Fine-grained vulnerability propagation detection method and system for Maven ecology

Abstract

The invention discloses a fine-grained vulnerability propagation detection method and system for Maven ecology. According to the method, a novel data structure name is a flattened function call graph to store the function call relation of each software package, a package dependency chain related to vulnerability propagation is recognized according to a dependency relation graph of the software package to be analyzed, and the flattened function call graphs are generated for each software package on the chain and then spliced. And then, on the basis of a special structure of the flattened function call graph, a quick vulnerability function call path search method is provided, quick function call path search is realized by firstly performing quick reachability judgment and then recovering a complete function call path in a single packet, so that vulnerability propagation is analyzed on function granularity. According to the method, rapid and large-scale vulnerability propagation analysis in Maven ecology is realized, the method can be used for user project vulnerability risk judgment and can also be used for large-scale analysis and research on the ecological level, and the practicability is high.

Description

Technical Field

[0001] The present invention relates to a vulnerability propagation analysis method in the field of software supply chain security, and in particular to a method and system for identifying and analyzing vulnerability propagation paths in software packages in a Maven ecosystem. Background Art

[0002] Software reuse greatly facilitates modern software development. Java developers can easily use the Maven package manager to obtain reusable libraries to quickly build their own projects. For example, developers can use the Tomcat library in the Maven ecosystem to build a network server. Numerous third-party libraries constitute a huge software ecosystem and also form complex dependencies. Although a package may have only a few direct dependencies, it is likely to have a large number of transitive dependencies. Complex dependencies not only increase the burden on developers to maintain projects, but also provide channels for the spread of vulnerabilities. Through the dependencies between packages, vulnerabilities in one package can be spread to another package. As a result, the dependencies between packages amplify the impact of vulnerabilities, making vulnerabilities in one package a threat to the entire ecosystem. For example, the vulnerability recently discovered in ApacheLog4j2 affects 8% of the entire Maven ecosystem. In order to mitigate the threat of vulnerabilities, academia and industry have proposed a variety of vulnerability propagation analysis tools to discover vulnerabilities in project dependencies and evaluate their threats to current projects, thereby helping people come up with effective countermeasures.

[0003] Traditional vulnerability propagation analysis is mainly based on package granularity, and all downstream packages affected by the vulnerable package are found through the dependency chain between packages. However, although some downstream packages depend on the vulnerable package, they do not necessarily call the vulnerable function and are not affected by the vulnerability, so this method has a large error. The latest individual studies have proposed to advance vulnerability propagation analysis to the function granularity. However, existing work is still based on traditional function call graph generation and path search methods, or requires the combination of dynamic analysis methods, which are inefficient and slow, and are not suitable for large-scale analysis. Therefore, large-scale analysis of vulnerability propagation at the function granularity is still an area to be studied.

[0004] There are at least the following problems in the prior art:

[0005] First, there is a lack of methods for quickly generating function call graphs in the prior art. The prior art relies on traditional static analysis solutions. When generating a function call graph, due to the large number of dependencies, it takes a lot of time to analyze the call relationship and consumes a lot of memory space. At the same time, after generating the function call graph, it is necessary to repeatedly traverse the path in the huge function call graph when searching for the function call path. The time complexity of this process is too high, and it is difficult to find all complete function call paths in a short time. Moreover, the number of function call paths found is too large and it is not easy to be fully analyzed.

[0006] Therefore, for the Maven ecosystem, a fine-grained vulnerability propagation detection method is needed to achieve rapid vulnerability risk assessment and repair method recommendations. Summary of the invention

[0007] In view of the deficiencies of the prior art, the purpose of the present invention is to provide a fine-grained vulnerability propagation detection method for the Maven ecosystem. The present invention proposes for the first time a novel data structure, called a flattened function call graph, which stores the function call relationship and class hierarchy information in the Java software package in the Maven ecosystem in a two-layer structure consisting of an entry function and a reachable function. Then, based on the dependency relationship of the software package to be analyzed in the ecosystem, the method screens out the dependencies related to vulnerability propagation and generates a flattened function call graph for each software package. Finally, the method combines the flattened function call graphs of multiple software packages, and proposes a method called fast vulnerability reachability judgment based on a flattened function call graph, which checks the reachability of each entry function of the software package to the vulnerability function, and then searches for the function call path from them to the vulnerability function. The final report obtains the vulnerability call path from the software package to be tested to the vulnerability function.

