Software supply chain security governance method, machine-readable storage medium and processor

Abstract

The embodiments of the present invention provide a software supply chain security governance method, a machine-readable storage medium, and a processor, which belong to the technical field of software vulnerability analysis. The software supply chain security governance method includes: obtaining open source files that need to be referenced during code development; preprocessing the open source files to obtain valid open source files; detecting the open source code component information of the valid open source files to obtain a feature vector set of the open source code in the valid open source files; matching the valid open source files after information detection with the existing open source code vulnerability feature library to find risk vulnerabilities of the valid open source files; generating a corresponding risk vulnerability list based on the risk vulnerabilities of the valid open source files found. The software supply chain security governance method can detect the referenced open source software to detect whether there are risk vulnerabilities in the open source software.

Description

Technical Field

[0001] The present invention relates to the technical field of software vulnerability analysis, and in particular to a software supply chain security governance method, a machine-readable storage medium and a processor. Background Art

[0002] For software products, it is necessary to focus on reviewing the software supply chain security risks in the software product development, testing, delivery, operation and maintenance. On the other hand, with the continuous development of big data, cloud computing, and artificial intelligence, open source software has become the mainstream choice for software development. However, the abuse of open source software may bring some potential risks, such as being unaware of the vulnerabilities of the introduced open source software. Therefore, a method is needed to detect whether the referenced open source software has vulnerabilities. Summary of the invention

[0003] The purpose of an embodiment of the present invention is to provide a software supply chain security governance method, a machine-readable storage medium and a processor. The software supply chain security governance method can detect referenced open source software to detect whether there are risk vulnerabilities in the open source software.

[0004] In order to achieve the above objectives, on the one hand, an embodiment of the present invention provides a software supply chain security governance method, the software supply chain security governance method comprising:

[0005] Obtain open source files that need to be referenced during code development;

[0006] Preprocessing the open source file to obtain a valid open source file;

[0007] Performing open source code component information detection on the valid open source file to obtain a feature vector set of the open source code in the valid open source file;

[0008] Matching the valid open source file after information detection with an existing open source code vulnerability feature library to find risk vulnerabilities in the valid open source file;

[0009] Generate a corresponding risk vulnerability list based on the risk vulnerabilities of the valid open source files found.

[0010] Optionally, the preprocessing of the open source file to obtain a valid open source file includes:

[0011] Obtaining the open source file;

[0012] Determine whether the programming language of the open source file is at least one of the 315 programming languages ​​supported by the system;

[0013] When the programming language of the open source file is at least one of the 315 programming languages ​​supported by the system, determining whether the file capacity of the open source file is greater than a preset capacity;

[0014] When the file capacity of the open source file is greater than the preset capacity, determining whether the number of file code lines of the open source file is greater than a preset number;

[0015] When the number of file code lines of the open source file is greater than a preset number, the open source file whose number of file code lines is greater than the preset number is obtained as a valid open source file.

[0016] Optionally, performing open source code component information detection on the valid open source file to obtain a feature vector set of the open source code in the valid open source file includes:

[0017] Obtaining the valid open source file;

[0018] Processing the valid open source file to remove redundant information such as comments, spaces, and line breaks in the open source code in the valid open source file;

[0019] Standardizing the variable names and function names of the open source code in the valid open source file;

[0020] Decomposing and marking the open source code of the valid open source file after the standardization process;

[0021] Extracting feature vectors from the decomposed and marked open source code of the valid open source file according to grammatical features;

[0022] The feature vectors are aggregated to obtain a feature vector set of the open source code of the valid open source file.

[0023] Optionally, matching the valid open source file after information detection with an existing open source code vulnerability feature library to find risk vulnerabilities of the valid open source file includes:

[0024] Obtaining the feature vector set;

[0025] Randomly select at least three feature vectors from the feature vector set, and search the open source code vulnerability feature library for a plurality of the initial vulnerability code fragments that match the three feature vectors;

[0026] Performing feature extraction on the multiple initial vulnerability code fragments to obtain multiple initial vulnerability code feature vector sets;

[0027] The similarity between the feature vector set of the open source code of the valid open source file and each of the initial vulnerability code feature vector sets is calculated according to formula (1):

[0028] Formula (1),

[0029] in, Indicates similarity, represents a set of feature vectors, Representing a single set of initial vulnerability code feature vectors;

[0030] Acquiring the similarity, and when the similarity exceeds a first preset threshold, determining that the open source code of the valid open source file matches the initial vulnerability code snippet;

[0031] The risk vulnerability of the valid open source file is determined according to the risk vulnerability corresponding to the matched initial vulnerability code fragment.

