Software supply chain security traceability method based on hash algorithm and blockchain technology

Abstract

The present invention relates to the field of data processing, and specifically to a software supply chain security tracing method based on hash algorithm and blockchain technology. The software supply chain security tracing method based on hash algorithm and blockchain technology includes the steps of software security detection, initial component security detection and nested component security detection. The present invention performs security detection on the software, and further performs security detection on the third-party components that the software depends on based on the detected security tags, and also continuously performs nested security detection on the third-party components that the third-party components depend on based on the security tags corresponding to the third-party components, thereby realizing security tracing of the software supply chain; in the process of tracing the security of the software supply chain, since security detection is continuously performed in a nested manner on the third-party components with security issues, there is no need to perform security detection on each code corresponding to the software, which can reduce the calculation amount of security detection and improve detection efficiency.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular to a software supply chain security tracing method based on hash algorithm and blockchain technology. Background Art

[0002] With the rapid development of information technology, the complexity and scale of the software supply chain are increasing. Each link in software development often involves the participation of multiple parties such as third-party libraries and open source components. Although this multi-level, multi-node supply chain structure has improved the efficiency of software development, it also brings huge security risks. In recent years, attacks on the software supply chain have occurred frequently. Attackers have directly affected the system security of end users by tampering with software packages, implanting malicious code, hijacking update channels, and other means, and even caused large-scale network security incidents. Summary of the invention

[0003] The present invention performs security checks on the software, and based on the detected security tags, performs further security checks on the third-party components that the software depends on, and based on the security tags corresponding to the third-party components, continuously nested security checks on the third-party components that the third-party components depend on, thereby achieving security tracing of the software supply chain and responding to attack incidents in the software supply chain in a timely manner. In the process of security tracing of software supply chain components, since security checks are continuously nested for third-party components with security issues, there is no need to perform security checks on each code corresponding to the software, which can reduce the computational complexity of security checks and improve detection efficiency.

[0004] The present invention provides a software supply chain security tracing method based on hash algorithm and blockchain technology, comprising:

[0005] Step S1: software security detection;

[0006] Perform software security detection on the software at preset intervals. The specific operation of the software security detection is: obtain the global input data, global output data and database access data of the software, and then form the global input data, global output data and database access data into software security analysis data, send the software security analysis data into the software security detection model for processing, and output a security label. The security label includes a label with no security issues and a label with security issues. If the security label is a label with no security issues, the software supply chain security traceability operation is not performed; if the security label is not a label with no security issues, output the security label vector corresponding to the security label and the software security analysis vector constructed when the software security analysis data is processed in the software security detection model, and enter step S2;

[0007] Step S2: initial component safety detection;

[0008] Calculate the hash value corresponding to the software, and obtain the first component set of the software from the blockchain according to the hash value of the software, the first component set includes all third-party components in the software, traverse the third-party components of the first component set, and perform the following operations for the selected third-party components: obtain the local input data, local output data and local access database data of the third-party components, and form the local input data, local output data and local access database data of the third-party components into component security analysis data, and send the component security analysis data, security label reference vector and security analysis vector to the component security detection model for processing, output the security label, and determine whether the security label is a label with security issues. If the security label is a label with security issues, obtain the component security detection model input The component security label vector corresponding to the security label output and the component security analysis vector constructed when the component security analysis data is processed in the component security detection model enter step S3; if the security label is not a label with security issues, continue to select third-party components from the first component set; until all third-party components in the first component set are traversed, if no security issue labels are output, the security issue comes from the source code of the software; in the initial state, the security label reference vector and the security analysis vector are respectively the security label vector and the software security analysis vector output by the software security detection model, and the subsequent security label reference vector and the security analysis vector are respectively the component security label vector and the component security analysis vector corresponding to the security label output by the previous component security detection model;

[0009] Step S3: Nested component security detection;

