Method and device for identifying safety of open source component and electronic equipment

Abstract

The invention discloses an open source component security identification method and device and electronic device.The method comprises the steps that when a target open source component with vulnerabilities is detected, a pre-constructed dependent component knowledge base is obtained, the dependency component knowledge base comprises association relationships between dependency components and program codes, application programs and deployment objects; searching a target dependent component matched with the target open source component from a dependent component knowledge base, and determining a target program code, a target application program and a target deployment object corresponding to the target dependent component; based on the target program code, the target application program and the target deployment object, code position information and production service information of the reference target dependency component are determined; and generating a security identification result based on the code position information and the production service information. Through the method, the accuracy and efficiency of open source security vulnerability identification and repair can be improved.

Description

Technical Field

[0001] The present application relates to the field of financial technology, and in particular to a method, device and electronic device for identifying the security of open source components. Background Art

[0002] Most applications built and used by enterprises include open source components in their code. When developers introduce open source dependencies into the source code of an application, they are often unaware of the included sub-dependencies, which results in the application including out-of-date versions of open source components, i.e., updates or patches are available but have not yet been applied. Accurate updates of open source components are critical to the security of applications, and if unupdated components are forgotten, they have the potential to become high-risk exploits. As applications migrate to the cloud and the complexity of programs increases, the software risks generated by open source components also increase.

[0003] At present, the scanning of open source security mainly includes the following two methods: (1) Performing open source security scanning on all artifacts in the artifact library (i.e., the installation package of the application) to identify all open source dependent components that each artifact depends on. When an open source component with a vulnerability is detected, the artifact with the open source vulnerability is quickly identified; however, this method requires all artifacts to be included in the artifact library for unified management, and the scanning efficiency is low; (2) Scanning the dependent component files of the code project by scanning the source code to identify the dependent components of the code project; since the correlation between the artifact and the source code cannot be associated, even if the artifact with risk is found, the corresponding source code cannot be quickly found, and scanning the dependent components by scanning the source code can only identify the one-time dependent components in the code, and cannot identify the sub-dependent components, resulting in the problem of missing open source components, and the identification efficiency and accuracy are low; in addition, the scanning based on the source code cannot determine the artifact with security risks. It can be seen that the existing technology can only realize the identification of single-node open source components, and the identification accuracy and efficiency are low.

[0004] Currently, no effective solution has been proposed to the above-mentioned problem of being unable to accurately and quickly identify the security of open source components of applications. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a method, device and electronic device for identifying the security of open source components, so as to solve the problem that the security of open source components of an application cannot be accurately and quickly identified.

[0006] In order to solve the above technical problems, the first aspect of this specification provides a method for identifying the security of open source components, including:

[0007] When a target open source component with a vulnerability is detected, a pre-built dependency component knowledge base is obtained, wherein the dependency component knowledge base includes association relationships between the dependency component and the program code, the application, and the deployment object;

[0008] Searching the target dependent component matching the target open source component from the dependent component knowledge base, and determining the target program code, target application program, and target deployment object corresponding to the target dependent component;

[0009] Determining, based on the target program code, the target application, and the target deployment object, code location information and production service information that reference the target dependent component;

[0010] A security identification result is generated based on the code location information and the production service information.

[0011] In some embodiments of the present specification, the dependent component knowledge base is constructed in the following manner:

[0012] During the execution of each node in the pipeline of the application, the execution parameters and execution results of each node are obtained;

[0013] Determine program code information and deployment object information corresponding to the application based on execution parameters and execution results of each node;

[0014] In the compilation and construction phase of the pipeline, obtaining dependent component information of the application;

[0015] The dependent component knowledge base is constructed based on the dependent component information, the program code information, the application information and the deployment object information.

[0016] In some embodiments of the present specification, the acquisition of the execution parameters, the execution results, and the dependent component information is implemented in an asynchronous manner.

[0017] In some embodiments of the present specification, during the execution of each node in the pipeline of the application, the execution parameters and execution results of each node are obtained, including:

[0018] At the code acquisition node of the pipeline, code repository information, repository branch information, and code version information of the application are acquired;

[0019] At the deployment node of the pipeline, a deployment record of the application is obtained.

[0020] In some embodiments of the present specification, determining the program code information and deployment object information corresponding to the application based on the execution parameters and execution results of each node includes:

[0021] Associating the code warehouse information, the warehouse branch information, and the code version information to generate the program code information;

[0022] The deployment object and application information are extracted from the deployment record, and the extracted application information is associated with the deployment object to generate the deployment object information.

[0023] In some embodiments of the present specification, in the compilation and construction phase of the pipeline, obtaining the dependent component information of the application includes:

[0024] In the compilation and construction phase, the dependency information of the application is obtained and output as a dependency log file;

[0025] The dependency log file is parsed to extract dependent components and information corresponding to the dependent components, so as to perform a structured conversion on the dependency log file to obtain the dependent component information, wherein the dependent component information includes the dependent components and the quantity and version information corresponding to the dependent components.

