A security detection and early warning system in open source components

Abstract

The present invention relates to the field of computer technology, and specifically discloses a security detection and early warning system in an open source component, comprising a data processing center and an evaluation vulnerability database, a code warehouse, a code batch processing module, a component early warning module, and a component scanning module connected to the data processing center, wherein the component scanning module is connected to a component evaluation module; the evaluation vulnerability database is used to store different vulnerability data for comparison by the component scanning module during scanning, and the code batch processing module realizes automatic batch pulling and packaging of main branch codes in the code warehouse; the component evaluation module makes a judgment based on the comparison result, and the component early warning module proposes an early warning strategy; the component scanning module scans the code package, and newly added unevaluated components need to be evaluated, and the scanning result is used to establish a component view; the security of the open source components can be effectively guaranteed, and the stable and effective operation of the components in the system can be guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a security detection and early warning system in an open source component. Background Art

[0002] With the rapid delivery of services and rapid iteration of products, open source components are being used by more and more companies. The security issues of open source components are becoming more and more prominent, and they have become one of the common targets for attackers to launch effective attacks. The security of open source components is an important factor in the normal operation and maintenance of the system. The security detection of existing open source components can only be manually packaged and scanned, which is inefficient. In addition, the code will be continuously updated during use, which requires manual repetitive scanning, which is a complex workload. Summary of the invention

[0003] The purpose of the present invention is to provide a security detection and early warning system in an open source component to solve the problems raised in the above background technology.

[0004] To achieve the above-mentioned purpose, the present invention provides the following technical solutions: a security detection and early warning system in an open source component, comprising a data processing center and an evaluation vulnerability database, a code warehouse, a code batch processing module, a component early warning module, and a component scanning module connected to the data processing center, wherein the component scanning module is connected to a component evaluation module; the evaluation vulnerability database is used to store different vulnerability data for comparison by the component scanning module during scanning, and the code batch processing module realizes automatic batch pulling and packaging of the main branch code in the code warehouse; the component early warning module judges the scanning result of the component scanning module and issues corresponding early warnings according to the judgment; the component scanning module scans the code package, and newly added unevaluated components need to undergo component evaluation, and the scanning result is used to establish a component view;

[0005] The component scanning module searches the packaged code package in the evaluation vulnerability database and gives the scanning result; the scanning result includes but is not limited to whether the component has been evaluated, the risk level, and usage suggestions;

[0006] For components that have not been evaluated, the component evaluation module performs nvd, cnvd, and cnnvd tests on the components to determine whether the components have public vulnerabilities; if there are public vulnerability reports, the components are rectified, including withdrawal, upgrade, and replacement; if there are no public vulnerability reports, the components are initially judged to be risk-free and require further evaluation;

[0007] The warning strategies of the component warning module include inconsistency between the scanning results and the project open source component view, notification of exception introduction of grey-listed components in the scanning results, existing code repositories not associated with project information, new code repositories not maintaining packaging configurations and not associated with project information, code repository packaging failure, no scanning results, changes in component risk levels in the open source component view, and notification of mitigation of exception-introduced components; among them, inconsistency is divided into newly added unevaluated components and newly added grey-listed components.

[0008] Preferably, the code batch processing module includes a code pulling unit and a code packaging unit, and the code pulling unit and the code packaging unit are respectively used to pull and package the main branch code in the code repository.

[0009] Preferably, for the evaluated components, if the component scanning module determines that the vulnerability risk level of the component is safe after scanning, the component can be used normally; if the component risk level is determined to be medium or above after scanning, it is recommended to withdraw use or upgrade the version or replace the security-level component; if risky components need to be used in special circumstances, exception introduction approval is required, and risk mitigation measures are provided.

[0010] Preferably, the further evaluation includes determining the open source protocol to which the open source component belongs, confirming that the open source protocol of the component is safe and available, and entering the component into the evaluation vulnerability database after passing the further evaluation.

[0011] Preferably, the component scanning module is provided with a project open source component view module, and the project open source component view module is used to establish an open source component view for the project code in units of projects after the scanning is completed.

[0012] Preferably, the code repository is provided with a code updating unit for maintaining code data in the code repository.

