SCA component recommendation method and device based on large model, equipment and medium

Abstract

The embodiment of the invention provides an SCA component recommendation method and device based on a large model, equipment and a medium. The method comprises the steps of obtaining components with vulnerabilities in a to-be-tested project; determining information of the component with the vulnerability and corresponding vulnerability information; according to a pre-trained component recommendation model and a knowledge graph, determining an initial recommendation component corresponding to the component with the vulnerability; determining a test case code corresponding to the initial recommendation component; according to the initial recommendation component and the test case code, verifying the test case code, and further determining a test score corresponding to the initial recommendation component; and according to the test score, determining the initial recommendation component as a target recommendation component, and obtaining a test case code of the target recommendation component. According to the method, the component recommendation model and the knowledge graph which are trained in advance are adopted, component recommendation is automatically carried out, the effectiveness of the recommended components is judged by calculating the test scores of different recommended components, and the component recommendation accuracy and efficiency are improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a large model-based SCA component recommendation method, device, equipment and medium. Background Art

[0002] In modern software development, open source components are widely used in software development. However, open source components come from many sources, and their quality and security vary. These components may contain known security vulnerabilities, and due to their high update frequency, if developers do not track them in a timely manner, it is easy to expose software products to risks. Based on this, security tools are usually used to discover risky components and replace them with recommended safe and available components. For the recommended replacement components, they must be evaluated in terms of security and ensure that they can provide the same or better functions as the original risky components.

[0003] The industry typically uses software composition analysis tools (SCA) to implement this functional process. SCA tools focus on identifying known security vulnerabilities and license compliance issues in open source components and third-party libraries. SCA tools help teams update or replace risky components in a timely manner by scanning project dependencies and comparing them with a known vulnerability database. Such tools are particularly important for managing open source components that are widely used in modern software development.

[0004] Currently, when a component is detected to have a vulnerability, the vulnerable component needs to be replaced, but the validity of the replacement component cannot be verified. Therefore, how to verify the validity of the replacement component is a problem that needs to be solved urgently. Summary of the invention

[0005] The purpose of some embodiments of the present application is to provide a SCA component recommendation method, device, electronic device and storage medium based on a large model. Through the technical solution of the embodiments of the present application, by obtaining the components with vulnerabilities in the project to be tested; according to the components with vulnerabilities in the project to be tested, determine the information of the components with vulnerabilities and the corresponding vulnerability information; according to the pre-trained component recommendation model and knowledge graph, determine the initial recommended component corresponding to the component with vulnerabilities; wherein the component recommendation model is obtained by training the large model with training sample data; according to the initial recommended component, determine the test case code corresponding to the initial recommended component; according to the initial recommended component and the test case code, verify the test case code and determine the test score corresponding to the initial recommended component; according to the test score, determine the initial recommended component as the target recommended component, and obtain the test case code of the target recommended component. In the embodiments of the present application, the pre-trained component recommendation model and knowledge graph are used to automatically recommend components, and then by calculating the test scores of different recommended components, the effectiveness of the recommended components can be judged, thereby improving the accuracy and efficiency of component recommendation.

[0006] In a first aspect, some embodiments of the present application provide a method for recommending SCA components based on a large model, including: Get the components with vulnerabilities in the project to be tested; According to the components with vulnerabilities in the project to be tested, determining information of the components with vulnerabilities and corresponding vulnerability information; Determine the initial recommended component corresponding to the vulnerable component according to the pre-trained component recommendation model and knowledge graph; wherein the component recommendation model is obtained by training a large model using training sample data; According to the initial recommended components, determining the test case code corresponding to the initial recommended components; Based on the initial recommended components and the test case codes, verify the test case codes and determine the test scores corresponding to the initial recommended components; According to the test score, the initial recommended component is determined as a target recommended component, and a test case code of the target recommended component is obtained.

[0007] Some embodiments of the present application can automatically recommend components by adopting a pre-trained component recommendation model and knowledge graph, and then by calculating the test scores of different recommended components, the effectiveness of the recommended components can be judged to improve the accuracy and efficiency of component recommendations.

