Open source component security identification method, device and electronic device

Abstract

The present application discloses a method, device and electronic device for identifying the security of open source components. The method includes obtaining a pre-built dependency component knowledge base when a target open source component with a vulnerability is detected, wherein the dependency component knowledge base contains the association relationship between the dependency component and the program code, application and deployment object; searching the dependency component that matches the target open source component from the dependency component knowledge base, and determining the target program code, target application and target deployment object corresponding to the target dependency component; based on the target program code, target application and target deployment object, determining the code location information and production service information of the referenced target dependency component; and generating a security identification result based on the code location information and production service information. The above method can improve the accuracy and efficiency of open source security vulnerability identification and repair.

Description

Technical Field

[0001] The present application relates to the field of financial technology, and in particular to a method, device, and electronic device for securely identifying open source components. Background Art

[0002] Most applications built and used by enterprises include open source components in their code. When developers include open source dependencies in their application's source code, they are often unaware of the included sub-dependencies. This can lead to applications containing out-of-date versions of open source components—that is, updates or patches are available but not yet applied. Accurately updating open source components is critical to application security; if out-of-date components are forgotten, they could potentially become exploitable. As applications migrate to the cloud and their complexity increases, the software risks posed by open source components also increase.

[0003] Currently, there are two main methods for scanning open source security: (1) performing open source security scanning on all artifacts in the artifact library (i.e., the installation packages of the application), identifying all open source dependent components that each artifact depends on, and quickly identifying the artifact with the open source vulnerability when an open source component with a vulnerability is detected; however, this method requires all artifacts to be included in the artifact library for unified management, and the scanning efficiency is low; (2) scanning the dependent component files of the code project by scanning the source code to identify the dependent components of the code project; since the correlation between the artifact and the source code cannot be associated, even if the risky artifact is found, the corresponding source code cannot be quickly found, and scanning the dependent component by scanning the source code can only identify the single-node dependent component in the code, and cannot identify the sub-dependent component, resulting in the problem of missing open source components, and the identification efficiency and accuracy are low; in addition, source code-based scanning cannot determine the artifact with security risks. It can be seen that the existing technology can only realize the identification of single-node open source components, and the identification accuracy and efficiency are low.

[0004] Currently, no effective solution has been proposed to the aforementioned problem of being unable to accurately and quickly identify the security of open source components of applications. Summary of the Invention

[0005] The purpose of the embodiments of the present application is to provide a method, device and electronic device for securely identifying open source components to solve the problem of being unable to accurately and quickly identify the security of open source components of an application.

[0006] To solve the above technical problems, the first aspect of this specification provides a method for identifying the security of open source components, including:

[0007] When a target open source component with a vulnerability is detected, a pre-built dependency component knowledge base is obtained, wherein the dependency component knowledge base includes association relationships between the dependency components and program codes, applications, and deployment objects;

[0008] Searching the target dependent component that matches the target open source component from the dependent component knowledge base, and determining the target program code, target application, and target deployment object corresponding to the target dependent component;

[0009] Determining, based on the target program code, the target application, and the target deployment object, code location information and production service information that references the target dependent component;

[0010] A security identification result is generated based on the code location information and the production service information.

[0011] In some embodiments of this specification, the dependency component knowledge base is constructed in the following manner:

[0012] During the execution of each node in the application pipeline, obtain the execution parameters and execution results of each node;

[0013] Determining program code information and deployment object information corresponding to the application based on execution parameters and execution results of each node;

[0014] In the compilation and construction phase of the pipeline, obtaining the dependent component information of the application;

[0015] The dependent component knowledge base is constructed based on the dependent component information, the program code information, the application information and the deployment object information.

[0016] In some embodiments of this specification, the acquisition of the execution parameters, the execution results, and the dependent component information is achieved in an asynchronous manner.

[0017] In some embodiments of this specification, during the execution of each node in the pipeline of the application, obtaining the execution parameters and execution results of each node includes:

[0018] At the code acquisition node of the pipeline, code repository information, repository branch information, and code version information of the application are acquired;

[0019] At the deployment node of the pipeline, a deployment record of the application is obtained.

[0020] In some embodiments of this specification, determining program code information and deployment object information corresponding to the application based on execution parameters and execution results of each node includes:

[0021] Associating the code repository information, the repository branch information, and the code version information to generate the program code information;

[0022] The deployment object and application information are extracted from the deployment record, and the extracted application information is associated with the deployment object to generate the deployment object information.

[0023] In some embodiments of the present specification, obtaining the dependent component information of the application during the compilation and construction phase of the pipeline includes:

[0024] In the compilation and construction phase, the dependency information of the application is obtained and output as a dependency log file;

[0025] The dependency log file is parsed to extract dependent components and information corresponding to the dependent components, so as to perform a structured conversion on the dependency log file to obtain the dependent component information, wherein the dependent component information includes dependent components and quantity and version information corresponding to the dependent components.