[0032] Optionally, randomly selecting at least three feature vectors from the feature vector set and searching the open source code vulnerability feature library for a plurality of initial vulnerability code snippets matching the features thereof comprises:

[0033] Obtaining the feature vector;

[0034] Obtaining code words in the feature vector;

[0035] Obtaining synonyms having the same meaning as the code words in the feature vector;

[0036] Bringing the synonym into the feature vector to obtain an updated feature vector;

[0037] Searching the open source code vulnerability feature library for a plurality of initial vulnerability code snippets that match the update feature vector.

[0038] Optionally, obtaining the similarity, and when the similarity exceeds a preset threshold, determining that the open source code of the valid open source file matches the initial vulnerability code snippet includes:

[0039] Acquire the initial vulnerability code feature vector set whose similarity exceeds a first preset threshold;

[0040] Obtaining the order of code blocks in the initial vulnerability code feature vector set;

[0041] Obtaining the sequence of code blocks of the open source code of the valid open source file;

[0042] When the number of times that the code blocks of the open source code of the valid open source file and the code blocks in the initial vulnerability code feature vector set appear in an order exceeds a second preset threshold, it is determined that the open source code of the valid open source file matches the initial vulnerability code fragment.

[0043] Optionally, matching the valid open source file after information detection with an existing open source code vulnerability feature library to find risk vulnerabilities of the valid open source file includes:

[0044] Build an open source file vulnerability matching model based on LSTM;

[0045] Obtaining the open source code of the valid open source file and the initial vulnerability code fragment matching the valid open source code;

[0046] Performing feature extraction on the valid open source code and the initial vulnerability code fragment matching the valid open source code to serve as input of an open source vulnerability matching model;

[0047] By training the open source vulnerability matching model, model parameters of the open source vulnerability matching model are obtained;

[0048] Construct an open source file vulnerability matching model based on LSTM according to the trained model parameters;

[0049] Re-obtaining the valid open source file after information detection;

[0050] The retrieved open source code and the open source code vulnerability feature library of the valid open source file are input into the open source file vulnerability matching model to find risk vulnerabilities related to the valid open source file.

[0051] Optionally, the open source vulnerability matching model includes unit status , Forget Gate , Input Gate and output gate , the function constructed for the open source vulnerability matching model is shown in formula (2):

[0052] Formula (2),

[0053] in, They represent the forget gate, input gate, memory unit and output gate respectively. is the sigmoid activation function, is the hyperbolic tangent activation function, represents the input to the open source vulnerability matching model, is the hidden layer state, is the unit state, is the weight matrix, is the bias matrix, the It is the unit status, indicating the output result of the open source vulnerability matching model.

[0054] On the other hand, the present invention also provides a machine-readable storage medium, on which instructions are stored, and the instructions are used to enable a machine to execute the software supply chain security governance method as described above.

[0055] On the other hand, the present invention also provides a processor for running a program, wherein the program, when run, is used to execute the software supply chain security governance method as described above.

[0056] Through the above technical solution, the software supply chain security governance method, machine-readable storage medium and processor provided by the present invention obtain the open source files that need to be referenced during the code development process, and pre-process the open source files to obtain valid open source files, and then detect the open source code component information of the valid open source files to obtain a feature vector set about the open source code in the valid open source files. After obtaining the feature vector set, the feature vector set can be matched with the existing open source code vulnerability feature library to find the risk vulnerabilities about the valid open source files, and then a risk vulnerability list about the valid open source files can be generated based on the risk vulnerabilities found. This method can effectively detect risk vulnerabilities in open source files that need to be referenced.

