Terminal open source software security detection and early warning method, system, device and terminal

Abstract

The application belongs to the technical field of software security, and discloses a terminal open source software security detection and early warning method, system, device and terminal. The open source software dependent library and hierarchical relationship are parsed according to the SBOM file of the software, and external threat information sources are accessed according to preset conditions. The latest vulnerability threats are extracted from the vulnerability information shared by the official information security vulnerability sharing platform and the open source software development platform, and are matched with the hierarchical relationship based on the SBOM knowledge, so as to analyze whether the terminal exists software system vulnerability threats and potential security risks caused by the hierarchical relationship of the software supply chain. If risks are found, safety early warning information is produced, and understandable safety alarms are sent to users. Recommended safety solutions are generated according to preset models or intelligent algorithms, and users are reminded to take relevant safety measures, including updating software and disabling software. The application can be used on various terminals to detect the security risks of software systems, and to upgrade and guarantee the security of software systems.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of software security, and particularly relates to a terminal open source software security detection and early warning method, system, device and terminal. BACKGROUND

[0002] At present, in the digital era, software is everywhere, and we are living in a software-defined world. Software defines from the earliest definition of radio to the definition of network (SDN), storage (SDS), computing (cloud computing), and product (intelligent terminal). Software is redefining the entire information world around us. Therefore, software has gradually become a new type of key infrastructure in the digital era. Open source software resources are the key pillar of today's software development. From a global perspective, Gartner surveys show that 99% of organizations use open source components in their IT systems. According to statistics of the American Frost Research Company, more than 80% of application software in the world uses open source components, and in the energy, communication, finance, and Internet industries, this proportion is as high as 95%. The current dependence on open source software is also increasing. Among them, Synopsys data in 2019 shows that in software containing open source components, the proportion of open source code in the total amount of code increased from 57% in 2018 to 60%. Data in 2021 shows that open source software supply is accelerating, with a global open source supply year-on-year growth of 20% and a component download volume growth of 73%. Open source demand is growing explosively. In addition, China's dependence on open source software is also increasing. At present, open source software, components, code, and frameworks are widely used in the fields of basic software, cloud computing, big data, artificial intelligence, etc. Data from Qianxin's "2021 China Software Supply Chain Security Analysis Report" shows that 100% of domestic enterprise software projects use open source software.

[0003] The security of software is also becoming a fundamental and basic problem in today's society, and the software supply chain is becoming more complex and diverse, introducing a series of security problems. In particular, open source software, due to its free and open, complex and diverse characteristics, has brought a series of security challenges and risks such as open source software defects, supply chain uncontrolled, etc. In December 2021, the open source software Log4j had a high-risk vulnerability, with an impact score of the highest level, and had a huge impact on the open source community ecology, triggering widespread concern about open source software vulnerabilities. The serious situation of open source software vulnerabilities has also increased the difficulty of overall security protection of China's information systems. Security provider Sonatype data shows that software supply chain attacks grew by 650% this year. The CNCERT “2021 Open Source Software Supply Chain Security Risk Research Report” points out that in the 8 mainstream open source repositories, more than half of the repositories have a growing number of vulnerabilities. With the increasing proportion of open source software in information systems, open source software security, especially open source software supply chain security, has become an important challenge to network security. Therefore, for open source software supply chain security vulnerability risk tracking, systematically investigating open source software vulnerability security risk situations, and strengthening local system terminal open source software vulnerability detection, investigation, early warning, and disposal are key problems to be solved in the future.

[0004] The existing solutions for open source software supply chain security mainly focus on software or open source software vulnerability detection technology. They research and design solutions to detect whether there are vulnerabilities and defects in a software, but lack intelligent solutions based on software supply chain relationships and using existing public vulnerability information to detect software system security and risks. For example, Jinhai et al. designed a software vulnerability detection scheme by constructing a software control flow behavior set through static analysis technology and obtaining the real-time verification value of each judgment block during software execution, and then comparing it with the software control flow behavior feature set for real-time verification to obtain the software vulnerability detection result. Sun Wei et al. proposed a new vulnerability detection method by obtaining the target domain name address and generating a detection command, which is then sent to the target host to determine whether there is a no echo command execution vulnerability. Liu Ye et al. proposed a new vulnerability discovery and emergency verification scheme by constructing a vulnerability detection radar in the system, regularly detecting network results and comparing them with the recorded vulnerability type database to discover and eliminate vulnerabilities. The above vulnerability detection schemes mainly target a software or network organization, use vulnerability detection technology to discover system vulnerabilities, and cannot use the dependency relationship of software in the software supply chain to realize intelligent detection and early warning of system vulnerability information and security risks.