[0026] In some embodiments of this specification, building the dependent component knowledge base based on the dependent component information, the program code information, the application information, and the deployment object information includes:

[0027] Building a first association relationship between the dependent component and the program code based on the dependent component information and the program code information;

[0028] Building a second association relationship between the dependent component and the deployment object based on the dependent component information and the deployment object information;

[0029] Building, based on the information of the application and the information of the deployment object, a third association relationship between the dependent component and the application and a fourth association relationship between the application and the deployment object;

[0030] The dependent component knowledge base is constructed based on the first association relationship, the second association relationship, the third association relationship, and the fourth association relationship.

[0031] In some embodiments of this specification, determining, based on the target program code, the target application, and the target deployment object, code location information and production service information referencing the target dependent component includes:

[0032] Determine a target code library corresponding to the target program code that references the target dependent component and a location of the target program code in the target code library;

[0033] generating the code location information based on a code library corresponding to the target program code and a location in the code library;

[0034] Obtaining deployment object information of a target deployment object that references the target dependent component;

[0035] Determining path information of the target application in the target deployment object;

[0036] Based on the path information and the deployment object information of the target deployment object, production service information referencing the target dependent component is determined.

[0037] In some embodiments of this specification, after determining the code location information and production service information referencing the target dependent component based on the target program code, the target application, and the target deployment object, the method further includes:

[0038] Replacing a target dependent component in the source code of the application with a dependent component to be updated based on the code location information;

[0039] Based on the production service information, a target dependent component deployed in a target application of a target deployment object is replaced with the dependent component to be updated.

[0040] A second aspect of this specification provides a device for identifying the security of open source components, including:

[0041] A data acquisition module is used to acquire a pre-built dependency component knowledge base when a target open source component with a vulnerability is detected, wherein the dependency component knowledge base includes associations between dependency components and program codes, applications, and deployment objects;

[0042] A dependency determination module, configured to search the dependency component knowledge base for a target dependency component that matches the target open source component, and determine a target program code, a target application, and a target deployment object corresponding to the target dependency component;

[0043] a location determination module, configured to determine code location information and production service information referencing the target dependent component based on the target program code, the target application, and the target deployment object;

[0044] A result generation module is used to generate a security identification result based on the code location information and the production service information.

[0045] A third aspect of this specification provides an electronic device, including:

[0046] A memory and a processor, wherein the processor and the memory are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the steps of the method described in the first aspect above.

[0047] A fourth aspect of this specification provides a computer storage medium, wherein the computer storage medium stores computer program instructions, and when the computer program instructions are executed, the steps of the method described in the first aspect are implemented.

[0048] A fifth aspect of this specification provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method described in the first aspect.

[0049] The open source component security identification method in the embodiments of this specification, when a target open source component with a vulnerability is detected, obtains a pre-built dependency component knowledge base, wherein the dependency component knowledge base contains the association relationship between the dependency component and the program code, application and deployment object; searches for a target dependency component that matches the target open source component from the dependency component knowledge base, and determines the target program code, target application and target deployment object corresponding to the target dependency component; based on the target program code, target application and target deployment object, determines the code location information and production service information that references the target dependency component; and generates a security identification result based on the code location information and production service information. In the embodiment of this specification, the pre-built dependency component knowledge base not only includes the association relationship between the dependency component and the program code, but also includes the association relationship between the dependency component and the application and the deployment object. When a target open source component with a vulnerability is detected, the target dependency component that matches the target open source component can be found in the dependency component knowledge base. Based on the association relationship stored in the dependency component knowledge base, the target program code, target application and target deployment object associated with the target dependency component can be determined. That is, through the dependency component knowledge base in the embodiment of this specification, not only the identification of open source components at the source code end can be achieved, but also the identification of open source components at the application and deployment object end can be achieved, and the security identification of open source components throughout the application cycle can be achieved with higher accuracy and efficiency. Furthermore, based on the target program code, target application and target deployment object, the code location information and production service information of the referenced target dependency component can be quickly and accurately determined, thereby improving the accuracy and efficiency of open source security vulnerability repair. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the implementation methods of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the implementation methods or the description of the prior art. Obviously, the drawings described below are only some implementation methods recorded in this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0051] Figure 1 FIG2 is a schematic diagram of a method for identifying the security of open source components provided by an embodiment of this specification;

[0052] Figure 2 FIG2 is a schematic diagram of a process for building a dependency component knowledge base according to an embodiment of the present disclosure;

[0053] Figure 3 FIG2 is a schematic diagram of a method for identifying the security of open source components provided by an embodiment of this specification;

[0054] Figure 4 FIG2 is a schematic diagram of a device for identifying the security of an open source component provided by an embodiment of this specification;

[0055] Figure 5 Shown is a schematic diagram of an electronic device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0056] In order to enable those skilled in the art to better understand the technical solutions in this application, the following will clearly and completely describe the technical solutions in the embodiments of this application in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0057] It should be noted that the user-related information and data involved in the embodiments of this specification are all information and data authorized by the user or fully authorized by relevant parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users or relevant parties to choose to authorize or refuse.

