application integration are obtained based on the risk hazard coefficient and risk probability coefficient corresponding to each integration step, including:

[0140] Calculate the sub-risk coefficient for each integration step based on the risk hazard coefficient and risk probability coefficient corresponding to each integration step;

[0141] The total risk coefficient of the target application is obtained by summing the sub-risk coefficients corresponding to each integration step.

[0142] Risk assessment results are generated based on the total risk coefficient.

[0143] For example, please refer to Figure 6 , Figure 6 This is a schematic diagram illustrating the acquisition of risk assessment results as an exemplary embodiment. Figure 6 As shown, the integration steps to be evaluated include code submission, code compilation, and image packaging. Security checks are performed on each integration step to obtain a risk hazard coefficient for each step, such as risk hazard coefficient 1 for code submission, risk hazard coefficient 2 for code compilation, and risk hazard coefficient 3 for image packaging. The execution frequency, security check frequency, and risk hazard coefficient changes for each integration step are also obtained to obtain a risk probability coefficient for each step, such as risk probability coefficient 1 for code submission, risk probability coefficient 2 for code compilation, and risk probability coefficient 3 for image packaging. Then, based on the risk hazard coefficient and risk probability coefficient for each integration step, a sub-risk coefficient is calculated for each step, such as sub-risk coefficient 1 for code submission, sub-risk coefficient 2 for code compilation, and sub-risk coefficient 3 for image packaging. Finally, the total risk coefficient of the target application is obtained based on the sub-risk coefficients for each integration step, thus yielding the risk assessment result.

[0144] For example, the formula for calculating the total risk coefficient is as follows:

[0145] R app =R code +R comp +R image

[0146] Among them, R code R represents the sub-risk coefficient corresponding to the code submission step. comp R represents the sub-risk coefficient corresponding to the code compilation step. image This represents the sub-risk coefficient corresponding to the image packaging step.

[0147] For example, if a developer submits 1000 lines of code for a target application and receives the following code security detection data: 1 critical, 2 high-risk, 3 medium-risk, 10 low-risk, and 12 warnings, then calculate the risk hazard coefficient L corresponding to the code submission step. code = (1*5+2*4+3*3+10*2+12) / 1 = 54. Wherein, the code submission step is performed on average every 5 days, and code checks are conducted on average every 5 days. Assuming the risk hazard coefficient remains constant, the risk probability coefficient corresponding to the code submission step is 2.

[0148] The code compilation step compiles the code submitted in the code submission step to obtain an intermediate file. Then, an intermediate file security check is performed on the intermediate file. The security check data shows that the intermediate file contains six vulnerabilities. The CVSS values ​​of each vulnerability are added together to obtain the risk severity coefficient corresponding to the code compilation step: L. comp =5+8+4+7+3+5=32. The code compilation step is performed on average every 6 days, and intermediate file checks are performed on average every 15 days. Given that the risk hazard coefficient is increasing, the risk probability coefficient corresponding to the code compilation step is 3.

[0149] The image packaging step involves packaging the intermediate files compiled in the code compilation step into an image file. Then, a security check is performed on the image file. The security check data shows that the image file contains six vulnerabilities. The CVSS values ​​of each vulnerability are added together to obtain the risk severity coefficient (L) corresponding to the image packaging step. image =15+8+3+4+2+6=28. Wherein, the image packaging step packages an image on average every 6 days, and performs image file checks on average every 6 days. Furthermore, if the risk hazard coefficient decreases, then the risk probability coefficient corresponding to the image packaging step is 2.

[0150] The final total risk coefficient is: 54*2+32*3+28*2=260.

[0151] This application obtains the integration objects, execution parameters, and risk assessment strategies corresponding to multiple integration steps to be evaluated during the integration process of the target application. Based on the risk assessment strategies, it performs security testing on the integration objects of each integration step to obtain security testing data for each integration step. Based on the security testing data, it calculates the risk hazard coefficient for each integration step and the risk probability coefficient for each integration step based on the execution parameters. This allows for a multi-faceted security risk assessment of each integration step. Finally, based on the risk hazard coefficient and risk probability coefficient for each integration step, it obtains the risk assessment result for the target application, thus providing a comprehensive assessment of the target application's security and obtaining a more accurate risk assessment result.

