Software security assessment method, system and readable storage medium

Abstract

The present invention discloses a software security assessment method, system, and readable storage medium. The method includes the following steps: extracting fingerprint features of third-party libraries in software delivery files; obtaining vulnerability information disclosed by the third-party libraries and extracting vulnerability features; calculating a vulnerability matching degree based on correlation comparison between the fingerprint features of the third-party libraries and the vulnerability features, and calculating a third-party library security score based on the vulnerability matching degree; obtaining the control flow of the program source code; calculating a source program security score based on the program's input validation, API calls, exception handling, and / or security features in the control flow; and calculating a software security score based on the third-party library security score and the source program security score, and using this score to assess the security of the software. The present invention solves the problem in related technologies of being unable to comprehensively detect security threats to program source code and referenced third-party libraries.

Description

Technical Field

[0001] The present invention belongs to the field of software security technology, and in particular relates to a software security assessment method, system and readable storage medium. Background Art

[0002] With the rapid development of internet technologies and applications, software-based network services have become a core component of cyberspace. Software vulnerabilities are a significant threat to cyberspace, with 75% of cyberattacks linked to software code security. Therefore, rapidly and accurately discovering and exploiting vulnerabilities and comprehensively assessing software security during the software development and delivery phases are essential components of software protection and a pressing need for ensuring cyberspace security.

[0003] To reduce software development costs and improve efficiency, developers often rely on various open-source third-party frameworks or libraries when developing open-source software systems. Third-party libraries play an increasingly important role in software development, and a compromised third-party library can have immeasurable consequences. Therefore, vulnerability analysis and security monitoring of third-party libraries used in software development are essential. Current software security assessments primarily rely on vulnerability library comparisons, but lack vulnerability detection for third-party libraries, preventing comprehensive detection of security threats within program source code and referenced third-party libraries.

[0004] In order to comprehensively detect security threats of program source code and referenced third-party libraries and thereby evaluate the security of software, a software security assessment method, system and readable storage medium are proposed. Summary of the Invention

[0005] The embodiments of the present invention provide a software security assessment method, system and readable storage medium to at least solve the problem in related technologies that the security threats of program source code and referenced third-party libraries cannot be fully detected.

[0006] According to one embodiment of the present invention, a software security assessment method is proposed, comprising:

[0007] Extract fingerprint features of third-party libraries in software delivery files;

[0008] Obtain vulnerability information disclosed by third-party libraries and extract vulnerability features;

[0009] Calculate the vulnerability matching degree based on the correlation comparison between the fingerprint features of the third-party library and the vulnerability features, and calculate the third-party library security score based on the vulnerability matching degree;

[0010] Get the control flow of the program source code;

[0011] Calculate the source program security score based on the program's input validation and / or API calls and / or exception handling and / or security features in the control flow;

[0012] The software security score is calculated based on the third-party library security score and the source program security score, and is used to evaluate the security of the software.

[0013] In an exemplary embodiment, extracting fingerprint features of third-party libraries in software delivery files includes the steps of:

[0014] Analyze header files and library files in software delivery files;

[0015] Identify third-party libraries involved in the software from header files and library files;

[0016] Identify the fingerprint features of the third-party library; the fingerprint features of the third-party library include any one or a combination of the name, the type of supported system, the current version number, the latest version number, the release time, and the manufacturer.

[0017] In an exemplary embodiment, the step of obtaining vulnerability information disclosed by a third-party library and extracting vulnerability features includes the following steps:

[0018] Obtain vulnerability information disclosed by third-party libraries through Python web crawlers;

[0019] Extract vulnerability features and store them in a predefined CSV file; the vulnerability features include any one or more combinations of the open source library name, number, hazard level, type, threat type, manufacturer, introduction, release time, and repair suggestions.