[0010] The third-party component whose security label is a label with a security problem is recorded as the target component, the hash value of the target component is calculated, and the second component set of the target component is obtained from the blockchain according to the hash value of the target component, the second component set includes all the third-party components in the target component, and it is determined whether the second component set is empty. If the second component set is empty, the security problem comes from the target component. If the second component set is not empty, the third-party components in the second component set are traversed, and the following operations are performed for the selected third-party components: local input data, local output data, and local access database data of the third-party component are obtained, and the local input data, local output data, and local access database data of the third-party component are used to form component security analysis data, and the component security analysis data, the security label reference vector, and the security analysis vector are sent to the component security detection model for processing, and the security label is output. It is determined whether the security label is a label with a security problem. If the security label is a label with a security problem, step S3 is entered; if the security label is not a label with a security problem, third-party components are continuously selected from the second component set; until all third-party components in the second component set are traversed, if no label with a security problem is output, the security problem comes from the source code of the target component;

[0011] Step S4: Repeat step S3 until the second component set is empty, completing the secure tracing of the software supply chain.

[0012] As a preferred aspect of the present invention, the blockchain in step S2 and step S3 is constructed by the following steps:

[0013] Whenever a user completes the construction of a third-party component, the version number, hash value, and dependent third-party component blocks corresponding to the built third-party component are uploaded to the blockchain;

[0014] Whenever a user completes the construction of the software, the version number, hash value and dependent third-party components of the built software are uploaded to the blockchain.

[0015] As a preferred aspect of the present invention, it comprises:

[0016] The software security detection model includes a software security analysis data unification layer, a software security analysis layer and a first security label output layer, wherein the software security analysis data unification layer is used to process the software security analysis data and construct a software security analysis vector, and the software security analysis data unification layer constructs software security analysis data of different lengths into a software security analysis vector of uniform length; the software security analysis layer is used to process the software security analysis vector and generate a security label; the first security label output layer is used to output a security label;

[0017] The component safety detection model includes a component safety analysis data unification layer, a feature enhancement layer, a feature fusion layer, a component safety analysis layer and a second safety label output layer, wherein the component safety analysis data unification layer is used to process the component safety analysis data and construct the component safety analysis vector to be enhanced. The component safety analysis data unification layer constructs component safety analysis data of different lengths into component safety analysis vectors to be enhanced of uniform length; the feature enhancement layer is used to perform self-attention mechanism operations on the component safety analysis vector to be enhanced through the safety analysis vector to construct the component safety analysis vector; the feature fusion layer is used to splice the component safety analysis vector with the safety label reference vector to construct the component safety data vector to be analyzed; the component safety analysis layer is used to process the component safety data vector to be analyzed and generate a safety label; the second safety label output layer is used to output the safety label.

[0018] As a preferred aspect of the present invention, training is performed on a software security detection model and a component security detection model, specifically including the following steps:

[0019] Obtain software security detection training samples, which include software security analysis data, and annotate the software security detection training samples with security labels, form all annotated software security detection training samples into a software security detection training set, and train a software security detection model with the software security detection training set, calculate a software security detection loss value with the security label as a target, and determine whether the software security detection loss value is within a first preset range. If the software security detection loss value is within the first preset range, output the trained software security detection model; otherwise, continue to train the software security detection model with the software security detection training set;

[0020] Obtain component safety detection training samples, which include component safety analysis data, safety label reference vectors and safety analysis vectors; label the component safety detection training samples with the safety labels corresponding to the safety label reference vectors; form all labeled component safety detection training samples into a component safety detection training set; train a component safety detection model with the component safety detection training set; calculate a component safety detection loss value with the safety label as a target; determine whether the component safety detection loss value is within a second preset range; if the component safety detection loss value is within the second preset range, output the trained component safety detection model; otherwise, continue to train the component safety detection model with the component safety detection training set.

[0021] As a preferred aspect of the present invention, it also includes simulating and setting the hyperparameters in the component safety detection model by using a swarm optimization algorithm, and the specific steps are as follows:

[0022] Construct several hyperparameter individuals, including the hyperparameters in the component safety detection model; combine all hyperparameter individuals into a hyperparameter population, and set the maximum number of iterations;

[0023] Calculate the fitness of the hyperparameter individuals;

[0024] Based on the fitness of individual hyperparameters, the hyperparameter population is iteratively updated through a population optimization algorithm;

[0025] Until the number of iterations reaches the maximum number of iterations, the hyperparameter individual with the largest fitness is output as the hyperparameter in the component safety detection model.