[0058] It should also be noted that in the embodiments of this specification, certain software, components, models and other existing solutions in the industry may be mentioned. They should be regarded as exemplary and their purpose is only to illustrate the feasibility of implementing the technical solution of this application, but it does not mean that the applicant has or will necessarily use the solution.

[0059] Open source components are included in software across various industries. An industry organization's open source security risk analysis report surveyed 17 sectors. Four of these sectors—computer hardware and semiconductors, cybersecurity, energy and clean technology, and the Internet of Things—had 100% open source code in their audited codebases. For the remaining verticals, 93% to 99% of the codebases of companies contain open source elements. However, when open source components develop vulnerabilities, they can have a significant impact on application usage. For example, the Log4Shell vulnerability in Log4j at the end of 2021 was discovered. According to statistics, over 35,863 open source Java components depend on Log4j, meaning that over 8% of software packages have at least one version affected by this vulnerability. In this scenario, companies expend considerable time and effort troubleshooting and patching product vulnerabilities. Currently, the industry has yet to develop a solution that can accurately and quickly identify the security of open source components throughout the entire application lifecycle.

[0060] Considering that most software development is currently implemented using automated pipelines, which include various nodes in the entire life cycle of an application, the embodiment of this specification proposes a method for identifying the security of open source components by seamlessly building a dependency component knowledge base based on a pipeline and seamlessly troubleshooting the risks of security vulnerabilities in open source components. Specifically, the method includes obtaining a pre-built dependency component knowledge base when a target open source component with a vulnerability is detected, wherein the dependency component knowledge base contains the association relationship between the dependency component and the program code, application, and deployment object; searching for a target dependency component that matches the target open source component from the dependency component knowledge base, and determining the target program code, target application, and target deployment object corresponding to the target dependency component; determining the code location information and production service information of the referenced target dependency component based on the target program code, target application, and target deployment object; and generating a security identification result based on the code location information and production service information.

[0061] In the open source component security identification method provided in the embodiment of this specification, the pre-built dependency component knowledge base not only includes the association relationship between the dependency component and the program code, but also includes the association relationship between the dependency component and the application and the deployment object. When a target open source component with a vulnerability is detected, the target dependency component that matches the target open source component can be found in the dependency component knowledge base. Based on the association relationship stored in the dependency component knowledge base, the target program code, target application and target deployment object associated with the target dependency component can be determined. That is, through the dependency component knowledge base in the embodiment of this specification, not only the open source component at the source code end can be identified, but also the open source component at the application and deployment object end can be identified, realizing the open source component security identification of the entire application cycle with higher accuracy and efficiency. Furthermore, based on the target program code, target application and target deployment object, the code location information and production service information of the referenced target dependency component can be quickly and accurately determined, thereby improving the accuracy and efficiency of open source security vulnerability repair.

[0062] It is understood that the above-mentioned method provided in this application can be applied to electronic devices, which can refer to electronic devices with data computing, processing, and storage capabilities. The electronic device can be a terminal such as a PC (Personal Computer), a tablet computer, a smartphone, a wearable device, an intelligent robot, etc.; it can also be a server. The server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0063] The following describes the method for identifying open source component security provided by an embodiment of the present application in conjunction with the accompanying drawings.

[0064] Figure 1 Shown is a schematic diagram of a method for identifying the security of open source components provided by an embodiment of this specification. Although this specification provides method operation steps or device structures as shown in the following embodiments or drawings, the method or device may include more or fewer operation steps or module units after partial merger based on routine or no creative labor. In the steps or structures where there is no necessary causal relationship logically, the execution order of these steps or the module structure of the device is not limited to the execution order or module structure shown in the embodiments or drawings of this specification. When the method or module structure described is applied to an actual device, server or terminal product, it can be executed sequentially or in parallel according to the method or module structure shown in the embodiment or drawings (for example, in an environment of parallel processors or multi-threaded processing, or even in an implementation environment of distributed processing and server clusters). As Figure 1 As shown, the method may include:

[0065] S101: When a target open source component with a vulnerability is detected, a pre-built dependency component knowledge base is obtained, wherein the dependency component knowledge base includes association relationships between dependency components and program codes, applications, and deployment objects.

[0066] Among them, the program code may include code repositories, repository branches, etc. that reference dependent components, the application may include code submission versions (commit IDs), products, etc. that reference dependent components, the deployment objects may include objects where products are deployed, such as servers, clouds, containers, etc., and the dependent components may include open source components and / or non-open source components.

[0067] It can be understood that the dependency component knowledge base can obtain corresponding information at various stages of the application life cycle and be constructed based on the obtained information. Among them, the life cycle of the application can, for example, include the source code writing stage, the compilation stage, the testing stage, the deployment stage, and the monitoring stage after being put into the production environment. For example, in the compilation stage, the deployment stage, and the monitoring stage, information related to the dependent components, program code, application program, and deployment objects can be obtained and associated to obtain the dependency component knowledge base. The specific construction process of the above-mentioned dependency component knowledge base will be specifically introduced below and will not be repeated here.

