Software supply chain analysis system based on digital twinning and construction method

Abstract

The application discloses a software supply chain analysis system and a construction method based on digital twinning, solves the problem of real-time, accurate, comprehensive and low-cost analysis of the software supply chain, discovers the software supply chain security risk, and reduces the generation and harm of the software supply chain security event.The technical scheme is as follows: the application converts tool chain data into supply chain events through a supply chain event model, stores the supply chain events into a big data platform, forms a supply chain digital twin, and continuously updates.

Description

Technical Field

[0001] This invention relates to software supply chain technology, specifically to a software supply chain analysis system and construction method based on digital twins. Background Technology

[0002] Software is the foundation of the digital economy, and the software supply chain is its cornerstone. The software supply chain consists of packages, tools, and processes used in developing, building, releasing, maintaining, and operating software. Any reusable piece of software can be called a package, more specifically referring to software uploaded to a package management platform. Synonyms include components, libraries, packages, frameworks, and container images. A package management platform is a platform that facilitates the reuse of software packages in a project. It aims to optimize the download and storage of binary packages used and generated during software development. Common package management platforms provide publicly hosted third-party packages, internally released non-publicly hosted packages, and internally released final executable packages. Package management platforms generally come with standard metadata for packages in different formats, such as author, generation time, checksum, and download count. Some tools allow adding custom attributes and can even store detailed build information (software bill of materials or SBOM) for all builds. Package managers are development tools that obtain packages from package hosting platforms for use in the current project, such as npm, maven, pip, and docker. Tools refer to the code repository, pipeline, package management platform, runtime environment, and information systems such as personnel information that provide external related data within the toolchain. Examples include software systems such as GitLab, Jenkins, Artifactory, Linux, and Active Directory.

[0003] The software supply chain can be simply understood as the software included in the supply chain and the dependencies between them. During the digitalization process, the boundaries between hardware and software become blurred, and everything is related to software. However, there is currently a lack of software supply chain analysis systems that cover the entire value chain of software development and operation, and the entire product lifecycle, as well as a lack of simplified means and methods to cope with increasing complexity.

[0004] In terms of supply chain analysis tools, independent, dedicated tools are predominantly used, making integration and operation difficult. Software development tools that carry software and its supply chain information are all functionally focused, emphasizing the solution of specific problems. There is no unified data model across different tools, making it difficult to extract and correlate supply chain-related data. Due to the diversification of software development languages, compilation and building processes, distribution and deployment, and operating environments, software supply chain analysis techniques are becoming increasingly complex. This has led to traditional supply chain analysis tools being specific to particular development tools or development stages, becoming dedicated third-party security tools. These dedicated tools have limited scope, are prone to gaps in coverage, and suffer from difficulties in data correlation and integration, resulting in high costs.

[0005] In terms of supply chain security analysis processes, current methods primarily focus on snapshot analysis of a single point in time or a single sample, making it difficult to cross value chains and lifecycle stages. Current supply chain security analyses typically perform word-by-word analysis on a single product version or operational status. However, due to the existence of multiple historical versions, production lines, and distribution channels, dynamic impact analysis and attribution analysis are challenging. Furthermore, in terms of processes, it is difficult to provide early warnings before supply chain security risks occur, and it is difficult to continuously track and monitor the effects of risk mitigation.

[0006] In terms of supply chain security analysis, it relies on the experience of cybersecurity personnel for investigation and analysis, which takes a long time to process.

[0007] The following example illustrates why real-time, accurate, comprehensive, and low-cost analysis of the software supply chain is a challenge for the software industry and for companies undergoing digital transformation. Figure 1 As shown, taking the most powerful, nuclear-level log4j vulnerability in history as an example, the scope of investigation and tracking is large, and single-point security products, single positions, and snapshot-style investigations cannot achieve both short-term and long-term solutions.

[0008] Taking the investigation of high-risk vulnerabilities in log4j as an example, the scope of the investigation should include: 1. All revisions in the codebase, including dependency management configuration files and source code files. This step is necessary because some code is delivered directly to customers without going through the pipeline (a series of steps that must be performed to deliver a new version of software; although each step of the production line can be performed manually, software pipelines are generally automated and typically include standard metadata such as source code revision numbers and the version of the generated delivery package). Some code can run in the runtime environment without going through the pipeline. Furthermore, whether some high-risk vulnerabilities meet the conditions for exploitation needs to be determined through source code analysis. A codebase is a system responsible for managing the revision history of computer programs, documents, or other sets of information. Revisions are usually identified by numeric or alphanumeric codes; for example, an initial set of files is "Revision 1." When the first change is made, the resulting set is "Revision 2," and so on. Each revision is associated with a timestamp and the person who made the change. Revisions of certain types of files can be compared, restored, and merged. Common codebase software includes GitLab and GitHub.

[0009] 2. All compilation and build information in the pipeline. This includes the codebase revision number, compilation and build parameters, dependency information, and release package information. This step is necessary because without it, it is impossible to trace the binary of the release package back to the source code revision number, and high-risk vulnerabilities in the runtime environment cannot be traced.