[0005] In addition, for the security problem of open source software supply chain, the academic and industrial circles put forward the concept and method of software bill of materials (SBOM). SBOM is a series of metadata describing the dependency tree of software packages, including multiple key information such as supplier, version number and component name. In the software development process, the collection of dependent projects in the whole life cycle of software development is recorded, including development environment, development language, open source certificate, vulnerability repair log, calling system, application and other software upstream related projects, so as to constitute the component list of software program or application and their mutual dependence, which can realize the tracking and tracing of vulnerability, and the early defense deployment of risk. Software bill of materials can provide software developers, buyers and operators with all the "raw materials" related information and their upstream and downstream dependence in the software development process, which can improve the overall transparency of software supply chain and reduce the cost of software use and security maintenance. In the software supply chain scenario composed of multiple suppliers, software bill of materials can not only help enterprises to realize the task decomposition from core suppliers to branch suppliers, but also can timely find the security vulnerabilities and attack risks in the product, quickly find the problem and locate the affected components when the attack occurs, and timely remedy, so as to provide the response speed of security incidents. However, at present, only the static software bill of materials is attached to the software, and there is a lack of software security risk detection and early warning scheme using the software dependence contained in the software bill of materials. Especially after learning the external software vulnerability information, the potential vulnerability risk of software is detected intelligently by using software dependence, and a recommended solution is generated, so as to improve the security of open source software and maintain the security of software system.

[0006] With the rapid development of software industry, open source software brings a series of security challenges and risks such as defects of open source software itself, software risk transmission along the supply chain, and increases the difficulty of overall security detection and protection of terminal information system. In addition, with the attention of SBOM at home and abroad, governments and enterprises continue to promote software products to provide SBOM certificate, which describes the list and hierarchical dependence information contained in the software, so that software users can quickly and accurately locate security problems and reduce the cost of enterprise development, procurement, maintenance and processing. However, the academic and industrial circles mainly focus on the static application of SBOM, that is, only the SBOM metadata is provided on the software product. However, after the outbreak of vulnerability threat, the static provision of SBOM and its software package dependency tree information only provides additional knowledge for manual vulnerability risk detection, and cannot actively track the security vulnerability risk information of open source software supply chain in time. The infected open source components will increase the risk of potential exploitation every minute if they are not repaired in the software.

[0007] Through the above analysis, the problems and defects of the prior art are:

[0008] (1) The existing solutions for open source software supply chain security mainly focus on software or open source software vulnerability detection technology, and lack intelligent solutions for detecting software system security and risks based on software supply chain relationships and using existing public vulnerability information.

[0009] (2) The existing vulnerability detection solutions mainly target a certain software or network organization, and use vulnerability detection technology to find existing system vulnerabilities, which cannot realize intelligent detection and early warning of system vulnerability information and security risks using the dependency relationship of software in the software supply chain.

[0010] (3) The current software side is only attached to the static software bill of materials, and the software security risk detection and early warning solution based on the software dependency relationship contained in the software bill of materials is not mature; the relationship dependency tree based on tree structure is constructed by relying on the relationship between open source components, and the tree structure is very complex due to the large number of component nodes and multiple dependency relationships, and the component information update and dynamic query efficiency is low.

[0011] (4) The existing intelligent code detection system can analyze the code composition to a certain extent, but it cannot accurately analyze all software component modules, the existing SBOM composition content has no standard specification, and the creation and maintenance of standard SBOM cannot be formed on the development side and the operation side, the SBOM mechanism for the whole life cycle of open source software has not been completely established, and the software component composition is still unclear. After detecting vulnerabilities and other open source threats, the SBOM and software package dependency information cannot be obtained in time, and the open source software supply chain security vulnerability risk information cannot be effectively tracked, so that the open source components with security risks cannot be detected and repaired in time, and the detected software security risks still exist. There is a risk of being exploited. SUMMARY

[0012] In view of the problems existing in the prior art, the present application provides a terminal open source software security detection and early warning method, system, device and terminal, especially a terminal open source software security detection and early warning method, system, medium, device and terminal based on a software bill of materials.