[0013] Preferably, the security detection process of the data processing center includes the following steps:

[0014] S1. Establish an evaluation vulnerability database;

[0015] S2: Automatically pull and package the code from the code repository in batches;

[0016] S3, parse the code package, search the parsed component package information in the evaluation vulnerability database, and give the scanning result;

[0017] S4. If the component has been evaluated and the component vulnerability risk level is safe, then by default the code can use the component normally;

[0018] The early warning process of the data processing center includes the following steps:

[0019] T1. If the component vulnerability risk level is medium or above, it will be a graylist component, and the notification will give suggestions for component rectification;

[0020] T2. Evaluate the notifications of un-evaluated components;

[0021] T3. If there is a public vulnerability report on the evaluation component, notify the component to be rectified;

[0022] T4: There is no public vulnerability report on the evaluated component, and further evaluation of the component is notified;

[0023] T5. Notify project codes on a project-by-project basis to establish an open source component view.

[0024] Compared with the prior art, the beneficial effects of the present invention are as follows: by constructing a vulnerability database, the present invention can automatically batch package the code and scan it regularly, and store the scan results in the database; automatically trigger batch detection regularly, and maintain the results in the vulnerability database; use the vulnerability database as a standard to perform security detection on the component code, and adopt different early warning strategies according to the detection results, which can effectively ensure the security of open source components, and then ensure the stable and effective operation of the components in the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 It is a structural schematic diagram of the present invention;

[0026] Numbers in the figure: 1. Data processing center; 2. Assessment vulnerability database; 3. Code repository; 4. Code batch processing module; 5. Component assessment module; 6. Component warning module; 7. Code update unit; 8. Code pulling unit; 9. Code packaging unit; 10. Project open source component view module; 11. Component scanning module. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] See also Figure 1The present invention provides a technical solution: a security detection and early warning system in an open source component, comprising a data processing center 1 and an evaluation vulnerability database 2, a code warehouse 3, a code batch processing module 4, a component early warning module 6, and a component scanning module 11 connected to the data processing center 1, wherein the component scanning module 11 is connected to a component evaluation module 5; the evaluation vulnerability database 2 is used to store different vulnerability data for comparison by the component scanning module 11 during scanning, and the code batch processing module 4 realizes automatic batch pulling and packaging of the main branch code in the code warehouse 3; the component early warning module 6 judges the scanning result of the component scanning module 11 and issues a corresponding early warning according to the judgment; the component scanning module 11 scans the code package, and newly added un-evaluated components need to be evaluated, and the scanning result is used to establish the component view;

[0029] The component scanning module 11 searches the packaged code package in the evaluation vulnerability database 2 and gives the scanning result; the scanning result includes but is not limited to whether the component has been evaluated, the risk level, and the usage suggestions;

[0030] For components that have not been evaluated, the component evaluation module 5 performs nvd, cnvd, and cnnvd tests on the components to determine whether the components have public vulnerabilities; if there are public vulnerability reports, the components are rectified, including withdrawal, upgrade, and replacement; if there are no public vulnerability reports, the components are initially judged to be risk-free and require further evaluation;

[0031] The warning strategies of the component warning module 6 include inconsistency between the scanning results and the project open source component view, notification of exception introduction of gray-listed components in the scanning results, existing code repositories not associated with project information, new code repositories not maintaining packaging configurations and not associated with project information, code repository 3 packaging failure, no scanning results, changes in component risk levels in the open source component view, and notification of mitigation of exception-introduced components; among them, inconsistency is divided into newly added unevaluated components and newly added gray-listed components.

[0032] Furthermore, the code batch processing module 4 includes a code pulling unit 8 and a code packaging unit 9, and the code pulling unit 8 and the code packaging unit 9 are respectively used to pull and package the main branch code in the code repository 3.

[0033] Furthermore, for the evaluated components, if the component scanning module 11 determines that the vulnerability risk level of the component is safe after scanning, the component can be used normally; if the component risk level is determined to be medium or above after scanning, it is recommended to exit use or upgrade the version or replace the security-level component; if risky components need to be used in special circumstances, exception introduction approval is required, and risk mitigation measures are provided.