[0008] Optionally, the pre-trained component recommendation model is obtained in the following manner: Acquire training sample data, wherein the training sample data is obtained from a component knowledge base according to business requirements; the training sample data at least includes component information, vulnerability information and test cases, and the component information corresponds to the vulnerability information and the test cases respectively; The training sample data is used to train the training parameters of the large model to obtain the component recommendation model, wherein the training parameters include at least a learning rate, a loss function and a number of training times.

[0009] Some embodiments of the present application collect information from multiple open source component platforms and integrate multi-dimensional security data to obtain a comprehensive open source component data set that is structured, easy to maintain, and easy to increase, thereby reducing misjudgments caused by insufficient data dimensions; a large model is trained based on a comprehensive data set, and recommended components are effectively generated through the strategy of the large model, which greatly improves the reliability of recommendation results compared to recommendations that rely on static rules.

[0010] Optionally, the knowledge graph is obtained in the following manner: According to the pre-stored component knowledge base, each component is regarded as a node component entity; The node component entity, API call information, vulnerability information and recommended components are combined according to preset association relationships to obtain triple data between entities and relationships; The triple data is converted into a vector to obtain the knowledge graph.

[0011] Some embodiments of the present application construct a knowledge graph and index of open source component information and vulnerability information, and treat each component as a node component entity, connecting it with API calls, vulnerability information, and alternative components through relationships. In this way, information is collected from multiple open source component platforms and multi-dimensional security data is integrated to generate a knowledge graph, thereby reducing misjudgments and security risks caused by insufficient data dimensions.

[0012] Optionally, determining the initial recommended component corresponding to the vulnerable component according to the pre-trained component recommendation model and knowledge graph includes: According to the component information and its vulnerability information and the pre-trained component recommendation model, a graph query statement corresponding to the component information and its vulnerability information is obtained, wherein the graph query statement at least includes a component name, a version number, and a usage of the component in the project; According to the graph query statement, a query is performed in the knowledge graph to obtain an entity subgraph in the knowledge graph, wherein the entity subgraph contains corresponding relevant component information and components corresponding to the vulnerability information, and the relevant component information in the subgraph, as well as the standardized component information and its vulnerability information are input into a pre-trained component recommendation model to obtain an initial recommended component.

[0013] Some embodiments of the present application introduce an automated verification module to effectively detect the functionality and security of recommended components in actual projects. Optionally, querying the knowledge graph according to the graph query statement to obtain an entity subgraph in the knowledge graph includes: A depth-first search method or a breadth-first search method is used to query the knowledge graph to obtain an entity subgraph in the knowledge graph corresponding to the graph query statement.

[0014] Some embodiments of the present application use a depth-first search method or a breadth-first search method to query the knowledge graph and obtain an entity subgraph in the knowledge graph corresponding to the graph query statement, without having to judge all entities, thereby reducing the amount of data processing and improving data processing efficiency.

[0015] Optionally, determining the initial recommended component as a target recommended component according to the test score, and obtaining a test case code of the target recommended component includes: Sorting the test scores in descending order; The initial recommended component corresponding to the test score being greater than a preset value is determined as the target recommended component.

[0016] In some embodiments of the present application, after verifying the validity of the three initially recommended security components through a component verification module, the security component model is called to generate test case codes for the valid components, and the recommended valid components and the test case codes for the components are determined after effective scoring, thereby improving the quality and credibility of the recommended components.

[0017] In a second aspect, some embodiments of the present application provide a large model-based SCA component recommendation device, including: Acquisition module, used to obtain components with vulnerabilities in the project to be tested; A first determination module, configured to determine information of the vulnerable component and corresponding vulnerability information according to the vulnerable component in the project to be tested; A second determination module is used to determine an initial recommended component corresponding to the vulnerable component based on a pre-trained component recommendation model and a knowledge graph; wherein the component recommendation model is obtained by training a large model using training sample data; A third determination module is used to determine the test case code corresponding to the initial recommended component according to the initial recommended component; A calculation module, used to verify the test case code according to the initial recommended components and the test case code, and determine the test score corresponding to the initial recommended components; The recommendation module is used to determine the initial recommended component as a target recommended component according to the test score, and obtain the test case code of the target recommended component.