[0026] As a preferred aspect of the present invention, the fitness of the hyperparameter individual is calculated. The specific calculation method is: the component safety detection model is set by the hyperparameters in the hyperparameter individual, and then the set component safety detection model is trained by the component safety detection training set, and the accuracy of the component safety detection model is used as the fitness of the hyperparameter individual.

[0027] As a preferred aspect of the present invention, the software security analysis data unification layer and the component security analysis data unification layer are both established based on the Transformer model.

[0028] As a preferred aspect of the present invention, the swarm optimization algorithm adopts the sparrow search algorithm.

[0029] The present invention has the following advantages:

[0030] The present invention performs security checks on the software, and based on the detected security tags, performs further security checks on the third-party components that the software depends on, and based on the security tags corresponding to the third-party components, continuously nested security checks on the third-party components that the third-party components depend on, thereby achieving security tracing of the software supply chain and responding to attack incidents in the software supply chain in a timely manner. In the process of security tracing of software supply chain components, since security checks are continuously nested for third-party components with security issues, there is no need to perform security checks on each code corresponding to the software, which can reduce the computational complexity of security checks and improve detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 The present invention is a flowchart of a software supply chain security tracing method based on a hash algorithm and blockchain technology adopted in an embodiment of the present invention. DETAILED DESCRIPTION

[0032] In order to enable persons skilled in the art to better understand the technical solutions in the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0033] Example 1, a software supply chain security tracing method based on hash algorithm and blockchain technology, such as Figure 1 As shown, including:

[0034] Step S1: software security detection;

[0035] Software security testing is performed on the software at preset intervals. The software here refers to various software that are actually in use, such as management systems or data analysis systems within various enterprises. These software rely on a large number of third-party components during the construction process, such as library support and framework support. The specific operations of software security testing are: obtaining the software's global input data, global output data, and access database data. It should be noted that the global input data and global output data here refer to the data input by the user and the data fed back by the software during the use of the software. The access database data refers to the data in the database accessed by the software when processing data or requests. The global input data, global output data, and access database data are then combined into software security analysis data. Software security analysis can characterize the behavior of the software during use, such as the output data containing unescaped HTML or JavaScript code, can identify cross-site scripting attacks, input data and the permissions in accessing database data do not correspond, can identify unauthorized access attacks, send software security analysis data to the software security detection model for processing, and output security labels. Security labels include labels with no security issues and labels with security issues. Labels with security issues include SQL injection attack labels, cross-site scripting attack labels, sensitive data leakage labels, and denial of service attack labels, etc. If the security label is a label with no security issues, the software supply chain security traceability operation is not performed; if the security label is not a label with no security issues, the security label vector corresponding to the security label and the software security analysis vector constructed when the software security analysis data is processed in the software security detection model are output, and step S2 is entered; it should be noted that security labels have multiple types, which can be described by unique hot encoding;

[0036] Step S2: initial component safety detection;

[0037] Calculate the hash value corresponding to the software, and obtain the first component set of the software from the blockchain according to the hash value of the software. The first component set includes all third-party components in the software, such as chart visualization components and identity authorization components, etc. Traverse the third-party components of the first component set, and perform the following operations for the selected third-party components: obtain the local input data, local output data and local access database data of the third-party component. It should be noted that when obtaining the local input data, local output data and local access database data corresponding to the third-party component, it is achieved by mapping the global input data, global output data and access database data to the third-party component, that is, the global input data, global output data and access database data are divided according to the third-party component, and the data input to the third-party component is recorded as local input data, the data output by the third-party component is recorded as local output data, and the data of the database accessed by the third-party component is recorded as local database data. The local input data, local output data and local access database data of the third-party component constitute component security analysis data, and the component security analysis data, the security label reference vector and the security analysis vector are sent to the component security detection model for Processing, outputting a security label, determining whether the security label is a label with security issues, if the security label is a label with security issues, indicating that the security issue comes from the currently selected third-party component, obtaining the component security label vector corresponding to the security label output by the component security detection model and the component security analysis vector constructed when the component security analysis data is processed in the component security detection model, and entering step S3; if the security label is not a label with security issues, indicating that the security issue does not come from the currently selected third-party component, continue to select third-party components from the first component set; until all third-party components in the first component set are traversed, if no security issue label is output, indicating that the security issue does not come from the third-party component of the software, but from the source code of the software. It should be noted that the code content in the software other than the dependent third-party components is called source code; in the initial state, the security label reference vector and the security analysis vector are the security label vector and the software security analysis vector output by the software security detection model, respectively, and the subsequent security label reference vector and the security analysis vector are the component security label vector and the component security analysis vector corresponding to the security label output by the previous component security detection model, respectively;