[0020] In an exemplary embodiment, the step of calculating the vulnerability matching degree based on the correlation comparison between the fingerprint features of the third-party library and the vulnerability features and calculating the third-party library security score based on the vulnerability matching degree includes the following steps:

[0021] Obtain one or more vulnerability libraries associated with the third-party library using an index-based association comparison method;

[0022] Calculate vulnerability matching degree based on name association, type association, and / or time similarity of fingerprint features;

[0023] The security score of the third-party library is calculated based on the vulnerability matching degree and vulnerability severity level of the third-party library.

[0024] In an exemplary embodiment, the step of calculating the vulnerability matching degree based on the name association degree, type association degree, and / or time similarity of the fingerprint features comprises the following steps:

[0025] Calculate the name association based on the similarity between the name of the third-party library and the name of the open source library, and / or the similarity between the version number of the third-party library and the vulnerability version number of the vulnerability library, and / or the similarity between the vendor of the third-party library and the vulnerability vendor in the vulnerability library;

[0026] Calculate the type association degree based on the similarity between the system type of the third-party library and the vulnerability system type of the vulnerability library and / or the matching degree between the type of the third-party library and the threat type of the vulnerability library;

[0027] Calculate the time similarity based on the similarity between the release time of the third-party library and the release time of the vulnerability library;

[0028] The vulnerability matching degree is calculated based on the positive correlation between the name association degree, type association degree, and / or time similarity of the fingerprint features and the vulnerability matching degree.

[0029] In an exemplary embodiment, obtaining the control flow of the program source code includes any one or a combination of using a Source Flowchart tool to generate a control flow based on the C++ program source code and using a Soot tool to generate a control flow based on the Java program source code.

[0030] In an exemplary embodiment, the step of calculating the source program security score based on input validation and / or API calls and / or exception handling and / or security features of the program in the control flow comprises the following steps:

[0031] Calculate an input validation security assessment value based on input special character validation and / or input numeric validation performed by the program in the control flow;

[0032] Calculate the API call security assessment value based on whether the API and / or API call called by the program encapsulation in the control flow complies with the rules;

[0033] Calculate the exception handling safety assessment value based on the proportion of program terminations due to program exceptions in the control flow and / or the amount of effective information prompted by program errors;

[0034] Calculate a security feature evaluation value based on a resource leakage index of a program in a control flow and / or an integrity index of a judgment logic and / or an access control index and / or a password management index;

[0035] The source program security score is calculated based on the input validation security evaluation value and / or the API call security evaluation value and / or the exception handling security evaluation value and / or the security feature evaluation value.

[0036] In an exemplary embodiment, calculating the software security score based on the third-party library security score and the source program security score and using this to evaluate the security of the software includes the following steps:

[0037] The software security score is calculated based on the positive correlation between the third-party library security score and the source program security score and the software security score;

[0038] The security rating of the current software is obtained based on the correspondence between the software security score and the preset different security levels.

[0039] A computer-readable storage medium stores a computer program for electronic data exchange, wherein the computer program causes a computer to execute the above method.

[0040] According to another embodiment of the present invention, a software security assessment system is provided, comprising:

[0041] processor;

[0042] Memory;

[0043] as well as

[0044] One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the processor, the programs causing the computer to perform the above method.

[0045] The software security assessment method, system, and readable storage medium of the present invention have the following advantages:

[0046] (1) An index-based association comparison method is used to obtain one or more vulnerability libraries associated with a third-party library and calculate the vulnerability matching degree based on the name association and / or type association and / or time similarity of the fingerprint features. Compared with the traditional technical solution of matching based on the vulnerability name, the accuracy of vulnerability matching can be effectively improved, and the accuracy of vulnerability analysis can be improved.

[0047] (2) The source code security score is calculated based on the input verification and / or API calls and / or exception handling and / or security features of the program in the control flow. Compared with the traditional technical solution that only evaluates program security based on security features, this can comprehensively and effectively evaluate the security of the program source code control flow and improve the accuracy of software security analysis.

