Software supply chain security detection and situation analysis system

Abstract

The invention relates to the technical field of security detection and situation analysis, discloses a security detection and situation analysis system for a software supply chain, and solves the problems that vulnerabilities in the software supply chain may be maliciously utilized, a security detection system of the system has certain limitation in the aspect of vulnerability detection, early warning and alarm mechanisms are not timely and accurate enough, and the security of the software supply chain is influenced. In order to solve the problems in the prior art that high requirements for software supply chain security are difficult to meet, an early warning and alarm module monitors output results of modules for vulnerability detection, malicious software detection, supply chain relation analysis and the like in real time, when security risks or abnormal conditions are detected, graded evaluation is performed according to preset rules and severity, and the security risk or abnormal conditions are detected. The early-warning and alarming module can quickly send out early-warning and alarming information, so that related personnel can timely know the early-warning and alarming module, the information can be timely and accurately transmitted by establishing interfaces of various notification channels, and an automatic analysis algorithm is adopted to quickly judge the safety condition and determine the early-warning level.

Description

Technical Field

[0001] The present invention relates to the technical field of security detection and situation analysis, and in particular to a software supply chain security detection and situation analysis system. Background Art

[0002] Application systems are generally composed of computer hardware systems, system software, and application software. Computer hardware systems are generally composed of arithmetic units and controllers, memory, peripheral interfaces and peripheral devices, and system software includes operating systems, compilers, database management systems, various high-level languages, etc. Application software in application systems is usually composed of general support software and various application software packages, which constitute the software part that people use directly, such as browsers, chat software, CAD drawing software, etc.

[0003] Generally, the security of system software in computer systems is relatively high, while the security of application software is much lower than that of system software due to its different application purposes, different compilation languages, simple usage functions and other factors; therefore, it is easy to be infected with Trojans and have vulnerabilities during use. Because of this, many anti-virus software were born in the prior art, and their working principle is to traverse the application software in the computer system to find Trojans and vulnerabilities.

[0004] The existing Chinese patent with publication number CN109190374A discloses a software supply chain security detection and situation analysis system. The security detection system of this solution is installed in Windows, Linus, Android, and IOS operating systems, and has a wide range of applications. At the same time, it provides a feature code detection and analysis submodule, a dynamic code security detection submodule, and a common code vulnerability library submodule to traverse the installed application software code at multiple levels and angles, which is better than the existing technology in discovering and clearing vulnerabilities. It can be seen that vulnerabilities in the software supply chain may be maliciously exploited, leading to serious security incidents. The security detection system of this system has certain limitations in vulnerability detection, and the early warning and alarm mechanism is not timely and accurate enough, and it is difficult to meet the high requirements for software supply chain security. Summary of the invention

[0005] To achieve the above objectives, this system is used to work, thereby solving the problem that vulnerabilities in the software supply chain may be maliciously exploited and lead to serious security incidents. The system's security detection system has certain limitations in vulnerability detection, and the early warning and alarm mechanism is not timely and accurate enough, which makes it difficult to meet the high requirements for software supply chain security.

[0006] The present invention provides the following technical solutions: The purpose of the present invention is to provide a software supply chain security detection and situation analysis system, including a data acquisition and detection module, an analysis and evaluation module, and a management response module, wherein the management response module includes an early warning and alarm module, a report generation module, a configuration management module, and an interface module;

[0007] The early warning and alarm module monitors the output results of vulnerability detection, malware detection, and supply chain relationship analysis modules in real time. When security risks or abnormal situations are detected, it conducts graded assessments based on preset rules and severity, and quickly issues early warning and alarm information to ensure that relevant personnel can be informed and take countermeasures in a timely manner. The early warning and alarm module establishes interfaces for multiple notification channels to ensure that information can be conveyed in a timely and accurate manner. It uses automated analysis algorithms to quickly determine security conditions and determine warning levels, and records historical records of early warnings and alarms to facilitate trend analysis and strategy improvement.