[0038] Step S3: Nested component security detection;

[0039] The third-party component with a security label as a security issue label is recorded as the target component, the hash value of the target component is calculated, and the second component set of the target component is obtained from the blockchain according to the hash value of the target component. The second component set includes all third-party components in the target component. It should be noted that the third-party component also has dependent third-party components, and the third-party components are continuously nested to build a complete software supply chain. It is judged whether the second component set is empty. If the second component set is empty, it means that the target component has no dependent third-party components, and the security issue comes from the target component. If the second component set is not empty, the third-party components in the second component set are traversed, and the following operations are performed for the selected third-party components: obtain the local input data, local output data and local access database data of the third-party component. It should be noted that when obtaining the local input data, local output data and local access database data corresponding to the third-party component, the target component is obtained by The corresponding local input data, local output data and local access database data are mapped to the selected third-party component, and the local input data, local output data and local access database data of the third-party component are used to form component security analysis data, and the component security analysis data, the security label reference vector and the security analysis vector are sent to the component security detection model for processing, and the security label is output to determine whether the security label is a label with security issues. If the security label is a label with security issues, it means that the security issue comes from the currently selected third-party component, and the process goes to step S3; if the security label is not a label with security issues, it means that the security issue does not come from the currently selected third-party component, and the process continues to select third-party components from the second component set; until all third-party components in the second component set are traversed, if no label with security issues is output, it means that the security issue does not come from the third-party component corresponding to the target component, but comes from the source code of the target component;

[0040] Step S4: Repeat step S3 until the second component set is empty, completing the security tracing of the software supply chain;

[0041] The present application performs security checks on the software, and based on the detected security tags, performs further security checks on the third-party components that the software depends on, and also performs security checks on the third-party components that the third-party components depend on based on the security tags corresponding to the third-party components, thereby achieving security traceability of the software supply chain and responding to attack incidents in the software supply chain in a timely manner. In the process of security tracing of software supply chain components, since security checks are continuously and nestedly performed on third-party components with security issues, there is no need to perform security checks on every line of code corresponding to the software, which can reduce the computational complexity of security checks and improve detection efficiency.

[0042] The construction of blockchain includes the following steps:

[0043] Whenever a user completes the construction of a third-party component, the version number, hash value, and dependent third-party component blocks corresponding to the built third-party component are uploaded to the blockchain. It should be noted that any user participating in the software supply chain will participate in the construction of the blockchain and comply with the consensus mechanism.

[0044] Whenever a user completes the construction of the software, the version number, hash value and dependent third-party components of the built software are uploaded to the blockchain.