[0152] Figure 7 This is a block diagram illustrating an application risk assessment device according to an embodiment of this application, such as... Figure 7 As shown, the device includes:

[0153] The parameter acquisition module 710 is configured to acquire the integration step parameters of multiple integration steps to be evaluated during the integration process of the target application. The integration step parameters include the integration object, step execution parameters and risk assessment strategy corresponding to each integration step.

[0154] The security detection module 720 is configured to perform security detection on the integration object of each integration step according to the risk assessment strategy, and obtain the security detection data corresponding to each integration step.

[0155] The calculation module 730 is configured to calculate the risk hazard coefficient corresponding to each integration step based on the safety detection data, and to calculate the risk probability coefficient corresponding to each integration step based on the step execution parameters.

[0156] The result acquisition module 740 is configured to obtain the risk assessment result corresponding to the target application based on the risk hazard coefficient and risk probability coefficient corresponding to each integration step.

[0157] In one embodiment of this application, the integration steps to be evaluated include a code submission step, a code compilation step, and an image packaging step; the security detection module 720 may include:

[0158] The code submission step detection unit is configured to obtain the code submitted in the code submission step, perform static code security detection on the code, and obtain the code security detection data corresponding to the code submission step.

[0159] The code compilation step detection unit is configured to compile the code to obtain intermediate files during the code compilation step, perform intermediate file security detection on the intermediate files, and obtain intermediate file security detection data corresponding to the code compilation step.

[0160] The image packaging step detection unit is configured to perform image packaging on intermediate files to obtain image files, perform image file security detection on the image files, and obtain image file security detection data corresponding to the image packaging step.

[0161] In one embodiment of this application, the code submission step detection unit may include:

[0162] The defect code detection unit is configured to detect defect codes contained in the code.

[0163] The statistics unit is configured to count the defect types contained in the defect code and the number of defect codes corresponding to each defect type, and obtain the code defect statistics results.

[0164] The code security detection data generation unit is configured to obtain code security detection data corresponding to the code submission step based on the code defect statistics results.

[0165] The computing module 730 may include:

[0166] The code security detection weight confirmation unit is configured to confirm the risk level corresponding to each defect type and obtain the weight parameters corresponding to each defect type based on the risk level.

[0167] The code security detection weighted calculation unit is configured to perform a weighted calculation on the number of defect codes corresponding to each defect type based on the weight parameters, so as to obtain the risk hazard coefficient corresponding to the code submission step.

[0168] In one embodiment of this application, the code compilation step detection unit may include:

[0169] The intermediate file vulnerability detection unit is configured to scan intermediate files and identify intermediate file vulnerabilities contained within them.

[0170] The intermediate file vulnerability scoring unit is configured to obtain the vulnerability score of each intermediate file vulnerability based on the general vulnerability scoring system, and obtain the intermediate file security detection data corresponding to the code compilation step;

[0171] The image packaging step detection unit may include:

[0172] The image file vulnerability detection unit is configured to scan image files and identify vulnerabilities contained within them.

[0173] The image file vulnerability scoring unit is configured to obtain the vulnerability score of each image file vulnerability based on the general vulnerability scoring system, and obtain the image file security detection data corresponding to the image packaging step;

[0174] The computing module 730 may also include:

[0175] The code compilation step risk hazard coefficient calculation unit is configured to sum the vulnerability scores corresponding to each intermediate file vulnerability to obtain the risk hazard coefficient corresponding to the code compilation step.

[0176] The risk and hazard coefficient calculation unit for the image packaging step is configured to sum the vulnerability scores corresponding to each image file vulnerability to obtain the risk and hazard coefficient corresponding to the image packaging step.

[0177] In one embodiment of this application, the computing module 730 may further include:

[0178] The frequency acquisition unit is configured to acquire the step execution frequency and security detection frequency corresponding to each integration step, respectively.

[0179] The first and second risk probability level acquisition units are configured to confirm the first risk probability level corresponding to the execution frequency of each step, and to confirm the second risk probability level corresponding to each security detection frequency.

[0180] The first risk probability coefficient calculation unit is configured to obtain the risk probability coefficient corresponding to each integration step based on the first risk probability level and the second risk probability level.

[0181] In one embodiment of this application, the computing module 730 may further include:

[0182] The historical risk hazard coefficient acquisition unit is configured to acquire the historical risk hazard coefficient corresponding to the historical safety detection data of each integration step.

[0183] The risk hazard coefficient comparison unit is configured to compare the historical risk hazard coefficient and the current risk hazard coefficient for each integration step to obtain the change of the risk hazard coefficient for each integration step.