[0008] Comprehensive risk score calculation formula:

[0009] R=W V (a*n v *b)+W M (c*d*t m )+W s (e*f*g)+W i

[0010] (h*i)

[0011] in:

[0012] R represents the comprehensive risk score;

[0013] W V is the vulnerability risk weight coefficient;

[0014] V represents the vulnerability risk score, which can be considered comprehensively, namely, the vulnerability severity level a (for example, divided into three levels of high, medium, and low, corresponding to values ​​(3, 2, and 1), the number of vulnerabilities (set to n v ) and the vulnerability exploitability difficulty level is b (also divided into three levels: high, medium, and low, corresponding to the values ​​3, 2, and 1);

[0015] W m is the malware risk weight factor;

[0016] M represents the malware risk score, which takes into account the malware type’s hazard level c (high, medium, and low corresponding to 3, 2, and 1), the spread ability level d (high, medium, and low corresponding to 3, 2, and 1), and the active time in the system (set as t m );

[0017] Ws is the supply chain risk weight coefficient;

[0018] S represents the supply chain risk score, with the comprehensive supplier reliability score being e (high, medium, and low corresponding to 3, 2, and 1), the component source stability level being f (high, medium, and low corresponding to 3, 2, and 1), and the dependency complexity level being g (high, medium, and low corresponding to 3, 2, and 1);

[0019] W i is the interaction risk weight coefficient;

[0020] I represents the interaction risk score between software and external systems, considering the interaction frequency level as h (high, medium, and low corresponding to values ​​3, 2, and 1), and the interaction data sensitivity level as i (high, medium, and low corresponding to values ​​3 and 21);

[0021] Alert level determination formula;

[0022] Set multiple warning level threshold intervals, such as low risk interval [0, T1), medium risk interval [T1, Tm), high risk interval [Tm, +∞);

[0023] If R is in the low-risk range, the warning level is a low-level warning; if R is in the medium-risk range, the warning level is a medium-level warning; if R is in the high-risk range, the warning level is a high-level warning and an alarm is triggered;

[0024] The report generation module generates detailed security detection reports and analysis reports by integrating data and analysis results from various modules of the system, providing clear and accurate vulnerability lists, risk assessment results, supply chain relationship diagrams and other contents, supporting report output in different formats to meet the needs of different users. It collects data from vulnerability detection, malware detection, supply chain relationship analysis, risk assessment and other modules, organizes and analyzes the data, extracts key information, and generates reports containing vulnerability details, risk levels, recommended measures and other contents according to preset report templates, and provides functions for downloading, printing and online viewing of reports;

[0025] The configuration management module is used for system configuration and parameter settings to meet the needs of different organizations and environments. It can adjust the configuration of data sources, the definition of detection rules, warning thresholds, etc., manage user permissions and system access control, ensure the security of the system, provide a user interface, and allow administrators to easily configure the system. According to user input, the system configuration parameters are updated, and configuration changes are verified and tested to ensure the normal operation of the system. The history of configuration changes is recorded for traceability and auditing;

[0026] The interface module realizes data sharing and collaborative work by providing an interface with other security systems or tools. It can be integrated with the enterprise's security information and event management system (SIEM), vulnerability management system, etc., to expand the system's functions and application scope, improve the efficiency of overall security management, define standardized interface protocols, ensure compatibility with other systems, receive data requests from other systems, process and convert data, output system data to other systems, realize data sharing, monitor the operating status of the interface, and handle interface failures in a timely manner.

[0027] Preferably, when the early warning and alarm module finds a risk, it first evaluates the vulnerability. The evaluation factors include the severity of the vulnerability (such as high risk, medium risk, low risk), the scope of impact (involved software components, system modules, etc.), and the availability (how easy it is to be attacked);

[0028] Vulnerabilities are graded based on the assessment results, and the levels of warning and alarm are determined. Different warning rules are set according to the level of the vulnerability. For example, for high-risk vulnerabilities, emergency alarms can be triggered immediately, and relevant personnel can be notified through multiple channels (such as emails, SMS, system pop-ups) at the same time, and alarms are continuously sent until they are confirmed to be processed.

[0029] For medium-risk vulnerabilities, early warning notifications can be issued in a relatively short period of time to remind relevant personnel to pay attention and handle them in a timely manner; for low-risk vulnerabilities, reminders can be issued after regular summary, and multiple alarm channels can be configured to ensure that relevant personnel can be notified in a timely manner in different situations;

[0030] In addition to common email and SMS notifications, it can also be integrated with instant messaging tools, internal enterprise security management platforms, etc. to achieve rapid response;

[0031] At the same time, the alarm channels are monitored in real time to ensure that they are unobstructed. Finally, each warning and alarm situation is recorded. The warning records include vulnerability information, trigger time, notification object, and processing status. By analyzing the warning history records, the trends and patterns of vulnerabilities can be discovered, providing a basis for further optimizing the warning and alarm mechanism.