[0057] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings:

[0059] Figure 1 is a flow chart of a software supply chain security governance method according to an embodiment of the present invention;

[0060] Figure 2 is a flowchart of preprocessing an open source file in a software supply chain security governance method according to an embodiment of the present invention;

[0061] Figure 3 is a flow chart of obtaining a feature vector set of a software supply chain security governance method according to an embodiment of the present invention;

[0062] Figure 4 It is a flowchart of detecting risk vulnerabilities of effective open source files in a software supply chain security governance method according to an embodiment of the present invention;

[0063] Figure 5is a flowchart of replacing code words in the feature vector according to a software supply chain security governance method according to an embodiment of the present invention;

[0064] Figure 6 is a flow chart of matching initial vulnerability code snippets of a software supply chain security governance method according to an embodiment of the present invention;

[0065] Figure 7 It is a flowchart of finding risk vulnerabilities of valid open source files in a software supply chain security governance method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0066] The specific implementation of the embodiment of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present invention, and is not used to limit the embodiment of the present invention.

[0067] Figure 1 1 is a flowchart of a software supply chain security management method according to an embodiment of the present invention. In the present invention, the software supply chain management method includes:

[0068] In step S1, the open source files that need to be referenced during the code development process are obtained.

[0069] In step S2, the open source file is preprocessed to obtain a valid open source file.

[0070] In step S3, open source code component information detection is performed on the valid open source file to obtain a feature vector set of the open source code in the valid open source file.

[0071] In step S4, the valid open source files after information detection are matched with the existing open source code vulnerability feature library to find risk vulnerabilities of the valid open source files.

[0072] In step S5, a corresponding risk vulnerability list is generated according to the risk vulnerabilities of the found valid open source files.

[0073] In the present invention, when managing the security of the software supply chain, the code in the software supply chain can be analyzed to determine whether there are risk vulnerabilities in the code in the software supply chain. When building a software supply chain, staff generally quote open source software, so the quoted open source software can be analyzed to determine whether there are risk vulnerabilities in the open source software. When analyzing, the open source files that need to be quoted in the code development process can be obtained, and then the open source files can be preprocessed to remove some redundant information in the open source files to obtain valid open source files. After obtaining the valid open source file, the open source code component information detection can be performed on the valid open source file, so that a feature vector set about the open source code in the valid open source file can be obtained. The feature vectors in the feature vector set can represent the structural features of the code fragments of the open source code. After the open source code component information detection is performed on the valid open source file, the valid open source file can be matched with the existing open source code vulnerability feature library, so that the risk vulnerabilities about the valid open source file can be found. The open source code vulnerability signature database contains more than 150,000 security vulnerabilities, of which more than 30,000 can be located at the version level, more than 10,000 at the file level, and more than 3,000 at the code level. At the same time, the security vulnerability knowledge base is updated regularly, and can be updated daily. After finding the risk vulnerabilities of the valid open source file, a corresponding risk vulnerability list can be generated based on the risk vulnerabilities of the found valid open source file, so that risk vulnerability detection can be performed on the open source code referenced in the software supply chain.

[0074] In one embodiment of the present invention, Figure 2 As shown, the process of preprocessing the open source file may include:

[0075] In step S6, the open source file is obtained.

[0076] In step S7, it is determined whether the programming language of the open source file is at least one of the 315 programming languages ​​supported by the system.

[0077] In step S8, when the programming language of the open source file is at least one of the 315 programming languages ​​supported by the system, it is determined whether the file capacity of the open source file is greater than a preset capacity.

[0078] In step S9, when the file capacity of the open source file is greater than the preset capacity, it is determined whether the number of file code lines of the open source file is greater than the preset number.

[0079] In step S10, when the number of file code lines of the open source file is greater than a preset number, the open source file with the number of file code lines greater than the preset number is obtained as a valid open source file.

[0080] In the present invention, when performing risk vulnerability detection on the open source code in the open source file, the open source file can be preprocessed first to remove invalid files in the open source file, retain valid files as valid open source files, and only valid open source files will participate in the open source code component information detection, and invalid files will not participate. When preprocessing, all the open source files can be obtained, and then it can be determined whether the programming language of the open source file is at least one of the 315 programming languages ​​supported by the system, so that the open source file can be detected. When it is determined that the programming language of the open source file is at least one of the 315 programming languages ​​supported by the system, it can be determined again whether the file capacity of the open source file is greater than the preset capacity, so that it can be determined whether the open source file contains useful information. When it is determined that the file capacity of the open source file is greater than the preset capacity, it can be determined whether the number of file code lines of the open source file is greater than the preset number. Only when the number of open source code lines is greater than the preset number, it can be indicated that the open source code is a valid code, so the open source file with a file code line number greater than the preset number can be obtained as a valid open source file. Through the above process, invalid open source files can be removed and valid open source files can be screened out to facilitate subsequent component information detection.