[0010] 3. Dependency Library. The dependency library records the name, version, binary hash code, and dependent reusable components of each reusable component. This step is necessary because without it, basic dependency information will be lacking, making it impossible to detect instances where official dependency packages are replaced in the pipeline or release.

[0011] 4. Distribution Package. The distribution package contains the executable software and its configuration information. This step is necessary because there are software packages that exist without code and do not require pipelined builds, but are imported directly from external sources, such as container images.

[0012] 5. Runtime Environment. The runtime environment records observable information about the software's operation, including loaded packages, functions, and call relationships. This step is necessary because the runtime environment is constantly changing; for example, debugging, configuration modifications, code changes, and dependency modifications can be performed within the runtime environment.

[0013] Taking the tracking of high-risk log4j vulnerability remediation as an example, the scope of monitoring and tracking needs to include: 1. Does the newly revised version of the codebase introduce any high-risk vulnerabilities?

[0014] 2. Does all compilation and build processes in the pipeline contain high-risk vulnerability components? Does the pipeline environment, such as the cache, contain high-risk vulnerability components?

[0015] 3. Dependency Libraries. Check whether newly added packages in the dependency libraries contain high-risk vulnerabilities, and whether there are any new downloads of high-risk vulnerability packages in the dependency libraries.

[0016] 4. Distribution Package. Does the distribution package contain high-risk vulnerabilities? Does the distribution package's configuration file reference other software packages that contain high-risk vulnerabilities?

[0017] 5. Operating Environment. The operating environment can be monitored to determine if any high-risk vulnerabilities are detected during operation and usage. Summary of the Invention

[0018] The following provides a brief overview of one or more aspects to offer a basic understanding of them. This overview is not an exhaustive summary of all conceived aspects, nor is it intended to identify key or decisive elements of all aspects, nor to define the scope of any or all aspects. Its sole purpose is to present some concepts of one or more aspects in a simplified form to prepare for the more detailed descriptions that follow.

[0019] The purpose of this invention is to solve the above-mentioned problems and provide a software supply chain analysis system and construction method based on digital twins. This system can solve the problem of analyzing the software supply chain in real time, accurately, comprehensively and at low cost, discover software supply chain security risks, and reduce the occurrence and harm of software supply chain security incidents.

[0020] The technical solution of this invention is as follows: This invention discloses a software supply chain analysis system based on digital twins. The system includes a modeling and synchronization cloud computing platform, a big data platform, and a visualization application system, wherein: The modeling and synchronization cloud computing platform is used to convert the collected raw toolchain data into supply chain event data and save it to the big data platform; Big data platforms are used to provide indexing, retrieval, and visualization of supply chain events; Visualization application systems are used to visualize data in big data platforms according to the needs of specific scenarios and roles; In this process, the toolchain of the software supply chain and its digital twin are connected through a modeling and synchronization cloud computing platform. This allows the raw data of the toolchain to be converted into supply chain event data and stored in a big data platform to create a digital twin. Then, through a visualization application system, the entire toolchain and the entire lifecycle of the supply chain can be monitored to enable early warning, monitoring, and continuous tracking of supply chain events.

[0021] According to an embodiment of the software supply chain analysis system based on digital twins of the present invention, the modeling and synchronization cloud computing platform adopts a master-slave mode for parallel processing. The master-slave mode allows applications to perform processing simultaneously across multiple machines or processes through a master control module and multiple working modules.

[0022] According to an embodiment of the software supply chain analysis system based on digital twins of the present invention, the modeling and synchronization cloud computing platform includes a job control module, a code repository module, a pipeline module, a package management module, and a runtime environment module, wherein: The job control module is used to continuously synchronize toolchain data to the job control of the supply chain twin; The code repository working module is used for building and continuously updating the supply chain digital twin of the code repository; The pipeline module is used for building and continuously updating the digital twin of the pipeline's supply chain; The package management module is used for the continuous updating of package dependencies; The runtime environment module is used for building and continuously updating the supply chain digital twin of the runtime environment.

[0023] According to an embodiment of the software supply chain analysis system based on digital twins of the present invention, the operation master control module is further configured as follows: First, the job control module obtains the synchronously updated list of tool assets. This further includes: the job control module receives query filtering conditions, and then processes the obtained list of tool assets. The processing includes pulling and pushing. Pulling is to obtain the list of assets that meet the query filtering conditions through the tool's interface or the tool's data. Pushing is to push asset event information to the job control module through the tool's interface. The job control module obtains the list of tool assets that meet the conditions from the asset event information and outputs it. Finally, the job control module uses each asset information as a job server, allowing various job modules to retrieve and execute it.

[0024] According to an embodiment of the software supply chain analysis system based on digital twins of the present invention, the codebase working module is further configured as follows: First, input the assets, then convert the code data in the codebase into code-type supply chain events based on the supply chain event model, store them in the index of the big data platform, and output the code-type index to the big data platform.

