Supply Chain Detection Method, Device, Electronic Device and Storage Medium for Online Services

Abstract

The present invention provides a supply chain detection method, device, electronic device and storage medium for online services, which relates to the field of computer technology. The method includes: sending a first detection instruction to a first type of client of the online service and obtaining first response information of the first type of client to the first detection instruction; analyzing the first response information to obtain first supply chain composition information corresponding to the first type of client; sending a second detection instruction to a second type of client of the online service and obtaining second response information of the second type of client to the second detection instruction; analyzing the second response information to obtain second supply chain composition information corresponding to the second type of client; and determining the supply chain information of the online service according to the first supply chain composition information and the second supply chain composition information. The present invention solves the problem of limited effective information detected in the prior art and can generate complete supply chain information of the online service.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and particularly to a method, device, electronic device and storage medium for detecting the supply chain of online services. Background Art

[0002] The supply chain of online services refers to the combination of components required to provide online services. The integration, management, and coordination of different components form the supply chain of online services. Any security risk in any component of the supply chain of online services will affect the quality and reliability of online services. Therefore, detecting the supply chain of online services, obtaining and managing complete supply chain information of online services has become a practical need.

[0003] Currently, the supply chain detection technology for online services is active detection. Active detection requires the experience of technical experts to generate detection payloads to detect the ports of online services, and then combine the response information returned by the web page of the online service to generate the supply chain information of the online service.

[0004] However, since the ports opened by online services are limited, some of the used ports are closed, and the services of these ports cannot be detected from the outside, let alone analyze what components are used. Active detection technology often cannot detect the information of all ports of online services, resulting in limited effective information detected and it is difficult to generate complete supply chain information of online services. Summary of the Invention

[0005] The present invention provides a method, device, electronic device and storage medium for detecting the supply chain of online services, so as to solve the problem in the prior art that the information of all ports of online services cannot be detected and it is difficult to generate complete supply chain information of online services.

[0006] The present invention provides a method for detecting the supply chain of online services, including: sending a first detection instruction to a first type of client of the online service, and obtaining first response information of the first type of client to the first detection instruction; analyzing the first response information to obtain first supply chain composition information corresponding to the first type of client; sending a second detection instruction to a second type of client of the online service, and obtaining second response information of the second type of client to the second detection instruction; analyzing the second response information to obtain second supply chain composition information corresponding to the second type of client; determining the supply chain information of the online service according to the first supply chain composition information and the second supply chain composition information.

[0007] A supply chain detection method for online services provided by the present invention sends a first detection instruction to a first type of client of the online service and obtains first response information of the first type of client to the first detection instruction, including: in response to the first detection instruction, automatically generating a detection payload according to the network protocol of the first type of client and the state machine of the first type of client; sending the detection payload to the online service through the first type of client and obtaining the response information of the online service to the detection payload as the first response information.

[0008] A supply chain detection method for online services provided by the present invention, in response to the first detection instruction, automatically generating a detection payload according to the network protocol of the first type of client and using the state machine of the first type of client, including: generating an initial detection payload according to the network protocol of the first type of client; the state machine generating a detection payload according to the initial detection payload and in combination with the trigger event and port opening situation of the online service.

[0009] A supply chain detection method for online services provided by the present invention, the first response information is unstructured information; analyzing the first response information to obtain first supply chain composition information corresponding to the first type of client, including: using natural language processing technology to analyze the first response information to obtain the first supply chain composition information; wherein the first supply chain composition information includes a first component name and a first version information.

[0010] A supply chain detection method for online services provided by the present invention, the second response information is binary information; analyzing the second response information to obtain second supply chain composition information corresponding to the second type of client, including: analyzing the second response information to obtain the second supply chain composition information; wherein the second supply chain composition information includes a second component name and a second version information.

[0011] A supply chain detection method for online services provided by the present invention, determining the supply chain information of the online service according to the first supply chain composition information and the second supply chain composition information, including: integrating the first component name, the first version information, the second component name and the second version information to obtain the supply chain composition information of the online service; obtaining the manufacturers providing the components according to the supply chain composition information and a preset component manufacturer relationship table; wherein the preset component manufacturer relationship table includes the corresponding relationship between different versions of components and manufacturers; forming the supply chain of the online service based on the online service, the supply chain composition information and the manufacturers providing the components.

[0012] A supply chain detection method for online services provided by the present invention forms a supply chain of online services based on online services, supply chain composition information, and manufacturers providing components, including: generating a supply chain knowledge graph of online services according to the supply chain of online services; wherein the supply chain knowledge graph includes the network feature relationship between online services and components, and the network feature relationship between components and manufacturers.