[0026] In some embodiments of the present specification, building the dependent component knowledge base based on the dependent component information, the program code information, the application information, and the deployment object information includes:

[0027] Based on the dependent component information and the program code information, construct a first association relationship between the dependent component and the program code;

[0028] Building a second association relationship between the dependent component and the deployment object based on the dependent component information and the deployment object information;

[0029] Based on the information of the application and the information of the deployment object, construct a third association relationship between the dependent component and the application and a fourth association relationship between the application and the deployment object;

[0030] The dependent component knowledge base is constructed based on the first association relationship, the second association relationship, the third association relationship and the fourth association relationship.

[0031] In some embodiments of the present specification, based on the target program code, the target application and the target deployment object, determining the code location information and the production service information of the target dependent component includes:

[0032] Determine a target code library corresponding to the target program code that references the target dependent component and a location of the target program code in the target code library;

[0033] Generate the code location information based on a code library corresponding to the target program code and a location in the code library;

[0034] Obtaining deployment object information of a target deployment object that references the target dependent component;

[0035] Determining path information of the target application in the target deployment object;

[0036] Based on the path information and the deployment object information of the target deployment object, production service information referencing the target dependent component is determined.

[0037] In some embodiments of the present specification, after determining the code location information and production service information of the target dependent component based on the target program code, the target application and the target deployment object, the method further includes:

[0038] Replacing a target dependent component in the source code of the application with a dependent component to be updated based on the code location information;

[0039] Based on the production service information, a target dependent component deployed in a target application of a target deployment object is replaced with a dependent component to be updated.

[0040] A second aspect of the present specification provides a device for identifying the security of an open source component, including:

[0041] A data acquisition module, used to acquire a pre-built dependency component knowledge base when a target open source component with a vulnerability is detected, wherein the dependency component knowledge base includes associations between dependency components and program codes, applications, and deployment objects;

[0042] A dependency determination module, used to search the dependency component knowledge base for a target dependency component that matches the target open source component, and determine a target program code, a target application program, and a target deployment object corresponding to the target dependency component;

[0043] A location determination module, configured to determine code location information and production service information that reference the target dependent component based on the target program code, the target application, and the target deployment object;

[0044] A result generation module is used to generate a security identification result based on the code location information and the production service information.

[0045] A third aspect of the present specification provides an electronic device, including:

[0046] A memory and a processor, wherein the processor and the memory are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the steps of the method described in the first aspect.

[0047] A fourth aspect of the present specification provides a computer storage medium, wherein the computer storage medium stores computer program instructions, and when the computer program instructions are executed, the steps of the method described in the first aspect are implemented.

[0048] A fifth aspect of the present specification provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method described in the first aspect.

[0049] The open source component security identification method in the embodiments of the present specification obtains a pre-built dependency component knowledge base when a target open source component with a vulnerability is detected, wherein the dependency component knowledge base contains associations between dependency components and program codes, applications, and deployment objects; searches for a target dependency component that matches the target open source component from the dependency component knowledge base, and determines the target program code, target application, and target deployment object corresponding to the target dependency component; determines the code location information and production service information that references the target dependency component based on the target program code, target application, and target deployment object; and generates a security identification result based on the code location information and production service information. In the embodiments of this specification, the pre-built dependency component knowledge base not only includes the association relationship between the dependency component and the program code, but also includes the association relationship between the dependency component and the application and the deployment object. When a target open source component with a vulnerability is detected, the target dependency component that matches the target open source component can be found in the dependency component knowledge base. Based on the association relationship stored in the dependency component knowledge base, the target program code, target application and target deployment object associated with the target dependency component can be determined. That is, through the dependency component knowledge base in the embodiments of this specification, not only the identification of the open source component at the source code end can be realized, but also the identification of the open source component at the application and deployment object end can be realized, and the open source component security identification of the entire cycle of the application can be realized, and the accuracy and efficiency are higher. Further, based on the target program code, target application and target deployment object, the code location information and production service information of the referenced target dependency component can be quickly and accurately determined, thereby improving the accuracy and efficiency of open source security vulnerability repair. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the implementation methods of the present application or the technical solutions in the prior art, the drawings required for use in the implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some implementation methods recorded in this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0051] Figure 1 Shown is a schematic diagram of a method for identifying the security of an open source component provided by an embodiment of this specification;

[0052] Figure 2 The figure is a schematic diagram of a process of building a dependent component knowledge base provided by an embodiment of the present specification;

[0053] Figure 3 Shown is a schematic diagram of a method for identifying the security of an open source component provided by an embodiment of this specification;

[0054] Figure 4 The figure shows a schematic diagram of a device for identifying the security of an open source component provided by an embodiment of the present specification;

[0055] Figure 5 Shown is a schematic diagram of an electronic device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0056] In order to enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0057] It should be noted that the user-related information and data involved in the embodiments of this specification are all information and data authorized by the user or fully authorized by relevant parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users or relevant parties to choose to authorize or refuse.