[0025] According to an embodiment of the software supply chain analysis system based on digital twins of the present invention, the pipeline working module is further configured as follows: First, input the assets. Then, based on the supply chain event model, convert the pipeline asset data into pipeline supply chain events and store them in the index of the big data platform. Finally, output the pipeline-type index to the big data platform.

[0026] According to an embodiment of the software supply chain analysis system based on digital twins of the present invention, the package management module is further configured as follows: First, the assets are input. Then, based on the supply chain event model, the software package asset data in the package management platform is converted into software package supply chain events and stored in the index of the big data platform. In parallel, based on the supply chain event model, the package dependency configuration file of the software package is read, and the software packages in the package management platform are refreshed and downloaded, thereby recursively obtaining the software package dependency relationship. Finally, the software package class index is output to the big data platform.

[0027] According to an embodiment of the software supply chain analysis system based on digital twins of the present invention, the runtime environment working module is further configured as follows: Input assets, and then, based on the event model of the supply chain, convert the operational asset data in the operating environment into operating environment supply chain events, store them in the index of the big data platform, and output the operating environment index to the big data platform.

[0028] According to an embodiment of the software supply chain analysis system based on digital twins of the present invention, the visualization application system includes an impact analysis module, a traceability analysis module, a continuous tracking module, and a scene orchestration module, wherein: The impact analysis module is used to query the affected content based on the name and version of the software package; The traceability analysis module is used to reconstruct the specific path through which the software package was introduced throughout the entire value chain and lifecycle, based on the package name and version. The continuous tracking module is used to continuously visualize the usage of software packages throughout their entire value chain and lifecycle, based on their name and version. The scenario orchestration module is used to manage complex workflows by combining the operation control module and big data platform, based on impact analysis, source tracing analysis, and continuous tracking.

[0029] This invention also discloses a method for constructing a software supply chain based on digital twins. The method is implemented on the software supply chain analysis system based on digital twins as described above, and includes: Step 1: Modeling and synchronizing the cloud computing platform and software tools to access the specified assets; Step 2.1: Modeling and synchronizing the cloud computing platform to obtain asset attribute data; Step 2.2: For cases with structured dependency information, model and synchronize the cloud computing platform to obtain the supply chain dependency list; Step 2.3: For unstructured, complex, and advanced supply chain characteristics, model and synchronize the cloud computing platform to obtain a list of supply chain characteristics; Step 3.1: Modeling and Synchronization: The cloud computing platform integrates the acquired supply chain dependency list and asset attribute data to generate a supply chain dependency event list; Step 3.2: Modeling and Synchronization: The cloud computing platform integrates the acquired supply chain feature list and asset attribute data to generate a supply chain feature event list; Step 4: Store the supply chain dependency event list generated in Step 3.1 and the supply chain feature event list generated in Step 3.2 into the big data platform and continuously update them to complete the construction of the supply chain twin.

[0030] According to an embodiment of the method for constructing a software supply chain based on digital twins of the present invention, in step 2.1, the attribute data of code assets includes the submitter, submission event, file name, project name, and a list of modified line numbers; the attribute data of software package assets includes the creator, creation event, modifier, modification time, library name, package name, file name, package version, path, software package hash code, number of downloads, and last download time; the attribute data of pipeline tasks includes the pipeline execution time, pipeline software version, pipeline environment configuration, and personnel executing the pipeline task; the attribute data of runtime environment assets includes the host name, environment name, IP address, process ID, and executable software package corresponding to the process.

[0031] According to an embodiment of the method for constructing a software supply chain based on digital twins according to the present invention, step 2.2 further includes: For code-type assets, if the file type is a structured configuration file of a package management software, the package management configuration file will be parsed in a structured manner to obtain the supply chain dependency list; For software package assets on the package management platform, two scenarios are handled: if a package management configuration file exists, the configuration file is parsed in a structured manner to obtain the supply chain dependency list; if a package management configuration file does not exist, package management software is used to obtain the relevant dependent software packages and can construct a software package dependency graph. For pipeline tasks, supply chain information includes source code revisions and dependency information during the build process, as well as deployment parameters during the deployment process. For runtime environment assets, supply chain information consists of observable data of runtime processes, and is handled in two ways: if it is a Java-like programming language software package process, virtual machine bytecode technology is used to directly collect the class and function call relationships loaded at runtime; if it is a non-Java type software package process, the compiler software is used to collect the dependency information contained in the software package.

[0032] According to an embodiment of the method for constructing a software supply chain based on digital twins according to the present invention, step 2.3 further includes: If the asset type is source code and it is necessary to determine the scope of impact through the source code, then extract the values ​​of each pair of call relationships and other utilization conditions after the source code is structured and parsed into a supply chain feature list. If the asset type is a binary software package, then it is necessary to use methods including decompression software, unpacking software, and binary analysis software for specific file types to obtain structured supply chain information from the content; If it is an operating environment asset, then observability software, performance analysis software, low-level analysis software, and compilation software are used in combination to extract the supply chain characteristic information of the operating environment.

