Risk detection method and apparatus

Abstract

Embodiments of the present specification provide a risk detection method and device, wherein the risk detection method comprises: obtaining feature data generated by a target software product in a plurality of target feature dimensions, the plurality of target feature dimensions being obtained by analyzing historical risk data of the target software product; for any target feature dimension, using a risk analysis strategy corresponding to the target feature dimension to analyze the feature data generated in the target feature dimension, and obtaining a risk estimate of the target feature dimension; and determining a risk detection result of the target software product according to the risk estimates of the plurality of target feature dimensions. The above method can improve the accuracy of risk detection by obtaining target feature dimensions with a relatively high correlation with the risk of the target software through analysis of the historical risk data of the target software product, and determining the risk detection result of the target software product through the feature data generated in the plurality of target feature dimensions.

Description

TECHNICAL FIELD

[0001] Embodiments of the present specification relate to the technical field of computer technology, and particularly relate to a risk detection method. BACKGROUND

[0002] The life cycle of a software product includes stages such as design, production, delivery, deployment, use and operation, and stop. The division of labor, joint research, platform environment and the like involved in the life cycle are the main content of the software supply chain, and the main attack types of the software supply chain are closely related to these links. In recent years, security attack events targeting the software supply chain have been growing rapidly, causing increasingly serious harm, and the development of software products cannot be separated from the software supply chain, so it is necessary to detect the risks of software products.

[0003] Currently, the risks of software products are detected by code scanning, which may fail to obtain detection results, so there is an urgent need for a more accurate and efficient way to detect the risks of software products. SUMMARY

[0004] Therefore, the embodiments of the present specification provide a risk detection method. One or more embodiments of the present specification also relate to a risk detection apparatus, a computing device, a computer-readable storage medium, and a computer program to solve the technical defects in the prior art.

[0005] According to a first aspect of the embodiments of the present specification, a risk detection method is provided, comprising:

[0006] Obtaining feature data generated by a target software product under a plurality of target feature dimensions, the plurality of target feature dimensions being obtained by analyzing historical risk data of the target software product;

[0007] For any target feature dimension, using a risk analysis strategy corresponding to the target feature dimension to analyze the feature data generated under the target feature dimension, and obtaining a risk estimate of the target feature dimension;

[0008] According to the risk estimates of the plurality of target feature dimensions, determining a risk detection result of the target software product.

[0009] In one or more embodiments of the present specification, according to the risk estimates of the plurality of target feature dimensions, determining a risk detection result of the target software product, comprising:

[0010] According to the risk estimates of the plurality of target feature dimensions, determining a risk metric value of the target software product;

[0011] Based on the risk metric value of the target software product, determining a risk detection result of the target software product.

[0012] In one or more embodiments of the present specification, determining the risk metric value of the target software product according to the risk estimation of the plurality of target feature dimensions comprises:

[0013] determining a risk weight of each target feature dimension;

[0014] determining the risk metric value of the target software product based on the risk estimation of each target feature dimension and the risk weight of the target feature dimension.

[0015] In one or more embodiments of the present specification, determining the risk weight of each target feature dimension comprises:

[0016] obtaining historical risk data of a plurality of sample software products, the historical risk data comprising a risk detection result of the sample software product and feature data generated by the sample software product under a plurality of target feature dimensions;

[0017] for any sample software product, determining a risk metric value of the sample software product based on a preset weight of each target feature dimension and the feature data generated under the target feature dimension;

[0018] adjusting the preset weight based on the risk metric value and the risk detection result of the plurality of sample software products until the risk metric value of the preset number of sample software products matches the risk detection result of the sample software product, to obtain the risk weight of each target feature dimension.

[0019] In one or more embodiments of the present specification, determining the risk detection result of the target software product based on the risk metric value of the target software product comprises:

[0020] obtaining a risk threshold and comparing the risk metric value of the target software product with the risk threshold;

[0021] if the risk metric value is greater than the risk threshold, determining that the risk detection result of the target software product is at risk.

[0022] In one or more embodiments of the present specification, obtaining a risk threshold comprises:

[0023] obtaining historical risk data of a plurality of sample software products, the historical risk data comprising a risk detection result of the sample software product and feature data generated by the sample software product under a plurality of target feature dimensions;

[0024] for any sample software product, determining a risk metric value of the sample software product based on a preset weight of each target feature dimension and the feature data generated under the target feature dimension;

[0025] determine a risk prediction result of each sample software product based on the risk measurement value of each sample software product and the preset risk threshold value;

[0026] adjust the preset risk threshold value based on the risk prediction result and the risk detection result of each sample software product until the risk prediction result and the risk detection result of the preset number of software products are consistent, and obtain the risk threshold value.

[0027] In one or more embodiments of the present specification, before obtaining the feature data generated by the target software product under the plurality of target feature dimensions, the method further comprises:

[0028] obtaining historical risk data of the target software product, the historical risk data comprising historical feature data generated by the target software product under a plurality of feature dimensions, the target software product comprising a plurality of software products of the same category;

[0029] analyzing the historical feature data of the plurality of feature dimensions to obtain variation rules of each feature dimension in the plurality of software products;

[0030] counting the number of times that the variation rule of the first feature dimension in the plurality of software products is the same, and if the number is greater than a preset number, determining the first feature dimension as the target feature dimension, the first feature dimension being any feature dimension in the plurality of feature dimensions.

[0031] In one or more embodiments of the present specification, the risk analysis strategy comprises a feature value conversion strategy and a risk estimation strategy; using the risk analysis strategy corresponding to the target feature dimension, performing risk analysis on the feature data generated under the target feature dimension to obtain a risk estimation of the target feature dimension, comprising:

[0032] using the feature value conversion strategy corresponding to the target feature dimension, determining the feature value corresponding to the target feature dimension based on the feature data generated under the target feature dimension;

[0033] using the risk estimation strategy corresponding to the target feature dimension, determining the risk estimation of the target feature dimension based on the feature value corresponding to the target feature dimension.

[0034] According to a second aspect of an embodiment of the present specification, a risk detection device is provided, comprising:

[0035] an obtaining module configured to obtain feature data generated by a target software product under a plurality of target feature dimensions, the plurality of target feature dimensions being obtained by analyzing historical risk data of the target software product;

[0036] The risk analysis module is configured to, for any target feature dimension, adopt a risk analysis strategy corresponding to the target feature dimension, perform risk analysis on feature data generated under the target feature dimension, and obtain a risk estimate of the target feature dimension.

[0037] The determination module is configured to determine a risk detection result of the target software product according to the risk estimates of the plurality of target feature dimensions.

