Open source component security scheduling method and device

Abstract

The invention discloses an open source component security scheduling method, which comprises the following steps: acquiring a task demand of a target system, and screening an open source component cluster matched with the task demand function from a preset component library according to a semantic similarity algorithm; extracting a risk assessment index of each open source component in each open source component cluster by using a software component analysis tool; inputting the risk assessment index into a pre-trained risk assessment model for prediction to obtain a risk assessment result corresponding to each open source component; constructing a scheduling strategy according to the task demand and the risk assessment result; in the actual scheduling process, the real-time task request is scheduled based on the scheduling strategy. According to the open source component security scheduling method provided by the embodiment of the invention, the open source component is automatically screened and evaluated, so that the time cost of manual screening and testing is reduced.

Description

Technical Field

[0001] The present invention relates to the field of security technology, and in particular to a method and device for securely scheduling open source components. Background Art

[0002] In today's highly information-based and digital age, the complexity and scale of software systems and applications continue to grow, and the requirements for system performance and reliability are also increasing. In order to meet these challenges, software development and operation and maintenance teams are increasingly using open source components to build and expand systems. Open source components have become an indispensable part of modern software development with their flexibility, scalability, and cost-effectiveness. However, with the widespread use of open source components, a series of security and performance challenges have also been brought about. Specifically, open source components may contain unknown security vulnerabilities, unstable codes, high resource consumption, and functions that do not match task requirements, all of which may threaten the successful implementation of the project and the stable operation of the system.

[0003] Traditional open source component risk assessment before scheduling often relies on manual review, and during the scheduling process of open source components, decisions are still made based on the subjective judgment and experience of developers. This method is not only inefficient, but also lacks scientificity and objectivity. With the increasing number of open source components and the accelerated update speed, traditional methods have been unable to meet actual needs. Summary of the invention

[0004] The present invention aims to provide a method and device for securely scheduling open source components to solve the technical problem of how to improve the efficiency of scheduling open source components.

[0005] In order to solve the above technical problems, an embodiment of the present invention provides a method for securely scheduling open source components, including the following steps:

[0006] Obtain the task requirements of the target system, and select an open source component cluster that matches the task requirements from a preset component library based on a semantic similarity algorithm;

[0007] Using a software component analysis tool to extract risk assessment indicators for each open source component in each of the open source component clusters;

[0008] Inputting the risk assessment indicator into a pre-trained risk assessment model for prediction to obtain a risk assessment result corresponding to each of the open source components, wherein the risk assessment model reflects the risk level of each of the open source components;

[0009] Constructing a scheduling strategy according to the task requirements and the risk assessment results, wherein the scheduling strategy is designed to schedule the open source components corresponding to the task requirements according to a preset load balancing algorithm;

[0010] In the actual scheduling process, the real-time task request is scheduled based on the scheduling strategy.

[0011] As one of the preferred solutions, the risk assessment indicators include component popularity, update frequency, number of vulnerabilities, number of maintenance times, number of dependencies, license compatibility and source code quality;

[0012] Before inputting the risk assessment indicator into the pre-trained risk assessment model for prediction, the method further includes:

[0013] Acquire a historical data set of the open source component, the historical data set includes risk assessment indicators, and perform a preprocessing operation on the historical data set, the preprocessing operation includes standardization and normalization;

[0014] Determine the weight of each indicator in the historical data set based on the hierarchical analysis method, combine the preprocessed historical data set with the corresponding weight to obtain the weighted risk assessment indicator, and construct a training data set according to the weighted risk assessment and the obtained risk level label;

[0015] A risk assessment model based on a deep neural network is constructed, and the risk assessment model is trained according to the training data set to obtain a trained risk assessment model.