[0068] In some embodiments of the present specification, in order to achieve seamless construction of a dependency component knowledge base, a dependency information acquisition service can be constructed. This service can obtain relevant execution information of each stage in a synchronous or asynchronous manner during the execution of each stage, such as execution parameters, execution results, etc., and then construct a dependency component knowledge base based on the acquired information.

[0069] In some embodiments of the present specification, the dependency component knowledge base may include a knowledge base related to the dependency component corresponding to an application. Since any application may correspond to at least one version, the association relationship between the dependency component and the application contained in the dependency component knowledge base may be an association relationship between the dependency component and the application version.

[0070] In some embodiments of the present specification, the dependency component knowledge base may include knowledge bases related to the dependency components corresponding to multiple applications, that is, the dependency component knowledge base includes multiple applications, and for any application, it may correspond to at least one version, so the association relationship between the dependency component and the application contained in the dependency component knowledge base may be an association relationship between the dependency component and the application and the version of the application.

[0071] In some embodiments of this specification, the dependency component knowledge base can be stored in the form of a database table, and the association relationship between the dependency component and the program code, application and deployment object can be realized through the hierarchical relationship in the database table. In other embodiments of this specification, the dependency component knowledge base can also be stored in the form of a network model. Furthermore, the dependency components, program code, application and deployment objects can be used as nodes in the network model. Different types of nodes can be distinguished by different colors or different graphics. The association relationship between the dependency component and the program code, application and deployment object can be represented by the edges connecting the nodes. Of course, in other embodiments, the dependency component knowledge base can also be stored or visualized in other forms, and this specification does not limit this.

[0072] In some embodiments of this specification, the target open source component may be an open source component that has an open source security vulnerability. For example, it may be an open source component that has a zero-day (0day) vulnerability. A 0day vulnerability is a security vulnerability that is immediately exploited after being discovered. A related malicious program will appear on the same day that the security patch and flaw are disclosed, and the attack is often very sudden and destructive.

[0073] S102: Searching for a target dependent component that matches the target open source component from the dependent component knowledge base, and determining a target program code, a target application, and a target deployment object corresponding to the target dependent component.

[0074] It can be understood that the dependency component knowledge base may include all dependency components corresponding to at least one application. After detecting a target open source component with a vulnerability, the dependency component knowledge base may be searched to determine whether the target open source component exists.

[0075] In some embodiments of this specification, the process of searching for a matching dependent component can be achieved by matching the component information of the target open source component with the dependent component information in the dependent component knowledge base. Specifically, the degree of matching between the component information of the open source component and the dependent component information can be calculated, and based on whether the degree of matching between the component information of the open source component and the dependent component information reaches a preset matching threshold, it is determined whether the target open source component exists in the dependent component knowledge base. The matching can be text matching, character matching, semantic matching, etc.

[0076] In some embodiments of the present specification, the process of finding a matching dependent component can be performed by searching the knowledge base for a name or name identifier corresponding to the target open source component, and a dependent component with the same version as the target open source component as the target dependent component.

[0077] Furthermore, after determining the target dependent component, the program code, application and deployment object associated with the target dependent component can be searched in the knowledge base, and the program code, application and deployment object associated with the target dependent component can be used as the target program code, target application and target deployment object respectively.

[0078] S103: Determine code location information and production service information referencing the target dependent component based on the target program code, the target application, and the target deployment object.

[0079] It can be understood that the code location information can be the specific location of the source code that references the target dependent component, and can include one or more of the code repository where the source code is located, the repository branch to which it belongs, the code file where it is located, the specific location in the code file, etc. The production service information can be the service that references the target dependent component in the production environment and the information corresponding to the service, wherein the information corresponding to the service may include the object on which the service is deployed, the location of the object, etc. Based on the code location information and the production service information, the target dependent component can be identified, security scanned, and repaired from the source code side and the application side of the program respectively; and when performing security scanning and identification, no additional operations or adjustments are required, only a search in the dependent component knowledge base is required, and the source code, artifacts, and deployment objects involved in the target dependent component can be quickly and accurately located, providing a basis for subsequent vulnerability repairs.

[0080] In some embodiments of the present specification, determining the code location information and production service information of the target dependent component based on the target program code, the target application and the target deployment object may include: determining the target code library corresponding to the target program code that references the target dependent component and the location of the target program code in the target code library; generating the code location information based on the code library corresponding to the target program code and the location in the code library; obtaining the deployment object information of the target deployment object that references the target dependent component; determining the path information of the target application in the target deployment object; and determining the production service information that references the target dependent component based on the path information and the deployment object information of the target deployment object.

[0081] It can be understood that the path information may be the path of the artifact corresponding to the target application in the target deployment object. Based on the path information, the artifact corresponding to the target application can be quickly located in the target deployment object.