[0058] It should also be noted that in the embodiments of this specification, certain software, components, models and other existing solutions in the industry may be mentioned. They should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of this application, but it does not mean that the applicant has or will necessarily use the solution.

[0059] Open source components are included in software in all walks of life. An open source security risk analysis report by an industry organization surveyed 17 industries, of which 4 industry sectors, computer hardware and semiconductors, cybersecurity, energy and clean technology, and the Internet of Things, contained 100% open source code in their audited code bases. The remaining vertical companies have 93% to 99% of their code bases containing open source elements. However, when open source components have vulnerabilities, they will have a significant impact on the application of applications. Taking the Log4Shell vulnerability of Log4j at the end of 2021 as an example, according to statistics, more than 35,863 open source software Java components depend on Log4j, which means that more than 8% of the software packages have at least one version that is affected by this vulnerability. In this scenario, companies spend a lot of time and energy to investigate and patch product vulnerabilities. At present, the industry has not yet proposed a solution that can accurately and quickly identify the security of open source components throughout the entire application cycle.

[0060] Considering that currently most software is developed automatically using automated pipelines, and the pipelines include various nodes in the entire life cycle of the application, the embodiments of this specification propose a method for identifying the security of open source components by seamlessly building a dependency component knowledge base based on the pipeline, and realizing seamless troubleshooting of open source component security vulnerability risks. Specifically, the method includes obtaining a pre-built dependency component knowledge base when a target open source component with a vulnerability is detected, wherein the dependency component knowledge base contains the association relationship between the dependency component and the program code, application, and deployment object; searching the dependency component knowledge base for a target that matches the target open source component, and determining the target program code, target application, and target deployment object corresponding to the target dependency component; determining the code location information and production service information of the referenced target dependency component based on the target program code, target application, and target deployment object; and generating a security identification result based on the code location information and production service information.

[0061] In the method for identifying the security of open source components provided in the embodiments of this specification, the pre-built dependent component knowledge base not only includes the association relationship between the dependent component and the program code, but also includes the association relationship between the dependent component and the application and the deployment object. When a target open source component with a vulnerability is detected, the target dependent component matching the target open source component can be found in the dependent component knowledge base, and then based on the association relationship stored in the dependent component knowledge base, the target program code, target application and target deployment object associated with the target dependent component can be determined. That is, through the dependent component knowledge base in the embodiments of this specification, not only the identification of open source components at the source code end can be realized, but also the identification of open source components at the application and deployment object ends can be realized, and the security identification of open source components throughout the application cycle can be realized with higher accuracy and efficiency. Further, based on the target program code, target application and target deployment object, the code location information and production service information of the referenced target dependent component can be quickly and accurately determined, thereby improving the accuracy and efficiency of open source security vulnerability repair.

[0062] It can be understood that the above method provided in the present application can be applied to electronic devices, and electronic devices can refer to electronic devices with data calculation, processing and storage capabilities. The electronic device can be a terminal such as a PC (Personal Computer), a tablet computer, a smart phone, a wearable device, an intelligent robot, etc.; it can also be a server. Among them, the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0063] The following is an introduction to the open source component security identification method provided by the embodiment of the present application in conjunction with the accompanying drawings.

[0064] Figure 1 Shown is a schematic diagram of a method for identifying the security of open source components provided in an embodiment of this specification. Although this specification provides method operation steps or device structures as shown in the following embodiments or drawings, the method or device may include more or fewer operation steps or module units after partial merger based on routine or no creative labor. In steps or structures where there is no necessary causal relationship logically, the execution order of these steps or the module structure of the device is not limited to the execution order or module structure shown in the embodiments or drawings of this specification. When the method or module structure described is applied in actual devices, servers or terminal products, it can be executed sequentially or in parallel according to the method or module structure shown in the embodiments or drawings (for example, in an environment of parallel processors or multi-threaded processing, or even in an implementation environment of distributed processing and server clusters). As Figure 1 As shown, the method may include:

[0065] S101: When a target open source component with a vulnerability is detected, a pre-built dependency component knowledge base is obtained, wherein the dependency component knowledge base includes association relationships between dependency components and program codes, applications, and deployment objects.

[0066] Among them, the program code may include code repositories, repository branches, etc. that reference dependent components, the application may include code submission versions (commit ids), products, etc. that reference dependent components, the deployment objects may include objects where products are deployed, such as servers, clouds, containers, etc., and the dependent components may include open source components and / or non-open source components.