[0016] As one of the preferred solutions, the method of selecting an open source component cluster matching the function of the task requirement from a preset component library according to a semantic similarity algorithm includes:

[0017] Obtaining a task description text of the task requirement and a component description text of an open source component in the preset component library;

[0018] Performing word segmentation processing on the task description text and the component description text respectively to obtain a task phrase set and an open source component phrase set;

[0019] Based on the cosine similarity algorithm, the semantic similarity between the task phrase set and each of the open source component phrase sets is calculated respectively, and the functional matching degree between the task requirement and each of the open source components is obtained according to the semantic similarity;

[0020] Screening is performed based on a preset matching degree threshold to obtain a plurality of the open source components whose functional matching degree exceeds the matching degree threshold.

[0021] As one of the preferred solutions, the construction of a scheduling strategy according to the task requirements and the risk assessment results includes:

[0022] Execute each of the open source components through simulation to obtain performance data of each of the open source components;

[0023] Performing consistency evaluation on each of the open source components according to the performance data to obtain consistency evaluation results corresponding to each of the open source components, wherein the consistency evaluation is designed to eliminate uncertainty in the execution process of the open source components;

[0024] Generate a priority list based on the consistency assessment result and the risk assessment result, wherein the priority list reflects the matching degree between the task requirements and the open source components and the risk assessment ranking of each of the open source components;

[0025] A scheduling strategy is formulated according to the priority selection list, wherein the scheduling strategy includes scheduling open source components corresponding to the task requirements.

[0026] As one preferred solution, before scheduling the real-time task request based on the scheduling strategy, the method further includes:

[0027] If the data volume of the open source component scheduled corresponding to the real-time task request exceeds a preset first threshold, a compression operation is performed on the open source component; if the scheduling times of the open source component scheduled corresponding to the real-time task request exceeds a preset second threshold, a cache operation is performed on the open source component.

[0028] Another embodiment of the present invention provides an open source component security scheduling device, which is characterized by comprising the following modules:

[0029] An acquisition module is used to acquire the task requirements of the target system and select an open source component cluster that matches the task requirements from a preset component library according to a semantic similarity algorithm;

[0030] An extraction module, used to extract risk assessment indicators of each open source component in each open source component cluster using a software component analysis tool;

[0031] A prediction module, used for inputting the risk assessment indicator into a pre-trained risk assessment model for prediction, and obtaining a risk assessment result corresponding to each of the open source components, wherein the risk assessment model reflects the risk level of each of the open source components;

[0032] A construction module, used to construct a scheduling strategy according to the task requirements and the risk assessment results, wherein the scheduling strategy is designed to schedule the open source components corresponding to the task requirements according to a preset load balancing algorithm;

[0033] The scheduling module is used to schedule the real-time task request based on the scheduling strategy in the actual scheduling process.

[0034] As one of the preferred solutions, the risk assessment indicators include component popularity, update frequency, number of vulnerabilities, number of maintenance times, number of dependencies, license compatibility and source code quality;

[0035] The prediction module is further used for:

[0036] Acquire a historical data set of the open source component, the historical data set includes risk assessment indicators, and perform a preprocessing operation on the historical data set, the preprocessing operation includes standardization and normalization;

[0037] Determine the weight of each indicator in the historical data set based on the hierarchical analysis method, combine the preprocessed historical data set with the corresponding weight to obtain the weighted risk assessment indicator, and construct a training data set according to the weighted risk assessment and the obtained risk level label;

[0038] A risk assessment model based on a deep neural network is constructed, and the risk assessment model is trained according to the training data set to obtain a trained risk assessment model.

[0039] As one preferred solution, the acquisition module is used to:

[0040] Obtaining a task description text of the task requirement and a component description text of an open source component in the preset component library;

[0041] Performing word segmentation processing on the task description text and the component description text respectively to obtain a task phrase set and an open source component phrase set;

[0042] Based on the cosine similarity algorithm, the semantic similarity between the task phrase set and each of the open source component phrase sets is calculated respectively, and the functional matching degree between the task requirement and each of the open source components is obtained according to the semantic similarity;

[0043] Screening is performed based on a preset matching degree threshold to obtain a plurality of the open source components whose functional matching degree exceeds the matching degree threshold.