[0008] The technical solution of the present invention is as follows:

[0009] 1. A fine-grained vulnerability propagation detection method for Maven ecosystem

[0010] Get the dependency graph of the target package in the Maven ecosystem;

[0011] Generate a package dependency chain from the target software package to the vulnerable dependency based on the dependency graph;

[0012] For all software packages in the package dependency chain, build a flattened function call graph corresponding to each software package;

[0013] According to the flattened function call graph of each software package, the function call path within the package and across packages from the target software package to the software package where the vulnerability function is located is generated, and then the vulnerability propagation path of the target software package is obtained.

[0014] The flattened function call graph of each software package is constructed by:

[0015] Get all entry functions of the current software package;

[0016] For each entry function, obtain the intermediate representation of the current entry function, analyze the intermediate representation line by line, obtain all functions called in the current entry function except other entry functions, and form a reachable function list of the current entry function; traverse and process other entry functions to obtain the reachable function lists corresponding to other entry functions, and organize each entry function and its reachable function list into a key-value pair structure, thereby constituting the main body of the flattened function call graph of the current software package. The flattened function call graph also stores the class hierarchy information of the current software package and the cross-package function call types.

[0017] The method generates, according to the flattened function call graph of each software package, a function call path within and across packages from the target software package to the software package where the vulnerability function is located, and then obtains the vulnerability propagation path of the target software package, including:

[0018] Use class hierarchy information to determine the accessibility of vulnerable functions for each software package, obtain a list of all actually reachable functions of the current software package and a list of actual entry functions of the next software package, and obtain the cross-package function call path of the current software package; based on the package dependency chain, determine the accessibility of vulnerable functions for each software package in turn until the last software package is reached, and obtain all cross-package function call paths;

[0019] According to the actual entry function list and all actually reachable function lists of each software package, the in-package function call path of each software package is generated. Each software package is traversed and processed to obtain the in-package function call paths corresponding to different software packages, and then the vulnerability propagation path of the target software package is obtained.

[0020] After intersecting the actual entry function list and all actually reachable function lists of the last software package in the package dependency chain with the vulnerable functions in the Maven ecosystem, the vulnerable functions that may be called by the entry function in the target software package are obtained.

[0021] For the actual entry function list of each software package, obtain the reachable function list of each actual entry function and record it as a possible reachable function list, intersect the possible reachable function list with the entry function list of the next software package on the package dependency chain, and obtain the actual reachable function list of the current actual entry function and the actual entry function of the next software package; traverse and process other actual entry functions in the current software package to obtain all actual reachable function lists of the current software package and the actual entry function list of the next software package.

[0022] In the process of intersecting the possible reachable function list with the entry function list of the next software package on the package dependency chain, all implicit possible function calls of each reachable function in the possible reachable function list are found according to the class hierarchy information to obtain a reachable calling function list, and after intersecting the reachable calling function list with the entry function list of the next software package, an actual reachable function list of the current actual entry function and the actual entry function of the next software package are obtained.

[0023] The step of generating the function call path within each software package according to the actual entry function list and all actually reachable function lists of each software package includes:

[0024] The path between each actual entry function and the corresponding actual reachable function list is searched, and after traversing and processing all actual entry functions, all paths of the current software package are obtained, thereby obtaining a flattened function call path and recording it as the function call path within the package.

[0025] 2. A fine-grained vulnerability propagation detection system for the Maven ecosystem

[0026] A flattened function call graph construction module is used to construct a flattened function call graph corresponding to each software package according to the function call relationship and class hierarchy structure in each software package on the package dependency chain;

[0027] The vulnerability function call path search module is used to use the flattened function call graph of each software package to perform reachability judgment and generate the function call path from the target software package to the dependency with the vulnerability, so as to obtain the vulnerability propagation path of the target software package.