[0067] It can be understood that the dependent component knowledge base can obtain corresponding information at various stages of the life cycle of the application, and be constructed based on the obtained information. Among them, the life cycle of the application can, for example, include the source code writing stage, the compilation stage, the testing stage, the deployment stage, and the monitoring stage after being put into the production environment. For example, in the compilation stage, the deployment stage, and the monitoring stage, information related to the dependent components, program codes, applications, and deployment objects can be obtained, and they can be associated to obtain the dependent component knowledge base. The specific construction process of the above-mentioned dependent component knowledge base will be specifically introduced below and will not be repeated here.

[0068] In some embodiments of the present specification, in order to achieve seamless construction of a dependency component knowledge base, a dependency information acquisition service can be constructed. The service can obtain relevant execution information of each stage in a synchronous or asynchronous manner during the execution of each stage, such as execution parameters, execution results, etc., and then a dependency component knowledge base can be constructed based on the acquired information.

[0069] In some embodiments of the present specification, the dependency component knowledge base may include a knowledge base related to the dependency component corresponding to an application. Since any application may correspond to at least one version, the association relationship between the dependency component and the application contained in the dependency component knowledge base may be an association relationship between the dependency component and the application version.

[0070] In some embodiments of the present specification, the dependency component knowledge base may include a knowledge base related to the dependency components corresponding to multiple applications, that is, the dependency component knowledge base includes multiple applications, and for any application, it may correspond to at least one version, so the association relationship between the dependency component and the application contained in the dependency component knowledge base may be an association relationship between the dependency component and the application and the version of the application.

[0071] In some embodiments of the present specification, the dependent component knowledge base can be stored in the form of a database table, and the association relationship between the dependent component and the program code, application program, and deployment object can be realized through the hierarchical relationship in the database table. In other embodiments of the present specification, the dependent component knowledge base can also be stored in the form of a network model. Furthermore, the dependent components, program code, application program, and deployment object can be used as nodes in the network model. Different types of nodes can be distinguished by different colors or different graphics. The association relationship between the dependent component and the program code, application program, and deployment object can be represented by the edges connecting the nodes. Of course, in other embodiments, the dependent component knowledge base can also be stored or visualized in other forms, and this specification does not limit this.

[0072] In some embodiments of the present specification, the target open source component may be an open source component with an open source security vulnerability. For example, it may be an open source component with a zero-day (0day) vulnerability, where a 0day vulnerability is a security vulnerability that is immediately exploited by malicious people after being discovered. The related malicious program will appear on the same day that the security patch and the flaw are exposed, and its attack is often very sudden and destructive.

[0073] S102: searching the dependent component knowledge base for a target dependent component that matches the target open source component, and determining a target program code, a target application program, and a target deployment object corresponding to the target dependent component.

[0074] It can be understood that the dependency component knowledge base may include all dependency components corresponding to at least one application. After detecting a target open source component with a vulnerability, it is possible to search in the dependency component knowledge base whether the target open source component exists.

[0075] In some embodiments of the present specification, the process of searching for matching dependent components can be implemented by matching the component information of the target open source component with the dependent component information in the dependent component knowledge base. Specifically, the degree of matching between the component information of the open source component and the dependent component information can be calculated, and based on whether the degree of matching between the component information of the open source component and the dependent component information reaches a preset matching threshold, it is determined whether the target open source component exists in the dependent component knowledge base. The matching can be text matching, character matching, semantic matching, etc.

[0076] In some embodiments of the present specification, the process of searching for a matching dependent component may be performed by searching in a knowledge base for a name or name identifier corresponding to a target open source component, and a dependent component having the same version as the target open source component as the target dependent component.

[0077] Furthermore, after determining the target dependent component, the program code, application and deployment object associated with the target dependent component can be searched in the knowledge base, and the program code, application and deployment object associated with the target dependent component can be used as the target program code, target application and target deployment object respectively.

[0078] S103: Based on the target program code, the target application program and the target deployment object, determine the code location information and production service information that reference the target dependent component.

[0079] It can be understood that the code location information can be the specific location of the source code that references the target dependent component, and can include one or more of the code repository where the source code is located, the repository branch to which it belongs, the code file where it is located, the specific location in the code file, etc. The production service information can be the service that references the target dependent component in the production environment and the information corresponding to the service, wherein the information corresponding to the service may include the object that deploys the service, the location of the object, etc. Based on the code location information and the production service information, the target dependent component can be identified, scanned, and repaired from the source code side and the application side of the program respectively; and when performing security scanning and identification, no additional operations or adjustments are required, only a search in the dependent component knowledge base is required, and the source code, artifacts, and deployment objects involved in the target dependent component can be quickly and accurately located, providing a basis for subsequent vulnerability repairs.

[0080] In some embodiments of the present specification, determining the code location information and production service information that reference the target dependent component based on the target program code, the target application, and the target deployment object may include: determining a target code library corresponding to the target program code that references the target dependent component and the location of the target program code in the target code library; generating the code location information based on the code library corresponding to the target program code and the location in the code library; obtaining deployment object information of the target deployment object that references the target dependent component; determining path information of the target application in the target deployment object; and determining production service information that references the target dependent component based on the path information and the deployment object information of the target deployment object.