[0013] The application is implemented as follows: a terminal open source software security detection and early warning method, which comprises the following steps: according to the software module composition technical document provided by the software provider, the intelligent source code analysis system module analyzes and identifies the software components, initializes the self-designed SBOM file, obtains the SBOM file data pool of the terminal system, forms the open source software dependent library and hierarchical relationship contained in the terminal system, and periodically or conditionally triggers access to external vulnerability information sources according to the preset conditions; the latest vulnerability threats are extracted from the vulnerability information shared by the official information security vulnerability sharing platform and the open source software development platform, matched with the hierarchical relationship based on the SBOM knowledge, and analyzed to determine whether the terminal has software system vulnerability threats and potential security risks caused by the software supply chain hierarchical relationship; if risks are found, the security threat level is calculated according to the system security risk calculation model, and understandable security alerts are sent to the user; the recommended security solution is generated according to the preset model or intelligent algorithm, and the user is reminded to take relevant security measures, including updating software and disabling software.

[0014] Further, the terminal open source software security detection and early warning method comprises the following steps:

[0015] Step one, system initialization;

[0016] Step two, system security risk detection;

[0017] Step three, risk assessment and grade determination;

[0018] Step four, risk warning and security solution generation.

[0019] Further, the system initialization in step one comprises the following steps: scanning the application software contained in the terminal system, extracting the software module composition technical document attached to each application software, using the intelligent source code analysis system module to analyze and identify the software components, identifying and classifying all the software bill of materials data, analyzing the metadata of each list, obtaining the software, component information and mutual relationship dependent on the terminal system, generating a self-defined SBOM file, forming a component dependency relationship tree of the terminal system; based on the component dependency relationship tree, a Bloom component information query is constructed, and initialization, element insertion and other operations are performed on the elements of the component dependency relationship tree.

[0020] Further, the system security risk detection in step two includes: the vulnerability information detection module actively detects and tracks the existing vulnerability library and threat information based on a periodic or trigger condition, analyzes and extracts the component name or the component name corresponding to the code to which the vulnerability information belongs, determines whether the vulnerability threat exists in the terminal software material dependency relationship tree through the query operation of the Bloom filter, if the query matching is successful, it is found that the system exists a new unpatched vulnerability, otherwise, the periodic detection of vulnerability and component name matching is continued.

[0021] Further, the risk assessment and level determination in step three includes: according to the vulnerability itself risk level and the range and degree of the influence on the system, and the level and node quantity information of the component dependency relationship tree, the system security risk calculation model is used to quantify the threat level, and the security risk warning is carried out according to the security threat level; the higher the security threat level of the system is, the higher the risk level of the vulnerability itself is, and the greater the influence range and degree of the vulnerability on the system are.

[0022] Further, the risk warning and security protection solution generation in step four includes: according to the security threat level result, corresponding warning information is given, including vulnerability information, corresponding component information and security threat level; and corresponding security solution is generated, including vulnerability repair reminder, patch update link-in, function isolation, call permission setting and function disable security measures.

[0023] Another object of the application is to provide a terminal open source software security detection and warning system applying the terminal open source software security detection and warning method.

[0024] The source code analysis part includes a terminal system scanning module, a software technical document analysis module, an intelligent source code analysis system module, an SBOM generation module, a component dependency relationship tree construction module and a Bloom component information query generator and initialization module.

[0025] The external threat information source refers to the publicly disclosed vulnerability information of domestic and foreign standardized information security vulnerability sharing platforms, open source software vulnerability information sharing platform organizations, technical community exchange platforms and the like; this part includes a vulnerability platform detection module, an open source intelligence threat identification module, a threat information standardization processing module, and a threat information and code association module.

[0026] The intelligent security detection and threat analysis engine internally includes an SBOM file analysis submodule, a vulnerability information detection module and a vulnerability threat analysis module, and is used for detecting security threats of local system installed software and dependent software libraries, intelligently analyzing security risks of the software system based on known external vulnerability information, and producing early warning information.

[0027] The risk early warning and security protection solution generation part is used for generating security early warning information to the user according to the early warning feedback information, reminding the user of the security threat, and generating a security solution according to a preset model or an intelligent algorithm.

[0028] Another object of the present application is to provide a computer device comprising a memory and a processor, the memory storing a computer program, the computer program being executed by the processor to make the processor execute the steps of the terminal open source software security detection and early warning method.

[0029] Another object of the present application is to provide a computer readable storage medium storing a computer program, the computer program being executed by the processor to make the processor execute the steps of the terminal open source software security detection and early warning method.

[0030] Another object of the present application is to provide an information data processing terminal for realizing the terminal open source software security detection and early warning system.