[0048] (3) The software security score is calculated based on the third-party library security score and the source program security score, and the software security is evaluated based on this score. Compared with the traditional technical solution of only performing security assessment by analyzing the program source code, this can comprehensively and effectively evaluate the security of the delivered software. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 is a flowchart of a software security assessment method according to an embodiment of the present invention;

[0050] Figure 2 is a flowchart of sub-step S01 of an embodiment of the present invention;

[0051] Figure 3 is a flowchart of sub-step S02 of an embodiment of the present invention;

[0052] Figure 4 is a flowchart of sub-step S03 of an embodiment of the present invention;

[0053] Figure 5 is a flowchart of sub-step S032 of an embodiment of the present invention;

[0054] Figure 6 is a flowchart of sub-step S05 of an embodiment of the present invention;

[0055] Figure 7 is a flowchart of sub-step S06 of an embodiment of the present invention;

[0056] Figure 8 The figure is a schematic diagram of the structure of a software security assessment system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0057] The present invention will be described in detail below with reference to specific embodiments. The following embodiments will help those skilled in the art to further understand the invention, but are not intended to limit the present invention in any form. It should be noted that those skilled in the art may make several changes and modifications without departing from the scope of the present invention. These all fall within the scope of protection of the present invention.

[0058] A software security assessment method according to an embodiment of the present invention is shown in the flowchart Figure 1 As shown, the steps include:

[0059] Step S01: extracting fingerprint features of third-party libraries in software delivery files;

[0060] Step S02: Obtain vulnerability information disclosed by a third-party library and extract vulnerability features;

[0061] Step S03: Calculate the vulnerability matching degree based on the correlation comparison between the fingerprint features of the third-party library and the vulnerability features, and calculate the third-party library security score based on the vulnerability matching degree;

[0062] Step S04: Obtain the control flow of the program source code;

[0063] Step S05: Calculate the source program security score based on the program's input verification and / or API calls and / or exception handling and / or security features in the control flow;

[0064] Step S06: Calculate the software security score based on the third-party library security score and the source program security score, and use this score to evaluate the security of the software.

[0065] In an exemplary embodiment, the step S01 is as shown in the flowchart. Figure 2 Shown, including:

[0066] Step S011: Analyze the header files and library files in the software delivery file;

[0067] Step S012: Identify third-party libraries involved in the software from header files and library files;

[0068] Step S013: Identify the fingerprint features of the third-party library; the fingerprint features of the third-party library include any one or a combination of the third-party library name, supported system type, current version number, latest version number, release time, and manufacturer.

[0069] In this example, we analyze the header files (*.h), static library files (*.lib), and dynamic library files (*.dll) within the software delivery files. We then directly extract the fingerprint features of third-party libraries from these files and store them in a predefined CSV file. The fingerprint features of third-party libraries include information such as the library name, supported systems, current version number, latest version number, release date, and manufacturer. If these fingerprint features cannot be directly extracted, we develop a Python web crawler program to extract them from the official website of the third-party library.

[0070] In an exemplary embodiment, the step S02 is as shown in the flowchart. Figure 3 Shown, including:

[0071] Step S021: Obtain vulnerability information disclosed by a third-party library through a Python web crawler program;

[0072] Step S022: Extract vulnerability features and store them in a predefined CSV file; the vulnerability features include any one or a combination of the open source library name, number, hazard level, type, threat type, manufacturer, introduction, release time, and repair suggestions.

[0073] In this example, we used a Python web crawler to retrieve vulnerability information from well-known open-source vulnerability websites, such as OSV, WSVD, SVD, and VVD, and stored it in a database file. We then extracted vulnerability features and stored them in a predefined CSV file. These features include the library's name, number, hazard level, type, release date, threat type, vendor, release date, description, and recommended fixes.