[0044] As one preferred solution, the building block is used to:

[0045] Execute each of the open source components through simulation to obtain performance data of each of the open source components;

[0046] Performing consistency evaluation on each of the open source components according to the performance data to obtain consistency evaluation results corresponding to each of the open source components, wherein the consistency evaluation is designed to eliminate uncertainty in the execution process of the open source components;

[0047] Generate a priority list based on the consistency assessment result and the risk assessment result, wherein the priority list reflects the matching degree between the task requirements and the open source components and the risk assessment ranking of each of the open source components;

[0048] A scheduling strategy is formulated according to the priority selection list, wherein the scheduling strategy includes scheduling open source components corresponding to the task requirements.

[0049] As one preferred solution, the scheduling module is further used for:

[0050] If the data volume of the open source component scheduled corresponding to the real-time task request exceeds a preset first threshold, a compression operation is performed on the open source component; if the scheduling times of the open source component scheduled corresponding to the real-time task request exceeds a preset second threshold, a cache operation is performed on the open source component.

[0051] Compared with the prior art, the embodiments of the present invention have the following advantages:

[0052] 1) The present invention reduces the time cost of manual screening and testing and speeds up the software development process by automatically screening and evaluating open source components;

[0053] 2) The present invention avoids the introduction of high-risk components into the system through risk assessment and screening, thereby reducing the risk of the system being attacked;

[0054] 3) The scheduling strategy based on the risk assessment results of the present invention can achieve reasonable allocation of resources and load balancing, and improve the overall performance and stability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 It is a flowchart of a method for securely scheduling open source components in one embodiment of the present invention;

[0056] Figure 2 It is a structural diagram of an open source component security scheduling device in one embodiment of the present invention. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. The purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] In the description of this application, the terms "first", "second", "third", etc. are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first", "second", "third", etc. may explicitly or implicitly include one or more of the feature. In the description of this application, unless otherwise specified, "plurality" means two or more.

[0059] In the description of the present application, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be a connection between the two elements. The terms "vertical", "horizontal", "left", "right", "upper", "lower" and similar expressions used herein are only for illustrative purposes, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0060] In the description of this application, it should be noted that, unless otherwise defined, all technical and scientific terms used in the present invention have the same meaning as those commonly understood by those skilled in the art. The terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood by specific circumstances.

[0061] An embodiment of the present invention provides a method for securely scheduling open source components. For details, see Figure 1 , Figure 1 The flowchart of the open source component security scheduling method provided in one embodiment of the present invention is shown. It includes steps S1 to S5:

[0062] S1. Obtain the task requirements of the target system, and select an open source component cluster that matches the task requirements from a preset component library according to a semantic similarity algorithm;

[0063] First, the mission requirements of the target system need to be clearly defined and understood. This usually includes the functional requirements, performance indicators, user interface requirements, security requirements, etc. of the target system. Mission requirements may come from multiple channels such as user interviews, requirement documents, system specifications, etc.

[0064] In the present invention, the preset component library is a collection of various open source components, which may cover various functions and modules commonly used in software development. The component library should be screened and sorted to ensure that the components therein are reliable, maintainable and meet certain standards. At the same time, each component should have detailed description information, including functions, interfaces, dependencies, license types, etc.

[0065] Preferably, in an embodiment of the present invention, the step of selecting an open source component cluster matching the function of the task requirement from a preset component library according to a semantic similarity algorithm includes:

[0066] Obtaining a task description text of the task requirement and a component description text of an open source component in the preset component library;

[0067] Performing word segmentation processing on the task description text and the component description text respectively to obtain a task phrase set and an open source component phrase set;

[0068] Based on the cosine similarity algorithm, the semantic similarity between the task phrase set and each of the open source component phrase sets is calculated respectively, and the functional matching degree between the task requirement and each of the open source components is obtained according to the semantic similarity;

[0069] Screening is performed based on a preset matching degree threshold to obtain a plurality of the open source components whose functional matching degree exceeds the matching degree threshold.