[0013] The present invention also provides a supply chain detection device for online services, including: a first detection instruction module for sending a first detection instruction to a first type of client of the online service and obtaining first response information of the first type of client to the first detection instruction; a first supply chain composition information module for analyzing the first response information to obtain first supply chain composition information corresponding to the first type of client; a second detection instruction module for sending a second detection instruction to a second type of client of the online service and obtaining second response information of the second type of client to the second detection instruction; a second supply chain composition information module for analyzing the second response information to obtain second supply chain composition information corresponding to the second type of client; a supply chain information module for determining supply chain information of the online service according to the first supply chain composition information and the second supply chain composition information.

[0014] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein when the processor executes the program, it implements the supply chain detection method for online services as described in any one of the above.

[0015] The present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the supply chain detection method for online services as described in any one of the above.

[0016] A supply chain detection method, device, electronic device, and storage medium for online services provided by the present invention send detection instructions to different types of clients of the online service respectively, obtain response information of different types of clients of the online service, analyze the obtained response information to obtain supply chain composition information corresponding to different types of clients of the online service, and determine supply chain information of the online service according to the supply chain composition information corresponding to different types of clients of the online service. By detecting and obtaining response information of different types of clients of the online service and analyzing the obtained response information to obtain supply chain composition information corresponding to different types of clients of the online service, the present invention makes up for the deficiency in the prior art that the information of all ports of the online service cannot be detected, solves the problem of limited effective information detected in the prior art, and then generates complete supply chain information of the online service according to the supply chain composition information corresponding to different types of clients of the online service. Description of the Drawings

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0018] Figure 1 is one of the schematic flowcharts of the supply chain detection method for online services of the present invention;

[0019] Figure 2 is the schematic diagram of the supply chain knowledge graph for online services of the present invention;

[0020] Figure 3 is the second schematic flowchart of the supply chain detection method for online services of the present invention;

[0021] Figure 4 is the schematic structural diagram of the supply chain detection device for online services of the present invention;

[0022] Figure 5 is the schematic structural diagram of the electronic device provided by the present invention. Detailed implementation manners

[0023] To make the objectives, technical solutions, and advantages of the present invention clearer, the following will clearly and completely describe the technical solutions in the present invention in conjunction with the drawings in the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. Based on the embodiments in the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

[0024] Currently, the supply chain detection technology for online services is active detection. Active detection requires the experience of technical experts to generate detection payloads to detect the ports of online services, and then combine the response information returned by the online service web page to generate the supply chain information of the online service. However, due to the limited number of open ports of online services, some used ports are closed, and the outside world cannot detect the services of these ports, let alone analyze what components are used. Active detection technology often cannot detect the information of all ports of online services, resulting in limited effective information detected and making it difficult to generate complete supply chain information of online services.

[0025] Based on this, the present invention provides a supply chain detection method for online services. By detecting and obtaining response information of different types of clients of the online service, analyzing the obtained response information, the supply chain composition information corresponding to different types of clients of the online service is obtained, which makes up for the deficiency in the prior art that the information of all ports of the online service cannot be detected, solves the problem that the effective information detected in the prior art is limited, and then generates the complete supply chain information of the online service according to the supply chain composition information corresponding to different types of clients of the online service.

[0026] Please refer to Figure 1 , Figure 1 which is one of the flow schematic diagrams of the supply chain detection method for the online service of the present invention. In this embodiment, the supply chain detection method for the online service specifically includes steps S110 to S150, and each step is as follows:

[0027] S110: Send a first detection instruction to the first type of client of the online service, and obtain the first response information of the first type of client to the first detection instruction.

[0028] An online service refers to providing online services to users by using Internet technology, such as online medical services, online education services, online government services, etc. Online services usually provide different types of clients. For example, an online navigation service will provide a web page (i.e., Web end), a mobile application (i.e., APP end), and a mini-program end, etc.

[0029] In some embodiments, the first type of client of the online service may be a web page.

[0030] In addition, the components adopted by the clients of the online service may include a database, a server component, an intermediate component, a network infrastructure component, a development component, a management component, a communication component, etc. Different components provide different functions. For example, the database is used to store and manage data, and the intermediate component is used to coordinate the interaction of different components. Different types of clients adopt different components, and the response information to the detection instruction is also different. For example, the web page of the online navigation service may adopt a Redis database, a communication component OpenSSH, a server component Nginx and Windows server, a development component jQuery, a management component IIS, and the mobile application end may adopt a MYSQL database and a server component Tomcat. Therefore, for the instruction to detect the client component information, different types of clients return different response information.