[0074] In an exemplary embodiment, the step S03 is as shown in the flowchart. Figure 4 Shown, including:

[0075] Step S031: Obtain one or more vulnerability libraries associated with the third-party library using an index-based association comparison method;

[0076] Step S032: Calculate vulnerability matching degree based on name association degree and / or type association degree and / or time similarity of fingerprint features;

[0077] Step S033: Calculate the security score of the third-party library based on the vulnerability matching degree and the vulnerability hazard level of the third-party library.

[0078] In an exemplary embodiment, the step S032 is as shown in the flowchart. Figure 5 Shown, including:

[0079] Step S0321: Calculate the name association based on the similarity between the name of the third-party library and the name of the open source library, and / or the similarity between the version number of the third-party library and the vulnerability version number of the vulnerability library, and / or the similarity between the manufacturer of the third-party library and the vulnerability manufacturer in the vulnerability library;

[0080] Step S0322: Calculate the type association degree based on the similarity between the system type of the third-party library and the vulnerability system type of the vulnerability library and / or the matching degree between the type of the third-party library and the threat type of the vulnerability library;

[0081] Step S0323: Calculate time similarity based on the similarity between the release time of the third-party library and the release time of the vulnerability library;

[0082] Step S0324: Calculate the vulnerability matching degree based on the positive correlation between the name association degree and / or type association degree and / or time similarity of the fingerprint feature and the vulnerability matching degree.

[0083] In this embodiment, the name association is calculated based on the similarity between the name of the third-party library and the name of the open source library and / or the similarity between the version number of the third-party library and the vulnerability version number of the vulnerability library and / or the similarity between the manufacturer of the third-party library and the vulnerability manufacturer in the vulnerability library, which is: calculating the name association based on the positive correlation between the similarity between the name of the third-party library and the name of the open source library (the ratio of repeated characters to the total number of characters) and the name association, calculating the name association based on the positive correlation between the similarity between the version number of the third-party library and the vulnerability version number of the vulnerability library (the ratio of repeated characters to the total number of characters) and the name association, calculating the name association based on the positive correlation between the similarity between the manufacturer of the third-party library and the vulnerability manufacturer in the vulnerability library (the manufacturer association calculated based on the name and equity relationship of the manufacturer) and the name association, calculating the name association based on the positive correlation between the similarity between the name of the third-party library and the name of the open source library (the ratio of repeated characters to the total number of characters) and the similarity between the version number of the third-party library and the vulnerability version number of the vulnerability library (the ratio of repeated characters to the total number of characters) and the name association, The name association is calculated based on the positive correlation between the similarity between the name of the third-party library and the name of the open source library (the ratio of repeated characters to the total number of characters) and the similarity between the manufacturer of the third-party library and the vulnerability manufacturer in the vulnerability library (the manufacturer association calculated based on the manufacturer's name and equity relationship) and the name association; the name association is calculated based on the positive correlation between the similarity between the version number of the third-party library and the vulnerability version number of the vulnerability library (the ratio of repeated characters to the total number of characters) and the similarity between the manufacturer of the third-party library and the vulnerability manufacturer in the vulnerability library (the manufacturer association calculated based on the manufacturer's name and equity relationship) and the name association; any one of the name associations is calculated based on the similarity between the name of the third-party library and the name of the open source library (the ratio of repeated characters to the total number of characters) and the similarity between the version number of the third-party library and the vulnerability version number of the vulnerability library (the ratio of repeated characters to the total number of characters) and the similarity between the manufacturer of the third-party library and the vulnerability manufacturer in the vulnerability library (the manufacturer association calculated based on the manufacturer's name and equity relationship) and the name association, and the name association is represented by the variable e.

[0084] The type association degree is calculated based on the similarity between the system type of the third-party library and the vulnerability system type of the vulnerability library and / or the vulnerability matching degree between the type of the third-party library and the vulnerability threat type of the vulnerability library, and is any one of: calculating the type association degree based on a positive correlation between the similarity between the system type of the third-party library and the vulnerability system type of the vulnerability library and the type association degree; calculating the type association degree based on a positive correlation between the matching degree between the type of the third-party library and the threat type of the vulnerability library and the type association degree; and calculating the type association degree based on a positive correlation between the similarity between the system type of the third-party library and the vulnerability system type of the vulnerability library and the matching degree between the type of the third-party library and the threat type of the vulnerability library and the type association degree. The type association degree is represented by a variable w.