[0032] Preferably, the data collection and detection module includes a data collection module, a vulnerability detection module and a malware detection module;

[0033] The data acquisition module collects relevant data from various links of the software supply chain to provide comprehensive and accurate basic information for subsequent detection and analysis, ensuring the real-time, completeness and accuracy of the data so as to timely discover potential security risks. The data acquisition module provides a data basis for the vulnerability detection module and the malware detection module. The vulnerability detection module and the malware detection module cooperate with each other to jointly discover security risks in the software supply chain. The vulnerability detection module mainly focuses on the vulnerabilities of the software and its components, while the malware detection module mainly focuses on the malware in the software supply chain.

[0034] Preferably, the vulnerability detection module conducts comprehensive vulnerability scanning and analysis on the software and its components to timely discover potential security vulnerabilities, reduce the risk of attack, and provide a detailed vulnerability report. The analysis results include information such as vulnerability type, severity, and impact range, providing guidance for vulnerability repair.

[0035] Preferably, the malware detection module prevents malware from being mixed into software products by detecting whether there is malware, such as viruses, Trojans, and backdoor programs, in the software supply chain, and provides detailed information on the malware. The analysis results include types, characteristics, and propagation methods, providing support for the removal and prevention of malware.

[0036] Preferably, the configuration management module includes an analysis and evaluation module including a supply chain relationship analysis module, a risk assessment module and a situation awareness module. The supply chain relationship analysis module provides basic information for the risk assessment module and the situation awareness module, and determines potential risk propagation paths by combing supply chain relationships and analyzing dependencies, providing input for risk assessment. The risk assessment module quantitatively evaluates the risks of the software supply chain based on the results of the supply chain relationship analysis and other security data. The evaluation results provide the situation awareness module with quantitative indicators of the current security status. The situation awareness module uses the results of the supply chain relationship analysis and risk assessment to monitor the security situation in real time, and the results of the situation awareness can be fed back to the supply chain relationship analysis and risk assessment modules;

[0037] The supply chain relationship analysis module comprehensively sorts out the relationships between various entities in the software supply chain, including software developers, suppliers, distributors, users, etc., analyzes the dependencies between software components, determines the position and role of key components and various entities in the supply chain, and identifies potential risk propagation paths so that security issues can be quickly located and resolved when they arise.

[0038] Preferably, the risk assessment module quantitatively assesses the security risks in the software supply chain, determines the severity and impact of the risks, provides a scientific basis for formulating risk response strategies, and helps enterprises to reasonably allocate security resources.

[0039] Preferably, the situation awareness module monitors the security situation of the software supply chain in real time, promptly discovers security incidents and abnormal situations, and provides a visual situation display to help enterprises intuitively understand the security status of the software supply chain, predict the development trend of the security situation, and provide a reference for taking preventive measures in advance.

[0040] Preferably, the situation awareness module collects relevant data, conducts a preliminary analysis of vulnerability risks, malware risks, supply chain relationship risks, and the effectiveness of current security measures, determines the initial state of each factor, and determines the weight coefficient (W) of each factor in combination with the characteristics of the software supply chain, enterprise security policies, and expert opinions. L , W M , W R , W C ), these weight coefficients can be dynamically adjusted according to actual conditions.

[0041] Preferably, the comprehensive situation calculation formula of the situation awareness module is as follows:

[0042] S=w l (u*v)*w m (w*x)*w r (y*z*a1)*w c (b1*

[0043] c1*d1)

[0044] in:

[0045] S represents the comprehensive situation value;

[0046] w l is the vulnerability risk weight coefficient;

[0047] L represents the vulnerability risk situation score, which can be calculated based on factors such as the number of vulnerabilities, vulnerability severity, and vulnerability repair progress. For example,

[0048] Where n1 is the number of vulnerabilities, u is a coefficient set according to the severity of the vulnerabilities, and v is the vulnerability repair progress coefficient;