[0070] The present invention selects the open source components that best match the task requirements based on the semantic similarity calculation results. The present invention has a high degree of automation and can quickly select components that meet the requirements from a large number of components, thereby improving development efficiency. In order to improve the accuracy and efficiency of the screening, the present invention sets a similarity threshold, and only components with a similarity higher than the threshold are considered as matches. In addition, since a task requirement may consist of multiple functional points, the screening result may be a cluster containing multiple components that work together to meet the task requirements.

[0071] S2. Using a software component analysis tool to extract risk assessment indicators for each open source component in each of the open source component clusters;

[0072] With the help of the Software Composition Analysis (SCA) tool, each open source component is scanned to extract risk assessment indicators including known vulnerabilities, license issues, historical update frequency, etc. The risk assessment indicators specifically include component popularity, update frequency, number of vulnerabilities, number of maintenance times, number of dependencies, license compatibility, and source code quality. The following is a detailed description of the risk assessment indicators.

[0073] Component popularity: This is assessed based on the frequency of use, download volume, or number of contributors in the open source community.

[0074] Update frequency: record the time interval between the last few component updates to assess the level of maintenance activity;

[0075] Number of vulnerabilities: List the number of known security vulnerabilities affecting this component and their severity;

[0076] Maintenance times: Record the number of major updates or maintenance activities that have been performed on the component since its release;

[0077] Number of dependencies: List the number of other components that the component depends on to assess its complexity and potential transitive risks;

[0078] License compatibility: Check if the component's license is compatible with the project or organization's license policy;

[0079] Source code quality: While this is not something all SCA tools can provide directly, some tools may provide indirect metrics about code complexity, test coverage, or how well the code has been reviewed.

[0080] S3, inputting the risk assessment indicator into a pre-trained risk assessment model for prediction, and obtaining a risk assessment result corresponding to each of the open source components, wherein the risk assessment model reflects the risk level of each of the open source components;

[0081] Preferably, in an embodiment of the present invention, before inputting the risk assessment indicator into a pre-trained risk assessment model for prediction, the method further includes:

[0082] Acquire a historical data set of the open source component, the historical data set includes risk assessment indicators, and perform a preprocessing operation on the historical data set, the preprocessing operation includes standardization and normalization;

[0083] Determine the weight of each indicator in the historical data set based on the hierarchical analysis method, combine the preprocessed historical data set with the corresponding weight to obtain the weighted risk assessment indicator, and construct a training data set according to the weighted risk assessment and the obtained risk level label;

[0084] A risk assessment model based on a deep neural network is constructed, and the risk assessment model is trained according to the training data set to obtain a trained risk assessment model.

[0085] Specifically, we first need to obtain a historical dataset of open source components. This dataset should contain detailed risk assessment indicators for multiple open source components and risk level labels corresponding to each component. This data can usually be collected through various channels such as open source communities, security reports, and version control repositories.

[0086] The collected historical data sets may contain data in various formats and dimensions, so preprocessing operations are required to ensure the consistency and comparability of the data. The preprocessing operations mainly include:

[0087] Standardization: Scale numerical data to a certain ratio so that it falls into a small specific range (such as 0 to 1 or -1 to 1). This helps eliminate the impact of different dimensions on data analysis;

[0088] Normalization: Although sometimes confused with standardization, normalization usually refers to scaling the data so that the data range is between [0, 1] without changing the distribution characteristics of the data.

[0089] Different risk assessment indicators may have different impacts on the overall risk of a component. Therefore, we need to determine the weights of each indicator based on the analytic hierarchy process (AHP) or other similar methods. The analytic hierarchy process is a method that combines qualitative and quantitative analysis of complex factors. It can decompose complex problems into several levels and factors, and perform a total ranking calculation among the factors to reflect the relative importance order of all factors. The preprocessed historical data set is combined with the corresponding weights to obtain the weighted risk assessment indicators. In this way, the evaluation of each component will be weighted according to the importance of its different indicators, thereby more accurately reflecting its overall risk level.