[0081] In one embodiment of the present invention, Figure 3 As shown, the flowchart for obtaining a feature vector set may include:

[0082] In step S11, a valid open source file is obtained.

[0083] In step S12, the valid open source file is processed to remove redundant information such as comments, spaces, and line breaks in the open source code in the valid open source file.

[0084] In step S13, the variable names and function names of the open source codes in the valid open source files are standardized.

[0085] In step S14, the open source code of the valid open source file after the standardization process is decomposed and marked.

[0086] In step S15, feature vectors are extracted from the open source code of the decomposed and marked valid open source file according to the grammatical features.

[0087] In step S16, the feature vectors are aggregated to obtain a feature vector set of open source codes related to valid open source files.

[0088] In the present invention, after obtaining a valid open source file, the valid open source file can be processed to remove redundant information in the open source code in the valid open source file, such as comments, spaces, line breaks and other information. After processing the valid open source file, the variable names and function names of the open source code in the valid open source file can be standardized to facilitate subsequent risk vulnerability matching of the open source code of the valid open source file. After the standardization process, the open source code of the valid open source file can be decomposed and marked, and then the feature vector can be extracted from the decomposed and marked open source code of the valid open source file according to the grammatical features. The feature vector can represent the structural features of the open source code. The feature vector can be aggregated to obtain a feature vector set of the open source code of the valid open source file. The feature vector set can participate in the subsequent detection of risk vulnerabilities.

[0089] In one embodiment of the present invention, Figure 4 As shown, the process of detecting risk vulnerabilities in valid open source files can include:

[0090] In step S17, a feature vector set is obtained.

[0091] In step S18, at least three feature vectors in the feature vector set are randomly selected, and a plurality of initial vulnerability code fragments matching the three feature vectors are searched in the open source code vulnerability feature library.

[0092] In step S19, feature extraction is performed on the multiple initial vulnerability code fragments to obtain multiple initial vulnerability code feature vector sets.

[0093] In step S20, the similarity between the feature vector set of the open source code of the valid open source file and the feature vector set of each initial vulnerability code is calculated according to formula (1):

[0094] Formula (1),

[0095] in, Indicates similarity, represents a set of feature vectors, Represents a single set of initial vulnerability code feature vectors.

[0096] In step S21, the similarity is obtained, and when the similarity exceeds a first preset threshold, it is determined that the open source code of the valid open source file matches the initial vulnerability code snippet.

[0097] In step S22, the risk vulnerability of the valid open source file is determined according to the risk vulnerability corresponding to the matched initial vulnerability code fragment.

[0098] In the present invention, after obtaining the feature vector set, at least three feature vectors in the feature vector set can be arbitrarily selected, and then multiple initial vulnerability code fragments matching them can be searched in the open source code vulnerability feature library. At least three feature vectors can roughly indicate the information characteristics of the open source code, and the staff can select more feature vectors in the feature vector set as needed to indicate the information characteristics of the open source code as much as possible. By screening some feature vectors in the feature vector set and matching them with the open source code vulnerability feature library, the amount of matching calculation can be minimized, avoiding the problem of a huge amount of calculation caused by matching all feature vectors in the feature vector set with the open source code vulnerability feature library one by one.