[0081] It can be understood that the path information may be the path of the artifact corresponding to the target application in the target deployment object, and the artifact corresponding to the target application may be quickly located in the target deployment object based on the path information.

[0082] S104: Generate a security identification result based on the code location information and the production service information.

[0083] In some embodiments of the present specification, the security identification result can be output to the user, and the user can then replace the target dependent component based on the security identification result, or review and confirm the security identification result to determine the accuracy of the identification result. After the user reviews and confirms the security identification result, if the identification result is determined to be correct, an input or a trigger review pass information can be generated, and then the target dependent component can be repaired and replaced based on the security identification result; if it is determined that there is a problem with the identification result, a new open source component security identification can be triggered, and then the above steps S101 to S104 can be executed again, and the security identification result can be generated again for review and confirmation. The user can also directly adjust the security identification result and upload the adjusted security identification result, and then the target dependent component can be repaired and replaced based on the security identification result.

[0084] In some embodiments of the present specification, after determining the code location information and production service information that reference the target dependent component based on the target program code, the target application, and the target deployment object, it may also include: replacing the target dependent component in the source code of the application with the dependent component to be updated based on the code location information; and replacing the target dependent component in the target application deployed in the target deployment object with the dependent component to be updated based on the production service information.

[0085] The dependent component to be updated may be a dependent component of the latest version, or a dependent component without security vulnerabilities, which is not limited in this specification.

[0086] In some embodiments of the present specification, after the security identification result is output, the user can directly locate the target dependent component based on the output security identification result, and replace the target dependent component with a vulnerability.

[0087] like Figure 2 As shown, in some embodiments of the present specification, the process of building a dependent component knowledge base includes the following steps:

[0088] S201: During the execution of each node in the pipeline of the application, the execution parameters and execution results of each node are obtained.

[0089] It can be understood that the pipeline is a set of automated software development processes, mainly including code construction, testing, deployment and monitoring. The construction can be to pull the source program from the code repository, compile the source program, and convert the source program into a computer-readable program file. The testing can be to test the functions of the software, etc., to ensure that the software can maintain high quality standards while iterating quickly, reduce human errors, improve the efficiency of development and deployment, and ensure product quality. Testing can be done by writing test scripts to verify new code changes to ensure that these changes do not destroy existing functions. The deployment can be to encapsulate the compiled program files into products and deploy the products in production environments such as servers. The monitoring is to monitor the execution process and results of the application's functions, services, etc. during the production process of the application to ensure that the application runs stably, correctly and reliably. As an essential tool for continuous construction and continuous integration of source code, the pipeline can achieve seamless and comprehensive identification of open source risks by analyzing the components of open source components based on the pipeline and establishing component analysis records.

[0090] In some embodiments of the present specification, during the execution of each node in the pipeline of an application, obtaining the execution parameters and execution results of each node may include: obtaining the code repository information, repository branch information, and code version information of the application at the code acquisition node of the pipeline; and obtaining the deployment record of the application at the deployment node of the pipeline.

[0091] Specifically, in the process of pulling the source program in the pipeline, the code repository, repository branch, code version (commit id) and other information of the pulled source program can be synchronously recorded. In the deployment stage, the deployment object of the product and the related information of the deployment object are recorded.

[0092] S202: Determine program code information and deployment object information corresponding to the application based on execution parameters and execution results of each node.

[0093] In some embodiments of the present specification, determining the program code information and deployment object information corresponding to the application based on the execution parameters and execution results of each node may include: associating the code repository information, the repository branch information, and the code version information to generate the program code information; extracting the deployment object and application information from the deployment record, and associating the extracted application information with the deployment object to generate the deployment object information.

[0094] S203: In the compilation and construction phase of the pipeline, the dependent component information of the application is obtained.

[0095] In some embodiments of the present specification, obtaining the dependency component information of the application in the compilation and construction phase of the pipeline may include: in the compilation and construction phase, obtaining the dependency information of the application and outputting it as a dependency log file; parsing the dependency log file, extracting the dependency components and information corresponding to the dependency components, and performing a structured conversion on the dependency log file to obtain the dependency component information, wherein the dependency component information includes the dependency components and the quantity and version information corresponding to the dependency components.

[0096] Specifically, you can add parameters to the compilation and construction phase of the pipeline to obtain the dependency component information parsed during the compilation process. For example, for a Maven project, you can add the parameter: dependency:tree when executing the Maven command for compilation and construction to print all the dependency components referenced by this build in the log. Then you can parse and format the log to obtain the dependency component information.

[0097] S204: constructing the dependent component knowledge base based on the dependent component information, the program code information, the application information and the deployment object information.