[0090] Based on the weighted risk assessment indicators and the obtained risk level labels, a training data set for training the risk assessment model is constructed. The training data set should contain enough samples to ensure the generalization ability and accuracy of the model.

[0091] The pre-built deep neural network is trained using a training dataset. During the training process, the model will learn how to map the input risk assessment indicators to the corresponding risk level labels. By adjusting the model's parameters (such as weights and biases), the error between the predicted results and the actual labels is minimized, thereby improving the model's prediction accuracy. After training is complete, the model needs to be evaluated to verify its performance. This usually involves using an independent test dataset to evaluate the model's prediction accuracy, recall rate, F1 score and other indicators. If the model performance does not meet the requirements, it can be improved by adjusting the model structure, increasing training data, optimizing the training algorithm, etc.

[0092] S4. Constructing a scheduling strategy according to the task requirements and the risk assessment results, wherein the scheduling strategy is designed to schedule the corresponding open source components for the task requirements according to a preset load balancing algorithm;

[0093] Preferably, in an embodiment of the present invention, constructing a scheduling strategy according to the task requirements and the risk assessment results includes:

[0094] Execute each of the open source components through simulation to obtain performance data of each of the open source components;

[0095] Performing consistency evaluation on each of the open source components according to the performance data to obtain consistency evaluation results corresponding to each of the open source components, wherein the consistency evaluation is designed to eliminate uncertainty in the execution process of the open source components;

[0096] Generate a priority list based on the consistency assessment result and the risk assessment result, wherein the priority list reflects the matching degree between the task requirements and the open source components and the risk assessment ranking of each of the open source components;

[0097] A scheduling strategy is formulated according to the priority selection list, wherein the scheduling strategy includes scheduling open source components corresponding to the task requirements.

[0098] Specifically, the execution process of each open source component is simulated to obtain its performance data in actual applications. Then, the uncertainty in the execution process of the open source component is eliminated and its stability and reliability are evaluated. The consistency evaluation process includes:

[0099] Perform statistical analysis on the collected performance data to identify outliers or erratic performance;

[0100] Design consistency evaluation indicators, such as stability coefficient and failure rate, to quantify the reliability of components;

[0101] Each open source component is scored according to the evaluation indicators to obtain the consistency evaluation results.

[0102] Combined with the specific requirements of the task and the risk assessment results of each component, design a scheduling strategy to determine how to allocate resources for the task based on the preset load balancing algorithm. Specifically, based on the task requirements and risk assessment results, provide a priority for the scheduling of open source components, including:

[0103] Comprehensively consider the requirements of the task requirements on component functions, performance, and safety;

[0104] Incorporate risk assessment results, especially those risk factors directly related to mission requirements (such as vulnerabilities, license issues, etc.);

[0105] Use algorithms (such as multi-objective optimization algorithms, sorting algorithms, etc.) to match task requirements with open source components, and consider the consistency evaluation results of components;

[0106] Generate a prioritized list that reflects the match between mission requirements and open source components and the risk assessment ranking of each component.

[0107] Finally, according to the priority list, appropriate open source components are scheduled for task requirements, including:

[0108] Design load balancing algorithms to ensure that system resources are used reasonably and avoid overload or idleness;

[0109] According to the scheduling strategy, components are selected from the priority list for scheduling;

[0110] Consider the dependencies and mutual exclusions between components to ensure the rationality and feasibility of scheduling;

[0111] Develop a detailed scheduling plan, including component startup order, resource allocation, execution time, etc.;

[0112] Monitor the scheduling process and adjust the scheduling strategy in time to deal with emergencies or system changes.

[0113] S5. In the actual scheduling process, the real-time task request is scheduled based on the scheduling strategy.

[0114] Before scheduling the real-time task request based on the scheduling strategy, the method further includes:

[0115] If the data volume of the open source component scheduled corresponding to the real-time task request exceeds a preset first threshold, a compression operation is performed on the open source component; if the scheduling times of the open source component scheduled corresponding to the real-time task request exceeds a preset second threshold, a cache operation is performed on the open source component.