[0082] S104: Generate a security identification result based on the code location information and the production service information.

[0083] In some embodiments of the present specification, a security identification result can be output to the user, and the user can then replace the target dependent component based on the security identification result, or review and confirm the security identification result to determine the accuracy of the identification result. After the user reviews and confirms the security identification result, if the identification result is determined to be correct, an input or a trigger review pass message can be generated, and then the target dependent component can be repaired and replaced based on the security identification result. If it is determined that there is a problem with the identification result, a new open source component security identification can be triggered, and then the above steps S101 to S104 can be executed again to generate a security identification result again for review and confirmation. The user can also directly adjust the security identification result and upload the adjusted security identification result, and then the target dependent component can be repaired and replaced based on the security identification result.

[0084] In some embodiments of the present specification, after determining the code location information and production service information that reference the target dependent component based on the target program code, the target application, and the target deployment object, it may also include: replacing the target dependent component in the source code of the application with the dependent component to be updated based on the code location information; and replacing the target dependent component in the target application deployed in the target deployment object with the dependent component to be updated based on the production service information.

[0085] The dependent component to be updated may be a dependent component of the latest version, or a dependent component without security vulnerabilities, which is not limited in this specification.

[0086] In some embodiments of the present specification, after the security identification result is output, the user can directly locate the target dependent component based on the output security identification result and replace the target dependent component with a vulnerability.

[0087] like Figure 2 As shown, in some embodiments of this specification, the process of building a dependency component knowledge base includes the following steps:

[0088] S201: During the execution of each node in the pipeline of the application, the execution parameters and execution results of each node are obtained.

[0089] As can be understood, a pipeline is an automated software development process, primarily encompassing code building, testing, deployment, and monitoring. Building involves pulling source code from a code repository and compiling it to convert it into a computer-readable program file. Testing involves testing software functionality, ensuring rapid iteration while maintaining high quality standards, minimizing human error, improving development and deployment efficiency, and ensuring product quality. Testing involves writing test scripts to verify new code changes and ensure they do not break existing functionality. Deployment involves packaging compiled program files into artifacts and deploying them in production environments such as servers. Monitoring involves monitoring the execution and results of application functions and services during the production process to ensure stable, correct, and reliable operation. As an essential tool for continuous source code building and integration, pipelines enable seamless and comprehensive identification of open source risks by analyzing the composition of open source components and establishing a record of this analysis.

[0090] In some embodiments of the present specification, during the execution process of each node in the pipeline of an application, obtaining the execution parameters and execution results of each node may include: obtaining the code repository information, repository branch information and code version information of the application at the code acquisition node of the pipeline; and obtaining the deployment record of the application at the deployment node of the pipeline.

[0091] Specifically, during the process of pulling the source code, the code repository, repository branch, code version (commit id) and other information of the pulled source code can be recorded synchronously. In the deployment phase, the deployment object of the product and related information of the deployment object are recorded.

[0092] S202: Determine program code information and deployment object information corresponding to the application based on the execution parameters and execution results of each node.

[0093] In some embodiments of the present specification, determining the program code information and deployment object information corresponding to the application based on the execution parameters and execution results of each node may include: associating the code repository information, the repository branch information, and the code version information to generate the program code information; extracting the deployment object and application information from the deployment record, and associating the extracted application information with the deployment object to generate the deployment object information.

[0094] S203: In the compilation and construction phase of the pipeline, the dependent component information of the application is obtained.

[0095] In some embodiments of the present specification, obtaining the dependency component information of the application in the compilation and construction phase of the pipeline may include: obtaining the dependency information of the application and outputting it as a dependency log file in the compilation and construction phase; parsing the dependency log file, extracting the dependency components and information corresponding to the dependency components, and performing a structured conversion on the dependency log file to obtain the dependency component information, wherein the dependency component information includes the dependency components and the quantity and version information corresponding to the dependency components.

[0096] Specifically, you can add parameters to the compilation and build phase of the pipeline to obtain dependency component information parsed during the compilation process. For example, for Maven projects, you can add the parameter "dependency:tree" when executing the Maven command to print all dependency components referenced by the build in the log. You can then parse and format the log to obtain the dependency component information.

[0097] S204: Construct the dependent component knowledge base based on the dependent component information, the program code information, the application information, and the deployment object information.

[0098] In some embodiments of the present specification, constructing the dependent component knowledge base based on the dependent component information, the program code information, the application information, and the deployment object information may include: constructing a first association relationship between the dependent component and the program code based on the dependent component information and the program code information; constructing a second association relationship between the dependent component and the deployment object based on the dependent component information and the deployment object information; constructing a third association relationship between the dependent component and the application and a fourth association relationship between the application and the deployment object based on the application information and the deployment object information; and constructing the dependent component knowledge base based on the first association relationship, the second association relationship, the third association relationship, and the fourth association relationship.