[0045] The software security detection model is established based on the BP neural network, including a software security analysis data unification layer, a software security analysis layer and a first security label output layer, wherein the software security analysis data unification layer is established based on the Transformer model with the output layer removed, and is used to process the software security analysis data and construct a software security analysis vector. It should be noted that each time the software security analysis data is input, the length of the software security analysis data is not the same. In order to facilitate the subsequent software security analysis, it is necessary to ensure that the length of the data input to the software security analysis layer is unified, and the software security analysis data unification layer can construct software security analysis data of different lengths into software security analysis vectors of uniform length; the software security analysis layer is established based on the BP neural network, and is used to process the software security analysis vector and generate security labels. The software security analysis layer is consistent with the BP neural network, and also includes an input layer, a hidden layer and an output layer; the first security label output layer is used to output security labels;

[0046] The component safety detection model is also established based on the BP neural network, including a component safety analysis data unification layer, a feature enhancement layer, a feature fusion layer, a component safety analysis layer, and a second safety label output layer. The component safety analysis data unification layer is also established based on the Transformer model with the output layer removed, and is used to process the component safety analysis data and construct the component safety analysis vector to be strengthened. The component safety analysis data unification layer can construct component safety analysis data of different lengths into component safety analysis vectors of uniform length to be strengthened; the feature enhancement layer is used to perform self-attention mechanism operations on the component safety analysis vector to be strengthened through the safety analysis vector, and construct the component safety Analysis vector: The self-attention mechanism operation is performed on the security analysis vector of the component to be strengthened through the security analysis vector output by the previous component security detection model. This can strengthen the data features related to security issues in the security analysis vector of the component to be strengthened and improve the accuracy of security detection. The feature fusion layer is used to splice the component security analysis vector with the security label reference vector to construct the security data vector of the component to be analyzed. The accuracy of security detection is further improved through the prior knowledge of the security label reference vector. The component security analysis layer is also established based on the BP neural network to process the security data vector of the component to be analyzed and generate a security label. The second security label output layer is used to output the security label.

[0047] It should be noted that the Transformer model is used to refer to the self-attention mechanism operation of the security analysis vector of the component to be strengthened, and the query matrix is ​​constructed based on the security analysis vector, and the value matrix and the key matrix are constructed based on the security analysis vector of the component to be strengthened.

[0048] Training software security detection models and component security detection models includes the following steps:

[0049] Obtain software security detection training samples, which include software security analysis data. The software security analysis data here is obtained by developers during the actual use of the software, and the software security detection training samples are labeled with security labels. The security labels here are set by developers based on actual security issues of the software. All labeled software security detection training samples form a software security detection training set, and the software security detection model is trained with the software security detection training set. The software security detection loss value is calculated with the security label as the target, and it is determined whether the software security detection loss value is within a first preset range. The first preset range is set by the developer and is used to characterize the accuracy of the software security detection model. If the software security detection loss value is within the first preset range, the trained software security detection model is output; otherwise, the software security detection model continues to be trained with the software security detection training set;

[0050] Obtain component security detection training samples, which include component security analysis data, security label reference vectors and security analysis vectors. It should be noted that the component security analysis data is obtained by developers based on third-party components of the software actually running. The security label reference vector comes from the security label corresponding to the component security analysis data and is also determined by the developer. The security analysis vector is a software security analysis vector constructed when the software to which the third-party component to which the component security analysis data belongs is processed in the trained software security detection model. The component security detection training samples are labeled by the security label corresponding to the security label reference vector, and all labeled component security detection training samples are formed into a component security detection training set. The component security detection model is trained through the component security detection training set, and the component security detection loss value is calculated with the security label as the target, and it is determined whether the component security detection loss value is within a second preset range. The second preset range is also set by the developer and is used to characterize the accuracy of the component security detection model. If the component security detection loss value is within the second preset range, the trained component security detection model is output; otherwise, the component security detection model continues to be trained through the component security detection training set;

[0051] It should be added that, in the process of training the component security detection model, the trained software security detection model can be used as a blueprint for transfer learning, that is, the component security analysis data unified layer of the component security detection model is initialized and set through the software security analysis data unified layer in the trained software security detection model; and the security analysis vector can come from the component security analysis vector output by the component security detection model after the last training;

[0052] In order to further improve the safety detection accuracy of the component safety detection model, the hyperparameters in the component safety detection model are simulated and set through a swarm optimization algorithm. The specific steps are as follows:

[0053] Construct several hyperparameter individuals, including hyperparameters in the component security detection model, such as the number of hidden layers and the number of hidden layer neural nodes; combine all hyperparameter individuals into a hyperparameter population and set the maximum number of iterations;