[0116] Specifically, when the amount of open source component data corresponding to a real-time task request exceeds a preset first threshold, compression operations can significantly reduce the time and bandwidth consumption required for data transmission. This is particularly important for scenarios that process large-scale data sets or high-frequency data transmission, and can speed up the response speed of task processing; caching open source components whose scheduling times exceed the preset second threshold can reduce the repeated scheduling and loading time of these components. The caching mechanism can ensure that frequently accessed components are quickly available in memory, thereby avoiding repeated calculations or I / O operations and improving the overall throughput and response speed of the system.

[0117] By intelligently identifying and processing open source components with high data volumes and high frequency of scheduling, the system can allocate resources more reasonably. For components with large data volumes but low scheduling frequency, compression processing can be prioritized; while for components with frequent scheduling but moderate data volumes, cache processing is more suitable. This differentiated processing helps optimize resource usage and reduce resource waste.

[0118] Another embodiment of the present invention provides an open source component security scheduling device. For details, see Figure 2 , Figure 2 The schematic diagram of the structure of the open source component security scheduling device provided in one embodiment of the present invention is shown. It includes: an acquisition module 11, an extraction module 12, a prediction module 13, a construction module 14, and a scheduling module 15, wherein:

[0119] The acquisition module 11 is used to acquire the task requirements of the target system and select an open source component cluster matching the task requirements from a preset component library according to a semantic similarity algorithm;

[0120] An extraction module 12 is used to extract risk assessment indicators of each open source component in each open source component cluster using a software component analysis tool;

[0121] A prediction module 13 is used to input the risk assessment indicator into a pre-trained risk assessment model for prediction, and obtain a risk assessment result corresponding to each of the open source components, wherein the risk assessment model reflects the risk level of each of the open source components;

[0122] A construction module 14 is used to construct a scheduling strategy according to the task requirements and the risk assessment results, wherein the scheduling strategy is designed to schedule the open source components corresponding to the task requirements according to a preset load balancing algorithm;

[0123] The scheduling module 15 is used to schedule the real-time task request based on the scheduling strategy in the actual scheduling process.

[0124] Preferably, in an embodiment of the present invention, the risk assessment indicators include component popularity, update frequency, number of vulnerabilities, number of maintenance times, number of dependencies, license compatibility, and source code quality;

[0125] The prediction module is further used for:

[0126] Acquire a historical data set of the open source component, the historical data set includes risk assessment indicators, and perform a preprocessing operation on the historical data set, the preprocessing operation includes standardization and normalization;

[0127] Determine the weight of each indicator in the historical data set based on the hierarchical analysis method, combine the preprocessed historical data set with the corresponding weight to obtain the weighted risk assessment indicator, and construct a training data set according to the weighted risk assessment and the obtained risk level label;

[0128] A risk assessment model based on a deep neural network is constructed, and the risk assessment model is trained according to the training data set to obtain a trained risk assessment model.

[0129] Preferably, in the embodiment of the present invention, the acquisition module is used to:

[0130] Obtaining a task description text of the task requirement and a component description text of an open source component in the preset component library;

[0131] Performing word segmentation processing on the task description text and the component description text respectively to obtain a task phrase set and an open source component phrase set;

[0132] Based on the cosine similarity algorithm, the semantic similarity between the task phrase set and each of the open source component phrase sets is calculated respectively, and the functional matching degree between the task requirement and each of the open source components is obtained according to the semantic similarity;

[0133] Screening is performed based on a preset matching degree threshold to obtain a plurality of the open source components whose functional matching degree exceeds the matching degree threshold.

[0134] Preferably, in an embodiment of the present invention, the building block is used to:

[0135] Execute each of the open source components through simulation to obtain performance data of each of the open source components;

[0136] Performing consistency evaluation on each of the open source components according to the performance data to obtain consistency evaluation results corresponding to each of the open source components, wherein the consistency evaluation is designed to eliminate uncertainty in the execution process of the open source components;

[0137] Generate a priority list based on the consistency assessment result and the risk assessment result, wherein the priority list reflects the matching degree between the task requirements and the open source components and the risk assessment ranking of each of the open source components;

[0138] A scheduling strategy is formulated according to the priority selection list, wherein the scheduling strategy includes scheduling open source components corresponding to the task requirements.