[0099] After obtaining the feature vector, the feature vector can be used to search for the initial vulnerability code fragment in the open source code vulnerability feature library that matches it. There may be more than one initial vulnerability code fragment that matches the feature vector, so it can be screened again based on the multiple initial vulnerability code fragments obtained. During the screening, the multiple initial vulnerability code fragments can be first feature extracted, and the initial vulnerability code fragments can be converted into corresponding initial vulnerability code feature vector sets. Then, the similarity between each initial vulnerability code feature vector set and the feature vector set of the open source code of the valid open source file can be calculated according to formula (1). After obtaining the similarity, the matching degree between the initial vulnerability code feature vector set and the open source code can be judged according to whether the similarity exceeds a first preset threshold, and then the initial vulnerability code fragment that exceeds the first preset threshold is selected to determine the match with the open source code. After obtaining the initial vulnerability code fragment that matches the open source code, the risk vulnerability of the valid open source file can be determined by the risk vulnerability corresponding to the initial vulnerability code fragment.

[0100] In the present invention, when the feature vector in the feature vector set of the valid open source file does not match the initial vulnerability code snippet in the open source code vulnerability feature library, it can be indicated that the risk vulnerability of the valid open source file is low.

[0101] In one embodiment of the present invention, Figure 5 As shown, the process of replacing the code words in the feature vector may include:

[0102] In step S23, a feature vector is obtained.

[0103] In step S24, the code vocabulary in the feature vector is obtained.

[0104] In step S25, synonyms having the same meaning as the code words in the feature vector are obtained.

[0105] In step S26, the synonyms are brought into the feature vector to obtain an updated feature vector.

[0106] In step S27, a plurality of initial vulnerability code fragments matching the updated feature vector are searched in the open source code vulnerability feature library.

[0107] In the present invention, after obtaining the feature vector of the open source code of the valid open source file, the feature vector is matched with the open source code vulnerability feature library. However, because the vocabulary contained in the feature vector may have synonyms with the same meaning, if the open source code vulnerability feature library is matched only by the code vocabulary in the feature vector, there may be a situation where the match is not accurate. Therefore, after obtaining the code vocabulary of the feature vector, the synonyms with the same meaning can be obtained according to the code vocabulary, and then brought into the feature vector to obtain an updated feature vector, and then the multiple initial vulnerability code fragments matching the updated feature vector can be searched in the open source code vulnerability feature library. By replacing the updated feature vector and then matching the initial vulnerability code fragment, the obtained initial vulnerability code fragment can be made more comprehensive, so that the risk vulnerability of the valid open source file can be better found.

[0108] In one embodiment of the present invention, Figure 6 As shown, the flowchart for matching the initial vulnerability code snippet may include:

[0109] In step S28, an initial vulnerability code feature vector set whose similarity exceeds a threshold is obtained.

[0110] In step S29, the order of the code blocks in the initial vulnerability code feature vector set is obtained.

[0111] In step S30, the sequence of code blocks of the open source code of the valid open source file is obtained.

[0112] In step S31, when the number of times the code blocks of the open source code of the valid open source file and the code blocks in the initial vulnerability code feature vector set appear in an order exceeds a second preset threshold, it is determined that the open source code of the valid open source file matches the initial vulnerability code fragment.

[0113] In the present invention, after obtaining an initial vulnerability code feature vector set whose similarity exceeds a first preset threshold, the order of the code blocks in the initial vulnerability code feature vector set can be obtained, so that the order of the code blocks in the open source code of the valid open source file and the order of the code blocks in the initial vulnerability code feature vector set can be compared, and then the initial vulnerability code vector with substantially the same order can be found. If the order comparison is not performed, codes with the same code blocks but completely different meanings may appear. For example, the code blocks of the open source code of the valid open source file are , the order of code blocks in the initial vulnerability code feature vector set is If the sequence comparison is not performed, the two codes may be mistakenly considered to be the same. Therefore, after the sequence comparison is performed, when the comparison result exceeds the second preset threshold, it can be determined that the open source code and the initial vulnerability code fragment match.

[0114] In another embodiment of the present invention, Figure 7 As shown, the process of finding risk vulnerabilities in valid open source files can include:

[0115] In step S32, an LSTM-based open source file vulnerability matching model is constructed.

[0116] In step S33, the open source code of the valid open source file and the initial vulnerability code fragment matching the valid open source code are obtained.

[0117] In step S34, feature extraction is performed on the valid open source code and the initial vulnerability code fragment matching the valid open source code to serve as input of the open source vulnerability matching model.

[0118] In step S35, the model parameters of the open source vulnerability matching model are obtained by training the open source vulnerability matching model.