[0031] In combination with the above technical solutions and the technical problems solved, the technical solutions to be protected by the present application have the following advantages and positive effects:

[0032] First, in view of the technical problems existing in the prior art and the difficulty in solving the problems, the technical solutions to be protected by the present application are closely combined with the results and data in the research and development process, and the technical problems solved by the technical solutions are analyzed in detail and deeply, and some creative technical effects brought by the solutions are described as follows:

[0033] In the open source software supply chain intelligent security detection and early warning system provided by the application, firstly, the SBOM file is defined and designed considering the open source software module ID, module composition list and other metadata, and the SBOM file is updated according to the code analysis and identification of the software module composition technical document and the intelligent source code analysis system module, so that the open source software dependent library and the hierarchical relationship thereof are described more simply and accurately. At the same time, the external threat information source is accessed according to the preset condition (periodically or conditionally triggered), the latest vulnerability threat information is extracted, and the vulnerability threat of the terminal software system and the potential security risk brought by the software supply chain hierarchical relationship are analyzed by matching the hierarchical relationship based on the SBOM knowledge. If the risk is found, the safety warning information is produced, and the understandable safety alarm is sent to the user. In addition, the application generates a recommended safety solution according to the preset model or intelligent algorithm, reminds the user to take relevant safety measures, including updating the software, disabling the software and the like, and protects the safety of the user terminal and the system thereof.

[0034] Secondly, from the perspective of the product or as a whole, the technical effects and advantages of the technical solution to be protected by the application are described as follows:

[0035] The application provides an open source software security risk detection and early warning scheme based on SBOM, which can be used on various terminals to detect the security risk of a software system and provide safety measures including vulnerability repair, access control and the like, so as to further upgrade and protect the safety of the software system.

[0036] 1. High efficiency. The application designs an open source software component SBOM file by using open source software module ID, module composition list and other metadata, constructs a component relationship dependency tree and a Bloom filter queryer, and on this basis, determines whether the terminal system exists known vulnerability risk and quickly locates the known vulnerability risk component name by using external threat information, so as to ensure the timely monitoring and solution of the known vulnerability risk of the terminal system.

[0037] 2. Intelligence. The application designs an intelligent detector, which can autonomously and intelligently detect and track the publicly disclosed vulnerability information of the domestic and foreign standardized information security vulnerability sharing platform, the open source software vulnerability information sharing platform organization, the technical community exchange platform and the like, so as to detect whether the terminal software system exists security risk.

[0038] 3. Accuracy. The application autonomously designs a system security risk calculation model, which covers the risk level of the vulnerability itself, the range and degree of the influence on the system, and the information such as the level and node quantity of the component dependency relationship tree, so as to determine the security risk level of the terminal software system and support taking an appropriate and economic vulnerability risk solution.

[0039] Third, as the invention of the claim of the creative evidence, also embodied in the following several important aspects:

[0040] (1) The expected income and commercial value of the technical scheme of the present application after transformation are:

[0041] The present application provides a terminal security risk detection and security protection scheme for open source intelligence, which can reduce the risk of open source software supply chain attack events, alleviate the current severe and complex open source security situation, recover potential economic losses caused by software supply chain attacks, build a network security barrier, ensure the stable operation of the economy and society, and protect the interests of the general public.

[0042] (2) The technical scheme of the present application fills the gap in the industry at home and abroad:

[0043] The present application provides a terminal software system security risk detection and security protection scheme for open source intelligence, which incorporates vulnerability standard library information and open source threat intelligence information (such as 0-day vulnerabilities) into the category of open source threat information, realizes the integration of open source threat information and open source software security detection, and uses software component information to build a component dependency tree of the software system and a Bloom filter queryer, which can efficiently and quickly judge the vulnerability security risk and its level of the terminal software system, determine whether there is a known vulnerability risk in the terminal system, and quickly locate the known vulnerability risk component name, ensuring timely monitoring and solving of the known vulnerability risk of the terminal system, better dynamically tracking software security risk monitoring, early warning, repair, disposal and other processes, and providing the possibility of timely and comprehensive understanding of the security risks existing in the current terminal system. BRIEF DESCRIPTION OF DRAWINGS

[0044] In order to more clearly illustrate the technical scheme of the embodiments of the present application, the drawings needed in the embodiments of the present application will be briefly introduced as follows. Obviously, the drawings described below are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0045] Figure 1 is a flow chart of the terminal open source software security detection and early warning method provided by the embodiments of the present application;

[0046] Figure 2 is a principle diagram of the terminal open source software security detection and early warning method provided by the embodiments of the present application;

[0047] Figure 3 is a terminal open source software security detection and early warning system model diagram provided by the embodiments of the present application;

[0048] Figure 4 is an embodiment flowchart provided by an embodiment of the present application;

[0049] Figure 5 is a system component dependency tree diagram provided by an embodiment of the present application;

[0050] Figure 6 is a Bloom filter-based component query diagram provided by an embodiment of the present application;

[0051] Figure 7 is a defined SBOM format example diagram provided by an embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in combination with embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0053] In view of the problems existing in the prior art, the present application provides a terminal open source software security detection and early warning method, system, device and terminal, which will be described in detail below in combination with the drawings.