[0033] Compared with existing technologies, this invention has the following advantages: This invention transforms toolchain data into supply chain events through a supply chain event model, and stores these events in a big data platform to form a digital twin of the supply chain (a digital twin is a virtual representation of an object or system that is updated based on real-time data, spanning the entire lifecycle of the object or system, and using simulation, machine learning, or reasoning to aid decision-making), and is continuously updated. Specifically, this invention has the following characteristics: 1. By using the event model of the supply chain, we address the increasing complexity of supply chain analysis methods, tools, and data correlation, providing a universal, concise, and clear method for information extraction and transformation. Furthermore, the event model of the supply chain is the core of supply chain data twinning, achieving supply chain analysis results that are non-intrusive to existing toolchains and have no impact on the developer experience.

[0034] 2. By modeling and synchronizing with the cloud computing platform, on the one hand, supply chain events across the entire value chain and lifecycle can be continuously monitored; on the other hand, stateless workers can be implemented, which can automatically scale up and down. Cloud computing power can be used to remodel and synchronize massive amounts of data on the toolchain with new algorithms, thereby achieving "epidemiological investigation" for supply chain security.

[0035] 3. Through the big data platform for supply chain events, on the one hand, the supply chain analysis and toolchain are completely decoupled, forming a digital twin of the supply chain; on the other hand, it enables separate data queries and related queries for code, pipeline, and software package runtime environment, providing multi-dimensional functions that can perform positive impact analysis and reverse tracing analysis. Attached Figure Description

[0036] The above-described features and advantages of the present invention will be better understood after reading the following detailed description of embodiments of the present disclosure in conjunction with the accompanying drawings. In the drawings, components are not necessarily drawn to scale, and components having similar related characteristics or features may have the same or similar reference numerals.

[0037] Figure 1 This diagram illustrates the process for investigating and monitoring existing log4j vulnerabilities.

[0038] Figure 2 A schematic diagram illustrating an embodiment of the digital twin-based software supply chain construction method of the present invention is shown.

[0039] Figure 3 A schematic diagram of the event model of the supply chain is shown.

[0040] Figure 4 A system architecture diagram of an embodiment of the software supply chain analysis system based on digital twins of the present invention is shown.

[0041] Figure 5 It shows Figure 4 A schematic diagram of the modeling and synchronization cloud computing platform in the embodiment. Detailed Implementation

[0042] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. It should be noted that the aspects described below with reference to the accompanying drawings and specific embodiments are merely exemplary and should not be construed as limiting the scope of protection of the present invention in any way.

[0043] A Method for Building a Software Supply Chain Based on Digital Twins

[0044] The construction method is based on a supply chain event model to build a supply chain twin. In this model, assets include attribute data, a supply chain dependency list, and a supply chain feature list. Attribute data and supply chain dependencies form supply chain dependency events, and attribute data and supply chain features form supply chain feature events. These two types of supply chain events are stored in a big data platform and continuously updated, thus completing the construction of the supply chain twin. Assets typically refer to data stored or running within a toolchain, such as commits and files in GitLab, task information in Jenkins, artifact information in Artifactory, file or process information in Linux, and personnel and department information in Active Directory.

[0045] Supply Chain Event Model Reference Figure 3 As shown, in the supply chain model, a software asset includes one asset and its corresponding attribute data, multiple supply chain dependencies, and multiple supply chain features. Each supply chain dependency and asset attribute data constitutes a supply chain dependency event, and each supply chain feature and asset attribute data constitutes a supply chain feature event. Supply chain dependency events and supply chain feature events together constitute a supply chain event. In this embodiment, metadata is defined as data that describes other data. There are six different types of metadata: narrative metadata, structured metadata, administrative metadata, referential metadata, statistical metadata, and legal metadata. Narrative metadata describes resources used to discover and identify meaning. It may include elements such as title, summary, author, and keywords. Structured metadata is metadata about data containers, indicating how to organize the composite objects within them. Administrative metadata is information used to manage resources, such as the time and method of data generation, file type and other technical information, and who has access to it. Referential metadata is information related to content and statistical data quality. Statistical metadata, also known as process data, describes the process of collecting, processing, or generating data. Legal metadata provides information about the author, copyright holder, and public license terms.

[0046] For details, please refer to the following: Figure 2 As shown, the following is a detailed description of the implementation steps of the method for constructing a software supply chain based on digital twins in this embodiment.

[0047] Step 1: Modeling and synchronizing the cloud computing platform and software tools to access the specified assets.

[0048] Step 2.1: Modeling and synchronizing the cloud computing platform to obtain asset attribute data.

[0049] The specific processing steps in this process include the following: If it is a code-related asset, the attribute data includes the submitter, submit event, file name, project name, and a list of modified line numbers.

[0050] If it is a software package asset, the attribute data (the attribute data is the value corresponding to a certain metadata of a certain asset, such as title, creation event, etc.) includes creator, creation event, modifier, modification time, library name, package name, file name, package version, path, software package hash code, number of downloads, last download time, etc.