[0139] Preferably, in the embodiment of the present invention, the scheduling module is further used for:

[0140] If the data volume of the open source component scheduled corresponding to the real-time task request exceeds a preset first threshold, a compression operation is performed on the open source component; if the scheduling times of the open source component scheduled corresponding to the real-time task request exceeds a preset second threshold, a cache operation is performed on the open source component.

[0141] The open source component security scheduling method and device provided by the embodiment of the present invention have the beneficial effects of at least one of the following:

[0142] 1) The present invention reduces the time cost of manual screening and testing and speeds up the software development process by automatically screening and evaluating open source components;

[0143] 2) The present invention avoids the introduction of high-risk components into the system through risk assessment and screening, thereby reducing the risk of the system being attacked;

[0144] 3) The scheduling strategy based on the risk assessment results of the present invention can achieve reasonable allocation of resources and load balancing, and improve the overall performance and stability of the system.

[0145] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A method for secure scheduling of open source components, characterized in that: The following steps are involved: Obtain the task requirements of the target system, and select an open source component cluster that matches the task requirements from a preset component library based on a semantic similarity algorithm; Using a software component analysis tool to extract risk assessment indicators for each open source component in each of the open source component clusters; Inputting the risk assessment indicator into a pre-trained risk assessment model for prediction to obtain a risk assessment result corresponding to each of the open source components, wherein the risk assessment model reflects the risk level of each of the open source components; Constructing a scheduling strategy according to the task requirements and the risk assessment results, wherein the scheduling strategy is designed to schedule the open source components corresponding to the task requirements according to a preset load balancing algorithm; In the actual scheduling process, the real-time task request is scheduled based on the scheduling strategy.

2. The open source component security scheduling method according to claim 1, characterized in that: The risk assessment indicators include component popularity, update frequency, number of vulnerabilities, number of maintenance times, number of dependencies, license compatibility, and source code quality; Before inputting the risk assessment indicator into the pre-trained risk assessment model for prediction, the method further includes: Acquire a historical data set of the open source component, the historical data set includes risk assessment indicators, and perform a preprocessing operation on the historical data set, the preprocessing operation includes standardization and normalization; Determine the weight of each indicator in the historical data set based on the hierarchical analysis method, combine the preprocessed historical data set with the corresponding weight to obtain the weighted risk assessment indicator, and construct a training data set according to the weighted risk assessment and the obtained risk level label; A risk assessment model based on a deep neural network is constructed, and the risk assessment model is trained according to the training data set to obtain a trained risk assessment model.

3. The open source component security scheduling method according to claim 1, characterized in that: The step of selecting an open source component cluster matching the function of the task requirement from a preset component library according to a semantic similarity algorithm includes: Obtaining a task description text of the task requirement and a component description text of an open source component in the preset component library; Performing word segmentation processing on the task description text and the component description text respectively to obtain a task phrase set and an open source component phrase set; Based on the cosine similarity algorithm, the semantic similarity between the task phrase set and each of the open source component phrase sets is calculated respectively, and the functional matching degree between the task requirement and each of the open source components is obtained according to the semantic similarity; Screening is performed based on a preset matching degree threshold to obtain a plurality of the open source components whose functional matching degree exceeds the matching degree threshold.

4. The open source component security scheduling method according to claim 1, characterized in that: The constructing a scheduling strategy according to the task requirements and the risk assessment results includes: Execute each of the open source components through simulation to obtain performance data of each of the open source components; Performing consistency evaluation on each of the open source components according to the performance data to obtain consistency evaluation results corresponding to each of the open source components, wherein the consistency evaluation is designed to eliminate uncertainty in the execution process of the open source components; Generate a priority list based on the consistency assessment result and the risk assessment result, wherein the priority list reflects the matching degree between the task requirements and the open source components and the risk assessment ranking of each of the open source components; A scheduling strategy is formulated according to the priority selection list, wherein the scheduling strategy includes scheduling open source components corresponding to the task requirements.