[0054] Calculate the fitness of the hyperparameter individual. The specific calculation method is: set the component safety detection model through the hyperparameters in the hyperparameter individual, and then train the set component safety detection model through the component safety detection training set, and use the accuracy of the component safety detection model as the fitness of the hyperparameter individual;

[0055] Based on the fitness of the hyperparameter individuals, the hyperparameter population is iteratively updated through the sparrow search algorithm;

[0056] Until the number of iterations reaches the maximum number of iterations, the hyperparameter individual with the largest fitness is output as the hyperparameter in the component safety detection model;

[0057] Similarly, the hyperparameters in the software security detection model can also be simulated and set through the swarm optimization algorithm.

[0058] It should be understood that those skilled in the art can make improvements or changes based on the above description, and all such improvements and changes should fall within the scope of protection of the appended claims of the present invention. Parts not described in detail in this specification belong to the prior art known to those skilled in the art.

Claims

1. A software supply chain security tracing method based on hash algorithm and blockchain technology, characterized in that: include: Step S1: software security detection; Perform software security detection on the software at preset intervals. The specific operation of the software security detection is: obtain the global input data, global output data and database access data of the software, and then form the global input data, global output data and database access data into software security analysis data, send the software security analysis data into the software security detection model for processing, and output a security label. The security label includes a label with no security issues and a label with security issues. If the security label is a label with no security issues, the software supply chain security traceability operation is not performed; if the security label is not a label with no security issues, output the security label vector corresponding to the security label and the software security analysis vector constructed when the software security analysis data is processed in the software security detection model, and enter step S2; Step S2: initial component safety detection; Calculate the hash value corresponding to the software, and obtain the first component set of the software from the blockchain according to the hash value of the software, the first component set includes all third-party components in the software, traverse the third-party components of the first component set, and perform the following operations for the selected third-party components: obtain the local input data, local output data and local access database data of the third-party components, and form the local input data, local output data and local access database data of the third-party components into component security analysis data, and send the component security analysis data, security label reference vector and security analysis vector to the component security detection model for processing, output the security label, and determine whether the security label is a label with security issues. If the security label is a label with security issues, obtain the component security detection model input The component security label vector corresponding to the security label output and the component security analysis vector constructed when the component security analysis data is processed in the component security detection model enter step S3; if the security label is not a label with security issues, continue to select third-party components from the first component set; until all third-party components in the first component set are traversed, if no security issue labels are output, the security issue comes from the source code of the software; in the initial state, the security label reference vector and the security analysis vector are respectively the security label vector and the software security analysis vector output by the software security detection model, and the subsequent security label reference vector and the security analysis vector are respectively the component security label vector and the component security analysis vector corresponding to the security label output by the previous component security detection model; Step S3: Nested component security detection; The third-party component whose security label is a label with a security problem is recorded as the target component, the hash value of the target component is calculated, and the second component set of the target component is obtained from the blockchain according to the hash value of the target component, the second component set includes all the third-party components in the target component, and it is determined whether the second component set is empty. If the second component set is empty, the security problem comes from the target component. If the second component set is not empty, the third-party components in the second component set are traversed, and the following operations are performed for the selected third-party components: local input data, local output data, and local access database data of the third-party component are obtained, and the local input data, local output data, and local access database data of the third-party component are used to form component security analysis data, and the component security analysis data, the security label reference vector, and the security analysis vector are sent to the component security detection model for processing, and the security label is output. It is determined whether the security label is a label with a security problem. If the security label is a label with a security problem, step S3 is entered; if the security label is not a label with a security problem, third-party components are continuously selected from the second component set; until all third-party components in the second component set are traversed, if no label with a security problem is output, the security problem comes from the source code of the target component; Step S4: Repeat step S3 until the second component set is empty, completing the secure tracing of the software supply chain.

2. The software supply chain security tracing method based on hash algorithm and blockchain technology according to claim 1 is characterized in that: The blockchain in step S2 and step S3 is constructed by the following steps: Whenever a user completes the construction of a third-party component, the version number, hash value, and dependent third-party component blocks corresponding to the built third-party component are uploaded to the blockchain; Whenever a user completes the construction of the software, the version number, hash value and dependent third-party components of the built software are uploaded to the blockchain.