[0049] w m is the malware risk weight factor;

[0050] M represents the malware risk situation score, which can be calculated by considering factors such as the number of malware, the degree of harm of malware types, and the frequency of malware detection;

[0051] where n m is the number of malware, w is the coefficient of malware type harm degree, and x is the coefficient of malware detection frequency;

[0052] wr is the risk weight coefficient of the supply chain relationship;

[0053] R represents the supply chain relationship risk situation score, which can be calculated by comprehensively considering factors such as supplier stability, component dependency complexity, and supply chain disruption possibility, and corresponds to supplier stability coefficient y, component dependency complexity coefficient z, and supply chain disruption possibility coefficient a1 respectively;

[0054] w c is the weight coefficient of the effectiveness of the current safety measures;

[0055] C represents the current security measure effectiveness status score, which can be calculated based on factors such as security policy execution, security tool operation status, and personnel safety awareness. It corresponds to the security policy execution coefficient b1, the security tool operation status coefficient c1, and the personnel safety awareness coefficient d1 respectively.

[0056] Compared with the prior art, the present invention has the following beneficial effects:

[0057] The present invention proposes a software supply chain security detection and situation analysis system. The system uses an early warning and alarm module to monitor the output results of modules such as vulnerability detection, malware detection, and supply chain relationship analysis in real time. When a security risk or abnormal situation is detected, a graded assessment is performed according to preset rules and severity, and early warning and alarm information is quickly issued to ensure that relevant personnel can know and take countermeasures in time. The early warning and alarm module ensures that information can be transmitted in a timely and accurate manner by establishing interfaces for multiple notification channels, and adopts an automated analysis algorithm to quickly judge the security status and determine the warning level, and record the historical records of early warnings and alarms to facilitate trend analysis and strategy improvement. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 It is a schematic diagram of the overall process of the software supply chain security detection and situation analysis method of the present invention;

[0059] Figure 2 A schematic diagram of the software supply chain security detection and situation analysis system of the present invention;

[0060] Figure 3 A monitoring flow diagram of the vulnerability analysis module of the present invention; DETAILED DESCRIPTION

[0061] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0062] like Figure 1-3 As shown, a software supply chain security detection and situation analysis system includes a data collection and detection module, an analysis and evaluation module, and a management response module. The management response module includes an early warning and alarm module, a report generation module, a configuration management module, and an interface module;

[0063] The early warning and alarm module monitors the output results of vulnerability detection, malware detection, and supply chain relationship analysis modules in real time. When security risks or abnormal situations are detected, it conducts graded assessments based on preset rules and severity, and quickly issues early warning and alarm information to ensure that relevant personnel can be informed and take countermeasures in a timely manner. The early warning and alarm module establishes interfaces for multiple notification channels to ensure that information can be conveyed in a timely and accurate manner. It uses automated analysis algorithms to quickly determine security conditions and determine warning levels, and records historical records of early warnings and alarms to facilitate trend analysis and strategy improvement.

[0064] Comprehensive risk score calculation formula:

[0065] R=W V (a*n v *b)+W M (c*d*t m )+W s (e*f*g)+W i

[0066] (h*i)

[0067] in:

[0068] R represents the comprehensive risk score;

[0069] W V is the vulnerability risk weight coefficient;

[0070] V represents the vulnerability risk score, which can be considered comprehensively, namely, the vulnerability severity level a (for example, divided into three levels of high, medium, and low, corresponding to values ​​(3, 2, and 1), the number of vulnerabilities (set to n v ) and the vulnerability exploitability difficulty level is b (also divided into three levels: high, medium, and low, corresponding to the values ​​3, 2, and 1);

[0071] W m is the malware risk weight factor;

[0072] M represents the malware risk score, which takes into account the malware type’s hazard level c (high, medium, and low corresponding to 3, 2, and 1), the spread ability level d (high, medium, and low corresponding to 3, 2, and 1), and the active time in the system (set as t m );

[0073] W s is the supply chain risk weight coefficient;

[0074] S represents the supply chain risk score, with the comprehensive supplier reliability score being e (high, medium, and low corresponding to 3, 2, and 1), the component source stability level being f (high, medium, and low corresponding to 3, 2, and 1), and the dependency complexity level being g (high, medium, and low corresponding to 3, 2, and 1);