[0018] Some embodiments of the present application can automatically recommend components by adopting a pre-trained component recommendation model and knowledge graph, and then by calculating the test scores of different recommended components, the effectiveness of the recommended components can be judged to improve the accuracy and efficiency of component recommendations.

[0019] Optionally, the device further comprises an establishing module, wherein the establishing module is configured to: Acquire training sample data, wherein the training sample data is obtained from a component knowledge base according to business requirements; the training sample data at least includes component information, vulnerability information and test cases, and the component information corresponds to the vulnerability information and the test cases respectively; The training sample data is used to train the training parameters of the large model to obtain the component recommendation model, wherein the training parameters include at least a learning rate, a loss function and a number of training times.

[0020] Some embodiments of the present application collect information from multiple open source component platforms and integrate multi-dimensional security data to obtain a comprehensive open source component data set that is structured, easy to maintain, and easy to increase, thereby reducing misjudgments caused by insufficient data dimensions; a large model is trained based on a comprehensive data set, and recommended components are effectively generated through the strategy of the large model, which greatly improves the reliability of recommendation results compared to recommendations that rely on static rules.

[0021] Optionally, the establishing module is used to: According to the pre-stored component knowledge base, each component is regarded as a node component entity; The node component entity, API call information, vulnerability information and recommended components are combined according to preset association relationships to obtain triple data between entities and relationships; The triple data is converted into a vector to obtain the knowledge graph.

[0022] Some embodiments of the present application construct a knowledge graph and index of open source component information and vulnerability information, and treat each component as a node component entity, connecting it with API calls, vulnerability information, and alternative components through relationships. In this way, information is collected from multiple open source component platforms and multi-dimensional security data is integrated to generate a knowledge graph, thereby reducing misjudgments and security risks caused by insufficient data dimensions.

[0023] Optionally, the second determining module is used to: According to the component information and its vulnerability information and the pre-trained component recommendation model, a graph query statement corresponding to the component information and its vulnerability information is obtained, wherein the graph query statement at least includes a component name, a version number, and a usage of the component in the project; According to the graph query statement, a query is performed in the knowledge graph to obtain an entity subgraph in the knowledge graph, wherein the entity subgraph contains corresponding relevant component information and components corresponding to the vulnerability information, and the relevant component information in the subgraph, as well as the standardized component information and its vulnerability information are input into a pre-trained component recommendation model to obtain an initial recommended component.

[0024] Some embodiments of the present application introduce an automated verification module to effectively detect the functionality and security of recommended components in actual projects. Optionally, the second determining module is used to: A depth-first search method or a breadth-first search method is used to query the knowledge graph to obtain an entity subgraph in the knowledge graph corresponding to the graph query statement.

[0025] Some embodiments of the present application use a depth-first search method or a breadth-first search method to query the knowledge graph and obtain an entity subgraph in the knowledge graph corresponding to the graph query statement, without having to judge all entities, thereby reducing the amount of data processing and improving data processing efficiency.

[0026] Optionally, the recommendation module is used to: Sorting the test scores in descending order; The initial recommended component corresponding to the test score being greater than a preset value is determined as the target recommended component. In some embodiments of the present application, after verifying the validity of the three initially recommended security components through a component verification module, the security component model is called to generate test case codes for the valid components, and the recommended valid components and the test case codes for the components are determined after effective scoring, thereby improving the quality and credibility of the recommended components.

[0027] In a third aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein when the processor executes the program, the large model-based SCA component recommendation method as described in any embodiment of the first aspect can be implemented.

[0028] In a fourth aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the large model-based SCA component recommendation method as described in any embodiment of the first aspect.