[0051] For pipelines, assets are pipeline tasks. Their attribute data includes the pipeline execution time, the pipeline software version, the pipeline environment configuration, and the personnel executing the pipeline tasks.

[0052] If it is a runtime environment asset, its attribute data includes hostname, environment name, IP address, process ID, and the executable software package corresponding to the process.

[0053] Step 2.2: For cases with structured dependency information, model and synchronize the cloud computing platform to obtain the supply chain dependency list.

[0054] The specific processing steps in this process include the following: For code-type assets, if the file type is a structured package management software configuration file, such as pom.xml, go.mod, etc., the package management configuration file will be parsed in a structured manner to obtain the supply chain dependency list, that is, a series of dependent software package names, versions, hash codes, etc.

[0055] For software package assets on the package management platform, two scenarios are handled: if a package management configuration file exists, the configuration file is parsed in a structured manner to obtain the supply chain dependency list; if no package management configuration file exists, package management software is used to obtain the relevant dependent software packages and can construct a software package dependency graph.

[0056] For a pipeline, assets are the pipeline tasks. Supply chain information includes source code revisions and dependency information during the build process, as well as deployment parameters during the deployment process.

[0057] For runtime environment assets, supply chain information consists of observable data of runtime processes, and is handled in two ways: If it is a Java-like programming language software package process, virtual machine bytecode technology can be used to directly collect the class and function call relationships loaded at runtime; if it is another type of software package process, compiler software can be used to collect the dependency information contained in the software package.

[0058] Step 2.3: For unstructured, complex, and advanced supply chain characteristics, model and synchronize the cloud computing platform to obtain a list of supply chain characteristics.

[0059] The specific processing steps in this process include the following: If the asset type is source code, and it is necessary to determine the scope of impact through the source code, then the values ​​of each pair of call relationships and other utilization conditions after the source code is structured and parsed are extracted into a supply chain feature list.

[0060] If the asset type is a binary software package, then decompression software, unpacking software, binary analysis software for specific file types, etc. are needed to obtain structured supply chain information from the content.

[0061] If it is an operating environment asset, observability software, performance analysis software, and low-level analysis software can be used in combination with compilation software to extract supply chain characteristic information of the operating environment.

[0062] Step 3.1: Modeling and Synchronization The cloud computing platform integrates the obtained supply chain dependency list and asset attribute data to generate a supply chain dependency event list.

[0063] For example, in step 2.1, one set of asset attribute data is obtained, including asset number, name, etc. The supply chain dependency list obtained in step 2.2 contains multiple events for the asset, such as dependency 1, description 1, dependency 2, description 2, forming two dependency events in step 3.1, namely: asset number, name, dependency 1, description 1; asset number, name, dependency 2, description 2.

[0064] Step 3.2: Modeling and Synchronization: The cloud computing platform integrates the obtained supply chain feature list and asset attribute data to generate a supply chain feature event list.

[0065] The generation of the supply chain characteristic event list is the same as step 3.1, and will not be repeated here.

[0066] Step 4: Store the two types of supply chain events (i.e., the generated list of supply chain dependent events and the list of supply chain characteristic events) into the big data platform and update them continuously to complete the construction of the supply chain twin.

[0067] Analysis system for software supply chain based on digital twins

[0068] Figure 4 The principle of an embodiment of a software supply chain analysis system based on digital twins is illustrated. Please see [link to documentation]. Figure 4 The system in this embodiment includes: a modeling and synchronization cloud computing platform, a big data platform, and a visualization application system. It also includes toolchain interactions with external systems and the software supply chain.

[0069] The software supply chain toolchain and its digital twin are connected through modeling and synchronization cloud computing platforms. This allows the raw toolchain data to be converted into supply chain event data and stored in a big data platform to create a digital twin. Then, through a visualization application system, the entire toolchain and the entire lifecycle of the supply chain can be monitored to enable early warning, monitoring, and continuous tracking of supply chain events.

[0070] The following is a detailed description of each component in the system.

[0071] The modeling and synchronization cloud computing platform is used to transform raw toolchain data into supply chain event data and store it on a big data platform. Specifically, the platform employs a Master-Worker model for parallel processing. This model follows a simple approach, allowing applications to execute processing simultaneously across multiple machines or processes via a Master (master control module) and multiple Workers (worker modules). The modeling and synchronization cloud computing platform collects and generates data using... Figure 2 The method for constructing a supply chain event model is shown.

[0072] The modeling and synchronization cloud computing platform includes a job control module, a code repository module, a pipeline module, a package management module, and a runtime environment module. For example... Figure 5 As shown, the job master control module is the master control module, and the corresponding tools in the toolchain are the working modules. The working modules can automatically expand and shrink to process data in parallel.