[0075] W i is the interaction risk weight coefficient;

[0076] I represents the interaction risk score between software and external systems, considering the interaction frequency level as h (high, medium, and low corresponding to values ​​3, 2, and 1), and the interaction data sensitivity level as i (high, medium, and low corresponding to values ​​3 and 21);

[0077] Alert level determination formula;

[0078] Set multiple warning level threshold intervals, such as low risk interval [0, T1), medium risk interval [T1, Tm), high risk interval [Tm, +∞);

[0079] If R is in the low-risk range, the warning level is a low-level warning; if R is in the medium-risk range, the warning level is a medium-level warning; if R is in the high-risk range, the warning level is a high-level warning and an alarm is triggered;

[0080] The report generation module generates detailed security detection reports and analysis reports by integrating the data and analysis results of various modules of the system, providing clear and accurate vulnerability lists, risk assessment results, supply chain relationship diagrams and other contents, supporting report output in different formats to meet the needs of different users. It collects data from vulnerability detection, malware detection, supply chain relationship analysis, risk assessment and other modules, organizes and analyzes the data, extracts key information, and generates reports containing vulnerability details, risk levels, recommended measures and other contents according to the preset report templates, and provides report download, printing and online viewing functions;

[0081] The configuration management module is used to configure and set parameters of the system to meet the needs of different organizations and environments. It can adjust the configuration of data sources, the definition of detection rules, warning thresholds, etc. It manages user permissions and system access control to ensure the security of the system, provides a user interface for administrators to easily configure the system, updates the system configuration parameters based on user input, verifies and tests configuration changes to ensure the normal operation of the system, and records the history of configuration changes for traceability and auditing;

[0082] The interface module realizes data sharing and collaborative work by providing interfaces with other security systems or tools. It can be integrated with the enterprise's security information and event management system (SIEM), vulnerability management system, etc., to expand the system's functions and application scope, improve the efficiency of overall security management, define standardized interface protocols, ensure compatibility with other systems, receive data requests from other systems, process and convert data, output system data to other systems, realize data sharing, monitor the operating status of the interface, and handle interface failures in a timely manner.

[0083] When the early warning and alarm module discovers a risk, it first evaluates the vulnerability. The evaluation factors include the severity of the vulnerability (such as high risk, medium risk, low risk), the scope of impact (involved software components, system modules, etc.), and the exploitability (how easy it is to be attacked);

[0084] Vulnerabilities are graded based on the assessment results, and the levels of warning and alarm are determined. Different warning rules are set according to the level of the vulnerability. For example, for high-risk vulnerabilities, emergency alarms can be triggered immediately, and relevant personnel can be notified through multiple channels (such as emails, SMS, system pop-ups) at the same time, and alarms are continuously sent until they are confirmed to be processed.

[0085] For medium-risk vulnerabilities, early warning notifications can be issued in a relatively short period of time to remind relevant personnel to pay attention and handle them in a timely manner; for low-risk vulnerabilities, reminders can be issued after regular summary, and multiple alarm channels can be configured to ensure that relevant personnel can be notified in a timely manner in different situations;

[0086] In addition to common email and SMS notifications, it can also be integrated with instant messaging tools, internal enterprise security management platforms, etc. to achieve rapid response;

[0087] At the same time, the alarm channels are monitored in real time to ensure that they are unobstructed. Finally, each warning and alarm situation is recorded. The warning records include vulnerability information, trigger time, notification object, and processing status. By analyzing the warning history records, the trends and patterns of vulnerabilities can be discovered, providing a basis for further optimizing the warning and alarm mechanism.

[0088] The data collection and detection module includes a data collection module, a vulnerability detection module and a malware detection module;

[0089] The data collection module collects relevant data from all links of the software supply chain to provide comprehensive and accurate basic information for subsequent testing and analysis, ensuring the real-time, completeness and accuracy of the data so as to timely discover potential security risks.

[0090] The vulnerability detection module conducts comprehensive vulnerability scanning and analysis on the software and its components to timely discover potential security vulnerabilities, reduce the risk of attack, and provide detailed vulnerability reports. The analysis results include information such as vulnerability type, severity, and impact range, providing guidance for vulnerability repair.