5. The open source component security scheduling method according to claim 1, characterized in that: Before scheduling the real-time task request based on the scheduling strategy, the method further includes: If the data volume of the open source component scheduled corresponding to the real-time task request exceeds a preset first threshold, a compression operation is performed on the open source component; if the scheduling times of the open source component scheduled corresponding to the real-time task request exceeds a preset second threshold, a cache operation is performed on the open source component.

6. An open source component security scheduling device, characterized in that: Includes the following modules: An acquisition module is used to acquire the task requirements of the target system and select an open source component cluster that matches the task requirements from a preset component library according to a semantic similarity algorithm; An extraction module, used to extract risk assessment indicators of each open source component in each open source component cluster using a software component analysis tool; A prediction module, used for inputting the risk assessment indicator into a pre-trained risk assessment model for prediction, and obtaining a risk assessment result corresponding to each of the open source components, wherein the risk assessment model reflects the risk level of each of the open source components; A construction module, used to construct a scheduling strategy according to the task requirements and the risk assessment results, wherein the scheduling strategy is designed to schedule the open source components corresponding to the task requirements according to a preset load balancing algorithm; The scheduling module is used to schedule the real-time task request based on the scheduling strategy in the actual scheduling process.

7. The open source component security scheduling device according to claim 6, characterized in that: The risk assessment indicators include component popularity, update frequency, number of vulnerabilities, number of maintenance times, number of dependencies, license compatibility, and source code quality; The prediction module is further used for: Acquire a historical data set of the open source component, the historical data set includes risk assessment indicators, and perform a preprocessing operation on the historical data set, the preprocessing operation includes standardization and normalization; Determine the weight of each indicator in the historical data set based on the hierarchical analysis method, combine the preprocessed historical data set with the corresponding weight to obtain the weighted risk assessment indicator, and construct a training data set according to the weighted risk assessment and the obtained risk level label; A risk assessment model based on a deep neural network is constructed, and the risk assessment model is trained according to the training data set to obtain a trained risk assessment model.

8. The open source component security scheduling device according to claim 6, characterized in that: The acquisition module is used to: Obtaining a task description text of the task requirement and a component description text of an open source component in the preset component library; Performing word segmentation processing on the task description text and the component description text respectively to obtain a task phrase set and an open source component phrase set; Based on the cosine similarity algorithm, the semantic similarity between the task phrase set and each of the open source component phrase sets is calculated respectively, and the functional matching degree between the task requirement and each of the open source components is obtained according to the semantic similarity; Screening is performed based on a preset matching degree threshold to obtain a plurality of the open source components whose functional matching degree exceeds the matching degree threshold.

9. The open source component security scheduling device according to claim 6, characterized in that: The building blocks are used to: Execute each of the open source components through simulation to obtain performance data of each of the open source components; Performing consistency evaluation on each of the open source components according to the performance data to obtain consistency evaluation results corresponding to each of the open source components, wherein the consistency evaluation is designed to eliminate uncertainty in the execution process of the open source components; Generate a priority list based on the consistency assessment result and the risk assessment result, wherein the priority list reflects the matching degree between the task requirements and the open source components and the risk assessment ranking of each of the open source components; A scheduling strategy is formulated according to the priority selection list, wherein the scheduling strategy includes scheduling open source components corresponding to the task requirements.

10. The open source component security scheduling device according to claim 6, characterized in that: The scheduling module is also used for: If the data volume of the open source component scheduled corresponding to the real-time task request exceeds a preset first threshold, a compression operation is performed on the open source component; if the scheduling times of the open source component scheduled corresponding to the real-time task request exceeds a preset second threshold, a cache operation is performed on the open source component.

Images