[0031] S120: Analyze the first response information to obtain the first supply chain composition information corresponding to the first type of client.

[0032] Among them, the first supply chain composition information includes the first component name and the first version information.

[0033] It should be noted that since the first response information is the response information of one type of client of the online service to the first detection instruction, the first supply chain composition information corresponding to the first type of client obtained by analyzing the first response information is only a part of the complete supply chain information of the online service. To generate the complete supply chain information of the online service, it is also necessary to analyze the response information of other types of clients of the online service to the detection instruction.

[0034] S130: Send a second detection instruction to the second type of client of the online service, and obtain the second response information of the second type of client to the second detection instruction.

[0035] In some embodiments, the second type of client of the online service may be a mobile application.

[0036] Optionally, different detection technologies and detection instructions may be adopted for different types of clients of the online service. For example, for the web client of the online service, the detection instruction may be sent in an active detection manner, and for the mobile application of the online service, the detection instruction may be sent in combination with the side-channel method. Those skilled in the art can select appropriate detection technologies and detection instructions for detection according to actual needs, and this embodiment does not limit this.

[0037] It should be noted that side-channel detection refers to detecting through non-direct means to obtain effective information. For information that cannot be directly obtained or interpreted, such as the information in a private protocol message, it is often difficult to obtain through the detection payload generated by active detection technology, so it is necessary to detect through non-direct means.

[0038] For example, one type of client of the online service, such as the web client, uses a private protocol. Since this private protocol is not publicly available, it is difficult for active detection technology to obtain the information of this private protocol. However, the binary information corresponding to another type of client of the online service, such as the mobile application, contains the binary code using this private protocol. At this time, the information of this private protocol can be determined by obtaining and analyzing the binary information of another type of client of the online service.

[0039] S140: Analyze the second response information to obtain the second supply chain composition information corresponding to the second type of client.

[0040] The second supply chain composition information includes the second component name and the second version information.

[0041] It should be noted that there may be some similarities between the second supply chain composition information and the first supply chain composition information. For example, when the web version and the mobile application version of an online service both use the same component with the same version and the same manufacturer, such as MYSQL, the component information about MYSQL in the second supply chain composition information and the first supply chain composition information is the same.

[0042] S150: Determine the supply chain information of the online service according to the first supply chain composition information and the second supply chain composition information.

[0043] Among them, the first supply chain composition information includes the first component name and the first version information, and the second supply chain composition information includes the second component name and the second version information.

[0044] It should be noted that the first component name and the first version information refer to the components and the corresponding version information used by the first type of client of the online service, such as the web version; the second component name and the second version information refer to the components and the corresponding version information used by the second type of client of the online service, such as the mobile application version.

[0045] After obtaining the first supply chain composition information and the second supply chain composition information, it is necessary to integrate the first component name, the first version information, the second component name and the second version information to determine the supply chain information of the online service. For example, organize and summarize all the components used by the online service and the corresponding version information, and then determine the manufacturers corresponding to different versions and different components according to the corresponding relationship between the components and the manufacturers. Based on the online service, the supply chain composition information and the manufacturers providing the components, form the supply chain of the online service.

[0046] Optionally, different types of clients of the online service may use the same component with the same version provided by the same manufacturer, and duplicate information needs to be removed in the finally formed supply chain of the online service.

[0047] In summary, the supply chain detection method, device, electronic device and storage medium for online services provided by the present invention send detection instructions to different types of clients of the online service respectively, obtain the response information of different types of clients of the online service, analyze the obtained response information, obtain the supply chain composition information corresponding to different types of clients of the online service, and determine the supply chain information of the online service according to the supply chain composition information corresponding to different types of clients of the online service. By detecting and obtaining the response information of different types of clients of the online service and analyzing the obtained response information, the present invention obtains the supply chain composition information corresponding to different types of clients of the online service, makes up for the deficiency in the prior art that the information of all ports of the online service cannot be detected, solves the problem that the effective information detected in the prior art is limited, and then generates the complete supply chain information of the online service according to the supply chain composition information corresponding to different types of clients of the online service.

[0048] In some embodiments, sending a first detection instruction to a first type of client of the online service and obtaining the first response information of the first type of client to the first detection instruction includes: in response to the first detection instruction, automatically generating a detection payload according to the network protocol of the first type of client and the state machine of the first type of client; sending the detection payload to the online service through the first type of client, and obtaining the response information of the online service to the detection payload as the first response information.

[0049] The network protocol is a set of communication rules between all devices on the network, which stipulates the message format that information must adopt during communication. The message format depicts the composition structure of various messages used by the network protocol and the semantic information of each component.