[0099] In some embodiments of this specification, in order to reduce the impact of the collection of execution parameters, execution results and dependent component information on pipeline execution, the acquisition of the execution parameters, the execution results and the dependent component information can be achieved in an asynchronous manner.

[0100] In the embodiments of this specification, a pipeline-based knowledge base for dependent components is constructed, eliminating the need for users to make any adjustments to the pipeline, source code, or application. This allows for the rapid and accurate construction of information about dependent components throughout the application's lifecycle, guiding users in quickly remediating dependent components that pose security risks. Furthermore, this eliminates the need for incurring significant costs in establishing and updating a separate knowledge base to manage the relationships between dependent components, enabling complete identification of dependent components.

[0101] The following takes the 0day vulnerability troubleshooting of open source components based on the Maven project pipeline as an example to further introduce the security identification method of the above open source components. Figure 3 As shown, in some embodiments of this specification, the above method includes:

[0102] S301: Create a new component composition analysis service based on Maven.

[0103] The component composition analysis service is used to obtain dependency log files, code repository information, repository branch information, code version information, and deployment records.

[0104] S302: Create a new component log analysis service.

[0105] The component log analysis service is used to structure the collected information and convert it into structured data.

[0106] S303: In the compilation and construction phase of the pipeline, a component composition analysis task is mounted in the background of the code construction task of the pipeline.

[0107] Among them, the component composition analysis task is used to execute the component composition analysis service, and the task is mounted in an asynchronous manner, so even if an exception occurs in the component composition analysis task, it will not affect the pipeline support execution.

[0108] S304: Mount the component log analysis service to perform structured processing on dependency log files, code repository information, repository branch information, code version information, and deployment records.

[0109] S305: The component composition log analysis service outputs results to build a dependent component knowledge base.

[0110] The output of the component log analysis service includes information such as the code repository, repository branch, code commit ID, artifacts, deployment, and dependent components.

[0111] S306: When a 0-day vulnerability is detected, the code engineering and production services that reference the dependent component with the 0-day vulnerability are searched in the dependent component knowledge base, and the reference location is located to replace the dependent component with the 0-day vulnerability.

[0112] The open source component security identification method in the embodiments of this specification does not include unified managed products, but is based on continuous construction of pipelines to identify open source security risks. It can quickly locate source code with open source security risks without the user having to make any adjustments, and guide R&D personnel to quickly repair the risks; users do not need to spend a lot of money to establish and update the knowledge base to manage the direct relationship between dependent components, and there is a risk of incomplete identification of dependent components leading to missed security vulnerabilities; and it can also identify production services with security vulnerabilities.

[0113] Based on the above-mentioned method for identifying the security of open source components, one or more embodiments of this specification also provide a device for identifying the security of open source components. The device may include a device (including a distributed system), software (application), module, plug-in, server, client, etc. that uses the method described in the embodiment of this specification and is combined with a device for implementing the necessary hardware. Based on the same innovative concept, the device in one or more embodiments provided in the embodiment of this specification is as described in the following embodiments. Since the implementation scheme and method for solving the problem of the device are similar, the implementation of the specific device in the embodiment of this specification can refer to the implementation of the aforementioned method, and the repetitions will not be repeated. As used below, the term "unit" or "module" can implement a combination of software and / or hardware for a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived. Figure 4 The figure shows a schematic diagram of a device for identifying the security of open source components provided by an embodiment of this specification. Figure 4 As shown, the open source component security identification device 400 may include:

[0114] The data acquisition module 401 is used to acquire a pre-built dependency component knowledge base when a target open source component with a vulnerability is detected, wherein the dependency component knowledge base includes associations between dependency components and program codes, applications, and deployment objects.

[0115] The dependency determination module 402 is configured to search the dependency component knowledge base for a target dependency component that matches the target open source component, and determine the target program code, target application, and target deployment object corresponding to the target dependency component.

[0116] The information determination module 403 is configured to determine the code location information and production service information of the target dependent component based on the target program code, the target application, and the target deployment object.

[0117] The result generation module 404 is configured to generate a security identification result based on the code location information and the production service information.

[0118] In some embodiments of this specification, the apparatus further includes a knowledge base construction module, which may include:

[0119] An execution recording unit, used to obtain the execution parameters and execution results of each node during the execution of each node in the pipeline of the application;

[0120] an information determining unit, configured to determine, based on the execution parameters and execution results of each node, program code information and deployment object information corresponding to the application;

[0121] A dependency recording unit, configured to obtain dependency component information of the application during the compilation and construction phase of the pipeline;

[0122] The knowledge base generation unit is configured to construct the dependent component knowledge base based on the dependent component information, the program code information, the application information, and the deployment object information.

[0123] In some embodiments of this specification, the acquisition of the execution parameters, the execution results, and the dependent component information is achieved in an asynchronous manner.

[0124] In some embodiments of the present specification, the execution recording unit can be specifically used to: obtain the code repository information, repository branch information and code version information of the application at the code acquisition node of the pipeline; and obtain the deployment record of the application at the deployment node of the pipeline.