[0091] The malware detection module prevents malware from being mixed into software products by detecting whether there is malware in the software supply chain, such as viruses, Trojans, and backdoor programs. It provides detailed information about malware, including type, characteristics, and propagation methods, to provide support for the removal and prevention of malware.

[0092] The configuration management module includes analysis and evaluation modules including supply chain relationship analysis module, risk assessment module and situation awareness module;

[0093] The supply chain relationship analysis module provides basic information for the risk assessment module and the situation awareness module, sorts out supply chain relationships and analyzes dependencies, determines potential risk transmission paths, and provides input for risk assessment. The risk assessment module conducts quantitative assessment of the risks of the software supply chain based on the results of the supply chain relationship analysis and other security data. The assessment results provide the situation awareness module with quantitative indicators of the current security status. The situation awareness module uses the results of the supply chain relationship analysis and risk assessment to monitor the security situation in real time. The results of situation awareness can be fed back to the supply chain relationship analysis and risk assessment modules;

[0094] The supply chain relationship analysis module comprehensively sorts out the relationships between various entities in the software supply chain, including software developers, suppliers, distributors, users, etc., analyzes the dependencies between software components, determines key components and their positions and functions in the supply chain, and identifies potential risk transmission paths so that security issues can be quickly located and resolved when they arise.

[0095] The risk assessment module conducts a quantitative assessment of security risks in the software supply chain, determines the severity and scope of risks, provides a scientific basis for formulating risk response strategies, and helps companies allocate security resources rationally.

[0096] The situation awareness module monitors the security situation of the software supply chain in real time, promptly detects security incidents and abnormal situations, and provides a visual situation display to help enterprises intuitively understand the security status of the software supply chain, predict the development trend of the security situation, and provide a reference for taking preventive measures in advance.

[0097] The situation awareness module collects relevant data, conducts preliminary analysis on vulnerability risks, malware risks, supply chain relationship risks, and the effectiveness of current security measures, determines the initial state of each factor, and determines the weight coefficient (W) of each factor based on the characteristics of the software supply chain, enterprise security strategies, and expert opinions.L , W M , W R , W C ), these weight coefficients can be dynamically adjusted according to actual conditions.

[0098] The comprehensive situation calculation formula of the situation awareness module is as follows:

[0099] S=w l (u*v)*w m (w*x)*w r (y*z*a1)*w c (b1*

[0100] c1*d1)

[0101] in:

[0102] S represents the comprehensive situation value;

[0103] w l is the vulnerability risk weight coefficient;

[0104] L represents the vulnerability risk situation score, which can be calculated based on factors such as the number of vulnerabilities, vulnerability severity, and vulnerability repair progress. For example,

[0105] Where n1 is the number of vulnerabilities, u is a coefficient set according to the severity of the vulnerabilities, and v is the vulnerability repair progress coefficient;

[0106] w m is the malware risk weight factor;

[0107] M represents the malware risk situation score, which can be calculated by considering factors such as the number of malware, the degree of harm of malware types, and the frequency of malware detection;

[0108] where n m is the number of malware, w is the coefficient of malware type harm degree, and x is the coefficient of malware detection frequency;

[0109] w r is the risk weight coefficient of the supply chain relationship;

[0110] R represents the supply chain relationship risk situation score, which can be calculated by comprehensively considering factors such as supplier stability, component dependency complexity, and supply chain disruption possibility, and corresponds to supplier stability coefficient y, component dependency complexity coefficient z, and supply chain disruption possibility coefficient a1 respectively;

[0111] w c is the weight coefficient of the effectiveness of the current safety measures;

[0112] C represents the current security measure effectiveness status score, which can be calculated based on factors such as security policy execution, security tool operation status, and personnel safety awareness. It corresponds to the security policy execution coefficient b1, the security tool operation status coefficient c1, and the personnel safety awareness coefficient d1 respectively.