[0054] I. Explanation of Embodiments. In order to enable those skilled in the art to fully understand how the present application is specifically implemented, this part is an explanation of the embodiments of the technical solutions claimed in the claims.

[0055] As shown in Figure 1 , the terminal open source software security detection and early warning method provided by the embodiment of the present application includes the following steps:

[0056] S101, scanning the application software contained in the terminal system, composing a technical document according to the software modules attached to the application software, using an intelligent source code analysis system to analyze and identify the software components, identifying and classifying all the software bill of materials data, analyzing the metadata of each list, obtaining the software, component information and mutual relationship on which the terminal system depends, and generating a self-defined SBOM file;

[0057] S102, parsing the open source software dependency library and hierarchical relationship according to the SBOM file, periodically or conditionally accessing external vulnerability information sources according to the preset conditions;

[0058] S103, extracting the latest vulnerability threats from the publicly disclosed threat information of domestic and foreign standardized information security vulnerability sharing platforms, open source software vulnerability information sharing platform organizations, technical community exchange platforms, etc., and matching with the hierarchical relationship based on SBOM knowledge;

[0059] S104, analyze whether there is a software system vulnerability threat and potential security risk of software supply chain hierarchy; if the risk is found, produce a security warning information, and send a understandable security alert to the user;

[0060] S105, generate a recommended security solution according to a preset model or intelligent algorithm, remind the user to take relevant security measures, including updating software and disabling software.

[0061] As a preferred embodiment, as shown in Figure 2 The terminal open source software security detection and early warning method provided by the embodiment of the application specifically includes the following steps:

[0062] 1. System initialization: scan the application software contained in the terminal system, extract the technical document of each application software, start the intelligent source code analysis system module to analyze and identify the software components, analyze the metadata of each list, obtain the software, component information and their mutual relationship on which the terminal system depends, form an SBOM file, and generate a component dependency relationship tree of the terminal system. When building the dependency relationship tree, compare the identified components with the component vulnerability library. If it is found that the component has a vulnerability, the user is notified to repair it to complete the system initialization. Among them, the component index is designed by using Bloom filter to improve the component query speed.

[0063] 2. System security risk detection: the vulnerability information detection module periodically or actively detects and tracks existing vulnerability library, threat intelligence and other information based on trigger conditions, analyzes and extracts the component name of the vulnerability information or the component name corresponding to the code, and matches with the components in the formed terminal software material dependency relationship tree. If the matching is successful, it is found that the system has a new emerging unpatched vulnerability, otherwise continue to periodically detect vulnerability and component name matching.

[0064] 3. Risk assessment and grade determination: according to the risk level of the vulnerability itself and the range and degree of the influence on the system, as well as the information of the level and node number of the component dependency relationship tree, the security threat assessment model is used to calculate the security threat level of the system. In principle, the higher the risk level of the vulnerability itself, the higher the security threat level of the system. The larger the influence range and the deeper the degree of the vulnerability on the system, the higher the security threat level of the system.

[0065] 4. Risk warning and solution generation: according to the security threat level result, give the corresponding warning information, including vulnerability information, corresponding component information, security threat level, etc. At the same time, generate the corresponding security solution, including vulnerability repair reminder, patch update chain, function isolation, call permission setting, function disablement and other security measures.

[0066] Figure 3The open source software supply chain intelligent security detection and early warning system model provided by the embodiment of the application is mainly composed of the following four main bodies: 1) source code analysis; 2) external threat information processing, 3) intelligent security detection and threat analysis, and 4) installed open source software.

[0067] 1) Source code analysis: mainly terminal application scanning, software technical document analysis, intelligent code analysis, to generate SBOM files, build component dependency relationship tree, and Bloom component information query generator and initialization module.

[0068] 2) External threat information processing: mainly extracting the vulnerability information disclosed by the domestic and foreign standardized information security vulnerability sharing platform, open source software vulnerability information sharing platform organization, technical community exchange platform and the like, realizing standardized processing of threat information, and associating threat information with code.