[0125] In some embodiments of the present specification, the information determination unit can be specifically used to: associate the code repository information, the repository branch information and the code version information to generate the program code information; extract the deployment object and application information from the deployment record, and associate the extracted application information with the deployment object to generate the deployment object information.

[0126] In some embodiments of the present specification, the dependency recording unit can be specifically used to: in the compilation and construction link, obtain the dependency information of the application and output it as a dependency log file; parse the dependency log file, extract the dependent components and the information corresponding to the dependent components, and perform a structured conversion on the dependency log file to obtain the dependent component information, wherein the dependent component information includes the dependent components and the quantity and version information corresponding to the dependent components.

[0127] In some embodiments of the present specification, the knowledge base generation unit can be specifically used to: construct a first association relationship between the dependent component and the program code based on the dependent component information and the program code information; construct a second association relationship between the dependent component and the deployment object based on the dependent component information and the deployment object information; construct a third association relationship between the dependent component and the application and a fourth association relationship between the application and the deployment object based on the application information and the deployment object information; and construct the dependent component knowledge base based on the first association relationship, the second association relationship, the third association relationship, and the fourth association relationship.

[0128] In some embodiments of the present specification, the information determination module can be specifically used to: determine the target code library corresponding to the target program code that references the target dependent component and the location of the target program code in the target code library; generate the code location information based on the code library corresponding to the target program code and the location in the code library; obtain the deployment object information of the target deployment object that references the target dependent component; determine the path information of the target application in the target deployment object; and determine the production service information that references the target dependent component based on the path information and the deployment object information of the target deployment object.

[0129] In some embodiments of the present specification, the device may further include a component replacement module, which may be specifically used to: replace the target dependent component in the source code of the application with the dependent component to be updated based on the code location information; and replace the target dependent component in the target application deployed in the target deployment object with the dependent component to be updated based on the production service information.

[0130] The description and functions of the above modules can be understood by referring to the content of the open source component security identification method section, and will not be repeated here.

[0131] The present application also provides an electronic device, such as Figure 5 As shown, the electronic device may include a processor 501 and a memory 502, wherein the processor 501 and the memory 502 may be connected via a bus or other means. Figure 5 The bus connection is taken as an example.

[0132] The processor 501 may be a central processing unit (CPU). The processor 501 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0133] The memory 502 is a non-transitory computer-readable storage medium that can be used to store non-transitory software programs, non-transitory computer executable programs, and modules, such as the program instructions / modules corresponding to the open source component security identification method in the embodiment of the present invention (for example, Figure 4 The processor 501 executes the non-transitory software programs, instructions, and modules stored in the memory 502 to perform various functional applications and data processing of the processor, thereby implementing the open source component security identification method in the above method embodiment.

[0134] The memory 502 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created by the processor 501, etc. In addition, the memory 502 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 502 may optionally include a memory remotely located relative to the processor 501, and these remote memories may be connected to the processor 501 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0135] The one or more modules are stored in the memory 502 and, when executed by the processor 501, perform the following open source component security identification method:

[0136] When a target open source component with a vulnerability is detected, a pre-built dependency component knowledge base is obtained, wherein the dependency component knowledge base includes association relationships between the dependency components and program codes, applications, and deployment objects;

[0137] Searching the target dependent component that matches the target open source component from the dependent component knowledge base, and determining the target program code, target application, and target deployment object corresponding to the target dependent component;

[0138] Determining, based on the target program code, the target application, and the target deployment object, code location information and production service information that references the target dependent component;

[0139] A security identification result is generated based on the code location information and the production service information.

[0140] The specific details of the above electronic device can be understood by referring to the corresponding descriptions and effects in the above method embodiments, and will not be repeated here.

[0141] This specification also provides a computer storage medium storing computer program instructions, which, when executed, implement the steps of the above-mentioned open source component security identification method.

[0142] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory, a hard disk drive (HDD), or a solid-state drive (SSD). The storage medium can also include a combination of the above-mentioned types of memory.

[0143] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

[0144] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions.

[0145] For the convenience of description, the above devices are described as being divided into various units according to their functions. Of course, when implementing this application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0146] Through the description of the above embodiments, it can be seen that those skilled in the art can clearly understand that the present application can be implemented by means of software plus the necessary general hardware platform. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product can be stored in a storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute certain parts of the methods of each embodiment of the present application.

[0147] The present application can be used in a wide variety of general-purpose or specialized computer system environments or configurations, such as personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments that include any of the above.

[0148] The present application may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communications network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0149] Although the present application has been described through embodiments, those skilled in the art will appreciate that there are many modifications and variations to the present application without departing from the spirit of the present application. It is intended that the appended claims include these modifications and variations without departing from the spirit of the present application.