[0038] According to a third aspect of an embodiment of the present specification, a computing device is provided, comprising:

[0039] a memory and a processor;

[0040] The memory is configured to store computer-executable instructions, and the processor is configured to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the above risk detection method are implemented.

[0041] According to a fourth aspect of an embodiment of the present specification, a computer-readable storage medium is provided, which stores computer-executable instructions. When the computer-executable instructions are executed by a processor, the steps of the above risk detection method are implemented.

[0042] According to a fifth aspect of an embodiment of the present specification, a computer program is provided. When the computer program is executed in a computer, the computer is caused to execute the steps of the above risk detection method.

[0043] One embodiment of the present specification realizes obtaining feature data generated under a plurality of target feature dimensions of a target software product, the plurality of target feature dimensions being obtained by analyzing historical risk data of the target software product; for any target feature dimension, adopting a risk analysis strategy corresponding to the target feature dimension, performing risk analysis on feature data generated under the target feature dimension, and obtaining a risk estimate of the target feature dimension; and determining a risk detection result of the target software product according to the risk estimates of the plurality of target feature dimensions. The above method obtains target feature dimensions that have a relatively high correlation with whether the target software product has risks according to analysis of historical risk data of the target software product, and determines the risk detection result of the target software product through feature data generated under the plurality of target feature dimensions, thereby improving the accuracy of risk detection. BRIEF DESCRIPTION OF DRAWINGS

[0044] Figure 1 is a flowchart of a risk detection method provided by one embodiment of the present specification;

[0045] Figure 2 is a process flowchart of a risk detection method provided by one embodiment of the present specification;

[0046] Figure 3is a structural schematic diagram of a risk detection device provided by an embodiment of the present specification.

[0047] Figure 4 is a structural block diagram of a computing device provided by an embodiment of the present specification. DETAILED DESCRIPTION

[0048] In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present specification. However, the present specification can be practiced without the specific details, other than in the examples described herein. Those of ordinary skill in the art, and others, can readily ascertain how to make and use the present specification in accordance with the following description and accompanying drawings.

[0049] The terminology used in one or more embodiments of the present specification is for the purpose of describing particular embodiments only and is not intended to be limiting of one or more embodiments of the present specification. As used in one or more embodiments of the present specification and the accompanying claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in one or more embodiments of the present specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0050] It will be understood that, although the terms first, second, etc. can be used herein to describe various information, these terms are not intended to denote a temporal or chronological order. Rather, these terms are used solely to distinguish one from another only. For example, without departing from the scope of one or more embodiments of the present specification, first can be termed second, and similarly, second can be termed first. Depending on the context, the word "if' as used herein can be interpreted to mean "when" or "in response to determining."

[0051] First, the noun terms related to one or more embodiments of the present specification are explained.

[0052] Software supply chain product: Various open source, closed source software libraries used in the design, development, delivery process of a software product.

[0053] Code static scanning: Analysis of code semantics and behavior without actually executing the program, thereby finding abnormal program semantics or undefined behavior in the program due to erroneous coding.

[0054] Code dynamic scanning: Performed at the time of code execution, by imitating a malicious attacker, simulating an automated attack application to find unintended consequences or results that can be used by an attacker to harm the application.

[0055] Next, the application scenario of the risk detection method provided by one or more embodiments of the present specification is described.

[0056] It has been reported that in the current development mode, most of the code in the application program is "assembled" rather than "developed". According to statistics, more than 95% of organizations actively or passively use important open source software (OSS) assets in key IT systems of projects; research shows that 80%-90% of the code of application software comes from open source components. Therefore, the security of open source components is directly related to the security of information system infrastructure, but the security of open source software is not optimistic, and it has become an important factor in the growth of software supply chain security problems.

[0057] XX Laboratory released the "XX Software Supply Chain Security Analysis Report". Through the analysis of the detection results of 2188 enterprise software projects, the security status of open source use is obtained: all software projects use open source software, the average number of open source software used by each project reaches 135, and the most used open source software appears in 581 projects, with a penetration rate of 26.6%; There are 52.5 open source software vulnerabilities in each software project on average, and there are 1695, 1599 and 1319 projects with open source software vulnerabilities, high-risk open source software vulnerabilities and super-risk open source software vulnerabilities, accounting for 77.5%, 71.3% and 60.3% respectively; The open source software vulnerability with the largest impact (Spring Frame Work vulnerability) appears in 973 projects, with a penetration rate of 44.5%, and once this vulnerability is exploited by attackers, it will affect nearly half of the enterprise software, and the number of affected enterprises is even more numerous.

[0058] In addition, according to another security detection of XX Laboratory on networked device firmware, the security problems of open source software of smart networked devices such as cameras and routers are also very prominent: many old vulnerabilities that have existed for many years have not been repaired in time, and 86.4% of the latest firmware of the devices have at least one old open source software vulnerability, and the firmware with the most vulnerabilities has 74 old open source software vulnerabilities. Even the "Heartbleed" vulnerability exposed in 2014 still exists in 5.3% of the latest devices. Therefore, risk detection for software products is urgent.

[0059] In the traditional field of risk detection of software products, code static scanning or code dynamic scanning technology is usually used to scan and analyze the source code, and potential security risks are mined through feature matching, semantic analysis and other means.

[0060] Static code scanning technology often fails to correctly identify code semantics and accurately pinpoint code features when the code within the packaged artifact has undergone compilation, obfuscation, or encryption compared to the original source code, leading to missed detections. Dynamic code scanning technology relies on runtime detection capabilities, but since software products are part of a software system and rarely run independently, runtime detection capabilities become ineffective and cannot be detected correctly.

[0061] Therefore, one or more embodiments of this specification provide a risk detection method that can solve the above problems. For specific implementation details, please refer to the relevant descriptions of the various embodiments below.

[0062] This specification provides a risk detection method, and also relates to a risk detection device, a computing device, and a computer-readable storage medium, which will be described in detail in the following embodiments.

[0063] See Figure 1 , Figure 1 A flowchart of a risk detection method provided in one embodiment of this specification is shown, which specifically includes the following steps.

[0064] Step 102: Obtain feature data of the target software product under multiple target feature dimensions. The multiple target feature dimensions are obtained by analyzing the historical risk data of the target software product.

[0065] In the embodiments of this specification, the target software product may also be referred to as a software supply chain product, which is a software product that needs to be risk-tested. It can be a class of software products or a single software product. The embodiments of this specification do not limit this.