[0085] The time similarity is calculated based on the similarity between the release time of the third-party library and the release time of the vulnerability library. The time similarity is calculated based on the negative correlation between the time difference between the release time of the third-party library and the release time of the vulnerability library and the time similarity. The time similarity is represented by the variable y.

[0086] The vulnerability matching degree is calculated based on the positive correlation between the name association degree and / or type association degree and / or time similarity of the fingerprint feature and the vulnerability matching degree according to any implementation method described in Table A below, and the vulnerability matching degree is represented by the variable x.

[0087] A1 to A7 in Table A represent different implementation methods for calculating vulnerability matching degrees. For ease of expression, the vulnerability matching degree x in Table A represents the vulnerability matching degree between a third-party library and a certain vulnerability library. The name association degree e, type association degree w, and time similarity y are calculated using the method described in any of the above implementation methods.

[0088] Table A Different ways to calculate vulnerability matching

[0089]

[0090]

[0091]

[0092]

[0093] In a preferred embodiment, step S033, calculating the security score of the third-party library based on the vulnerability matching degree and the vulnerability hazard level of the third-party library, includes:

[0094] Pre-set different vulnerability risk levels for different vulnerability libraries;

[0095] Obtain vulnerability matching between the third-party library and different vulnerability libraries according to any method described in Table A;

[0096] The security score of the third-party library is calculated based on the weighted sum of the vulnerability matching degree of the third-party library and the vulnerability hazard level of the corresponding vulnerability library, which is denoted as q.

[0097] In another preferred embodiment, step S033, calculating the security score of the third-party library based on the vulnerability matching degree and the vulnerability hazard level of the third-party library, includes:

[0098] Pre-set vulnerability matching ranges corresponding to different vulnerability hazard levels and security scores corresponding to different vulnerability hazard levels;

[0099] Obtain the vulnerability matching degree between the third-party library and all vulnerability libraries according to any method described in Table A, calculate the maximum vulnerability matching degree, and determine the corresponding vulnerability hazard level;

[0100] The security score of the third-party library is obtained based on the corresponding vulnerability hazard level of the third-party library and the security scores corresponding to different vulnerability hazard levels.

[0101] In this embodiment, vulnerability matching ranges corresponding to different vulnerability risk levels are pre-set. A vulnerability risk level of no threat corresponds to a vulnerability matching range of 0-0.2, a vulnerability risk level of low risk corresponds to a vulnerability matching range of 0.2-0.5, a vulnerability risk level of medium risk corresponds to a vulnerability matching range of 0.5-0.8, and a vulnerability risk level of medium risk corresponds to a vulnerability matching range of 0.8-1. The corresponding relationship between vulnerability risk levels and the security assessment scores of third-party libraries is as follows: a vulnerability risk level of no threat corresponds to a security assessment score of [7, 10] for third-party libraries, a vulnerability risk level of low risk corresponds to a security assessment score of [4, 7] for third-party libraries, a vulnerability risk level of medium risk corresponds to a security assessment score of (0, 4), and a vulnerability risk level of medium risk corresponds to a security assessment score of 0. The vulnerability matching scores of the third-party library and all vulnerability libraries are obtained using the method described in any of the items in Table A. The maximum vulnerability matching score is calculated and its corresponding vulnerability risk level is determined. Thus, a security score of the third-party library is obtained based on the corresponding vulnerability risk level of the third-party library and the security scores corresponding to different vulnerability risk levels, denoted as q.

[0102] In an exemplary embodiment, step S04 includes any one or a combination of using a Source Flowchart tool to generate a control flow based on a C++ program source code, and using a Soot tool to generate a control flow based on a Java program source code.