[0073] The job control module is used to continuously synchronize toolchain data to the job control of the supply chain twin. Its internal processing is as follows: First, the job control module obtains a list of tool assets that need to be synchronized and updated, typically based on query conditions. Specifically, this step involves the job control module receiving query filtering conditions, such as time ranges or other metadata filtering conditions. Then, the obtained tool asset list is processed, including pulling and pushing. Pulling refers to obtaining a list of assets that meet the query filtering conditions through the tool's interface or data. Pushing refers to pushing asset event information to the job control module through the tool's interface. The job control module then retrieves the list of tool assets that meet the conditions from the asset event information and outputs it.

[0074] Finally, the job control module uses each asset information as a job server, allowing various job modules to retrieve and execute it.

[0075] The codebase working module is used for building and continuously updating the supply chain digital twin of the codebase. Its internal processing involves first inputting assets, and then, based on a supply chain event model-based construction method (such as...),... Figure 2As shown, the code data in the code repository is converted into code-class supply chain events and stored in the index of the big data platform. The code-class index is then output to the big data platform.

[0076] The pipeline module is used for building and continuously updating the digital twin of the supply chain for the pipeline. Its internal processing is as follows: first, the assets are input; then, based on the construction method of the supply chain event model, the pipeline asset data is converted into pipeline supply chain events and stored in the index of the big data platform; finally, the pipeline-type index is output to the big data platform.

[0077] The package management module is used for the continuous updating of package dependencies. Its internal processing is as follows: First, assets are input. Then, based on the supply chain event model, the package asset data in the package management platform is converted into package supply chain events and stored in the big data platform's index. In parallel, based on the supply chain event model, the package dependency configuration files are read, and the packages in the package management platform are refreshed and downloaded, thus recursively obtaining package dependencies. Finally, the package class index is output to the big data platform.

[0078] The runtime environment module is used for building and continuously updating the supply chain digital twin of the runtime environment. Its internal processing is as follows: input assets, and then, according to the construction method based on the supply chain event model, convert the runtime asset data in the runtime environment into runtime environment supply chain events, store them in the index of the big data platform, and output the runtime environment index to the big data platform.

[0079] Big data platforms are used to provide indexing, retrieval, and visualization of supply chain events.

[0080] Visualization application systems are used to visualize data in big data platforms according to the needs of specific scenarios and roles.

[0081] The visualization application system includes an impact analysis module, a source tracing analysis module, a continuous tracking module, and a scene orchestration module.

[0082] The impact analysis module is used to query the affected content based on the name and version of the software package, including: the specific revision in the code repository, the specific revision and files in the code repository that meet the vulnerability listing conditions, the build tasks in the pipeline, other software packages (including third-party, second-party software packages, distribution packages and images) that depend on the software package in the package management platform, and the relevant runtime environment.

[0083] The source tracing analysis module is used to reconstruct the specific path through which a software package was introduced throughout the entire value chain and lifecycle, based on the package name and version. The source tracing content includes: specific revisions in the codebase, specific revisions and files in the codebase that meet the vulnerability deployment criteria, build tasks in the pipeline, software packages in the package management platform that depend on this package (including third-party and second-party packages, distribution packages, and images), and related runtime environments.

[0084] The continuous tracking module is used to continuously visualize the usage of a software package throughout its entire value chain and lifecycle, based on its name and version. Tracking content includes: specific revisions in the codebase, specific revisions and files in the codebase that meet the vulnerability listing criteria, build tasks in the pipeline, software packages in the package management platform that depend on this package (including third-party and second-party packages, distribution packages, and images), and related runtime environments.

[0085] The scenario orchestration module is used to achieve more complex workflow management by combining the operation control module and big data platform, based on impact analysis, source tracing analysis, and continuous tracking. For example, it can include: "flow investigation" of supply chain characteristics, adjusting worker algorithms based on the code, package, and runtime call status of a certain characteristic, and regenerating all historical supply chain events.

[0086] Although the methods described above are illustrated and depicted as a series of actions for the sake of simplicity, it should be understood and appreciated that these methods are not limited by the order of the actions, as some actions may occur in a different order and / or concurrently with other actions from the illustrations and descriptions herein or not illustrated and described herein but which may be understood by those skilled in the art, according to one or more embodiments.

[0087] Those skilled in the art will further appreciate that the various illustrative logic blocks, modules, circuits, and algorithm steps described in conjunction with the embodiments disclosed herein can be implemented as electronic hardware, computer software, or a combination of both. To clearly illustrate this interchangeability between hardware and software, the various illustrative components, blocks, modules, circuits, and steps are described above in a generalized manner in terms of their functionality. Whether such functionality is implemented as hardware or software depends on the specific application and the design constraints imposed on the overall system. Those skilled in the art may implement the described functionality in different ways for each specific application, but such implementation decisions should not be construed as departing from the scope of the invention.

[0088] The various illustrative logic blocks, modules, and circuits described in conjunction with the embodiments disclosed herein can be implemented or performed using a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. The general-purpose processor may be a microprocessor, but in alternatives, it may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors cooperating with a DSP core, or any other such configuration.

[0089] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of both. The software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to a processor such that the processor can read and write information to / from the storage medium. In an alternative, the storage medium may be integrated into the processor. The processor and storage medium may reside in an ASIC. The ASIC may reside in a user terminal. In an alternative, the processor and storage medium may reside as discrete components in the user terminal.