[0034] Furthermore, the further evaluation includes determining the open source protocol to which the open source component belongs, confirming that the open source protocol of the component is safe and usable, and entering the evaluation vulnerability database 2 after passing the further evaluation.

[0035] Furthermore, the component scanning module 11 is provided with a project open source component view module 10, and the project open source component view module 10 is used to establish an open source component view for the project code in units of projects after the scanning is completed.

[0036] Furthermore, the code warehouse 3 is provided with a code updating unit 7 for maintaining the code data in the code warehouse 3 .

[0037] Working Principle: The following describes the safety process and the early warning process respectively;

[0038] Security Process:

[0039] The evaluation vulnerability database 2 is established in advance, and the component codes in the code warehouse 3 are pulled and packaged through the code pulling unit 8 and the code packaging unit 9 in the code batch processing module 4. After that, the component scanning module 11 searches the code package in the evaluation vulnerability database 2 and gives the scanning result; the scanning result includes whether the component has been evaluated, the risk level, and the usage suggestions.

[0040] Determine the next steps based on whether the component is evaluated;

[0041] If the component has been evaluated and the component vulnerability risk level is safe, it will be used normally by default; if the component vulnerability risk level is medium or above, it is recommended to stop using it or upgrade the version or replace the safe-level component; if risky components need to be used in special circumstances, exception introduction approval is required and risk mitigation measures must be provided.

[0042] If the component has not been evaluated, the component will be tested for nvd, cnvd, and cnnvd to determine whether the component has a public vulnerability; if there is a public vulnerability report, the component needs to be rectified, and the rectification methods include withdrawal, upgrade, and replacement; if there is no public vulnerability report, the component is preliminarily judged to be risk-free and requires further evaluation. Further evaluation includes determining the open source protocol to which the open source component belongs, confirming that the open source protocol of the component is safe and available, and entering the evaluation vulnerability database 2 after passing further evaluation.

[0043] Finally, establish an open source component view for the project code on a project basis.

[0044] Early warning process:

[0045] The component early warning module 6 provides different early warning strategies according to the evaluation results;

[0046] definition

[0047] A: Scan results of the code repository involved in the project;

[0048] B: A view of the open source components of the project;

[0049] C: Component exception reference list;

[0050] Warning strategy 1: The scan results are not completely consistent with the project open source component view:

[0051] Compare A and B on a project basis.

[0052] Warning content:

[0053] The component is in AB, that is, a new component is added, and notification is made to carry out component rectification;

[0054] The component is in BA, that is, exit the component, notify the maintenance view, and delete the component in the view.

[0055] Warning strategy 2: Introduction of notifications for exceptions to greylisted components in scan results;

[0056] Compare C with A∩B on a project basis.

[0057] Warning content:

[0058] The component is in C-(A∩B), that is, the expired greylist component, and the component is notified to be introduced and exited as an exception;

[0059] The component is in (A∩B)-C, that is, a new graylist component is added, and the component exception introduction approval is notified.

[0060] Warning strategy 3: The existing code repository is not associated with the project information, and the new code repository does not maintain the packaging configuration and is not associated with the project information;

[0061] Read code repository 3 and update the repository list.

[0062] Warning content: Notify the warehouse administrator to perform information maintenance. The notification email contains the URL of the maintenance information. The maintenance information includes packaging configuration information and related project information.

[0063] Warning strategy 4: Code repository 3 packaging failed and no scanning results were found;

[0064] Generally, packaging fails due to internal configuration problems in the code, or no scanning results are found.

[0065] Warning content: Notify the warehouse administrator of the reason why the warehouse open source component scan failed and ask the warehouse administrator to modify the configuration.

[0066] Warning strategy 5: Changes in component risk levels in the open source component view;

[0067] The head office-level assessment vulnerability library and the branch-level assessment vulnerability library are both dynamically changing. Components are regularly inspected and judged, and component security levels are modified. Components are regularly notified to make corresponding rectifications based on their security levels.

[0068] Warning content: Notify the project leader of the latest component risk level and require update and maintenance of the open source component view.