[0050] A state machine is a mathematical model that represents states and behaviors such as transitions and actions between these states, describes the order of interaction between different types of messages during communication, and is the most commonly used model for describing protocols.

[0051] The state machine can automatically generate a detection payload through the method of heuristic fuzz testing. Fuzz testing refers to performing different operations on the client of the online service to cause state changes. For an online service, performing different clicks, inputs, outputs, etc. on different pages of the client or scanning the opening of an unusual port will trigger different events, which are thus recognized as state changes of the client, and these state changes can be obtained by the state machine.

[0052] Specifically, the state machine can generate a detection payload according to the state changes of the first type of client, combined with the network protocol of the first type of client, to detect relevant information of the online service, send the detection payload to the online service through the first type of client, and obtain the response information of the online service to the detection payload as the first response information.

[0053] It should be noted that the response information of the online service to the detection payload may include original information such as port response status, status code, carried software service, version, timestamp, etc.

[0054] For example, assume that the first type of client of the online service is the web client. It has been detected by the active detection method that the network protocols used by the web client of the online service include the FTP protocol (File Transfer Protocol). The FTP protocol can be used for file transfer. When the web client of the online service performs file transfer operations using the FTP protocol, the status of the web client of the online service changes. The state machine generates a detection payload based on the status change of the web client and the FTP protocol used by the web client to detect the information of the online service during file transfer. After sending the generated detection payload to the online service through the web client, the response information of the online service to the detection payload can be obtained. The response information may be a response message of the FTP protocol, including information such as the port and response status, status code, timestamp, etc. corresponding to the FTP protocol.

[0055] Optionally, after sending the detection payload to the online service through the first type of client, if the response information of the online service to the detection payload is not received within the preset time, the detection can be performed again.

[0056] Preferably, the detection is performed again after reaching the preset time interval, and / or the number of times of performing the detection again is set to ensure that the failure to obtain the response information is not caused by network fluctuations.

[0057] In some embodiments, in response to the first detection instruction, the detection payload is automatically generated according to the network protocol of the first type of client and the state machine using the first type of client, including: generating an initial detection payload according to the network protocol of the first type of client; the state machine generates a detection payload based on the initial detection payload, in combination with the trigger event and port opening situation of the online service.

[0058] For an online service that has never been detected, its used network protocol cannot be determined at the initial stage of detection. Therefore, based on the network protocol family, the commonly used network protocols of the same type of clients of different online services can be analyzed and summarized to generate an initial detection payload applicable to the detection of different online services.

[0059] For example, the network protocols commonly used in online services include the HTTP protocol (Hyper Text Transfer Protocol), the FTP protocol, the HTTPS protocol (Hypertext Transfer Protocol Secure), the SSH protocol (Secure Shell), the SMTP protocol (Simple Mail Transfer Protocol), the ICMP protocol (Internet Control Message Protocol), the UDP protocol (User Datagram Protocol), the TCP / IP protocol (a collection of different communication protocols based on the TCP protocol and the IP protocol), etc. The initial detection payload can be used to detect all the above network protocols.

[0060] The protocol types detected by the initial detection payload can be adaptively designed by those skilled in the art according to actual needs, and this embodiment does not limit this.

[0061] Further, the initial detection payload is sent to the online service for detection, triggering the events corresponding to the online service, scanning the port opening situation of the online service, causing changes in the state of the online service client. After the state machine obtains the state changes of the online service client, according to the initial detection payload, combined with the triggering events and port opening situation of the online service, a detection payload is generated.

[0062] It should be noted that when providing an online service, multiple network protocols need to be used. Different network protocols correspond to different port numbers, and the port number can be used to identify the corresponding network protocol. For example, the default port number corresponding to the HTTP protocol is 80.

[0063] The initial detection payload can be used to detect all commonly used network protocols, but the online service does not necessarily use all network protocols. When the initial detection payload is sent to the online service for detection, the port opening situation of the online service will be scanned. The state machine can determine the network protocols actually used by the online service according to the port opening information of the online service (such as the opened port number). For example, when it is scanned that the port opened by the online service is 80, it can be determined that the online service uses the HTTP protocol. The state machine can generate a detection payload according to the initial detection payload, combined with the triggering events and port opening situation of the online service.

[0064] In some embodiments, the first response information is unstructured information; analyzing the first response information to obtain the first supply chain composition information corresponding to the first type of client, including: analyzing the first response information using natural language processing technology to obtain the first supply chain composition information; wherein the first supply chain composition information includes the first component name and the first version information.