[0184] The third risk probability level acquisition unit is configured to confirm the third risk probability level corresponding to the change in the risk hazard coefficient of each integration step.

[0185] The second risk probability coefficient calculation unit is configured to obtain the risk probability coefficient corresponding to each integration step based on the first risk probability level, the second risk probability level, and the third risk probability level.

[0186] It should be noted that the application risk assessment device and the application risk assessment method provided in the above embodiments belong to the same concept. The specific operation methods of each module and unit have been described in detail in the method embodiments and will not be repeated here. In practical applications, the application risk assessment device provided in the above embodiments can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. This is not a limitation here.

[0187] Figure 8 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown.

[0188] It should be noted that, Figure 8 The computer system 800 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0189] like Figure 8 As shown, the electronic device 800 is presented in the form of a general-purpose computing device. The components of the electronic device 800 may include, but are not limited to: at least one processing unit 810, at least one storage unit 820, a bus 830 connecting different system components (including storage unit 820 and processing unit 810), and a display unit 840.

[0190] The storage unit stores program code, which can be executed by the processing unit 810, causing the processing unit 810 to perform the steps described in the "Exemplary Methods" section above according to various exemplary embodiments of this disclosure.

[0191] Storage unit 820 may include a readable medium in the form of a volatile storage unit, such as random access memory (RAM) 821 and / or cache memory 822, and may further include a read-only memory (ROM) 823.

[0192] The storage unit 820 may also include a program / utility 824 having a set (at least one) of program modules 825, including but not limited to: an operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0193] Bus 830 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0194] Electronic device 800 can also communicate with one or more external devices 870 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 800, and / or with any device that enables electronic device 800 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 850. Furthermore, electronic device 800 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 860. As shown, network adapter 860 communicates with other modules of electronic device 800 via bus 830. It should be understood that, although not shown in the figures, other hardware and / or application modules can be used in conjunction with electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0195] In particular, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer applications. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program including a computer program for performing the methods shown in the flowcharts. When the computer program is executed by the processing unit 810, it performs various functions defined in the system of this application.

[0196] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying a computer-readable computer program. Such transmitted data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can initiate, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0197] The units described in the embodiments of this application can be implemented by application programs or by hardware, and the described units can also be located in a processor. The names of these units do not necessarily constitute a limitation on the unit itself.

[0198] Another aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the application risk assessment method as described above. This computer-readable storage medium may be included in the electronic device described in the above embodiments, or it may exist independently and not assembled into the electronic device.

[0199] Another aspect of this application provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the application risk assessment method provided in the various embodiments described above.

[0200] The above description is merely a preferred exemplary embodiment of this application and is not intended to limit the implementation of this application. Those skilled in the art can easily make corresponding modifications or alterations based on the main concept and spirit of this application. Therefore, the scope of protection of this application should be determined by the scope of protection claimed in the claims.

Claims

1. An application risk assessment method, characterized in that, include: The integration step parameters of multiple integration steps to be evaluated during the integration process of the target application are obtained respectively. The integration step parameters include the integration object, step execution parameters and risk assessment strategy corresponding to each integration step. According to the risk assessment strategy, security detection is performed on the integration object of each integration step to obtain security detection data corresponding to each integration step; Calculate the risk hazard coefficient for each integration step based on the safety detection data, and calculate the risk probability coefficient for each integration step based on the step execution parameters. Based on the risk hazard coefficient and risk probability coefficient corresponding to each integration step, the risk assessment result corresponding to the target application is obtained; The step of calculating the risk probability coefficient corresponding to each integration step based on the step execution parameters includes: Obtain the step execution frequency and security detection frequency for each integration step, and the historical risk hazard coefficient corresponding to the historical security detection data for each integration step; Confirm the first risk probability level corresponding to the execution frequency of each of the steps, and confirm the second risk probability level corresponding to each of the security detection frequencies; By comparing the historical risk hazard coefficient and the current risk hazard coefficient for each integration step, the change in the risk hazard coefficient for each integration step is obtained, and the third risk probability level corresponding to the change in the risk hazard coefficient for each integration step is confirmed. Based on the first risk probability level, the second risk probability level, and the third risk probability level, the risk probability coefficient corresponding to each integration step is obtained.