[0090] In one or more exemplary embodiments, the described functionality may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software as a computer program product, the functionality may be stored or transmitted as one or more instructions or code on or through a computer-readable medium. A computer-readable medium includes both computer storage media and communication media, encompassing any medium that facilitates the transfer of a computer program from one location to another. A storage medium may be any available medium accessible to a computer. By way of example and not limitation, such a computer-readable medium may include RAM, ROM, EEPROM, CD-ROM or other optical disc storage, disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and is accessible to a computer. Any connection is also legitimately referred to as a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of a medium. As used in this article, disk and disc include compact discs (CDs), laser discs, optical discs, digital multi-purpose discs (DVDs), floppy disks, and Blu-ray discs. Disks typically reproduce data magnetically, while discs reproduce data optically using lasers. Combinations of these should also be included within the scope of computer-readable media.

[0091] The prior description of this disclosure is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to this disclosure will be apparent to those skilled in the art, and the general principles defined herein may be applied to other variations without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not intended to be limited to the examples and designs described herein, but should be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A software supply chain analysis system based on digital twins, characterized in that, The system includes a modeling and synchronization cloud computing platform, a big data platform, and a visualization application system, among which: The modeling and synchronization cloud computing platform is used to convert the collected raw toolchain data into supply chain event data and save it to the big data platform; Big data platforms are used to provide indexing, retrieval, and visualization of supply chain events; Visualization application systems are used to visualize data in big data platforms according to the needs of specific scenarios and roles; Among them, the software supply chain toolchain and the software supply chain digital twin are connected through modeling and synchronization cloud computing platforms to convert the raw toolchain data into supply chain event data and save it to the big data platform to realize the digital twin. Then, through a visualization application system, the entire toolchain and the entire lifecycle of the supply chain can be monitored to realize early warning, monitoring and continuous tracking of supply chain events. The system also includes a supply chain twin construction process, which includes: Step 1: Modeling and synchronizing the cloud computing platform and software tools to access the specified assets; Step 2.1: Modeling and synchronizing the cloud computing platform to obtain asset attribute data; Step 2.2: For cases with structured dependency information, model and synchronize the cloud computing platform to obtain the supply chain dependency list; Step 2.3: For unstructured, complex, and advanced supply chain characteristics, model and synchronize the cloud computing platform to obtain a list of supply chain characteristics; Step 3.1: Modeling and Synchronization: The cloud computing platform integrates the acquired supply chain dependency list and asset attribute data to generate a supply chain dependency event list; Step 3.2: Modeling and Synchronization: The cloud computing platform integrates the acquired supply chain feature list and asset attribute data to generate a supply chain feature event list; Step 4: Store the supply chain dependency event list generated in Step 3.1 and the supply chain feature event list generated in Step 3.2 into the big data platform and continuously update them to complete the construction of the supply chain twin.

2. The software supply chain analysis system based on digital twins according to claim 1, characterized in that, The modeling and synchronization cloud computing platform adopts a master-slave mode for parallel processing. The master-slave mode allows applications to perform processing simultaneously across multiple machines or processes through a master control module and multiple working modules.

3. The software supply chain analysis system based on digital twins according to claim 1, characterized in that, The modeling and synchronization cloud computing platform includes a job control module, a code repository module, a pipeline module, a package management module, and a runtime environment module, among which: The job control module is used to continuously synchronize toolchain data to the job control of the supply chain twin; The code repository working module is used for building and continuously updating the supply chain digital twin of the code repository; The pipeline module is used for building and continuously updating the digital twin of the pipeline's supply chain; The package management module is used for the continuous updating of package dependencies; The runtime environment module is used for building and continuously updating the supply chain digital twin of the runtime environment.

4. The software supply chain analysis system based on digital twins according to claim 3, characterized in that, The main control module for the operation is further configured as follows: First, the job control module obtains the synchronously updated list of tool assets. This further includes: the job control module receives query filtering conditions, and then processes the obtained list of tool assets. The processing includes pulling and pushing. Pulling is to obtain the list of assets that meet the query filtering conditions through the tool's interface or the tool's data. Pushing is to push asset event information to the job control module through the tool's interface. The job control module obtains the list of tool assets that meet the conditions from the asset event information and outputs it. Finally, the job control module uses each asset information as a job server, allowing various job modules to retrieve and execute it.

5. The software supply chain analysis system based on digital twins according to claim 3, characterized in that, The code repository working module is further configured as follows: First, input the assets, then convert the code data in the codebase into code-type supply chain events based on the supply chain event model, store them in the index of the big data platform, and output the code-type index to the big data platform; In the event model of the supply chain, a software asset includes one asset and attribute data corresponding to the asset metadata, multiple supply chain dependencies, and multiple supply chain features. Each supply chain dependency and asset attribute data constitutes a supply chain dependency event, and each supply chain feature and asset attribute data constitutes a supply chain feature event. Supply chain dependency events and supply chain feature events together constitute a supply chain event.