[0119] In step S36, an LSTM-based open source file vulnerability matching model is constructed according to the trained model parameters.

[0120] In step S37, the valid open source files after information detection are retrieved.

[0121] In step S38, the retrieved open source code and the open source code vulnerability feature library of the valid open source file are input into the open source file vulnerability matching model to find risk vulnerabilities related to the valid open source file.

[0122] In the present invention, when matching the open source code and the open source code vulnerability feature library, the open source code of the effective open source file and the matched initial vulnerability code fragment can be sent to the model by constructing an open source file vulnerability matching model based on LSTM to train the model, so that the open source code can be better matched by the open source file vulnerability matching model. Because the open source file vulnerability matching model is constructed based on the LSTM, it can continuously learn and optimize when matching, and can better match in terms of long-term memory. After constructing the open source vulnerability matching model, the matched open source code and the initial vulnerability code fragment can be feature extracted as the input of the open source vulnerability matching model. After training the open source vulnerability matching model, the effective open source file and the open source code vulnerability feature library after re-acquiring information detection can be input into the model, so that the risk vulnerability of the effective open source file can be found.

[0123] In one embodiment of the present invention, the open source vulnerability matching model may include unit status , Forget Gate , Input Gate and output gate The function constructed by the open source vulnerability matching model can be shown as formula (2):

[0124] Formula (2),

[0125] in, They represent the forget gate, input gate, memory unit and output gate respectively. is the sigmoid activation function, is the hyperbolic tangent activation function, represents the input to the open source vulnerability matching model, is the hidden layer state, is the unit state, is the weight matrix, is the bias matrix, the In the present invention, after the open source file vulnerability matching model is constructed, the open source file and the open source code vulnerability feature library can be used as the input of the open source vulnerability matching model after feature extraction. Input into the model and then find the risk vulnerabilities of the valid open source file.

[0126] On the other hand, the present invention also provides a machine-readable storage medium, on which instructions are stored, and the instructions are used to enable a machine to execute the software supply chain security governance method as described above.

[0127] On the other hand, the present invention also provides a processor for running a program, wherein the program, when run, is used to execute the software supply chain security governance method as described above.

[0128] Through the above technical solution, the software supply chain security governance method, machine-readable storage medium and processor provided by the present invention obtain the open source files that need to be referenced during the code development process, and pre-process the open source files to obtain valid open source files, and then detect the open source code component information of the valid open source files to obtain a feature vector set about the open source code in the valid open source files. After obtaining the feature vector set, the feature vector set can be matched with the existing open source code vulnerability feature library to find the risk vulnerabilities about the valid open source files, and then a risk vulnerability list about the valid open source files can be generated based on the risk vulnerabilities found. This method can effectively detect risk vulnerabilities in open source files that need to be referenced.

[0129] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0130] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0131] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0132] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0133] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0134] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0135] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0136] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0137] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A software supply chain security governance method, characterized in that: The software supply chain security governance method includes: Obtain open source files that need to be referenced during code development; Preprocessing the open source file to obtain a valid open source file; Performing open source code component information detection on the valid open source file to obtain a feature vector set of the open source code in the valid open source file; Matching the valid open source file after information detection with an existing open source code vulnerability feature library to find risk vulnerabilities in the valid open source file; Generate a corresponding risk vulnerability list according to the risk vulnerabilities of the found valid open source files; Performing open source code component information detection on the valid open source file to obtain a feature vector set of the open source code in the valid open source file includes: Obtaining the valid open source file; Processing the valid open source file to remove redundant information such as comments, spaces, and line breaks in the open source code in the valid open source file; Standardizing the variable names and function names of the open source code in the valid open source file; Decomposing and marking the open source code of the valid open source file after the standardization process; Extracting feature vectors from the decomposed and marked open source code of the valid open source file according to grammatical features; Aggregating the feature vectors to obtain a feature vector set of the open source code of the valid open source file; The valid open source file after information detection is matched with the existing open source code vulnerability feature library to find the risk vulnerabilities of the valid open source file, including: Obtaining the feature vector set; Randomly select at least three feature vectors from the feature vector set, and search for multiple initial vulnerability code snippets matching the three feature vectors in the open source code vulnerability feature library; Performing feature extraction on the multiple initial vulnerability code fragments to obtain multiple initial vulnerability code feature vector sets; The similarity between the feature vector set of the open source code of the valid open source file and each of the initial vulnerability code feature vector sets is calculated according to formula (1): Formula (1), in, Indicates similarity, represents a set of feature vectors, Representing a single set of initial vulnerability code feature vectors; Acquiring the similarity, and when the similarity exceeds a first preset threshold, determining that the open source code of the valid open source file matches the initial vulnerability code snippet; The risk vulnerability of the valid open source file is determined according to the risk vulnerability corresponding to the matched initial vulnerability code fragment.