2. The method according to claim 1, characterized in that, The integration steps to be evaluated include code submission, code compilation, and image packaging. The security detection of the integration object for each integration step is performed according to the risk assessment strategy to obtain security detection data corresponding to each integration step, including: Obtain the code submitted in the code submission step, perform static code security detection on the code, and obtain the code security detection data corresponding to the code submission step; In the code compilation step, the code is compiled to obtain an intermediate file, and the intermediate file security is checked to obtain the intermediate file security check data corresponding to the code compilation step. In the image packaging step, the intermediate files are image packaged to obtain an image file, and the image file security is checked to obtain the image file security check data corresponding to the image packaging step.

3. The method according to claim 2, characterized in that, The step of performing static code security testing on the code to obtain code security testing data corresponding to the code submission step includes: Detect defective code contained in the code; The defect types contained in the defect codes and the number of defect codes corresponding to each defect type are statistically analyzed to obtain the code defect statistics results; Based on the statistical results of the code defects, the code security detection data corresponding to the code submission step is obtained; The step of calculating the risk hazard coefficient corresponding to each integration step based on the safety detection data includes: Determine the risk level corresponding to each defect type, and obtain the weight parameter corresponding to each defect type based on the risk level; The risk hazard coefficient corresponding to the code submission step is obtained by weighting the number of defect codes corresponding to each defect type according to the weighting parameter.

4. The method according to claim 2, characterized in that, The steps of performing intermediate file security checks on the intermediate files to obtain intermediate file security check data corresponding to the code compilation step, and performing image file security checks on the image files to obtain image file security check data corresponding to the image packaging step, include: Scan the intermediate file to obtain the intermediate file vulnerability contained in the intermediate file; and scan the image file to obtain the image file vulnerability contained in the image file; The vulnerability score of each intermediate file vulnerability is obtained according to the general vulnerability scoring system, and the security detection data of the intermediate file corresponding to the code compilation step is obtained; and the vulnerability score of each image file vulnerability is obtained according to the general vulnerability scoring system, and the security detection data of the image file corresponding to the image packaging step is obtained. The step of calculating the risk hazard coefficient corresponding to each integration step based on the safety detection data includes: The vulnerability scores corresponding to each intermediate file vulnerability are summed to obtain the risk hazard coefficient corresponding to the code compilation step; and the vulnerability scores corresponding to each image file vulnerability are summed to obtain the risk hazard coefficient corresponding to the image packaging step.

5. The method according to any one of claims 1 to 4, characterized in that, The step of obtaining the risk assessment result corresponding to the target application based on the risk hazard coefficient and risk probability coefficient corresponding to each integration step includes: Calculate the sub-risk coefficient corresponding to each integration step based on the risk hazard coefficient and risk probability coefficient corresponding to each integration step; The total risk coefficient of the application integration is obtained by summing the sub-risk coefficients corresponding to each integration step. The risk assessment result is generated based on the total risk coefficient.

6. An application risk assessment device, characterized in that, include: The parameter acquisition module is configured to acquire the integration step parameters of multiple integration steps to be evaluated during the integration process of the target application. The integration step parameters include the integration object, step execution parameters and risk assessment strategy corresponding to each integration step. The security detection module is configured to perform security detection on the integration object of each integration step according to the risk assessment strategy, and obtain security detection data corresponding to each integration step. The calculation module is configured to calculate the risk hazard coefficient corresponding to each of the integration steps based on the safety detection data, and to calculate the risk probability coefficient corresponding to each of the integration steps based on the step execution parameters. The result acquisition module is configured to obtain the risk assessment result corresponding to the target application based on the risk hazard coefficient and risk probability coefficient corresponding to each integration step. The calculation module is further configured to: acquire the execution frequency and security detection frequency of each integration step, and the historical risk hazard coefficient corresponding to the historical security detection data of each integration step; confirm the first risk probability level corresponding to the execution frequency of each step, and confirm the second risk probability level corresponding to the security detection frequency; compare the historical risk hazard coefficient and the current risk hazard coefficient of each integration step to obtain the change in the risk hazard coefficient of each integration step, and confirm the third risk probability level corresponding to the change in the risk hazard coefficient of each integration step; and obtain the risk probability coefficient corresponding to each integration step based on the first risk probability level, the second risk probability level, and the third risk probability level.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the application risk assessment method as described in any one of claims 1 to 5.

8. An electronic device, characterized in that, include: processor; as well as A memory for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the application risk assessment method as described in any one of claims 1 to 5.

Images