[0066] In some embodiments, the target feature dimension is a feature dimension that has a high correlation with whether the target software product has risks. That is, the feature data of the target feature dimension can be used to determine whether the target software product has risks. This can be understood as the target feature dimension corresponding to a type of software product, or the target feature dimension corresponding to a single software product. Such a determined target feature dimension is more targeted and better reflects the relationship between the feature data of the target software product and the risks of the target software product, thereby improving the accuracy of risk detection.

[0067] In one or more embodiments of this specification, multiple target feature dimensions may include basic feature dimensions and code feature dimensions. The basic feature dimensions are the dimensions containing features related to the basic information of the target software product, and the code feature dimensions are the dimensions containing features related to the code of the target software product or features that need to be determined through the code.

[0068] In some embodiments, the basic feature dimensions can at least include a download usage dimension, a release time dimension, and a product name dimension, and the code feature dimensions can at least include a code amount dimension, a code obfuscation feature dimension, and a code static scanning feature dimension. Therefore, the feature data generated by the target software product under the plurality of target feature dimensions can include: a download usage of the target software product in the download usage dimension, a release time feature of the target software product in the release time dimension, a product name feature of the target software product in the product name dimension, a code amount of the target software product in the code amount dimension, a code obfuscation feature of the target software product in the code obfuscation feature dimension, and a code static scanning feature of the target software product in the code static scanning feature dimension.

[0069] The download usage indicates the number of times that the target software product is downloaded and used by a user; the release time feature indicates the release time of the target software product; the product name feature indicates whether the product name is the same as or similar to the product name used internally by the company, or has other obvious abnormalities, such as containing a large number of meaningless letters in the name; the code amount indicates the sum of the sizes of all files in the target software product; the code obfuscation feature indicates whether the code of the target software product is obfuscated and the degree of obfuscation; and the code static scanning feature indicates whether the code static scanning result of the target software product has a vulnerability.

[0070] In some embodiments, the product name, version, download link, and technology stack (software basic components on which the product is implemented) of the target software product can be obtained first, and then the download usage and the release time feature of the target software product can be obtained from the platform on which the target software product is released according to the product name, version, download link, and technology stack, and the target software product can be downloaded, the installation package of the target software product can be decompressed to obtain the source code of the target software product, the sum of the sizes of all code files in the source code of the target software product can be calculated to obtain the code amount of the target software product, the source code can be detected by a code scanning tool to determine whether the source code of the target software product is obfuscated and the degree of obfuscation of the source code of the target software product, the source code can be scanned by a code static scanning technology to obtain the code static scanning feature, and the product name feature of the target software product can be determined according to the product name and the enterprise name of the enterprise that developed the target software product.

[0071] In one or more embodiments of the present specification, before obtaining the feature data generated by the target software product under the plurality of target feature dimensions, the method further comprises:

[0072] Obtain historical risk data of the target software product, the historical risk data comprising historical feature data of the target software product in a plurality of feature dimensions, the target software product comprising a plurality of software products of the same category; analyze the historical feature data of the plurality of feature dimensions to obtain variation rules of each feature dimension in the plurality of software products; and count the number of feature dimensions whose variation rules are the same in the plurality of software products, and if the number is greater than a preset number, determine the first feature dimension as the target feature dimension, the first feature dimension being any feature dimension in the plurality of feature dimensions.

[0073] As an example, the historical risk data is data related to the risk of the target software product, and at least includes historical feature data of the target software product in a plurality of feature dimensions in a historical time, which can include historical feature data generated in a risky situation, and can also include historical feature data generated in a non-risky situation. Moreover, the plurality of feature dimensions at least include a download usage dimension, a release time dimension, a product name dimension, a code amount dimension, a code obfuscation feature dimension, and a code static scanning feature dimension.

[0074] In some embodiments, before performing risk detection on the target software product, it is necessary to determine a target feature dimension that is highly related to the risk of the target software product. Therefore, historical feature data of a plurality of software products of the same category as the target software product can be obtained first, and then for a first feature dimension, the variation rule of the first feature dimension in each software product is determined, and the number of feature dimensions whose variation rules are the same in the plurality of software products is counted. If the number is greater than a preset number, it can be considered that the feature data of the first feature dimension is highly related to whether the target software product is risky, and the first feature dimension can be determined as the target feature dimension.

[0075] It should be noted that the preset number can be set by default by the device, or can be set by the user according to actual needs, and can be adaptively adjusted during use, and the embodiments of the present specification do not limit this.

[0076] As an example, the change rule of the first feature dimension in the software product can be the correlation between the first feature dimension and the software product. For example, the lower the download usage of the software product, the higher the risk, which can be understood as that the download usage is negatively correlated with the risk; the lower the code amount of the software product, the higher the risk, which can be understood as that the code amount is negatively correlated with the risk; the shorter the release time of the software product, the higher the risk, which can be understood as that the code amount is negatively correlated with the risk; the more the code obfuscation features of the software product, the higher the risk, which can be understood as that the code obfuscation features are positively correlated with the risk; the more the static scanning features of the software product, the higher the risk, which can be understood as that the code static scanning features are positively correlated with the risk; the higher the similarity between the product name and the enterprise name of the software product, the higher the risk, which can be understood as that the product name is positively correlated with the risk.

[0077] As an example, taking the code amount dimension as an example, the code amount of the plurality of software products in the code amount dimension and the risk degree of each software product are obtained. If the code amount dimension is negatively correlated with the risk degree of the software product in N software products, and N is greater than a preset number, it can be determined that the code amount dimension is the target feature dimension. After the above operation is performed on the plurality of feature dimensions, the target feature dimension can be determined from the plurality of feature dimensions.

[0078] In the embodiments of the present specification, the target feature dimension with a high correlation degree with the risk degree of the target product can be determined through the historical feature data of the target software product in the plurality of feature dimensions, and the target feature dimension is targeted for the target software product and more consistent with the relationship between the risk of the target software product and the feature dimension. Therefore, the risk detection of the target software product based on the feature data of the target feature dimension can obtain a more accurate risk detection result.

[0079] Step 104: For any target feature dimension, using the risk analysis strategy corresponding to the target feature dimension, the feature data generated under the target feature dimension is analyzed to obtain the risk estimation of the target feature dimension.

[0080] In one or more embodiments of the present specification, the risk analysis strategy is used to analyze the risk of the feature data of the target feature dimension to determine the risk degree (risk estimation) of the target feature dimension. And for different target feature dimensions, different risk analysis strategies are used, so that the risk analysis can be performed using the strategy that conforms to the data situation of the target feature dimension, and the obtained risk estimation is more accurate.