[0069] 3) Intelligent security detection and threat analysis: responsible for security threat detection of local system installed software and its dependent software library, determining whether the threat information exists in the terminal system according to the Bloom query result on the basis of known external threat information, if the terminal system exists threat information, then using the system security risk calculation model to calculate the threat value, and determining the risk level according to the value distribution.

[0070] 4) Security early warning and protection module: mainly responsible for security early warning and security protection scheme generation, giving corresponding early warning information according to the security threat level result, including vulnerability information, corresponding component information and security threat level; at the same time, generating corresponding security solution, including security measures such as vulnerability repair prompt, patch update link-in, function isolation, call permission setting and function disablement.

[0071] II. Application embodiment. In order to prove the creativity and technical value of the technical scheme of the application, this part is an application embodiment of the technical scheme of the claim on a specific product or related technology.

[0072] As a preferred embodiment, as shown in Figure 4 The terminal open source software security detection and early warning method provided by the embodiment of the application specifically includes the following steps:

[0073] 1. System initialization:

[0074] 1) Scanning the application software contained in the terminal system, extracting the software bill of materials attached to the three application software A1, A2 and A3, then identifying and classifying all the software bill of materials data, analyzing the metadata of each list, obtaining the software, component information and their mutual relationship depended by the terminal system, forming the component dependency relationship tree of the terminal system, as shown in Figure 5The software bill of materials includes a baseline attribute set, an undetermined attribute value, a mapping to an existing format, a component relationship, and an additional element. The line attribute set includes the name of the SBOM creation author, the update date and time, the component name or other identifier, the component supplier name or other identifier, the component version information, the cryptographic hash value of the component, the unique identifier identifying the component, the two association relationships including and included by the component, and the like. In the component dependency relationship tree, the terminal system has a root node Root, and the nodes are application software A1, A2, and A3. The first-level dependent components of the software A1 include B1, B2, B3, and B4, the second-level dependent component of B1 is C1, the second-level dependent components of B3 are C2, C3, and C4. By analogy, the dependent component relationship of the software A2 and A3 is obtained.

[0075] 2) Constructing a Bloom component information queryer by using the component list, as shown in Figure 6 and initializing and comparing analysis by using the existing component vulnerability library in the system to detect whether the terminal system has an unpatched vulnerability and to ensure the safe initialization of the system. If it is found that the component has a vulnerability, the user is notified to repair. In the present application, the Bloom filter-based component queryer includes three basic operations of initialization, element insertion, and element query:

[0076] A) Initialization, first generating a Bloom filter BF of an m-bit (for example, m = 100) binary bit array, and initializing each bit of BF[0] to BF[m-1] to 0.

[0077] B) Element insertion, defining k hash functions, calculating the hash values of the inserted elements, for example, inserting the B1 element, calculating h1(B1),..., h k (B1), setting the corresponding positions of the array BF, that is, BF[h1(B1)] = BF[h2(B1)] =... = BF[h k (B1)] = 1.

[0078] C) Element query, assuming that it is necessary to check whether the component B1 exists in the dependency tree, first calculating the k position settings of B1, h1(B1),..., h k (B1), and then checking whether the k corresponding positions of the array BF, BF[h1(B1)], BF[h2(B1)],..., BF[h k (B1)] are all 1. As long as one of the positions is 0, the component definitely does not exist in the dependency relationship tree.

[0079] 2. System security risk detection: The vulnerability information detection module will periodically or based on trigger conditions actively detect and track existing vulnerability libraries, threat intelligence, etc. information, including official vulnerability sharing platforms such as the United States National Vulnerability Database, China National Information Security Vulnerability Sharing Platform, and international non-profit organizations such as Common Vulnerabilities and Exposures (CVE), to obtain new vulnerability information, and obtain the component name or the corresponding component name of the code of the vulnerability, for example, C6. First, calculate the k position of C6, h1(C6),..., h k (C6), and then check the k corresponding positions in the array BF: BF[h1(C6)], BF[h2(C6)],..., BF[h k (C6)]. If any of them is 0, the system does not include the component with the vulnerability, and the vulnerability detection continues. If all are 1, there is a component with a vulnerability in the dependency tree, for example, C6 exists in the component dependency tree, indicating that the system has a newly discovered unpatched vulnerability, which needs to be assessed and warned.