[0065] Unstructured information refers to information with a relatively unfixed form. Unstructured information may have various formats. For example, the message formats of different network protocols are different, and the meanings corresponding to the message contents are also different. The information contained in unstructured information is often difficult to directly interpret. Therefore, it is necessary to analyze the obtained first response information to obtain the first supply chain composition information corresponding to the first type of client.

[0066] Natural Language Processing (NLP) technology takes language as the object and uses computer technology to analyze, understand, and process language. It can extract and analyze effective information from unstructured information and has significant advantages in processing unstructured information.

[0067] Preferably, a named entity recognition technology can be used to analyze the unstructured first response information and extract relevant named entities.

[0068] It should be noted that the named entity recognition technology is a type of natural language processing technology, which can scan unstructured information and extract entities in the information.

[0069] Specifically, use the named entity recognition method to analyze the unstructured first response information, extract the named entities related to the component name and the version information corresponding to the component used by the first type of client of the online service, and then combine the existing feature data set to obtain the supply chain composition information of the first type of client of the online service, where the first supply chain composition information includes the first component name and the first version information.

[0070] For example, if the obtained unstructured information contains information about a certain component used by the online service, the named entity recognition method can be used to extract the information related to a certain component. For example, the 50th to 100th bytes of a certain private protocol message definition carry the development component information used by the online service, the 50th to 75th bytes are the component name information, and the 76th to 100th bytes are the version information corresponding to the component. Then, the named entity recognition method can be used to extract the information of the 50th to 75th bytes and the 76th to 100th bytes of the message respectively, and then combine the existing feature data set to analyze the name and version information of the component.

[0071] In some embodiments, the second response information is binary information; analyzing the second response information to obtain the second supply chain composition information corresponding to the second type of client, including: analyzing the second response information to obtain the second supply chain composition information; wherein the second supply chain composition information includes the second component name and the second version information.

[0072] Specifically, the second response information may be the binary information of the second type of client. For example, if the second type of client of the online service is a mobile application, then the binary information of the second type of client may be the binary information of the mobile application corresponding to the online service.

[0073] Optionally, the Soot tool can be used to analyze the binary information of the second type of client. It should be noted that the Soot tool is a Java optimization framework that can be used to analyze, detect, optimize, and visualize the binary information of the client.

[0074] Optionally, based on the analysis of the binary information, a control dependence graph and a data dependence graph corresponding to the second type of client are constructed. Among them, the control dependence graph is used to represent the control flow in the binary information, and the data dependence graph is used to represent the data flow situation in the binary information.

[0075] Optionally, according to the network protocol and function used by the second type of client, corresponding events are executed on the second type of client to obtain the second response information, analyze the second response information, extract the component name and the version information corresponding to the component used by the second type of client of the online service, and obtain the supply chain composition information of the second type of client of the online service.

[0076] By detecting the information of different types of clients of the online service, the present invention can make up for the deficiency in the prior art that only the active detection technology is used to detect the information of a single type of client, resulting in limited effective information detected, and can obtain more information related to the online service.

[0077] In some embodiments, determining the supply chain information of the online service according to the first supply chain composition information and the second supply chain composition information includes: integrating the first component name, the first version information, the second component name, and the second version information to obtain the supply chain composition information of the online service; according to the supply chain composition information and the preset component manufacturer relationship table, obtaining the manufacturers providing the components; wherein the preset component manufacturer relationship table includes the corresponding relationship between different versions of components and manufacturers; based on the online service, the supply chain composition information, and the manufacturers providing the components, forming the supply chain of the online service.

[0078] Specifically, by summarizing and organizing the component names used by the first type of clients of the online service and the corresponding version information of the components, as well as the component names used by the second type of clients and the corresponding version information of the components, the complete supply chain composition information of the online service can be obtained; according to the obtained supply chain composition information, look up in the preset component manufacturer relationship table to obtain the manufacturer information corresponding to all components used by the online service, and form the supply chain of the online service.

[0079] In some embodiments, based on the online service, the supply chain composition information, and the manufacturers providing the components, a supply chain of the online service is formed, including: generating a supply chain knowledge graph of the online service according to the supply chain of the online service; wherein, the supply chain knowledge graph includes the network feature relationships between the online service and the components, and the network feature relationships between the components and the manufacturers.

[0080] It should be noted that the supply chain knowledge graph of the online service is a graph that visually displays the supply chain information of the online service, which can help technicians better understand the supply chain information of the online service. Among them, the supply chain knowledge graph includes the network feature relationships between the online service and the components, and the network feature relationships between the components and the manufacturers.