[0081] In one or more embodiments of the present specification, the risk analysis strategy includes a feature value conversion strategy and a risk estimation strategy; using the risk analysis strategy corresponding to the target feature dimension, the feature data generated under the target feature dimension is analyzed to obtain the risk estimation of the target feature dimension, including:

[0082] The feature value corresponding to the target feature dimension is converted by using the feature value conversion strategy corresponding to the target feature dimension, and the risk estimate of the target feature dimension is determined based on the feature value corresponding to the target feature dimension by using the risk estimate strategy corresponding to the target feature dimension.

[0083] The feature value conversion strategy is used to convert the feature data into a feature value, i.e., a numerical value, to facilitate subsequent calculation. The risk estimate strategy is used to determine the risk estimate according to the feature value, which can be a pre-determined function or a pre-set threshold, and the embodiments of the present specification do not limit this. Moreover, the feature conversion strategy and the risk estimate strategy can be set by the user according to the risk situation of the target software product, or can be set according to experience, or can be adjusted according to actual conditions during use, and the embodiments of the present specification do not limit this.

[0084] In some embodiments, the feature data of the corresponding target feature dimension can be converted into a feature value according to the feature value conversion strategy first, and then the feature value is converted into a risk estimate based on the corresponding risk estimate strategy, so that the risk estimate of the target feature dimension can be obtained.

[0085] As an example, for the code amount dimension, since the code amount itself is a numerical value, the feature value conversion strategy corresponding to the code amount dimension is to determine the feature data as the feature value; for the code obfuscation feature dimension, the feature value can be converted according to the obfuscation degree of the code obfuscation feature, such as 0 for no obfuscation, 1 for weak obfuscation, 2 for moderate intensity obfuscation, and 3 for strong obfuscation; for the code static scanning feature dimension, the feature value can be converted according to the possibility of existence of a vulnerability, such as 0% for the possibility of existence of a vulnerability, corresponding to the feature value 0, 1%-80% for the possibility of existence of a vulnerability, corresponding to the feature value 1, 81%-90% for the possibility of existence of a vulnerability, corresponding to the feature value 2, and 91%-100% for the possibility of existence of a vulnerability, corresponding to the feature value 3; for the product name feature, the feature value can be converted according to the possibility of existence of an anomaly, such as 0% for the possibility of existence of an anomaly, corresponding to the feature value 0, 1%-80% for the possibility of existence of an anomaly, corresponding to the feature value 1, 81%-90% for the possibility of existence of an anomaly, corresponding to the feature value 2, and 91%-100% for the possibility of existence of an anomaly, corresponding to the feature value 3.

[0086] In the above manner, the feature data of each target feature dimension can be converted into a feature value, and then the risk estimate is determined based on the feature value according to the risk estimate strategy.

[0087] For example, for the code amount, by analyzing the differences between the software products with risks and the software products without risks, it is determined that the code amount of the software products with risks is much less than that of the software products without risks, and thus a code amount threshold can be set. When the code amount is less than the code amount threshold, the smaller the code amount, the higher the risk degree, and thus the higher the risk estimation; when the code amount is greater than the code amount threshold, it can be determined that the risk estimation is 0.

[0088] As an example, assuming that the target feature dimensions include dimension 1, dimension 2 and dimension 3, and the feature data of the three target feature dimensions are a1, a2 and a3 respectively, if the risk estimation strategy is a function, and the risk estimation strategies corresponding to the three target feature dimensions are f1, f2 and f3 respectively, the risk estimation b1 of dimension 1 is f1(a1), the risk estimation b2 of dimension 2 is f2(a2), and the risk estimation b3 of dimension 3 is f3(a3).

[0089] In one or more embodiments of the present specification, for each target feature dimension, the risk estimation of each target feature dimension is determined by using the feature value conversion strategy and the risk estimation strategy corresponding to the target feature dimension, which improves the accuracy of the determined risk estimation.

[0090] Step 106: determining the risk detection result of the target software product according to the risk estimations of the plurality of target feature dimensions.

[0091] The risk detection result can be whether there is a risk or the risk degree, which is not limited in the embodiments of the present specification.

[0092] In one or more embodiments of the present specification, the risk detection result of the target software product is determined according to the risk estimations of the plurality of target feature dimensions, including:

[0093] The risk metric value of the target software product is determined according to the risk estimations of the plurality of target feature dimensions; and the risk detection result of the target software product is determined based on the risk metric value of the target software product.

[0094] The risk metric value can be used to measure the risk of the target software product.

[0095] That is, after the risk estimations of the plurality of target feature dimensions are determined, the risk estimations of the plurality of target feature dimensions are fused to obtain the risk metric value of the target software product, and then the risk detection result of the target software product can be obtained according to the risk metric value of the target software product, and thus the risk detection of the target software product is realized.

[0096] In some embodiments, the risk estimation of the plurality of target feature dimensions can be added to obtain a sum as the risk metric value of the target software product. Alternatively, the relationship between the plurality of target feature dimensions and the relationship between the plurality of target feature dimensions and the risk degree of the target software product can be determined according to experience or big data to obtain a risk metric function, and the plurality of target feature dimensions are substituted into the risk metric function to obtain the risk metric value of the target software product.

[0097] The method described above determines the risk detection result of the target software product according to the risk estimation of the plurality of target feature dimensions, and can combine risk detection with the plurality of feature dimensions to make the obtained risk detection result more accurate.

[0098] In other embodiments, the risk metric value of the target software product is determined according to the risk estimation of the plurality of target feature dimensions, including:

[0099] The risk weight of each target feature dimension is determined, and the risk metric value of the target software product is determined based on the risk estimation of each target feature dimension and the risk weight of the target feature dimension.

[0100] As an example, since different target feature dimensions have different influences on the risk of the target software product, different risk weights need to be determined for different target feature dimensions, and therefore, the risk weight of each target feature dimension can be determined first, the risk weight of each target feature dimension is multiplied by the risk estimation of the target feature dimension, and then each target feature dimension can determine a product, and the sum of the plurality of products is determined as the risk metric value of the target software product.

[0101] For example, assuming that the target feature dimensions include dimension 1, dimension 2, and dimension 3, the risk estimation of dimension 1 is b1, the risk estimation of dimension 2 is b2, the risk estimation of dimension 3 is b3, the risk weight of dimension 1 is c1, the risk weight of dimension 2 is c2, and the risk weight of dimension 3 is c3, then the risk metric value s of the target software product can be determined as c1*b1+c2*b2+c3*b3.

[0102] The method described above assigns different risk weights to the risk estimation of different feature dimensions, and determines the risk metric value of the target software product according to the risk estimation of different feature dimensions and the corresponding risk weight. Since different risk weights distinguish the influence of different feature dimensions on the risk degree of the target software product, the determined risk metric value will be more accurate.