[0028] 3. A computer device

[0029] The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the steps of the fine-grained vulnerability propagation detection method for the Maven ecosystem when executing the computer program.

[0030] 4. A computer-readable storage medium

[0031] The medium stores a computer program, which, when executed by a processor, implements the steps of the fine-grained vulnerability propagation detection method for the Maven ecosystem.

[0032] In general, the beneficial effects of the present invention are:

[0033] 1) Fast function call graph construction: This invention proposes the concept of flattened function call graph for the first time, splits the functions in the software package into entry functions and reachable functions, and stores the reachable function list corresponding to the entry function in the form of key-value pairs. It can generate a function call graph for each software package separately, replacing the traditional function call relationship stored in the form of a graph. At the same time, it retains the class hierarchy information, and can realize the splicing of multiple flattened function call graphs, instead of generating a function call graph containing all dependencies like the traditional method, realizing the parallel generation and reuse of function call graphs.

[0034] 2) Low-cost cross-package function call path search: The flattened function call graph proposed in the present invention divides the functions in the software package into two categories: entry functions and reachable functions. Based on this structure, it is possible to avoid path traversal within the software package and directly obtain reachable functions across packages. According to the class hierarchy and call type of each package, the function call graphs of different software packages are automatically spliced ​​to achieve flexible cross-package function call path search.

[0035] 3) Fast vulnerability reachability judgment: This invention proposes for the first time a fast vulnerability function reachability judgment method based on a flattened function call graph, which aggregates multiple functions in each software package into one unit. It quickly gives the reachability of the vulnerable function to the specified entry function by avoiding the backtracking and recursive operations required for path traversal without outputting the specific function call path.

[0036] 4) Search for complete function call paths by package: Search for the entry and exit of each package based on the flattened function call graph, and search for the complete path in each package's respective function call graph instead of searching for the path in the traditional function call graph that includes all dependencies. This splits the original task of searching from the starting point function to the vulnerable function in a huge function call graph into searching for the starting point and end point in multiple subgraphs and then splicing them together, effectively reducing complexity.

[0037] 5) Comprehensive and accurate vulnerability propagation analysis: The method proposed in the present invention can quickly find all function call paths from the specified entry function to the vulnerable function, rather than just being limited to partial paths or the shortest paths. Therefore, it can help software developers or researchers grasp the complete rules of vulnerability propagation and conduct comprehensive vulnerability propagation analysis.

[0038] 6) Good compatibility and versatility: It can process both Java source code and compiled Java bytecode files. The intermediate results in the process are stored in the hard disk in Json format and can be shared and reused.

[0039] In summary, the present invention has a good prospect for promotion and application. It should be understood that the above general description and the following detailed description are only exemplary and explanatory and cannot limit the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0041] Figure 1 It is a hierarchical structure diagram showing the vulnerability propagation analysis method proposed in the present invention, which includes two parts: flattened function call graph generation and function call path search.

[0042] Figure 2 The diagram is a schematic diagram showing construction of a flattened function call graph for a single package according to an exemplary embodiment.

[0043] Figure 3 The diagram is a schematic diagram showing construction of a flattened function call graph for multiple packages according to an exemplary embodiment.

[0044] Figure 4 The diagram is a schematic diagram showing a vulnerability reachability analysis of a package according to an exemplary embodiment. DETAILED DESCRIPTION

[0045] Here, exemplary embodiments will be described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention.

[0046] The terms used in the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The singular forms "a", "the" and "the" used in the present invention and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0047] It should be understood that although the terms first, second, third, etc. may be used in the present invention to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present invention, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0048] On the one hand, the present invention proposes a fine-grained vulnerability propagation detection method for Maven ecology, such as Figure 1 As shown, the method includes:

[0049] Get the dependency graph of the target package in the Maven ecosystem, such as Figure 3 As shown;

[0050] Based on the dependency graph, generate a package dependency chain from the target software package to the vulnerable dependency (i.e., the software package where the vulnerable function may be located);

[0051] For all software packages in the package dependency chain, build a flattened function call graph corresponding to each software package;

[0052] Figure 2 (a) is the traditional function call graph. Figure 2 As shown in (b), the flattened function call graph of each software package is constructed by:

[0053] Get all entry functions of the current software package;

[0054] For each entry function, the intermediate representation (IR) of the current entry function is obtained, and after analyzing the intermediate representation line by line, all functions called in the current entry function except other entry functions are obtained to form a reachable function list of the current entry function; other entry functions are traversed and processed to obtain the reachable function lists corresponding to other entry functions. Each entry function and its reachable function list are organized into a key-value pair structure, thereby forming the main body of the flattened function call graph of the current software package. The flattened function call graph also stores the class hierarchy information of the current software package and the cross-package function call types.