[0103] In an exemplary embodiment, the step S05 is as shown in the flowchart. Figure 6 Shown, including:

[0104] Step S051: Calculate an input verification security assessment value based on the verification of input special characters and / or verification of input numbers in the control flow program;

[0105] Step S052: Calculate the API call security assessment value based on whether the API called by the program encapsulation in the control flow and / or the API call complies with the rules;

[0106] Step S053: Calculate the exception handling safety assessment value based on the proportion of program terminations due to program exceptions in the control flow and / or the amount of effective information prompted by program errors;

[0107] Step S054: Calculate a security feature evaluation value based on the resource leakage index of the program in the control flow and / or the integrity index of the judgment logic and / or the access control index and / or the password management index;

[0108] Step S055: Calculate the source program security score based on the input verification security evaluation value and / or the API call security evaluation value and / or the exception handling security evaluation value and / or the security feature evaluation value.

[0109] In this embodiment, the input verification security assessment value is calculated based on the special character verification and / or the digital verification of the input by the program in the control flow, which is: calculating the input verification security assessment value based on the positive correlation between the degree of verification of the special characters input by the program in the control flow (the degree of verification is calculated based on the number of verifications and the number of digits verified) and the input verification security assessment value; calculating the input verification security assessment value based on the positive correlation between the degree of verification of the digital input by the program in the control flow (the degree of verification is calculated based on the number of verifications and the number of digits verified) and the input verification security assessment value; calculating any one of the input verification security assessment values ​​based on the positive correlation between the degree of verification of the special characters input by the program in the control flow (the degree of verification is calculated based on the number of verifications and the number of digits verified) and the degree of verification of the digital input by the program in the control flow (the degree of verification is calculated based on the number of verifications and the number of digits verified) and the input verification security assessment value, and the input verification security assessment value is represented by the variable d.

[0110] The API call security assessment value is calculated based on whether the APIs and / or API calls encapsulated in the control flow comply with the rules. The API call security assessment value is calculated based on the negative correlation between the degree of API calling encapsulated in the control flow (the degree of API calling is calculated based on the positive correlation between the number of calls and / or the frequency of calls and / or the length of API calls and the degree of API calling) and the API call security assessment value; the API call security assessment value is calculated based on the positive correlation between the degree of matching between the API calling encapsulated in the control flow and the rules (the proportion of calls that comply with the rules) and the API call security assessment value; the API call security assessment value is calculated based on the negative correlation between the degree of API calling encapsulated in the control flow (the degree of API calling is calculated based on the positive correlation between the number of calls and / or the frequency of calls and / or the length of API calls and the degree of API calling) and the API call security assessment value; and the API call security assessment value is calculated based on the positive correlation between the degree of matching between the API calling encapsulated in the control flow and the rules (the proportion of calls that comply with the rules) and the API call security assessment value. The API call security assessment value is represented by the variable m.

[0111] The calculation of the exception handling safety assessment value based on the proportion of program terminations when a program exception occurs in the control flow and / or the effective information volume of program error prompts is: calculating the exception handling safety assessment value based on the negative correlation between the proportion of program terminations when a program exception occurs in the control flow (the ratio of the number of program terminations after a program exception occurs to the number of program exceptions) and the exception handling safety assessment value; calculating the exception handling safety assessment value based on the negative correlation between the effective information volume of program error prompts in the control flow (the overlap ratio of error prompt keywords to program keywords) and the exception handling safety assessment value; calculating any one of the exception handling safety assessment values ​​based on the negative correlation between the proportion of program terminations when a program exception occurs in the control flow (the ratio of the number of program terminations after a program exception occurs to the number of program exceptions) and the effective information volume of program error prompts in the control flow (the overlap ratio of error prompt keywords to program keywords) and the exception handling safety assessment value, wherein the exception handling safety assessment value is represented by a variable n.