3. The software supply chain security tracing method based on hash algorithm and blockchain technology according to claim 2 is characterized in that: include: The software security detection model includes a software security analysis data unification layer, a software security analysis layer and a first security label output layer, wherein the software security analysis data unification layer is used to process the software security analysis data and construct a software security analysis vector, and the software security analysis data unification layer constructs software security analysis data of different lengths into a software security analysis vector of uniform length; the software security analysis layer is used to process the software security analysis vector and generate a security label; the first security label output layer is used to output a security label; The component safety detection model includes a component safety analysis data unification layer, a feature enhancement layer, a feature fusion layer, a component safety analysis layer and a second safety label output layer, wherein the component safety analysis data unification layer is used to process the component safety analysis data and construct the component safety analysis vector to be enhanced. The component safety analysis data unification layer constructs component safety analysis data of different lengths into component safety analysis vectors to be enhanced of uniform length; the feature enhancement layer is used to perform self-attention mechanism operations on the component safety analysis vector to be enhanced through the safety analysis vector to construct the component safety analysis vector; the feature fusion layer is used to splice the component safety analysis vector with the safety label reference vector to construct the component safety data vector to be analyzed; the component safety analysis layer is used to process the component safety data vector to be analyzed and generate a safety label; the second safety label output layer is used to output the safety label.

4. The software supply chain security tracing method based on hash algorithm and blockchain technology according to claim 3 is characterized in that: Training software security detection models and component security detection models includes the following steps: Obtain software security detection training samples, which include software security analysis data, and annotate the software security detection training samples with security labels, form all annotated software security detection training samples into a software security detection training set, and train a software security detection model with the software security detection training set, calculate a software security detection loss value with the security label as a target, and determine whether the software security detection loss value is within a first preset range. If the software security detection loss value is within the first preset range, output the trained software security detection model; otherwise, continue to train the software security detection model with the software security detection training set; Obtain component safety detection training samples, which include component safety analysis data, safety label reference vectors and safety analysis vectors; label the component safety detection training samples with the safety labels corresponding to the safety label reference vectors; form all labeled component safety detection training samples into a component safety detection training set; train a component safety detection model with the component safety detection training set; calculate a component safety detection loss value with the safety label as a target; determine whether the component safety detection loss value is within a second preset range; if the component safety detection loss value is within the second preset range, output the trained component safety detection model; otherwise, continue to train the component safety detection model with the component safety detection training set.

5. The software supply chain security tracing method based on hash algorithm and blockchain technology according to claim 4 is characterized in that: It also includes simulating and setting the hyperparameters in the component safety detection model through a swarm optimization algorithm. The specific steps are as follows: Construct several hyperparameter individuals, including the hyperparameters in the component safety detection model; combine all hyperparameter individuals into a hyperparameter population, and set the maximum number of iterations; Calculate the fitness of the hyperparameter individuals; Based on the fitness of individual hyperparameters, the hyperparameter population is iteratively updated through a population optimization algorithm; Until the number of iterations reaches the maximum number of iterations, the hyperparameter individual with the largest fitness is output as the hyperparameter in the component safety detection model.

6. The software supply chain security tracing method based on hash algorithm and blockchain technology according to claim 5 is characterized in that: Calculate the fitness of the hyperparameter individual. The specific calculation method is: set the component safety detection model through the hyperparameters in the hyperparameter individual, and then train the set component safety detection model through the component safety detection training set, and use the accuracy of the component safety detection model as the fitness of the hyperparameter individual.

7. The software supply chain security tracing method based on hash algorithm and blockchain technology according to claim 6 is characterized in that: The software security analysis data unification layer and the component security analysis data unification layer are both built based on the Transformer model.

8. The software supply chain security tracing method based on hash algorithm and blockchain technology according to claim 7 is characterized in that: The swarm optimization algorithm uses the sparrow search algorithm.

Images