[0055] In the specific implementation, for each entry function, a new queue is created and all entry functions are added to the queue; each time an entry function is taken out of the queue, the intermediate representation (IR) of the entry function is obtained, and it is analyzed line by line to find all other functions called in the function body and add them to the reachable function list corresponding to the entry function, and the entry function and its reachable function list are organized in key-value form; the operation is repeated until the queue is empty, and the key-value pair structure of all entry functions is obtained, thereby obtaining the main body of the flattened function call graph for the next step of path search.

[0056] According to the flattened function call graph of each software package, the function call path from the target software package to the software package where the vulnerable function is located and across packages is generated, and then the vulnerability propagation path of the target software package is obtained, which includes:

[0057] Use the class hierarchy information to determine the accessibility of the vulnerable function for each software package, obtain the list of all actually reachable functions of the current software package and the list of actual entry functions of the next software package, and obtain the cross-package function call path of the current software package; based on the package dependency chain, determine the accessibility of the vulnerable function for each software package in turn until the last software package is reached, and obtain all cross-package function call paths, such as Figure 4 As shown;

[0058] According to the actual entry function list and all actually reachable function lists of each software package, the in-package function call path of each software package is generated. Each software package is traversed and processed to obtain the in-package function call paths corresponding to different software packages, and then the vulnerability propagation path of the target software package is obtained.

[0059] After intersecting the actual entry function list and all actually reachable function lists of the last software package in the package dependency chain with the vulnerable functions in the Maven ecosystem, the vulnerable functions that may be called by the entry function in the target software package are obtained.

[0060] For the actual entry function list of each software package, the actual entry function list of the target software package is all entry functions, and the actual entry function list of other software packages is a list of entry functions after intersection processing with the possible reachable function list of the previous software package; obtain the reachable function list of each actual entry function and record it as the possible reachable function list, and after intersecting the possible reachable function list with the entry function list of the next software package on the package dependency chain, obtain the actual reachable function list of the current actual entry function and the actual entry function of the next software package; traverse and process other actual entry functions in the current software package to obtain all actual reachable function lists of the current software package and the actual entry function list of the next software package.

[0061] Among them, in the process of intersecting the possible reachable function list with the entry function list of the next software package on the package dependency chain, that is, when processing cross-package function calls, all implicit possible function calls of each reachable function in the possible reachable function list are found according to the class hierarchy information. For example, when static calls (static invoke), the functions in the parent class are automatically searched, and when virtual calls (virtual invoke) and interface calls (interface voke), possible subclass functions are automatically searched, so as to obtain a reachable calling function list. After intersecting the reachable calling function list with the entry function list of the next software package, the actual reachable function list of the current actual entry function and the actual entry function of the next software package are obtained.

[0062] Based on the actual entry function list and all actually reachable function lists of each software package, generate the function call path within each software package, including:

[0063] Search the path between each actual entry function (i.e., the starting point) and the corresponding actual reachable function list (i.e., the end point). After traversing and processing all actual entry functions, all paths of the current software package are obtained, thereby obtaining a flattened function call path and recording it as the function call path within the package.

[0064] On the other hand, the present invention also proposes a fine-grained vulnerability propagation detection system for Maven ecology, including:

[0065] A flattened function call graph construction module is used to construct a flattened function call graph corresponding to each software package according to the function call relationship and class hierarchy structure in each software package on the package dependency chain;

[0066] The flattened function call graph construction module proposed in the present invention simplifies the storage of function call graphs from two levels: cross-package and intra-package. First, the present invention can only focus on dependencies related to vulnerability propagation and ignore other irrelevant dependencies. Second, a function call graph can be generated for each dependency separately. When searching for function call paths across packages, the function call graphs of the used dependencies are spliced ​​to perform cross-package vulnerability function call path search.