[0112] The security feature evaluation value is calculated based on the resource leakage index and / or the integrity index and / or the access control index and / or the password management index of the program in the control flow, which includes: calculating the security feature evaluation value based on the negative correlation between the resource leakage index of the program in the control flow (calculated based on the number and / or proportion of resource leakage) and the security feature evaluation value; calculating the security feature evaluation value based on the positive correlation between the integrity index of the judgment logic of the program in the control flow (calculated based on the ratio of the complete logic chain length to the program length) and the security feature evaluation value; calculating the security feature evaluation value based on the positive correlation between the access control index of the program in the control flow (calculated based on the positive correlation between the permission strength and / or control number of the program access control and the access control index) and the security feature evaluation value; calculating the security feature evaluation value based on the positive correlation between the password management index of the program in the control flow (calculated based on the positive correlation between the password management strength of the program and the password management index) and the security feature evaluation value; and calculating any one of the security feature evaluation values ​​based on the product or weighted sum of any one or more of the above items, wherein the security feature evaluation value is represented by the variable h.

[0113] The calculation of the source program security score based on the input verification security assessment value and / or the API call security assessment value and / or the exception handling security assessment value and / or the security feature assessment value is to obtain the source program security score based on the positive correlation between the input verification security assessment value and / or the API call security assessment value and / or the exception handling security assessment value and / or the security feature assessment value and the source program security score, and the source program security score is represented by the variable p.

[0114] B1 to B15 in Table B represent different implementation methods for calculating the source program security score, where the input verification security assessment value d, API call security assessment value m, exception handling security assessment value n, and security feature assessment value h involved in Table B are obtained using the above implementation methods.

[0115] Table B Different implementation methods for calculating source program security scores

[0116]

[0117]

[0118]

[0119]

[0120]

[0121]

[0122]

[0123]

[0124]

[0125] In an exemplary embodiment, the step S06 is as shown in the flowchart. Figure 7 As shown, the steps include:

[0126] Step S061: Calculate the software security score based on the positive correlation between the third-party library security score, the source program security score, and the software security score;

[0127] Step S062: Obtain the security rating of the current software based on the corresponding relationship between the software security score and the preset different security levels.

[0128] In this embodiment, the third-party library security score q is calculated according to the method described in any of the above embodiments, and the source program security score p is calculated according to any item in Table B.

[0129] The software security score is calculated based on the positive correlation between the third-party library security score, the source program security score and the software security score, and the software security score is calculated as follows: s = r1·q r2 +r3·p r4 +r5 or s=r6·q r7 ·p r8+r9, wherein r1, r2, r3, r4, r5, r6, r7, r8, and r9 are calculation coefficients obtained through prior training.

[0130] The software security score ranges corresponding to different security levels are pre-set, and the security rating of the current software is obtained according to the range in which the calculated software security score s lies.

[0131] A software security assessment system according to an embodiment of the present invention is shown in the structural diagram as follows: Figure 8 Shown, including:

[0132] processor;

[0133] Memory;

[0134] as well as

[0135] One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the processor, the programs causing the computer to perform the above method.

[0136] Of course, those skilled in the art should realize that the above embodiments are only used to illustrate the present invention and are not intended to limit the present invention. As long as they are within the scope of the present invention, any changes or modifications to the above embodiments will fall within the scope of protection of the present invention.