[0081] Optionally, a software service fingerprint of the online service can be generated by using techniques such as domain document understanding enhancement. The domain document understanding enhancement technique refers to automatically generating a software service fingerprint through deep learning based on document materials (such as web banners, html static pages, etc.). Among them, the features of the software service fingerprint can be IP address, used web server, JS library, development framework, intermediate components, geographical location, photos, browser version, plugins, etc., and this embodiment does not limit this.

[0082] Furthermore, according to the features of the generated software service fingerprint of the online service, a supply chain knowledge graph of the online service is generated.

[0083] Optionally, techniques such as graph modeling can be used to abstract the features of the software service fingerprint of the online service into the form of graph nodes and graph edges to generate a supply chain knowledge graph of the online service. Among them, the supply chain knowledge graph includes the network feature relationships between the online service and the components, and the network feature relationships between the components and the manufacturers.

[0084] Please refer to Figure 2 , Figure 2 which is a schematic diagram of the supply chain knowledge graph of the online service of the present invention.

[0085] For online services, different versions of different components provided by different manufacturers may be used. For example, an online service uses three components in total, namely the MYSQL database, the development component Fastjson, and the server component Tomcat. Among them, the web side uses MYSQL 5.6, the development component Fastjson, and the server component Tomcat 6, and the mobile application side uses MYSQL 8.0, the development component Fastjson, and the server component Tomcat 7. Supplier A provides MYSQL 5.6 and MYSQL 8.0, Supplier B provides the server components Tomcat 6 and Tomcat 7, and Supplier C provides the development component Fastjson. Then the supply chain knowledge graph of this online service is as Figure 2 shown.

[0086] Please refer to Figure 3 , Figure 3 which is the second flow schematic diagram of the supply chain detection method for the online service of the present invention.

[0087] The present invention also provides a specific embodiment of the supply chain detection method for an online service. In this embodiment, the supply chain detection method for the online service specifically includes steps S310 to S360, and each step is as follows:

[0088] S310: Automatically generate a probing payload according to the network protocol and the state machine.

[0089] In this embodiment, the first type of client of the online service is the web side, and the second type of client of the online service is the mobile application side.

[0090] Specifically, the state machine can generate a probing payload to detect relevant information of the online service according to the state change of the web side of the online service and in combination with the network protocol of the web side of the online service.

[0091] S320: Send the probing payload to the web side of the online service and obtain the first response information.

[0092] Among them, the first response information is the response information of the web side of the online service to the probing payload.

[0093] In this embodiment, after sending the probing payload to the online service, it will trigger an event corresponding to the online service, scan the port opening situation of the online service, and obtain the response information of the web side of the online service.

[0094] It should be noted that the response information of the web side of the online service to the probing payload can be the response message corresponding to the network protocol of the web side of the online service, and the corresponding response message can carry original information such as port response status, status code, used components, version, and timestamp.

[0095] S330: Analyze the first response information to obtain the first supply chain composition information corresponding to the online service.

[0096] In this embodiment, the response information of the online service web - end to the detection payload is unstructured information. Therefore, it is necessary to use the named entity recognition technology in natural language processing technology to analyze the unstructured response information, extract relevant named entities, and then combine the existing feature data set to analyze the component names used by the online service web - end and the version information corresponding to the components, so as to obtain the first supply chain composition information corresponding to the online service.

[0097] S340: Send a detection instruction to the mobile application - end of the online service and obtain the second response information, and analyze the second response information to obtain the second supply chain composition information corresponding to the online service.

[0098] Among them, the second response information is the binary information of the online service mobile application - end.

[0099] In this embodiment, it is necessary to execute corresponding events on the mobile application - end according to the network protocol and functions used by the online service mobile application - end to obtain the second response information, analyze the second response information, extract the component names used by the online service mobile application - end and the version information corresponding to the components, so as to obtain the second supply chain composition information corresponding to the online service.

[0100] Optionally, use the Soot tool to analyze the binary information of the online service mobile application - end. Based on the analysis of the binary information, construct the control - dependence graph and data - dependence graph corresponding to the second - type client. Among them, the control - dependence graph is used to represent the control flow in the binary information, and the data - dependence graph is used to represent the data flow situation in the binary information.

[0101] S350: Generate the supply chain of the online service according to the first supply chain composition information and the second supply chain composition information.

[0102] In this embodiment, it is necessary to summarize and sort out the component names used by the first - type client of the online service and the version information corresponding to the components, and the component names used by the second - type client and the version information corresponding to the components, so as to obtain the complete supply chain composition information of the online service; then, according to the obtained supply chain composition information, search in the preset component manufacturer relationship table to obtain the manufacturer information corresponding to all components used by the online service, and form the supply chain of the online service.