[0067] This module first defines the functions in a software package into two categories: entry functions and reachable functions. An entry function refers to an API that a package exposes to the outside world, representing the entry point of a package to the outside world. In Java, entry functions are defined based on function modifiers. If a function and its class are not private, it is marked as an entry function. All functions that can be called directly and indirectly from a certain entry function are called reachable functions of the entry function.

[0068] To construct a flattened function call graph for a single package, first traverse all classes and functions, then check the modifiers of all classes and functions, and find all entry functions (functions whose attributes are not private). Then, for each entry function, use the breadth-first method to find all their reachable functions, including directly reachable functions and indirectly reachable functions. After completing the reachable function search for all entry functions, all entry functions and the reachable functions of each entry function found are organized into a key-value pair structure to form the body of the flattened function call graph for a single package. At the same time, the class hierarchy information in this software package is also recorded. Then for multiple packages, first determine the package dependency chain from the target package to the vulnerable function, and then build a flattened function call graph for all packages on the package dependency chain. These flattened function call graphs contain the class hierarchy information in each package and the function call types across packages, and can be spliced ​​together to restore the global class hierarchy information.

[0069] The vulnerability function call path search module is used to use the flattened function call graph of each software package to perform reachability judgment and generate the function call path from the target software package to the dependency with the vulnerability, so as to obtain the vulnerability propagation path of the target software package.

[0070] The vulnerability function call path search module proposed in the present invention utilizes the flattened function call graph generated by the flattened function call graph construction module to search for all function call paths from the specified entry to the vulnerability function. The design compresses the complex function call relationship within a package into two layers: the entry function and the reachable function. Therefore, for a package dependency chain of length n, the deepest recursive stack depth when searching for the path is only 2n. The significantly reduced depth of the call stack during path search can greatly accelerate the process of path search. However, on the whole, path search is still a complicated task because it requires traversing a large number of paths. In particular, although the flattened function call graph is shallow in depth, there are usually many reachable functions for each entry function, that is, the depth is shallow but the width is wide, so there are still many combinations that need to be traversed, which means that its time overhead still has room for further compression.

[0071] In order to solve this problem, the basic design idea of ​​the module is to determine whether an entry function is likely to trigger a vulnerability function through a fast reachability analysis, and then search for a specific function call path, and reduce the complexity of the overall task by splitting the overall task into path searches in each package during the search. In order to achieve this goal, the present invention first introduces a new method called fast vulnerability reachability judgment based on a flattened function call graph to quickly determine whether a given one or more entries are likely to call a vulnerability function without traversing a large number of paths. Through this method, a low-cost vulnerability function reachability judgment is made for each given entry function, and then there is no need to initiate a complex path search for each entry function, but those entries that cannot reach the vulnerability function can be ignored, and only those entries that are judged to be likely to reach the vulnerability function in the fast vulnerability reachability judgment based on the flattened function call graph need to initiate a path search, thereby narrowing the search range and achieving acceleration. In the actual operation process, it can be observed that 97% of the entry functions are impossible to reach the vulnerability function, so this method can achieve pruning to a large extent. For each entry function that may reach the vulnerable function, the traditional depth-first search algorithm (DFS) is used to find all flattened function call paths from the entry function of the target package to the vulnerable function in the vulnerable dependency. Then, for each flattened function call path, the path between the starting point and the end point in each software package is searched in the traditional function call graph that only contains the function call content of each dependency. The specific path results in each software package are spliced ​​together to form a complete function call path. After processing all flattened function call paths obtained from all entry functions, the final output is obtained.

[0072] Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and practicing the contents disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention.

[0073] It will be appreciated that the present invention is not limited to the exact construction that has been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof.

Claims

1. A fine-grained vulnerability propagation detection method for Maven ecology, characterized in that: include: Get the dependency graph of the target package in the Maven ecosystem; Generate a package dependency chain from the target software package to the vulnerable dependency based on the dependency graph; For all software packages in the package dependency chain, build a flattened function call graph corresponding to each software package; According to the flattened function call graph of each software package, the function call path within the package and across packages from the target software package to the software package where the vulnerability function is located is generated, and then the vulnerability propagation path of the target software package is obtained.