[0103] In some embodiments, the risk weight of each target feature dimension is determined, including:

[0104] obtaining historical risk data of a plurality of sample software products, the historical risk data comprising risk detection results of the sample software products and feature data generated by the sample software products in a plurality of target feature dimensions; determining, for each sample software product, a risk measurement value of the sample software product based on a preset weight of each target feature dimension and the feature data generated by the sample software product in the target feature dimension; and adjusting the preset weights based on the risk measurement values and the risk detection results of the plurality of sample software products until the risk measurement values of a preset number of sample software products match the risk detection results of the sample software products, to obtain risk weights of each target feature dimension.

[0105] In some embodiments, the sample software products can be software products of the same category as the target software product, and the risk detection results of the sample software products are known. The feature data generated by the sample software products in the plurality of feature dimensions is also known.

[0106] As an example, the risk detection results of the sample software products can be obtained first. The feature data generated by the sample software products in the plurality of target feature dimensions can be obtained. The preset weights can be obtained. The risk measurement values of the sample software products can be determined based on the feature data of the plurality of target feature dimensions and the corresponding preset weights in the same manner as in step 106. The risk prediction results of the sample software products can be determined based on the risk measurement values. The risk prediction results of each sample software product can be compared with the risk detection results of the sample software product. If the risk prediction results of more than a preset number of sample software products do not match the risk detection results, the preset weights can be adjusted. The risk measurement values of each sample software product can be determined again until the risk estimates of more than or equal to a preset number of sample software products match the risk detection results of the sample software products. The preset weights at this time can be determined to be more appropriate. The preset weights of each target feature dimension at this time can be determined as the risk weights of the target feature dimension.

[0107] In some embodiments, the preset weights are adjusted based on the feature data and the risk detection results of the sample software products to obtain the risk weights of the target feature dimensions. The risk weights that make the risk detection results of most sample software products match the risk prediction results can be determined. The risk weights are the same as the risk distribution of the target software product in the plurality of feature dimensions. Therefore, the determined risk weights are more appropriate and more accurate.

[0108] In some embodiments, the risk detection results of the target software product are determined based on the risk measurement value of the target software product, comprising:

[0109] The risk threshold is obtained, and the risk measurement value of the target software product is compared with the risk threshold. If the risk measurement value is greater than the risk threshold, it is determined that the risk detection result of the target software product is that there is a risk.

[0110] The risk threshold can be set by the user according to actual needs, can be set by default by the device, or can be obtained according to big data analysis, and the embodiments of the present specification do not limit this.

[0111] As an example, the risk threshold can be obtained first, and then the risk threshold is compared with the risk measurement value. If the risk measurement value is greater than the risk threshold, it can be considered that the target software product has a relatively high risk possibility, and therefore, it can be determined that the risk detection result of the target software product is that there is a risk. If the risk measurement value is less than or equal to the risk threshold, it can be considered that the target software product has a relatively low risk possibility, and therefore, it can be considered that the risk detection result of the target software product is that there is no risk.

[0112] The above-mentioned manner determines the risk detection result of the target software product by comparing the risk measurement value with the pre-set risk threshold, and realizes the risk detection of the target software product in a simple manner, thereby improving the efficiency of the risk detection.

[0113] In another possible implementation manner of the present specification, the risk detection result of the target software product determined by one risk threshold can be too broad, and therefore, the risk levels can be divided. Different risk levels correspond to different ranges of risk measurement values. The risk level of the target software product can be determined according to the range of the risk measurement value in which the risk measurement value of the target software product is located, and the risk level is determined as the risk detection result of the target software product.

[0114] As an example, it is assumed that the risk levels include high risk, medium risk, low risk, and no risk, and the risk measurement value is divided into four ranges of 0-60, 61-80, 81-90, and 91-100. The risk level corresponding to the risk measurement value 0-60 is no risk, the risk level corresponding to the risk measurement value 61-80 is low risk, the risk level corresponding to the risk measurement value 81-90 is medium risk, and the risk level corresponding to the risk measurement value 91-100 is high risk. If the risk measurement value of the target software product is 88, it can be determined that the risk level of the target software product is medium risk.

[0115] The above-mentioned manner detects the risk of the target software product according to the risk level, and divides the risk level more in detail, so that the risk detection result of the target software product determined is more accurate.

[0116] In one or more embodiments of the present specification, the risk threshold is obtained, including:

[0117] obtain historical risk data of a plurality of sample software products, the historical risk data comprising risk detection results of the sample software products and feature data generated by the sample software products under a plurality of target feature dimensions; for each sample software product, determine a risk measurement value of the sample software product based on a risk weight of each target feature dimension and the feature data generated under the target feature dimension; determine a risk prediction result of each sample software product based on the risk measurement value of each sample software product and a preset risk threshold; and adjust the preset risk threshold based on the risk prediction result and the risk detection result of each sample software product until the risk prediction results and the risk detection results of a preset number of software products are consistent, and obtain the risk threshold.

[0118] The sample software products can be software products of the same category as the target software product, and the risk detection results of the sample software products are known, and the feature data generated by the sample software products under a plurality of feature dimensions is also known.

[0119] As an example, the risk detection results of a plurality of sample software products and the feature data generated by each sample software product under a plurality of target feature dimensions can be obtained, the adjusted risk weight can be obtained, the risk measurement value of the sample software product can be determined based on the feature data of the plurality of target feature dimensions and the corresponding risk weight in the same manner as step 106, the risk prediction result of the sample software product can be determined by comparing the risk measurement value with the preset risk threshold, the risk prediction result of each sample software product can be compared with the risk detection result of the sample software product, if the risk prediction results of more than a preset number of sample software products do not match the risk detection results, the preset risk threshold can be adjusted, and the risk measurement value of each sample software product can be determined again until the risk prediction results of more than a preset number of sample software products match the risk detection results of the sample software products, and the preset risk threshold at this time can be determined to be more appropriate, and the preset risk threshold at this time can be determined as the risk threshold.

[0120] It should be noted that the above process is actually to adjust the risk threshold, so that the risk measurement values of software products known to have risks are all higher than the risk threshold, the risk measurement values of software products known to have no risks are lower than the risk threshold, the accuracy is ensured, and as few software products known to have no risks as possible have risk measurement values higher than the risk threshold, the false positive rate is reduced, and finally a precise risk threshold is obtained.

[0121] The method adjusts the preset risk threshold according to the feature data and the risk detection result of the sample software product, obtains the risk threshold, can determine the risk threshold that makes the risk detection result of most sample software products match the risk prediction result, and then determines the risk detection result of the target software product based on the risk threshold, so that a more accurate detection result can be obtained.