[0113] Working principle: In the software supply chain security detection and situation analysis system, each module works closely together. The data collection module provides basic data for other modules. The vulnerability detection module uses the source code and component information it collects to scan vulnerabilities. The malware detection module checks for malware based on software features. The supply chain relationship analysis module builds a graph based on supplier information. The vulnerability detection and malware detection modules feed back the results to the risk assessment and situation awareness modules. The risk assessment module combines this information to quantify the risk, and the situation awareness module updates the security situation value accordingly. The supply chain relationship analysis module provides relationship information for risk assessment and helps determine the risk propagation path. The early warning alarm module issues an alarm based on the situation awareness and risk assessment results. The report generation module integrates the data of each module to generate a report. The configuration management module adjusts the parameters of each module. The interface module realizes data sharing with other systems to jointly ensure the security of the software supply chain.

[0114] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0115] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A software supply chain security detection and situation analysis system, including a data collection and detection module, an analysis and evaluation module, and a management and response module, characterized in that: The management response module includes an early warning and alarm module, a report generation module, a configuration management module and an interface module. The early warning and alarm module monitors security risks in real time and issues early warning and alarm information in a timely manner to provide protection for the security management of the system. The report generation module generates a detailed security report based on the detection and analysis results of the system to provide a basis for security decision-making and management. The configuration management module performs configuration management on the system to improve the flexibility and scalability of the system. The interface module provides an interface with other systems to achieve data sharing and collaborative work and improve the overall efficiency of the system. The early warning and alarm module uses an automated analysis algorithm to quickly determine the security status and the early warning level by real-time monitoring of the output results of the vulnerability detection, malware detection and supply chain relationship analysis modules, and records the historical records of early warnings and alarms to facilitate trend analysis and strategy improvement; The automated analysis algorithm formula is as follows: R=W V (a*n v *b)+W M (c*d*t m )+W s (e*f*g)+W i (h*i) in: R represents the comprehensive risk score, W V is the vulnerability risk weight coefficient, V represents the vulnerability risk score, the vulnerability severity level is a, and the number of vulnerabilities is n v , and the vulnerability can be exploited with difficulty level b, W m is the malware risk weight coefficient, M represents the malware risk score, considering that the malware type has a hazard level of c, a propagation capability level of d, and an active time in the system of t m , W s is the supply chain risk weight coefficient, S represents the supply chain risk score, the comprehensive supplier reliability score is e, the component source stability level is f, and the dependency complexity level is g, W i is the interaction risk weight coefficient, I represents the interaction risk score between the software and the external system, considering the interaction frequency level as h and the interaction data sensitivity level as i; Alert level determination formula; Set multiple warning level threshold intervals, low risk interval [0, T1), medium risk interval [T1, Tm), high risk interval [Tm, +∞); If R is in the low-risk range, the warning level is a low-level warning; if R is in the medium-risk range, the warning level is a medium-level warning; if R is in the high-risk range, the warning level is a high-level warning and an alarm is triggered; The report generation module generates security detection reports and analysis reports by integrating the data and analysis results of various modules of the system, providing vulnerability lists, risk assessment results, and supply chain relationship diagrams, and supports report output in different formats; The configuration management module is used for system configuration and parameter settings to meet the needs of different organizations and environments. It can adjust the configuration of data sources, the definition of detection rules, warning thresholds, manage user permissions and system access control; The interface module realizes data sharing and collaborative work by providing interfaces with other security systems or tools, and can collaborate with the enterprise's security information and event management system and vulnerability management system to expand the system's functions and application scope.

2. A software supply chain security detection and situation analysis system according to claim 1, characterized in that: When the early warning and alarm module discovers a risk, it first evaluates the vulnerability, and the evaluation factors include the severity, impact scope, and exploitability of the vulnerability; Vulnerabilities are graded based on the assessment results, and the levels of warning and alarm are determined. Different warning rules are set according to the level of the vulnerability. For high-risk vulnerabilities, emergency alarms can be triggered immediately, and relevant personnel can be notified through multiple channels at the same time. Alarms are continuously sent until they are confirmed to be processed; For medium-risk vulnerabilities, early warning notifications can be issued in a relatively short period of time to remind relevant personnel to pay attention and handle them in a timely manner. For low-risk vulnerabilities, reminders can be given after regular summary. At the same time, multiple alarm channels can be configured to notify relevant personnel in a timely manner in different situations. In addition to common email and SMS notifications, it can also be integrated with instant messaging tools and the company's internal security management platform to achieve response; At the same time, the alarm channels are monitored in real time to ensure that they are unobstructed. Finally, each warning and alarm situation is recorded. The warning records include vulnerability information, trigger time, notification object, and processing status. By analyzing the warning history records, the trends and patterns of vulnerabilities can be discovered, providing a basis for further optimizing the warning and alarm mechanism.