Claims

1. A method for identifying open source component security, characterized in that: include: When a target open source component with a vulnerability is detected, a pre-built dependency component knowledge base is obtained, wherein the dependency component knowledge base includes association relationships between the dependency components and program codes, applications, and deployment objects; Searching the target dependent component that matches the target open source component from the dependent component knowledge base, and determining the target program code, target application, and target deployment object corresponding to the target dependent component; Determining, based on the target program code, the target application, and the target deployment object, code location information and production service information that references the target dependent component; generating a security identification result based on the code location information and the production service information; The dependency component knowledge base is constructed in the following way: During the execution of each node in the application pipeline, obtain the execution parameters and execution results of each node; Determining program code information and deployment object information corresponding to the application based on execution parameters and execution results of each node; In the compilation and construction phase of the pipeline, obtaining the dependent component information of the application; Building a first association relationship between the dependent component and the program code based on the dependent component information and the program code information; Building a second association relationship between the dependent component and the deployment object based on the dependent component information and the deployment object information; Building, based on the information of the application and the information of the deployment object, a third association relationship between the dependent component and the application and a fourth association relationship between the application and the deployment object; The dependent component knowledge base is constructed based on the first association relationship, the second association relationship, the third association relationship, and the fourth association relationship.

2. The method according to claim 1, characterized in that The acquisition of the execution parameters, the execution results and the dependent component information is achieved in an asynchronous manner.

3. The method according to claim 1, characterized in that During the execution of each node in the application pipeline, obtain the execution parameters and execution results of each node, including: At the code acquisition node of the pipeline, code repository information, repository branch information, and code version information of the application are acquired; At the deployment node of the pipeline, a deployment record of the application is obtained.

4. The method according to claim 3, characterized in that Determine the program code information and deployment object information corresponding to the application based on the execution parameters and execution results of each node, including: Associating the code repository information, the repository branch information, and the code version information to generate the program code information; The deployment object and application information are extracted from the deployment record, and the extracted application information is associated with the deployment object to generate the deployment object information.

5. The method according to claim 1, wherein During the compilation and construction phase of the pipeline, information about the application's dependent components is obtained, including: In the compilation and construction phase, the dependency information of the application is obtained and output as a dependency log file; The dependency log file is parsed to extract dependent components and information corresponding to the dependent components, so as to perform a structured conversion on the dependency log file to obtain the dependent component information, wherein the dependent component information includes dependent components and quantity and version information corresponding to the dependent components.

6. The method according to claim 1, characterized in that Determining, based on the target program code, the target application, and the target deployment object, code location information and production service information referencing the target dependent component, including: Determine a target code library corresponding to the target program code that references the target dependent component and a location of the target program code in the target code library; generating the code location information based on a code library corresponding to the target program code and a location in the code library; Obtaining deployment object information of a target deployment object that references the target dependent component; Determining path information of the target application in the target deployment object; Based on the path information and the deployment object information of the target deployment object, production service information referencing the target dependent component is determined.

7. The method according to any one of claims 1 to 6, characterized in that After determining the code location information and production service information of the target dependent component based on the target program code, the target application, and the target deployment object, the method further includes: Replacing a target dependent component in the source code of the application with a dependent component to be updated based on the code location information; Based on the production service information, a target dependent component deployed in a target application of a target deployment object is replaced with the dependent component to be updated.

8. A device for identifying the security of open source components, characterized in that: include: A data acquisition module is used to acquire a pre-built dependency component knowledge base when a target open source component with a vulnerability is detected, wherein the dependency component knowledge base includes associations between dependency components and program codes, applications, and deployment objects; A dependency determination module is configured to search the dependency component knowledge base for a target dependency component that matches the target open source component, and determine a target program code, a target application, and a target deployment object corresponding to the target dependency component; a location determination module, configured to determine code location information and production service information referencing the target dependent component based on the target program code, the target application, and the target deployment object; A result generating module, configured to generate a security identification result based on the code location information and the production service information; The dependency component knowledge base is constructed in the following way: During the execution of each node in the application pipeline, obtain the execution parameters and execution results of each node; Determining program code information and deployment object information corresponding to the application based on execution parameters and execution results of each node; In the compilation and construction phase of the pipeline, obtaining the dependent component information of the application; Building a first association relationship between the dependent component and the program code based on the dependent component information and the program code information; Building a second association relationship between the dependent component and the deployment object based on the dependent component information and the deployment object information; Building, based on the information of the application and the information of the deployment object, a third association relationship between the dependent component and the application and a fourth association relationship between the application and the deployment object; The dependent component knowledge base is constructed based on the first association relationship, the second association relationship, the third association relationship, and the fourth association relationship.

9. An electronic device, characterized in that: include: A memory and a processor, wherein the processor and the memory are communicatively connected to each other, the memory stores computer instructions, and the processor implements the steps of the method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer storage medium, characterized in that The computer storage medium stores computer program instructions, and when the computer program instructions are executed, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product, characterized in that The invention comprises a computer program, which implements the steps of the method according to any one of claims 1 to 7 when the computer program is executed by a processor.

Images