[0122] It should be noted that in some other embodiments of the present specification, the preset weight and the preset risk threshold can also be adjusted together to obtain the risk weight and the risk threshold according to the historical risk data of the sample software product.

[0123] One embodiment of the present specification realizes obtaining feature data generated by a target software product in a plurality of target feature dimensions, the plurality of target feature dimensions being obtained by analyzing historical risk data of the target software product; for any target feature dimension, a risk analysis strategy corresponding to the target feature dimension is used to analyze the feature data generated in the target feature dimension to obtain a risk estimate of the target feature dimension; and a risk detection result of the target software product is determined according to the risk estimates of the plurality of target feature dimensions. The above method obtains the target feature dimensions with a relatively high degree of relevance to whether the target software product has risks according to the analysis of the historical risk data of the target software product, and determines the risk detection result of the target software product through the feature data generated in the plurality of target feature dimensions, which can improve the accuracy of risk detection. In addition, after using the present solution, it is not necessary to identify the semantics of the code after confusion or encryption, but only to judge whether the current code has been confused or encrypted as part of the feature data, and it is not necessary to run the software, and the risk measurement value can be obtained by combining the feature data of other feature dimensions, so that the phenomenon of scanning failure and detection omission due to code confusion and encryption or the inability of software supply chain products to run independently can be avoided.

[0124] The following describes the risk detection method in combination with the accompanying Figure 2 The risk detection method provided in the present specification is taken as an example to further illustrate the risk detection method. Among them, Figure 2 FIG. 1 shows a process flow diagram of a risk detection method provided by one embodiment of the present specification, which specifically includes the following steps:

[0125] Step 202: Obtain historical risk data of a target software product, the historical risk data including historical feature data generated by the target software product in a plurality of feature dimensions, and the target software product including a plurality of software products of the same category.

[0126] For example, a list of multiple software supply chain products used in the company is obtained, historical feature data generated by the multiple software supply chain products in the dimensions of download usage, release time, product name, code amount, code obfuscation feature, and code static scanning feature, and a risk detection result of whether each software supply chain product has a risk.

[0127] Step 204: Analyzing the historical feature data in multiple feature dimensions to obtain the variation law of each feature dimension in the multiple software products.

[0128] Step 206: Counting the number of times that the variation law of the first feature dimension in the multiple software products is the same, and if the number is greater than a preset number, determining the first feature dimension as the target feature dimension, and the first feature dimension is any feature dimension in the multiple feature dimensions.

[0129] For example, based on the historical feature data generated by the multiple software supply chain products in the multiple feature dimensions, it is analyzed that the lower the download usage of the software supply chain product, the lower the code amount, the shorter the release time, the more the code obfuscation features, the more the static scanning features, and the higher the similarity between the supply chain product name and the enterprise keyword, the higher the risk.

[0130] Step 208: Obtaining feature data generated by the target software product in multiple target feature dimensions.

[0131] For example, for a target software product that needs to be detected for risk, feature data generated by the target software product in the dimensions of download usage, release time, product name, code amount, code obfuscation feature, and code static scanning feature is obtained.

[0132] Step 210: For any target feature dimension, a feature value conversion strategy corresponding to the target feature dimension is adopted, and a feature value corresponding to the target feature dimension is determined based on the feature data generated in the target feature dimension.

[0133] For example, the feature value conversion strategy can be determined according to experience. For the code obfuscation feature dimension, the feature value can be converted according to the obfuscation degree of the code obfuscation feature, such as 0 for no obfuscation, 1 for weak obfuscation, 2 for moderate intensity obfuscation, and 3 for strong obfuscation.

[0134] Step 212: Adopting a risk estimation strategy corresponding to the target feature dimension, and determining a risk estimation of the target feature dimension based on the feature value corresponding to the target feature dimension.

[0135] Continuing the above example, the risk estimation strategy can be determined empirically. For the code obfuscation feature dimension, assume that the risk estimation strategy is to determine the feature value as the risk estimate.

[0136] Step 214: Determine the risk weight of each target feature dimension.

[0137] For example, set a preset weight and a preset risk threshold, analyze the feature data of multiple software supply chain products used internally by the company in multiple feature dimensions, determine the risk estimate of each software supply chain product in multiple feature dimensions according to the preset weight, determine the risk metric value of each software supply chain product based on the risk estimate, determine the risk prediction result of each software supply chain product based on the risk metric value and the preset risk threshold, dynamically adjust the preset weight and the preset risk threshold according to the risk prediction result and the risk detection result, make the risk metric value of the software product known to have risks higher than the risk threshold, make the risk metric value of the software product known to have no risks lower than the risk threshold, ensure the accuracy, and make as few software products known to have no risks as possible have risk metric values higher than the risk threshold, reduce the false positive rate, and finally obtain accurate risk weight and risk threshold.

[0138] Step 216: Determine the risk metric value of the target software product based on the risk estimate of each target feature dimension and the risk weight of the target feature dimension.

[0139] For example, assume that the target feature dimensions include dimension 1 and dimension 2, the risk estimate of dimension 1 is b1, the risk estimate of dimension 2 is b2, the risk weight of dimension 1 is c1, and the risk weight of dimension 2 is c2. Then the risk metric value s of the target software product can be determined as s = c1*b1 + c2*b2.

[0140] Step 218: Obtain the risk threshold and compare the risk metric value of the target software product with the risk threshold.

[0141] Step 220: If the risk metric value is greater than the risk threshold, determine that the risk detection result of the target software product is that there is risk.

[0142] For example, assume that the risk threshold is 90 and the risk metric value is 95. Then it can be determined that the target software product has risk.

[0143] For example, the download log of the internal software repository of the company can be continuously monitored, the target software product downloaded is parsed, and the risk metric value of the target software product is compared with the risk threshold. If it is greater than the risk threshold, it means that an employee has downloaded and used a product with risk, which may be externally invaded, and the subsequent emergency investigation work begins.

[0144] One embodiment of the specification realizes obtaining feature data generated by a target software product under a plurality of target feature dimensions, the plurality of target feature dimensions being obtained by analyzing historical risk data of the target software product; for any target feature dimension, adopting a risk analysis strategy corresponding to the target feature dimension to analyze the feature data generated under the target feature dimension, and obtaining a risk estimate of the target feature dimension; and determining a risk detection result of the target software product according to the risk estimates of the plurality of target feature dimensions. The above method obtains target feature dimensions with relatively high correlation with whether the target software product has risks according to historical risk data of the target software product, determines the risk detection result of the target software product through feature data generated under a plurality of target feature dimensions, and can improve the accuracy of risk detection. In addition, after the present scheme is adopted, it is not necessary to identify the semantics of the code after confusion or encryption, but only to judge whether the current code has been confused or encrypted as part of the feature data, and it is not necessary to run the software, and the risk measurement value can be obtained by combining the feature data of other feature dimensions, so that the phenomenon of scanning failure and detection omission due to code confusion and encryption or the inability of software supply chain products to run independently does not occur.