[0080] 3. Risk assessment and level determination: According to the vulnerability risk level and the range and degree of its impact on the system, as well as the level and node number information in the component dependency tree, the security threat assessment model is used to calculate the security threat level of the system. In principle, the higher the vulnerability risk level, the greater the impact on the system, and the higher the security threat level of the system. The specific algorithm is as follows: define the vulnerability risk level R 0 , the level H in the component dependency tree, then calculate the system security risk as where br represents a certain vulnerability, H br is the level of the vulnerability corresponding component in the component dependency tree. After calculating the risk value, the risk level can be determined according to Table 1.

[0081] Table 1: Numerical division standard for system security risk level determination

[0082]

[0083] Regarding R 0 , the initial value is determined, such as the vulnerability threat being clearly marked as a vulnerability hazard level in the public vulnerability library such as the National Information Security Vulnerability Database (CNNVD), R 0 is set to 0.5, medium risk 0.35, and low risk 0.15. If the vulnerability threat is an open source risk threat intelligence information, based on the existing vulnerability risk assessment standard, the vulnerability risk level is determined, and R 0 is assigned according to the determination result.

[0084] 4. Risk warning and solution generation: According to the security threat level result, the corresponding warning information is given, including vulnerability information, corresponding component information, security threat level, etc. For example, it is found that only C3 has a vulnerability br, and its risk level R 0 = 3, then send the user the information set (vulnerability information br, component name C3, security risk R = 2 * sigmoid(6) - 1, affected dependency chain C3-B3-A1-Root). At the same time, the security solution is produced, which includes vulnerability repair reminder, patch update chain, function isolation, call permission setting, function disablement and other security measures.

[0085] Embodiments of the present application can be realized by hardware, software or a combination of software and hardware. The hardware part can be realized by special logic; the software part can be stored in the memory and executed by the appropriate instruction execution system, such as microprocessor or special design hardware. Those skilled in the art can understand that the above-mentioned devices and methods can be realized by computer executable instructions and / or included in processor control code, such as carrier medium, such as magnetic disk, CD or DVD-ROM, programmable memory, such as read-only memory (firmware), or data carrier, such as optical or electronic signal carrier. The device of the present application and its modules can be realized by hardware circuit, such as very large scale integrated circuit or gate array, semiconductor, such as logic chip, transistor, etc., or programmable hardware device, such as field programmable gate array, programmable logic device, etc., or by software executed by various types of processors, or by a combination of the above hardware circuit and software, such as firmware.

[0086] III. Evidence of the effects of the embodiments. The embodiments of the present application have achieved some positive effects during research and development or use, and indeed have great advantages compared with the prior art. The following content is described in combination with the data and graphs of the test process.

[0087] The present application constructs a component dependency relationship tree of a terminal system based on SBOM, and designs a Bloom filter. The essence of the algorithm structure is that N elements in a set are mapped to a M-bit string vector through k hash functions. Unlike the traditional hash storage table, the hash table in the Bloom filter degenerates into a bit string vector M, and an element only occupies a few bits. The Bloom filter query algorithm uses an M vector of m bits to represent a set of n elements, and each element only needs m / n bits on average, with a space complexity of O(m). The Bloom filter needs to perform k hash operations for each element added or queried in the set, with a time complexity of O(k). The linear storage space complexity and linear query time complexity greatly save storage space and improve query efficiency.

[0088] There is false positive error (i.e. an element belonging to the set is misjudged as not belonging to the set) in the Bloom filter. When the number of elements of the set is n, the length of the M vector is m, and the number of hash functions is k, the element misjudgment rate f BF (m, k, n) = (1-p) k = (1-e -kn / m ) k = exp(kln(1-e -kn / m )) When m, k, n are reasonably valued, the misjudgment rate can be at a low level. Therefore, the Bloom filter is a hash structure allowing certain misjudgment, saving storage space, and a compromise between query accuracy and storage cost.

[0089] The above merely describes the specific embodiments of the present application, but the protection scope of the present application is not limited thereto, any modification, equivalent replacement, and improvement within the technical range disclosed by the present application, and within the spirit and principle of the present application, should be covered within the protection scope of the present application.