[0098] In some embodiments of the present specification, constructing the dependent component knowledge base based on the dependent component information, the program code information, the application information and the deployment object information may include: constructing a first association relationship between the dependent component and the program code based on the dependent component information and the program code information; constructing a second association relationship between the dependent component and the deployment object based on the dependent component information and the deployment object information; constructing a third association relationship between the dependent component and the application and a fourth association relationship between the application and the deployment object based on the application information and the deployment object information; and constructing the dependent component knowledge base based on the first association relationship, the second association relationship, the third association relationship and the fourth association relationship.

[0099] In some embodiments of the present specification, in order to reduce the impact of the collection of execution parameters, execution results and dependent component information on pipeline execution, the acquisition of the execution parameters, the execution results and the dependent component information may be implemented in an asynchronous manner.

[0100] In the embodiments of this specification, the construction of the dependent component knowledge base is realized based on the pipeline, without the user having to make any adjustments to the pipeline or source program, application program, etc., and the relevant information of the dependent components of the entire life cycle of the application can be quickly and accurately constructed, guiding the user to quickly repair the dependent components with security risks. In addition, there is no need to spend a lot of money to build and update the knowledge base to manage the relationship between dependent components, and the complete identification of dependent components can be achieved.

[0101] The following uses the 0day vulnerability troubleshooting of open source components based on the Maven project pipeline as an example to further introduce the security identification method of the above open source components. Figure 3 As shown, in some embodiments of this specification, the above method includes:

[0102] S301: Create a new component composition analysis service based on Maven.

[0103] The component composition analysis service is used to obtain dependency log files, code repository information, repository branch information, code version information, and deployment records.

[0104] S302: Create a new component log analysis service.

[0105] The component log analysis service is used to structure the collected information and convert it into structured data.

[0106] S303: In the compilation and construction phase of the pipeline, a component component analysis task is mounted in the background of the code construction task of the pipeline.

[0107] Among them, the component composition analysis task is used to execute the component composition analysis service, and the task is mounted in an asynchronous manner, so that even if an exception occurs in the component composition analysis task, it will not affect the pipeline support execution.

[0108] S304: Mount the component log analysis service to perform structured processing on dependency log files, code repository information, repository branch information, code version information, and deployment records.

[0109] S305: The component composition log analysis service outputs the results to build a dependent component knowledge base.

[0110] The output results of the component log analysis service include information such as code repository, repository branch, code submission commit ID, products, deployment, and dependent components.

[0111] S306: When a 0day vulnerability is detected, the code engineering and production services that reference the dependent component with the 0day vulnerability are searched in the dependent component knowledge base, and the reference position is located to replace the dependent component with the 0day vulnerability.

[0112] The open source component security identification method in the embodiments of this specification is not a unified managed product, but is based on continuous construction of the pipeline to identify open source security risks. It can quickly locate the source code with open source security risks without the user making any adjustments, and guide R&D personnel to quickly repair the risks; users do not need to spend a lot of money to establish and update the knowledge base to manage the direct relationship between dependent components, and there is a risk of not fully identifying dependent components and missing security vulnerabilities; and it can also identify production services with security vulnerabilities.

[0113] Based on the above-mentioned open source component security identification method, one or more embodiments of this specification also provide an open source component security identification device. The device may include a device (including a distributed system), software (application), module, plug-in, server, client, etc. using the method described in the embodiment of this specification and combined with a device of necessary implementation hardware. Based on the same innovative concept, the device in one or more embodiments provided in the embodiment of this specification is as described in the following embodiments. Since the implementation scheme and method of the device to solve the problem are similar, the implementation of the specific device in the embodiment of this specification can refer to the implementation of the aforementioned method, and the repetitions will not be repeated. As used below, the term "unit" or "module" can implement a combination of software and / or hardware of a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived. Figure 4 The figure shows a schematic diagram of a device for identifying the security of open source components provided by an embodiment of the present specification. Figure 4 As shown, the open source component security identification device 400 may include:

[0114] The data acquisition module 401 is used to acquire a pre-built dependency component knowledge base when a target open source component with a vulnerability is detected, wherein the dependency component knowledge base contains associations between dependency components and program codes, applications, and deployment objects.

[0115] The dependency determination module 402 is used to search the target dependency component that matches the target open source component from the dependency component knowledge base, and determine the target program code, target application program, and target deployment object corresponding to the target dependency component.

[0116] The information determination module 403 is used to determine the code location information and production service information of the referenced target dependent component based on the target program code, the target application and the target deployment object.

[0117] The result generation module 404 is used to generate a security identification result based on the code location information and the production service information.

[0118] In some embodiments of the present specification, the apparatus further includes a knowledge base construction module, which may include:

[0119] An execution recording unit, used to obtain the execution parameters and execution results of each node during the execution of each node in the pipeline of the application;

[0120] an information determination unit, configured to determine program code information and deployment object information corresponding to the application program based on execution parameters and execution results of each node;

[0121] A dependency recording unit, used to obtain the dependency component information of the application in the compilation and construction phase of the pipeline;

[0122] The knowledge base generation unit is used to construct the dependent component knowledge base based on the dependent component information, the program code information, the application program information and the deployment object information.