[0103] S360: Generate the supply chain knowledge graph of the online service according to the supply chain of the online service.

[0104] In this embodiment, after generating the supply chain of the online service, the domain document understanding enhancement technology can be used to generate the software service fingerprint of the online service, and according to the characteristics of the generated software service fingerprint of the online service, the supply chain knowledge graph of the online service is generated. Among them, the supply chain knowledge graph includes the network feature relationship between the online service and the components, and the network feature relationship between the components and the manufacturers.

[0105] The supply chain detection device for the online service provided by the present invention will be described below. The supply chain detection device for the online service described below can be correspondingly referred to the supply chain detection method for the online service described above.

[0106] Please refer to Figure 4 , Figure 4 which is a schematic structural diagram of the supply chain detection device for the online service of the present invention.

[0107] In this embodiment, the supply chain detection device for the online service includes a first detection instruction module 410, a first supply chain composition information module 420, a second detection instruction module 430, a second supply chain composition information module 440, and a supply chain information module 450.

[0108] The first detection instruction module 410 is configured to send a first detection instruction to the first type of client of the online service and obtain the first response information of the first type of client to the first detection instruction;

[0109] The first supply chain composition information module 420 is configured to analyze the first response information to obtain the first supply chain composition information corresponding to the first type of client;

[0110] The second detection instruction module 430 is configured to send a second detection instruction to the second type of client of the online service and obtain the second response information of the second type of client to the second detection instruction;

[0111] The second supply chain composition information module 440 is configured to analyze the second response information to obtain the second supply chain composition information corresponding to the second type of client;

[0112] The supply chain information module 450 is configured to determine the supply chain information of the online service according to the first supply chain composition information and the second supply chain composition information.

[0113] In some embodiments, the first detection instruction module 410 is configured to send a first detection instruction to a first type of client of the online service and obtain first response information of the first type of client to the first detection instruction, including: in response to the first detection instruction, automatically generating a detection payload according to the network protocol of the first type of client and the state machine of the first type of client; sending the detection payload to the online service through the first type of client, and obtaining the response information of the online service to the detection payload as the first response information.

[0114] In some embodiments, the first detection instruction module 410 is configured to, in response to the first detection instruction, automatically generate a detection payload according to the network protocol of the first type of client and using the state machine of the first type of client, including: generating an initial detection payload according to the network protocol of the first type of client; the state machine generating a detection payload based on the initial detection payload, in combination with the trigger event and port opening situation of the online service.

[0115] In some embodiments, the first response information is unstructured information; the first supply chain composition information module 420 is configured to analyze the first response information to obtain first supply chain composition information corresponding to the first type of client, including: using natural language processing technology to analyze the first response information to obtain the first supply chain composition information; wherein the first supply chain composition information includes a first component name and a first version information.

[0116] In some embodiments, the second response information is binary information; the second supply chain composition information module 440 is configured to analyze the second response information to obtain second supply chain composition information corresponding to the second type of client, including: analyzing the second response information to obtain the second supply chain composition information; wherein the second supply chain composition information includes a second component name and a second version information.

[0117] In some embodiments, the supply chain information module 450 is configured to determine the supply chain information of the online service according to the first supply chain composition information and the second supply chain composition information, including: integrating the first component name, the first version information, the second component name, and the second version information to obtain the supply chain composition information of the online service; obtaining the manufacturers providing the components according to the supply chain composition information and a preset component manufacturer relationship table; wherein the preset component manufacturer relationship table includes the corresponding relationships between different versions of components and manufacturers; forming the supply chain of the online service based on the online service, the supply chain composition information, and the manufacturers providing the components.

[0118] In some embodiments, the supply chain information module 450 is used to form a supply chain of an online service based on the online service, the supply chain composition information, and the manufacturers providing components, including: generating a supply chain knowledge graph of the online service according to the supply chain of the online service; wherein, the supply chain knowledge graph includes the network feature relationships between the online service and the components, and the network feature relationships between the components and the manufacturers.

[0119] The present invention also provides an electronic device. Please refer to Figure 5 , Figure 5 FIG. is a schematic structural diagram of an embodiment of the electronic device of the present invention. In this embodiment, the electronic device may include a memory 520, a processor 510, and a computer program stored in the memory 520 and executable on the processor 510. When the processor 510 executes the program, it implements the supply chain detection method of the online service provided by each of the above methods.