2. The software supply chain security management method according to claim 1 is characterized in that: The preprocessing of the open source file to obtain a valid open source file includes: Obtaining the open source file; Determine whether the programming language of the open source file is at least one of the 315 programming languages ​​supported by the system; When the programming language of the open source file is at least one of the 315 programming languages ​​supported by the system, determining whether the file capacity of the open source file is greater than a preset capacity; When the file capacity of the open source file is greater than the preset capacity, determining whether the number of file code lines of the open source file is greater than a preset number; When the number of file code lines of the open source file is greater than a preset number, the open source file whose number of file code lines is greater than the preset number is obtained as a valid open source file.

3. The software supply chain security management method according to claim 1 is characterized in that: Randomly selecting at least three feature vectors from the feature vector set and searching the open source code vulnerability feature library for a plurality of initial vulnerability code snippets that match the features thereof comprises: Obtaining the feature vector; Obtaining code words in the feature vector; Obtaining synonyms having the same meaning as the code words in the feature vector; Bringing the synonym into the feature vector to obtain an updated feature vector; Searching the open source code vulnerability feature library for a plurality of initial vulnerability code snippets that match the update feature vector.

4. The software supply chain security management method according to claim 1 is characterized in that: Acquiring the similarity, and when the similarity exceeds a preset threshold, determining that the open source code of the valid open source file matches the initial vulnerability code snippet includes: Acquire the initial vulnerability code feature vector set whose similarity exceeds a first preset threshold; Obtaining the order of code blocks in the initial vulnerability code feature vector set; Obtaining the sequence of code blocks of the open source code of the valid open source file; When the number of times that the code blocks of the open source code of the valid open source file and the code blocks in the initial vulnerability code feature vector set appear in an order exceeds a second preset threshold, it is determined that the open source code of the valid open source file matches the initial vulnerability code fragment.

5. The software supply chain security management method according to claim 4 is characterized in that: The step of matching the valid open source file after information detection with an existing open source code vulnerability feature library to find risk vulnerabilities of the valid open source file includes: Build an open source file vulnerability matching model based on LSTM; Obtaining the open source code of the valid open source file and the initial vulnerability code fragment matching the valid open source code; Performing feature extraction on the valid open source code and the initial vulnerability code fragment matching the valid open source code to serve as input of an open source vulnerability matching model; By training the open source vulnerability matching model, model parameters of the open source vulnerability matching model are obtained; Construct an open source file vulnerability matching model based on LSTM according to the trained model parameters; Re-obtaining the valid open source file after information detection; The retrieved open source code and the open source code vulnerability feature library of the valid open source file are input into the open source file vulnerability matching model to find risk vulnerabilities related to the valid open source file.

6. The software supply chain security management method according to claim 5 is characterized in that: The open source vulnerability matching model includes unit status , Forget Gate , Input Gate and output gate , the function constructed for the open source vulnerability matching model is shown in formula (2): Formula (2), in, They represent the forget gate, input gate, memory unit and output gate respectively. is the sigmoid activation function, is the hyperbolic tangent activation function, represents the input to the open source vulnerability matching model, is the hidden layer state, is the unit state, is the weight matrix, is the bias matrix, the It is the unit status, indicating the output result of the open source vulnerability matching model.

7. A machine-readable storage medium, characterized in that: The machine-readable storage medium stores instructions for enabling a machine to execute the software supply chain security governance method as described in any one of claims 1-6.

8. A processor, characterized in that: Used to run a program, wherein the program, when run, is used to execute the software supply chain security governance method as described in any one of claims 1-6.

Images