3. A software supply chain security detection and situation analysis system according to claim 1, characterized in that: The data collection and detection module includes a data collection module, a vulnerability detection module and a malware detection module. The data collection module provides a data basis for the vulnerability detection module and the malware detection module. The vulnerability detection module and the malware detection module cooperate with each other to jointly discover security risks in the software supply chain. The vulnerability detection module mainly focuses on the vulnerabilities of the software and its components, while the malware detection module mainly focuses on the malware in the software supply chain.

4. A software supply chain security detection and situation analysis system according to claim 1, characterized in that: The vulnerability detection module conducts comprehensive vulnerability scanning and analysis on the software and its components to timely discover potential security vulnerabilities, reduce the risk of being attacked, and provide a detailed vulnerability report. The analysis results include vulnerability type, severity, and impact range information.

5. A software supply chain security detection and situation analysis system according to claim 1, characterized in that: The malware detection module detects whether there is malware in the software supply chain to prevent malware from being mixed into software products, provides detailed information on malware, and analyzes the results including type, characteristics, and propagation methods to strengthen the removal and prevention of malware.

6. A software supply chain security detection and situation analysis system according to claim 4, characterized in that: The configuration management module includes an analysis and evaluation module, including a supply chain relationship analysis module, a risk assessment module and a situation awareness module. The supply chain relationship analysis module provides basic information for the risk assessment module and the situation awareness module, sorts out supply chain relationships and analyzes dependencies, determines potential risk propagation paths, and provides input for risk assessment. The risk assessment module quantitatively evaluates the risks of the software supply chain based on the results of the supply chain relationship analysis and other security data. The evaluation results provide the situation awareness module with quantitative indicators of the current security status. The situation awareness module uses the results of the supply chain relationship analysis and risk assessment to monitor the security situation in real time. The results of the situation awareness can be fed back to the supply chain relationship analysis and risk assessment modules; The supply chain relationship analysis module comprehensively sorts out the relationships between various entities in the software supply chain, including software developers, suppliers, distributors, and users, analyzes the dependencies between software components, determines the positions and functions of key components and various entities in the supply chain, and identifies potential risk transmission paths.

7. A software supply chain security detection and situation analysis system according to claim 1, characterized in that: The risk assessment module determines the severity and impact of the risks by quantitatively assessing the security risks in the software supply chain.

8. A software supply chain security detection and situation analysis system according to claim 6, characterized in that: The situation awareness module monitors the security situation of the software supply chain in real time, promptly discovers security incidents and abnormal situations, and provides a visual situation display.

9. A software supply chain security detection and situation analysis system according to claim 7, characterized in that: The situation awareness module collects relevant data, conducts a preliminary analysis of vulnerability risks, malware risks, supply chain relationship risks, and the effectiveness of current security measures, determines the initial state of each factor, and determines the weight coefficient of each factor as W based on the characteristics of the software supply chain. L , W M , W R , W C .

10. A software supply chain security detection and situation analysis system according to claim 8, characterized in that: The comprehensive situation calculation formula of the situation awareness module is as follows: S=w l (u*v)*w m (w*x)*w r (y*z*a1)*w c (b1* c1*d1) in: S represents the comprehensive situation value, w l is the vulnerability risk weight coefficient, L represents the vulnerability risk situation score, where n1 is the number of vulnerabilities, u is the coefficient set according to the severity of the vulnerability, v is the vulnerability repair progress coefficient, and w m is the malware risk weight coefficient, M represents the malware risk situation score, where n m is the number of malware, w is the malware type harm coefficient, x is the malware detection frequency coefficient, and w r is the risk weight coefficient of the supply chain relationship; R represents the risk situation score of the supply chain relationship, which corresponds to the supplier stability coefficient y, the component dependency complexity coefficient z, and the supply chain interruption possibility coefficient a1, w c is the weight coefficient of the effectiveness of the current security measures, and C represents the current security measures effectiveness status score, which respectively correspond to the security policy execution coefficient b1, the security tool operation status coefficient c1, and the personnel safety awareness coefficient d1.

Images