[0123] In some embodiments of the present specification, the acquisition of the execution parameters, the execution results, and the dependent component information is implemented in an asynchronous manner.

[0124] In some embodiments of the present specification, the execution recording unit can be specifically used to: obtain code repository information, repository branch information, and code version information of the application at the code acquisition node of the pipeline; and obtain deployment records of the application at the deployment node of the pipeline.

[0125] In some embodiments of the present specification, the information determination unit can be specifically used to: associate the code repository information, the repository branch information and the code version information to generate the program code information; extract the deployment object and application information from the deployment record, and associate the extracted application information with the deployment object to generate the deployment object information.

[0126] In some embodiments of the present specification, the dependency recording unit can be specifically used to: in the compilation and construction stage, obtain the dependency information of the application and output it as a dependency log file; parse the dependency log file, extract the dependency components and the information corresponding to the dependency components, so as to perform a structured conversion on the dependency log file to obtain the dependency component information, wherein the dependency component information includes the dependency components and the quantity and version information corresponding to the dependency components.

[0127] In some embodiments of the present specification, the knowledge base generation unit can be specifically used to: construct a first association relationship between a dependent component and a program code based on the dependent component information and the program code information; construct a second association relationship between a dependent component and a deployment object based on the dependent component information and the deployment object information; construct a third association relationship between a dependent component and an application and a fourth association relationship between an application and a deployment object based on the application information and the deployment object information; and construct the dependent component knowledge base based on the first association relationship, the second association relationship, the third association relationship, and the fourth association relationship.

[0128] In some embodiments of the present specification, the information determination module can be specifically used to: determine the target code library corresponding to the target program code that references the target dependent component and the location of the target program code in the target code library; generate the code location information based on the code library corresponding to the target program code and the location in the code library; obtain the deployment object information of the target deployment object that references the target dependent component; determine the path information of the target application in the target deployment object; and determine the production service information that references the target dependent component based on the path information and the deployment object information of the target deployment object.

[0129] In some embodiments of the present specification, the device may also include a component replacement module, which may be specifically used to: replace the target dependent component in the source code of the application with the dependent component to be updated based on the code location information; and replace the target dependent component in the target application deployed in the target deployment object with the dependent component to be updated based on the production service information.

[0130] The description and functions of the above modules can be understood by referring to the content of the open source component security identification method part, which will not be repeated here.

[0131] The present application also provides an electronic device, such as Figure 5 As shown, the electronic device may include a processor 501 and a memory 502, wherein the processor 501 and the memory 502 may be connected via a bus or other means. Figure 5 The example of connecting through bus is taken in the following.

[0132] The processor 501 may be a central processing unit (CPU). The processor 501 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0133] The memory 502 is a non-transitory computer-readable storage medium that can be used to store non-transitory software programs, non-transitory computer executable programs, and modules, such as program instructions / modules corresponding to the open source component security identification method in the embodiment of the present invention (for example, Figure 4 The processor 501 executes various functional applications and data processing of the processor by running the non-transient software programs, instructions and modules stored in the memory 502, that is, the open source component security identification method in the above method embodiment is implemented.

[0134] The memory 502 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required by at least one function; the data storage area may store data created by the processor 501, etc. In addition, the memory 502 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 502 may optionally include a memory remotely arranged relative to the processor 501, and these remote memories may be connected to the processor 501 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0135] The one or more modules are stored in the memory 502, and when executed by the processor 501, perform the following open source component security identification method:

[0136] When a target open source component with a vulnerability is detected, a pre-built dependency component knowledge base is obtained, wherein the dependency component knowledge base includes association relationships between the dependency component and the program code, the application, and the deployment object;

[0137] Searching the target dependent component matching the target open source component from the dependent component knowledge base, and determining the target program code, target application program, and target deployment object corresponding to the target dependent component;

[0138] Determining, based on the target program code, the target application, and the target deployment object, code location information and production service information that reference the target dependent component;

[0139] A security identification result is generated based on the code location information and the production service information.

[0140] The specific details of the above electronic device can be understood by referring to the corresponding descriptions and effects in the above method embodiments, and will not be repeated here.

[0141] The present specification also provides a computer storage medium storing computer program instructions, which, when executed, implement the steps of the above-mentioned open source component security identification method.

[0142] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the storage medium can be a disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above-mentioned types of memory.

[0143] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0144] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions.

[0145] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0146] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly contributed to the prior art in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute certain parts of the methods of each implementation method of the present application.

[0147] The present application can be used in many general or special computer system environments or configurations, such as personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc.

[0148] The present application may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0149] Although the present application has been described through embodiments, those skilled in the art will appreciate that there are many modifications and variations to the present application without departing from the spirit of the present application, and it is intended that the appended claims include these modifications and variations without departing from the spirit of the present application.