[0120] Optionally, the electronic device may further include a communication bus 530 and a communication interface 540. Among them, the processor 510, the communication interface 540, and the memory 520 complete mutual communication through the communication bus 530. The processor 510 may call the logical instructions in the memory 520 to execute the supply chain detection method of the online service, and the method includes: sending a first detection instruction to a first type of client of the online service, and obtaining first response information of the first type of client to the first detection instruction; analyzing the first response information to obtain first supply chain composition information corresponding to the first type of client; sending a second detection instruction to a second type of client of the online service, and obtaining second response information of the second type of client to the second detection instruction; analyzing the second response information to obtain second supply chain composition information corresponding to the second type of client; determining the supply chain information of the online service according to the first supply chain composition information and the second supply chain composition information.

[0121] In addition, when the logical instructions in the above-mentioned memory 520 are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs that can store program codes.

[0122] On the other hand, the present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it is used to implement the supply chain detection method for online services provided by the above-mentioned various methods. The steps and principles have been introduced in detail in the above methods and will not be repeated here.

[0123] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art can understand and implement it without creative labor.

[0124] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the technical solution, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium such as ROM / RAM, magnetic disks, optical discs, etc., and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments.

[0125] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements on some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A supply chain detection method for online services, characterized in that, Including: Sending a first detection instruction to a first type of client of the online service and obtaining first response information of the first type of client to the first detection instruction; Analyzing the first response information to obtain first supply chain composition information corresponding to the first type of client; Sending a second detection instruction to a second type of client of the online service and obtaining second response information of the second type of client to the second detection instruction; Analyzing the second response information to obtain second supply chain composition information corresponding to the second type of client; Determining the supply chain information of the online service according to the first supply chain composition information and the second supply chain composition information.

2. The supply chain detection method for online services according to claim 1, wherein The step of sending a first detection instruction to a first type of client of the online service and obtaining first response information of the first type of client to the first detection instruction includes: In response to the first detection instruction, automatically generating a detection payload according to the network protocol of the first type of client and the state machine of the first type of client; Sending the detection payload to the online service through the first type of client and obtaining the response information of the online service to the detection payload as the first response information.

3. The supply chain detection method for online services according to claim 2, wherein The step of, in response to the first detection instruction, automatically generating a detection payload according to the network protocol of the first type of client and using the state machine of the first type of client includes: Generating an initial detection payload according to the network protocol of the first type of client; The state machine generates the detection payload according to the initial detection payload, in combination with the trigger event and port opening situation of the online service.

4. The supply chain detection method for online services according to claim 1, characterized in that, The first response information is unstructured information; the step of analyzing the first response information to obtain first supply chain composition information corresponding to the first type of client includes: Analyzing the first response information using natural language processing technology to obtain first supply chain composition information; wherein the first supply chain composition information includes a first component name and a first version information.

5. The supply chain detection method for online services according to claim 4, characterized in that, The second response information is binary information; the step of analyzing the second response information to obtain second supply chain composition information corresponding to the second type of client includes: Analyzing the second response information to obtain second supply chain composition information; wherein the second supply chain composition information includes a second component name and a second version information.

6. The supply chain detection method for online services according to claim 5, characterized in that, The step of determining the supply chain information of the online service according to the first supply chain composition information and the second supply chain composition information includes: Integrating the first component name, the first version information, the second component name and the second version information to obtain the supply chain composition information of the online service; Obtaining the manufacturer providing the component according to the supply chain composition information and a preset component manufacturer relationship table; wherein the preset component manufacturer relationship table includes the corresponding relationship between different versions of components and manufacturers; Forming the supply chain of the online service based on the online service, the supply chain composition information and the manufacturer providing the component.

7. The supply chain detection method for online services according to claim 6, characterized in that, Based on the online service, the supply chain composition information, and the manufacturers of the provided components, a supply chain of the online service is formed, including: Generating a supply chain knowledge graph of the online service according to the supply chain of the online service; Among them, the supply chain knowledge graph includes the network feature relationship between the online service and the components, and the network feature relationship between the components and the manufacturers.

8. A supply chain detection device for online services, characterized in that, Including: A first detection instruction module, configured to send a first detection instruction to a first type of client of the online service, and obtain first response information of the first type of client to the first detection instruction; A first supply chain composition information module, configured to analyze the first response information to obtain first supply chain composition information corresponding to the first type of client; A second detection instruction module, configured to send a second detection instruction to a second type of client of the online service, and obtain second response information of the second type of client to the second detection instruction; A second supply chain composition information module, configured to analyze the second response information to obtain second supply chain composition information corresponding to the second type of client; A supply chain information module, configured to determine the supply chain information of the online service according to the first supply chain composition information and the second supply chain composition information.

9. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the supply chain detection method of the online service according to any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the supply chain detection method of the online service according to any one of claims 1 to 7.

Images