[0069] Warning strategy 6: Notification of mitigation of exception-introduced components

[0070] Based on the approval time for the introduction of exceptions for greylist components and the time when they are planned to be withdrawn from the exceptions, warnings are issued in stages for components that are about to expire, and notifications are escalated as time becomes more urgent.

[0071] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A security detection and early warning system in an open source component, characterized by: The system comprises a data processing center (1), an evaluation vulnerability database (2) connected to the data processing center (1), a code warehouse (3), a code batch processing module (4), a component early warning module (6), and a component scanning module (11), wherein the component scanning module (11) is connected to a component evaluation module (5); the evaluation vulnerability database (2) is used to store different vulnerability data for comparison by the component scanning module (11) during scanning; the code batch processing module (4) realizes automatic batch extraction and packaging of the main branch code in the code warehouse (3); the component early warning module (6) judges the scanning result of the component scanning module (11) and issues a corresponding early warning according to the judgment; the component scanning module (11) scans the code package, and newly added components that have not been evaluated need to be evaluated, and the scanning result is used to establish a component view; The component scanning module (11) searches the packaged code package in the evaluation vulnerability database (2) and gives a scanning result; the scanning result includes but is not limited to whether the component has been evaluated, the risk level, and usage suggestions; For components that have not been evaluated, the component evaluation module (5) performs nvd, cnvd, and cnnvd tests on the components to determine whether the components have public vulnerabilities; if there are public vulnerability reports, the components are rectified, including withdrawal, upgrading, and replacement; If there are no public vulnerability reports, the component is initially judged to be risk-free and requires further evaluation; The warning strategy of the component warning module (6) includes the following: the scanning result is not completely consistent with the project open source component view, the exception introduction notification of the grey list component in the scanning result, the existing code repository is not associated with the project information, the new code repository has not maintained the packaging configuration and is not associated with the project information, the code repository (3) packaging failed, the scanning result is not available, the component risk level in the open source component view is changed, and the exception introduction component mitigation notification; The inconsistencies are divided into newly added untested components and newly added gray-list components.

2. The security detection and early warning system in open source components according to claim 1, characterized in that: The code batch processing module (4) comprises a code pulling unit (8) and a code packaging unit (9), wherein the code pulling unit (8) and the code packaging unit (9) are respectively used to pull and package the main branch code in the code warehouse (3).

3. The security detection and early warning system in open source components according to claim 1, characterized in that: For the evaluated components, if the component scanning module (11) determines that the vulnerability risk level of the component is safe after scanning, the component can be used normally; if the component risk level is medium or above after scanning, it is recommended to stop using or upgrade the version or replace the safe level component; Special circumstances where risky components need to be used require approval for their introduction and the provision of risk mitigation measures.

4. The security detection and early warning system in an open source component according to claim 1, characterized in that: The further evaluation includes determining the open source protocol to which the open source component belongs, confirming that the open source protocol of the component is safe and usable, and entering the evaluation vulnerability database (2) after passing the further evaluation.

5. The open source component security detection and early warning system according to claim 1, characterized in that: The component scanning module (11) is provided with a project open source component view module (10), and the project open source component view module (10) is used to establish an open source component view for the project code in units of projects after the scanning is completed.

6. The open source component security detection and early warning system according to claim 1, characterized in that: The code warehouse (3) is provided with a code updating unit (7) for maintaining the code data in the code warehouse (3).

7. The open source component security detection and early warning system according to claim 1, characterized in that: The security detection process of the data processing center (1) comprises the following steps: S1. Establishing a vulnerability database for evaluation (2); S2, automatically batch pull and package the code from the code repository (3); S3, parsing the code package, searching the parsed component package information in the vulnerability assessment database (2), and providing the scanning result; S4. If the component has been evaluated and the component vulnerability risk level is safe, then by default the code can use the component normally; The early warning process of the data processing center (1) comprises the following steps: T1. If the component vulnerability risk level is medium or above, it will be a graylist component, and the notification will give suggestions for component rectification; T2. Evaluate the notifications of un-evaluated components; T3. If there is a public vulnerability report on the evaluation component, notify the component to be rectified; T4: There is no public vulnerability report on the evaluated component, and further evaluation of the component is notified; T5. Notify project codes on a project-by-project basis to establish an open source component view.

Images