Claims

1. A method for identifying the security of open source components, characterized in that: include: When a target open source component with a vulnerability is detected, a pre-built dependency component knowledge base is obtained, wherein the dependency component knowledge base includes association relationships between the dependency component and the program code, the application, and the deployment object; Searching the target dependent component matching the target open source component from the dependent component knowledge base, and determining the target program code, target application program, and target deployment object corresponding to the target dependent component; Determining, based on the target program code, the target application, and the target deployment object, code location information and production service information that reference the target dependent component; A security identification result is generated based on the code location information and the production service information.

2. The method according to claim 1, characterized in that The dependency component knowledge base is constructed in the following way: During the execution of each node in the pipeline of the application, the execution parameters and execution results of each node are obtained; Determine program code information and deployment object information corresponding to the application based on execution parameters and execution results of each node; In the compilation and construction phase of the pipeline, obtaining dependent component information of the application; The dependent component knowledge base is constructed based on the dependent component information, the program code information, the application information and the deployment object information.

3. The method according to claim 2, characterized in that The acquisition of the execution parameters, the execution results and the dependent component information is achieved in an asynchronous manner.

4. The method according to claim 2, characterized in that: During the execution of each node in the pipeline of the application, the execution parameters and execution results of each node are obtained, including: At the code acquisition node of the pipeline, code repository information, repository branch information, and code version information of the application are acquired; At the deployment node of the pipeline, a deployment record of the application is obtained.

5. The method according to claim 4, characterized in that Based on the execution parameters and execution results of each node, program code information and deployment object information corresponding to the application are determined, including: Associating the code warehouse information, the warehouse branch information, and the code version information to generate the program code information; The deployment object and application information are extracted from the deployment record, and the extracted application information is associated with the deployment object to generate the deployment object information.

6. The method according to claim 2, characterized in that In the compilation and construction phase of the pipeline, the dependent component information of the application is obtained, including: In the compilation and construction phase, the dependency information of the application is obtained and output as a dependency log file; The dependency log file is parsed to extract dependent components and information corresponding to the dependent components, so as to perform a structured conversion on the dependency log file to obtain the dependent component information, wherein the dependent component information includes the dependent components and the quantity and version information corresponding to the dependent components.

7. The method according to claim 2, characterized in that Building the dependent component knowledge base based on the dependent component information, the program code information, the application information and the deployment object information includes: Based on the dependent component information and the program code information, construct a first association relationship between the dependent component and the program code; Building a second association relationship between the dependent component and the deployment object based on the dependent component information and the deployment object information; Based on the information of the application and the information of the deployment object, construct a third association relationship between the dependent component and the application and a fourth association relationship between the application and the deployment object; The dependent component knowledge base is constructed based on the first association relationship, the second association relationship, the third association relationship and the fourth association relationship.

8. The method according to claim 1, characterized in that Determining, based on the target program code, the target application, and the target deployment object, code location information and production service information referencing the target dependent component, including: Determine a target code library corresponding to the target program code that references the target dependent component and a location of the target program code in the target code library; Generate the code location information based on a code library corresponding to the target program code and a location in the code library; Obtaining deployment object information of a target deployment object that references the target dependent component; Determining path information of the target application in the target deployment object; Based on the path information and the deployment object information of the target deployment object, production service information referencing the target dependent component is determined.

9. The method according to any one of claims 1 to 8, characterized in that: After determining the code location information and production service information of the target dependent component based on the target program code, the target application and the target deployment object, the method further includes: Replacing a target dependent component in the source code of the application with a dependent component to be updated based on the code location information; Based on the production service information, a target dependent component deployed in a target application of a target deployment object is replaced with a dependent component to be updated.

10. A device for identifying the security of open source components, characterized in that: include: A data acquisition module, used to acquire a pre-built dependency component knowledge base when a target open source component with a vulnerability is detected, wherein the dependency component knowledge base includes associations between dependency components and program codes, applications, and deployment objects; A dependency determination module, used to search the dependency component knowledge base for a target dependency component that matches the target open source component, and determine a target program code, a target application program, and a target deployment object corresponding to the target dependency component; A location determination module, configured to determine code location information and production service information that reference the target dependent component based on the target program code, the target application, and the target deployment object; A result generation module is used to generate a security identification result based on the code location information and the production service information.

11. An electronic device, characterized in that: include: A memory and a processor, wherein the processor and the memory are communicatively connected to each other, the memory stores computer instructions, and the processor implements the steps of the method according to any one of claims 1 to 9 by executing the computer instructions.

12. A computer storage medium, characterized in that: The computer storage medium stores computer program instructions, and when the computer program instructions are executed, the steps of the method according to any one of claims 1 to 9 are implemented.

13. A computer program product, characterized in that The invention comprises a computer program, which implements the steps of the method according to any one of claims 1 to 9 when being executed by a processor.

Images