2. According to claim 1, a fine-grained vulnerability propagation detection method for Maven ecology is characterized in that: The flattened function call graph of each software package is constructed by: Get all entry functions of the current software package; For each entry function, obtain the intermediate representation of the current entry function, analyze the intermediate representation line by line, obtain all functions called in the current entry function except other entry functions, and form a reachable function list of the current entry function; traverse and process other entry functions to obtain the reachable function lists corresponding to other entry functions, and organize each entry function and its reachable function list into a key-value pair structure, thereby constituting the main body of the flattened function call graph of the current software package. The flattened function call graph also stores the class hierarchy information of the current software package and the cross-package function call types.

3. According to claim 1, a fine-grained vulnerability propagation detection method for Maven ecology is characterized in that: The method generates, according to the flattened function call graph of each software package, a function call path within and across packages from the target software package to the software package where the vulnerability function is located, and then obtains the vulnerability propagation path of the target software package, including: Use class hierarchy information to determine the accessibility of vulnerable functions for each software package, obtain a list of all actually reachable functions of the current software package and a list of actual entry functions of the next software package, and obtain the cross-package function call path of the current software package; based on the package dependency chain, determine the accessibility of vulnerable functions for each software package in turn until the last software package is reached, and obtain all cross-package function call paths; According to the actual entry function list and all actually reachable function lists of each software package, the in-package function call path of each software package is generated. Each software package is traversed and processed to obtain the in-package function call paths corresponding to different software packages, and then the vulnerability propagation path of the target software package is obtained.

4. A fine-grained vulnerability propagation detection method for Maven ecology according to claim 1 or 3, characterized in that: After intersecting the actual entry function list and all actually reachable function lists of the last software package in the package dependency chain with the vulnerable functions in the Maven ecosystem, the vulnerable functions that may be called by the entry function in the target software package are obtained.

5. According to claim 3, a fine-grained vulnerability propagation detection method for Maven ecology is characterized in that: For the actual entry function list of each software package, obtain the reachable function list of each actual entry function and record it as a possible reachable function list, intersect the possible reachable function list with the entry function list of the next software package on the package dependency chain, and obtain the actual reachable function list of the current actual entry function and the actual entry function of the next software package; Traverse and process other actual entry functions in the current software package to obtain a list of all actually reachable functions of the current software package and a list of actual entry functions of the next software package.

6. According to claim 5, a fine-grained vulnerability propagation detection method for Maven ecology is characterized in that: In the process of intersecting the possible reachable function list with the entry function list of the next software package on the package dependency chain, all implicit possible function calls of each reachable function in the possible reachable function list are found according to the class hierarchy information to obtain a reachable calling function list, and after intersecting the reachable calling function list with the entry function list of the next software package, an actual reachable function list of the current actual entry function and the actual entry function of the next software package are obtained.

7. According to claim 3, a fine-grained vulnerability propagation detection method for Maven ecology is characterized in that: The step of generating the function call path within each software package according to the actual entry function list and all actually reachable function lists of each software package includes: The path between each actual entry function and the corresponding actual reachable function list is searched, and after traversing and processing all actual entry functions, all paths of the current software package are obtained, thereby obtaining a flattened function call path and recording it as the function call path within the package.

8. A fine-grained vulnerability propagation detection system for Maven ecosystem, characterized in that: include: A flattened function call graph construction module is used to construct a flattened function call graph corresponding to each software package according to the function call relationship and class hierarchy structure in each software package on the package dependency chain; The vulnerability function call path search module is used to use the flattened function call graph of each software package to perform reachability judgment and generate the function call path from the target software package to the dependency with the vulnerability, so as to obtain the vulnerability propagation path of the target software package.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the fine-grained vulnerability propagation detection method for the Maven ecosystem as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the fine-grained vulnerability propagation detection method for the Maven ecosystem as described in any one of claims 1 to 7 are implemented.

Images