6. The software supply chain analysis system based on digital twins according to claim 5, characterized in that, The pipeline module is further configured as follows: First, input the assets. Then, based on the supply chain event model, convert the pipeline asset data into pipeline supply chain events and store them in the index of the big data platform. Finally, output the pipeline-type index to the big data platform.

7. The software supply chain analysis system based on digital twins according to claim 6, characterized in that, The package management module is further configured as follows: First, the assets are input. Then, based on the supply chain event model, the software package asset data in the package management platform is converted into software package supply chain events and stored in the index of the big data platform. In parallel, based on the supply chain event model, the package dependency configuration file of the software package is read, and the software packages in the package management platform are refreshed and downloaded, thereby recursively obtaining the software package dependency relationship. Finally, the package class index is output to the big data platform.

8. The software supply chain analysis system based on digital twins according to claim 7, characterized in that, The runtime environment working module is further configured as follows: Input assets, and then, based on the event model of the supply chain, convert the operational asset data in the operating environment into operating environment supply chain events, store them in the index of the big data platform, and output the operating environment index to the big data platform.

9. The software supply chain analysis system based on digital twins according to claim 1, characterized in that, The visualization application system includes an impact analysis module, a source tracing analysis module, a continuous tracking module, and a scene orchestration module, among which: The impact analysis module is used to query the affected content based on the name and version of the software package; The traceability analysis module is used to reconstruct the specific path through which the software package was introduced throughout the entire value chain and lifecycle, based on the package name and version. The continuous tracking module is used to continuously visualize the usage of software packages throughout their entire value chain and lifecycle, based on their name and version. The scenario orchestration module is used to manage complex workflows by combining the operation control module and big data platform, based on impact analysis, source tracing analysis, and continuous tracking.

10. A method for constructing a software supply chain based on digital twins, characterized in that, The method is implemented on the digital twin-based software supply chain analysis system as described in claim 1, and the method includes: Step 1: Modeling and synchronizing the cloud computing platform and software tools to access the specified assets; Step 2.1: Modeling and synchronizing the cloud computing platform to obtain asset attribute data; Step 2.2: For cases with structured dependency information, model and synchronize the cloud computing platform to obtain the supply chain dependency list; Step 2.3: For unstructured, complex, and advanced supply chain characteristics, model and synchronize the cloud computing platform to obtain a list of supply chain characteristics; Step 3.1: Modeling and Synchronization: The cloud computing platform integrates the acquired supply chain dependency list and asset attribute data to generate a supply chain dependency event list; Step 3.2: Modeling and Synchronization: The cloud computing platform integrates the acquired supply chain feature list and asset attribute data to generate a supply chain feature event list; Step 4: Store the supply chain dependency event list generated in Step 3.1 and the supply chain feature event list generated in Step 3.2 into the big data platform and continuously update them to complete the construction of the supply chain twin.

11. The method for constructing a software supply chain based on digital twins according to claim 10, characterized in that, In step 2.1, the attribute data for code assets includes the committer, commit event, file name, project name, and a list of modified line numbers; the attribute data for software package assets includes the creator, creation event, modifier, modification time, library name, package name, file name, package version, path, package hash code, number of downloads, and last download time; the attribute data for pipeline tasks includes the pipeline execution time, pipeline software version, pipeline environment configuration, and personnel executing the pipeline task; and the attribute data for runtime environment assets includes the hostname, environment name, IP address, process ID, and the executable software package corresponding to the process.

12. The method for constructing a software supply chain based on digital twins according to claim 11, characterized in that, Step 2.2 further includes: For code-type assets, if the file type is a structured configuration file of a package management software, the package management configuration file will be parsed in a structured manner to obtain the supply chain dependency list; For software package assets on the package management platform, two scenarios are handled: if a package management configuration file exists, the configuration file is parsed in a structured manner to obtain the supply chain dependency list; if a package management configuration file does not exist, package management software is used to obtain the relevant dependent software packages and can construct a software package dependency graph. For pipeline tasks, supply chain information includes source code revisions and dependency information during the build process, as well as deployment parameters during the deployment process. For runtime environment assets, supply chain information consists of observable data of runtime processes, and is handled in two ways: if it is a Java-like programming language software package process, virtual machine bytecode technology is used to directly collect the class and function call relationships loaded at runtime; if it is a non-Java type software package process, the compiler software is used to collect the dependency information contained in the software package.

13. The method for constructing a software supply chain based on digital twins according to claim 12, characterized in that, Step 2.3 further includes: If the asset type is source code and it is necessary to determine the scope of impact through the source code, then extract the values ​​of each pair of call relationships and other utilization conditions after the source code is structured and parsed into a supply chain feature list. If the asset type is a binary software package, then it is necessary to use methods including decompression software, unpacking software, and binary analysis software for specific file types to obtain structured supply chain information from the content; If it is an operating environment asset, then observability software, performance analysis software, low-level analysis software, and compilation software are used in combination to extract the supply chain characteristic information of the operating environment.

Images