Claims

1. A method for security detection and early warning of terminal open-source software, characterized in that, The terminal open-source software security detection and early warning method includes: parsing the open-source software dependency libraries and hierarchical relationships from the software's SBOM file; periodically or conditionally accessing external threat information sources according to preset conditions; matching publicly disclosed vulnerability information from external threat information sources (referring to domestic and international standardized information security vulnerability sharing platforms, open-source software vulnerability information sharing platforms, and technical community exchange platforms) with hierarchical relationships based on SBOM knowledge to analyze whether the terminal has software system vulnerability threats and potential security risks brought about by the software supply chain hierarchical relationships; if risks are found, generating security early warning information and sending understandable security alerts to users; generating recommended security solutions based on preset models or intelligent algorithms, reminding users to take relevant security measures, including updating software and disabling software; The methods for security detection and early warning of open-source terminal software include the following steps: Step 1: System initialization; Step two: System security risk detection; Step 3: Risk Assessment and Level Determination. Based on the inherent risk level of the vulnerability, the scope and extent of its impact on the system, and information on the hierarchy and number of nodes in the component dependency tree, the security threat level of the system is calculated using a security threat assessment model. A higher inherent risk level of the vulnerability, and a larger and deeper impact on the system, indicates a higher security threat level. The specific algorithm is as follows: Define the inherent risk level R of the vulnerability. 0 If the component is at level H in the component dependency tree, then the security risk of the computation system is... Where br represents a vulnerability, H br The size of the component corresponding to the vulnerability in the component dependency tree; Step 4: Risk warning and solution generation; The system initialization in step one includes: scanning the application software contained in the terminal system and extracting the software composition technical documents attached to each application software; starting the intelligent source code parsing system module to parse the software code, and in conjunction with the software composition technical documents, identifying and classifying the material data list contained in the software, parsing the relevant metadata of the software modules, forming an SBOM file, obtaining the software and component information and interrelationships that the terminal system depends on, and completing the construction of the component dependency tree of the terminal system; building and initializing the Bloom query tool, comparing the identified components with the component vulnerability database, and if vulnerabilities are found in the components, notifying the user to fix them, thus completing the system initialization.

2. The terminal open-source software security detection and early warning method as described in claim 1, characterized in that, The system security risk detection in step two includes: the vulnerability information detection module will periodically or based on trigger conditions actively detect and track existing vulnerability databases and threat intelligence information, analyze and extract the component name to which the vulnerability information belongs or the component name to which the corresponding code belongs, and match it with the components in the formed terminal software material dependency relationship tree; if the match is successful, a newly emerging unpatched vulnerability is found in the system; otherwise, the periodic detection of vulnerability and component name matching continues.

3. The terminal open-source software security detection and early warning method as described in claim 1, characterized in that, Step 3, risk assessment and level determination, includes: calculating the system's security threat level using a security threat assessment model based on the vulnerability's inherent risk level, the scope and extent of its impact on the system, and information on the hierarchy and number of nodes in the component dependency tree; the higher the vulnerability's inherent risk level and the greater and deeper its impact on the system, the higher the security threat level to the system.

4. The terminal open-source software security detection and early warning method as described in claim 1, characterized in that, Step four, risk warning and solution generation, includes: providing corresponding warning information based on the security threat level results, including vulnerability information, corresponding component information, and security threat level; and generating corresponding security solutions, including security measures such as vulnerability remediation reminders, patch update linking, function isolation, access permission settings, and function disabling.

5. A terminal open-source software security detection and early warning system applying the terminal open-source software security detection and early warning method as described in any one of claims 1 to 4, characterized in that, The terminal open-source software security detection and early warning system consists of four main components: external vulnerability information sources, intelligent security detection and early warning engine, security early warning and protection module, and installed open-source software. External vulnerability information sources mainly include publicly disclosed vulnerability information from domestic and international standardized information security vulnerability sharing platforms, open-source software vulnerability information sharing platforms, and technical community exchange platforms. The intelligent security detection and early warning engine includes an SBOM file parsing submodule, a vulnerability information detection module, and a vulnerability threat analysis module. It is responsible for detecting security threats to the software installed on the local system and its dependent software libraries. Based on known external vulnerability information, it intelligently analyzes the security risks of the software system and calculates the risk level according to SBOM knowledge. The security warning and protection module is used to generate security warning information to users based on warning feedback information, reminding users of the existence of security threats, and generating security solutions based on preset models or intelligent algorithms.

6. A computer device, characterized in that, The computer device includes a memory and a processor. The memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the terminal open-source software security detection and early warning method as described in any one of claims 1 to 4.

7. A computer-readable storage medium storing a computer program, wherein when executed by a processor, the computer program causes the processor to perform the steps of the terminal open-source software security detection and early warning method as described in any one of claims 1 to 4.

8. An information data processing terminal, characterized in that, The information data processing terminal is used to implement the terminal open-source software security detection and early warning system as described in claim 5.

Images