[0145] Corresponding to the above method embodiment, the specification also provides a risk detection device embodiment, Figure 3 The structure schematic diagram of a risk detection device provided by one embodiment of the specification is shown. As shown in the figure, Figure 3 The device comprises:

[0146] The obtaining module 302 is configured to obtain feature data generated by a target software product under a plurality of target feature dimensions, the plurality of target feature dimensions being obtained by analyzing historical risk data of the target software product;

[0147] The risk analysis module 304 is configured to, for any target feature dimension, adopt a risk analysis strategy corresponding to the target feature dimension to analyze the feature data generated under the target feature dimension, and obtain a risk estimate of the target feature dimension;

[0148] The determining module 306 is configured to determine a risk detection result of the target software product according to the risk estimates of the plurality of target feature dimensions.

[0149] In one or more embodiments of the specification, the determining module 306 is further configured to:

[0150] determine a risk measurement value of the target software product according to the risk estimates of the plurality of target feature dimensions;

[0151] determine the risk detection result of the target software product based on the risk measurement value of the target software product.

[0152] In one or more embodiments of the present specification, the determining module 306 is further configured to:

[0153] determine a risk weight of each target feature dimension;

[0154] determine a risk metric value of the target software product based on the risk estimate of each target feature dimension and the risk weight of the target feature dimension.

[0155] In one or more embodiments of the present specification, the determining module 306 is further configured to:

[0156] obtain historical risk data of a plurality of sample software products, the historical risk data comprising a risk detection result of the sample software product and feature data generated by the sample software product under a plurality of target feature dimensions;

[0157] for each sample software product, determine a risk metric value of the sample software product based on a preset weight of each target feature dimension and the feature data generated by the sample software product under the target feature dimension;

[0158] adjust the preset weight based on the risk metric values and the risk detection results of the plurality of sample software products until the risk metric values of a preset number of sample software products match the risk detection results of the sample software products, to obtain the risk weight of each target feature dimension.

[0159] In one or more embodiments of the present specification, the determining module 306 is further configured to:

[0160] obtain a risk threshold value and compare the risk metric value of the target software product with the risk threshold value;

[0161] if the risk metric value is greater than the risk threshold value, determine that the risk detection result of the target software product is at risk.

[0162] In one or more embodiments of the present specification, the determining module 306 is further configured to:

[0163] obtain historical risk data of a plurality of sample software products, the historical risk data comprising a risk detection result of the sample software product and feature data generated by the sample software product under a plurality of target feature dimensions;

[0164] for each sample software product, determine a risk metric value of the sample software product based on a risk weight of each target feature dimension and the feature data generated by the sample software product under the target feature dimension;

[0165] determine a risk prediction result of each sample software product based on the risk metric value of each sample software product and a preset risk threshold value;

[0166] Based on the risk prediction result and the risk detection result of each sample software product, the preset risk threshold is adjusted until the risk prediction result and the risk detection result of the preset number of software products are consistent, and the risk threshold is obtained.

[0167] In one or more embodiments of the present specification, the acquisition module 302 is further configured to:

[0168] Acquire historical risk data of the target software product, the historical risk data including historical feature data generated by the target software product under a plurality of feature dimensions, the target software product including a plurality of software products of the same category;

[0169] Analyze the historical feature data of the plurality of feature dimensions to obtain variation rules of each feature dimension in the plurality of software products;

[0170] Count the number of times when the variation rule of the first feature dimension in the plurality of software products is the same, and if the number is greater than a preset number, determine the first feature dimension as a target feature dimension, the first feature dimension being any feature dimension in the plurality of feature dimensions.

[0171] In one or more embodiments of the present specification, the risk analysis module 304 is further configured to:

[0172] Using the feature value conversion strategy corresponding to the target feature dimension, determine the feature value corresponding to the target feature dimension based on the feature data generated under the target feature dimension;

[0173] Using the risk estimation strategy corresponding to the target feature dimension, determine the risk estimation of the target feature dimension based on the feature value corresponding to the target feature dimension.

[0174] The risk detection device provided by the embodiment of the present specification obtains feature data generated by a target software product in a plurality of target feature dimensions, wherein the plurality of target feature dimensions are obtained by analyzing historical risk data of the target software product; for any target feature dimension, a risk analysis strategy corresponding to the target feature dimension is used to analyze the feature data generated in the target feature dimension to obtain a risk estimate of the target feature dimension; and the risk detection result of the target software product is determined according to the risk estimates of the plurality of target feature dimensions. The above method obtains the target feature dimensions that have a relatively high correlation with the risk of the target software product according to the historical risk data of the target software product, determines the risk detection result of the target software product through the feature data generated in the plurality of target feature dimensions, and can improve the accuracy of risk detection. In addition, after the present solution is used, it is not necessary to identify the semantics of the code after confusion or encryption, but only to determine whether the current code has been confused or encrypted as part of the feature data, and it is not necessary to run the software, and the risk measurement value can be obtained by combining the feature data of other feature dimensions, and the phenomenon of scanning failure or detection omission due to code confusion and encryption or the inability of the software supply chain product to run independently will not occur.

[0175] The above is a schematic solution of a risk detection device of the embodiment. It should be noted that the technical solution of the risk detection device belongs to the same concept as the technical solution of the risk detection method described above, and the details of the technical solution of the risk detection device that are not described in detail can be referred to the description of the technical solution of the risk detection method.

[0176] Figure 4 A structural block diagram of a computing device 400 is shown, which is provided by an embodiment of the present specification. The components of the computing device 400 include but are not limited to a memory 410 and a processor 420. The processor 420 is connected with the memory 410 through a bus 430, and a database 450 is used to save data.

[0177] The computing device 400 also includes an access device 440 that enables the computing device 400 to communicate via one or more networks 460. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of networks such as the Internet. The access device 440 can include one or more of any type of network interface (for example, a network interface card (NIC)) such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a Worldwide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, a Near Field Communication (NFC) interface, or the like.

[0178] In one embodiment of the present specification, the above-mentioned components of the computing device 400 and other components not shown in the Figure 4 may be connected to each other, for example, through a bus. It should be understood that Figure 4 The computing device structure diagram shown is only for the purpose of example, and is not a limitation on the scope of the present specification. Those skilled in the art can add or replace other components as needed.