Claims

1. A software security assessment method, characterized in that: include: Extract fingerprint features of third-party libraries in software delivery files; Obtain vulnerability information disclosed by third-party libraries and extract vulnerability features; Calculating the vulnerability matching degree based on the correlation comparison between the fingerprint features and the vulnerability features of the third-party library and calculating the third-party library security score based on the vulnerability matching degree; calculating the vulnerability matching degree based on the correlation comparison between the fingerprint features and the vulnerability features of the third-party library and calculating the third-party library security score based on the vulnerability matching degree, including the steps of: obtaining one or more vulnerability libraries associated with the third-party library by using an index-based correlation comparison method; calculating the vulnerability matching degree based on the name correlation degree and / or type correlation degree and / or time similarity of the fingerprint features; and calculating the third-party library security score based on the vulnerability matching degree and the vulnerability hazard level of the third-party library; The method of calculating the vulnerability matching degree based on the name association degree and / or type association degree and / or time similarity of the fingerprint feature comprises the following steps: calculating the name association degree based on the similarity between the name of the third-party library and the name of the open source library and / or the similarity between the version number of the third-party library and the vulnerability version number of the vulnerability library and / or the similarity between the manufacturer of the third-party library and the vulnerability manufacturer in the vulnerability library; calculating the type association degree based on the similarity between the system type of the third-party library and the vulnerability system type of the vulnerability library and / or the matching degree between the type of the third-party library and the threat type of the vulnerability library; calculating the time similarity based on the similarity between the release time of the third-party library and the release time of the vulnerability library; and calculating the vulnerability matching degree based on the positive correlation between the name association degree and / or type association degree and / or time similarity of the fingerprint feature and the vulnerability matching degree. Get the control flow of the program source code; Calculating the source program security score based on the input verification and / or API calls and / or exception handling and / or security features of the program in the control flow; the said calculating the source program security score based on the input verification and / or API calls and / or exception handling and / or security features of the program in the control flow comprises the following steps: calculating the input verification security assessment value based on the special character verification and / or digital verification of the input by the program in the control flow; calculating the API call security assessment value based on whether the APIs and / or API calls encapsulated and called by the program in the control flow comply with the rules; calculating the exception handling security assessment value based on the proportion of program terminations when the program in the control flow is abnormal and / or the amount of effective information prompted by the program error; calculating the security feature assessment value based on the resource leakage index and / or the integrity index of the judgment logic and / or the access control index and / or the password management index of the program in the control flow; and calculating the source program security score based on the input verification security assessment value and / or the API call security assessment value and / or the exception handling security assessment value and / or the security feature assessment value; The software security score is calculated based on the third-party library security score and the source program security score, and is used to evaluate the security of the software.

2. The software security assessment method according to claim 1, characterized in that: The method of extracting fingerprint features of third-party libraries in software delivery files includes the following steps: Analyze header files and library files in software delivery files; Identify third-party libraries involved in the software from header files and library files; Identify fingerprint features of third-party libraries; The fingerprint features of the third-party library include any one or a combination of the third-party library name, the type of supported system, the current version number, the latest version number, the release time, and the manufacturer.

3. The software security assessment method according to claim 2, characterized in that: The method of obtaining vulnerability information disclosed by a third-party library and extracting vulnerability features includes the following steps: Obtain vulnerability information disclosed by third-party libraries through Python web crawlers; Extract vulnerability features and store them in a predefined CSV file; the vulnerability features include any one or more combinations of the open source library name, number, hazard level, type, threat type, manufacturer, introduction, release time, and repair suggestions.

4. The software security assessment method according to claim 1, wherein: The obtaining of the control flow of the program source code includes any one or a combination of using a Source Flowchart tool to generate a control flow based on the C++ program source code and using a Soot tool to generate a control flow based on the Java program source code.

5. The software security assessment method according to claim 1, characterized in that: The method of calculating the software security score based on the third-party library security score and the source program security score and using the score to evaluate the software security includes the following steps: The software security score is calculated based on the positive correlation between the third-party library security score and the source program security score and the software security score; The security rating of the current software is obtained based on the correspondence between the software security score and the preset different security levels.

6. A computer-readable storage medium storing a computer program for electronic data exchange, wherein: The computer program enables a computer to execute the method according to any one of claims 1 to 5.

7. A software security assessment system, characterized in that include: processor Memory; as well as One or more programs, wherein the one or more programs are stored in a memory and configured to be executed by the processor, the programs causing the computer to perform the method according to any one of claims 1 to 5.

Images