[0179] The computing device 400 can be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (for example, a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, and the like), a mobile phone (for example, a smartphone), a wearable computing device (for example, a smart watch, smart glasses, and the like), or other types of mobile devices, or a stationary computing device such as a desktop computer or a PC. The computing device 400 can also be a mobile or stationary server.

[0180] The processor 420 is configured to execute computer-executable instructions, which, when executed by the processor, implement the steps of the risk detection method described above.

[0181] The above is a schematic scheme of the computing device of the embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the risk detection method described above belong to the same concept, and details of the technical scheme of the computing device that are not described in detail can be referred to the description of the technical scheme of the risk detection method.

[0182] An embodiment of the present specification also provides a computer readable storage medium storing computer executable instructions, which, when executed by a processor, implement the steps of the risk detection method.

[0183] The above is a schematic scheme of the computer readable storage medium of the embodiment. It should be noted that the technical scheme of the storage medium and the technical scheme of the risk detection method described above belong to the same concept, and details of the technical scheme of the storage medium that are not described in detail can be referred to the description of the technical scheme of the risk detection method.

[0184] An embodiment of the present specification also provides a computer program, which, when executed in a computer, causes the computer to perform the steps of the risk detection method.

[0185] The above is a schematic scheme of the computer program of the embodiment. It should be noted that the technical scheme of the computer program and the technical scheme of the risk detection method described above belong to the same concept, and details of the technical scheme of the computer program that are not described in detail can be referred to the description of the technical scheme of the risk detection method.

[0186] The above describes specific embodiments of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the acts or steps recited in the claims can be performed in a different order than the order in which they are recited and still achieve desirable results. In addition, the processes depicted in the figures do not necessarily require the particular order shown, or sequential order to achieve the desired results. In some implementations, multitasking and parallel processing can be advantageous.

[0187] The computer instructions include computer program code, which can be in the form of source code, object code, executable code, or some intermediate form. The computer readable medium can include any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, and software distribution medium, etc.

[0188] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments in this specification are not limited to the described order of actions, because according to the embodiments in this specification, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the embodiments in this specification.

[0189] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0190] The preferred embodiments disclosed above are merely illustrative of this specification. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the embodiments described herein. These embodiments are selected and specifically described in this specification to better explain the principles and practical applications of the embodiments, thereby enabling those skilled in the art to better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

1. A risk detection method, comprising: obtaining historical risk data of a plurality of sample software products, wherein the historical risk data comprises risk detection results of the sample software products and feature data generated by the sample software products under a plurality of target feature dimensions; for each sample software product, determining a risk metric value of the sample software product based on a preset weight of each target feature dimension and the feature data generated under the target feature dimension, wherein the plurality of target feature dimensions comprise a base feature dimension and a code feature dimension; adjusting the preset weights based on the risk metric values and the risk detection results of the plurality of sample software products until the risk metric values of a preset number of sample software products match the risk detection results of the sample software products, to obtain risk weights of each target feature dimension; determining a risk metric value of a target software product based on a risk estimate of each target feature dimension of the target software product under the plurality of target feature dimensions and the risk weight of the target feature dimension, wherein the target software product is of the same category as the sample software products; and determining a risk detection result of the target software product based on the risk metric value of the target software product. 2.The method of claim 1, before the determining the risk metric value of the target software product based on the risk estimate of each target feature dimension of the target software product and the risk weight of the target feature dimension, further comprising: for any target feature dimension of the target software product, performing risk analysis on the feature data generated under the target feature dimension using a risk analysis strategy corresponding to the target feature dimension to obtain a risk estimate of the target feature dimension. 3.The method of claim 1, wherein the determining the risk detection result of the target software product based on the risk metric value of the target software product comprises: obtaining a risk threshold and comparing the risk metric value of the target software product with the risk threshold; and if the risk metric value is greater than the risk threshold, determining that the risk detection result of the target software product is that there is a risk. 4.The method of claim 3, wherein the obtaining a risk threshold comprises: obtaining historical risk data of a plurality of sample software products, wherein the historical risk data comprises risk detection results of the sample software products and feature data generated by the sample software products under a plurality of target feature dimensions; for each sample software product, determining a risk metric value of the sample software product based on a risk weight of each target feature dimension and the feature data generated under the target feature dimension; determining a risk prediction result of each sample software product based on the risk metric value of each sample software product and a preset risk threshold; adjusting the preset risk threshold based on the risk prediction result and the risk detection result of each sample software product until the risk prediction results of a preset number of software products match the risk detection results, to obtain the risk threshold.

5. The method of claim 2, wherein the risk analysis strategy comprises a feature value conversion strategy and a risk estimation strategy; and wherein the performing risk analysis on the feature data generated under the target feature dimension using the risk analysis strategy corresponding to the target feature dimension to obtain the risk estimation of the target feature dimension comprises: performing feature value conversion on the feature data generated under the target feature dimension using the feature value conversion strategy corresponding to the target feature dimension to determine the feature value corresponding to the target feature dimension; and performing risk estimation on the feature value corresponding to the target feature dimension using the risk estimation strategy corresponding to the target feature dimension to determine the risk estimation of the target feature dimension.

6. A risk detection apparatus, comprising: an obtaining module configured to obtain historical risk data of a plurality of sample software products, wherein the historical risk data comprises risk detection results of the sample software products and feature data generated under a plurality of target feature dimensions for the sample software products; a risk metric value determination module configured to determine, for each sample software product, a risk metric value of the sample software product based on a preset weight of each target feature dimension and the feature data generated under the target feature dimension, wherein the plurality of target feature dimensions comprise a base feature dimension and a code feature dimension; a risk weight determination module configured to adjust the preset weight based on risk metric values and risk detection results of the plurality of sample software products until risk metric values of a preset number of sample software products match the risk detection results of the sample software products to obtain risk weights of each target feature dimension; and a risk detection result determination module configured to determine a risk metric value of a target software product based on risk estimations of each target feature dimension under the plurality of target feature dimensions for the target software product and the risk weight of the target feature dimension, wherein the target software product is of the same category as the sample software products; and determine a risk detection result of the target software product based on the risk metric value of the target software product.

7. A computing device, comprising: a memory and a processor; wherein the memory is configured to store computer executable instructions, and the processor is configured to execute the computer executable instructions, and the computer executable instructions, when executed by the processor, implement steps of the risk detection method of any one of claims 1 to 5.

8. A computer readable storage medium storing computer executable instructions, wherein the computer executable instructions, when executed by a processor, implement steps of the risk detection method of any one of claims 1 to 5. ​ ​ ​ ​ ​ ​ ​ ​

Images