[0029] In a fifth aspect, some embodiments of the present application provide a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the large model-based SCA component recommendation method as described in any embodiment of the first aspect can be implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the drawings required for use in some embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0031] Figure 1 A flowchart of a large-model-based SCA component recommendation method provided in an embodiment of the present application; Figure 2 A schematic diagram of the model training process provided in the embodiment of the present application; Figure 3 A schematic diagram of a knowledge graph provided for an embodiment of the present application; Figure 4 A schematic diagram of component detection provided in an embodiment of the present application; Figure 5 A flowchart of another SCA component recommendation method based on a large model provided in an embodiment of the present application; Figure 6 A schematic diagram of the recommendation results provided in the embodiment of the present application; Figure 7 A schematic diagram of the structure of a large model-based SCA component recommendation device provided in an embodiment of the present application; Figure 8 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0032] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0033] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0034] After recommending components, the general solution does not automatically verify the recommended components. The lack of a module for automatic verification of recommended components means that even if the components are replaced, it is difficult to confirm their effectiveness and security in actual projects in real time, and it is impossible to verify the security effectiveness of recommended components after replacement.

[0035] The existing technology in the industry monitors the changes in the configuration files of the project to be developed in real time to obtain the newly introduced open source components in the project; obtains the recommended target open source components based on the security knowledge data of the newly introduced open source components, and the security knowledge data includes version information; replaces the newly introduced open source components with the target open source components and introduces them into the project, and obtains the security information between the target open source components and the components used in the project, so as to perform security detection on the project based on the security information. In this way, the security risks brought by the newly introduced open source components are reduced, the effect of "developing and repairing at the same time" is achieved, major security issues caused by the accumulation of security issues are effectively avoided, and the real-time nature of software development is guaranteed.

[0036] Typically, existing technologies in the industry rely on a single source or limited data dimensions when collecting component security information, such as component versions and known vulnerability databases. This results in incomplete component security data information that cannot cover potential dependency risks and updated security threats. In the common technical methods of related industries, the complex dependencies between components are not deeply analyzed. Especially in the case of recursive dependencies, the dependencies cannot be fully understood, resulting in incomplete component security data information, inability to identify deep-level security risks, and difficulty in achieving accurate matching recommendations for components. Existing technologies usually only recommend components based on pre-collected static data or rules. As the collection is delayed, component security information will lag behind the current threat situation, increasing security risks.

[0037] At the same time, static data or rules are not combined to adapt to different project requirements and environments, and have poor flexibility, and cannot guarantee that the recommended components can fully adapt to current development needs. Therefore, although the existing technology has achieved the effect of "development and repair", that is, "development and testing", due to the inaccurate security data of the recommended components, it may delay the discovery of risks and affect the security of the project.

[0038] In addition, the general solution does not automatically verify the recommended components after recommending them. The lack of a module for automatically verifying the recommended components means that even if the components are replaced, it is difficult to confirm their effectiveness and safety in actual projects in real time, and it is impossible to verify the safety effectiveness of the recommended components after replacement.

[0039] In the existing technology implementation process, when developers introduce new components, they need to write test cases themselves, which is time-consuming and labor-intensive, and may miss key test scenarios, reducing the efficiency and accuracy of component replacement recommendations.

[0040] Although existing technologies can replace open source components, they do not collect comprehensive information about component security, analyze the dimensions that components rely on, and pre-collected static data may be outdated. These results in the use of inaccurate component security data sets, affecting the accuracy of component recommendations. Component recommendations based only on static data or rules cannot adapt to the needs of different projects and environments, reducing the availability of recommended components. There is a lack of automated verification of the generation of recommended components, resulting in the inability to verify the security effectiveness of components after replacement, that is, the security of the recommended components cannot be verified. At the same time, the lack of automated test cases means that the component replacement process needs to be manually written, reducing the efficiency and accuracy of component replacement.

[0041] In view of this, some embodiments of the present application provide an SCA component recommendation method based on a large model, the method comprising obtaining components with vulnerabilities in a project to be tested; determining information of the components with vulnerabilities and corresponding vulnerability information based on the components with vulnerabilities in the project to be tested; determining an initial recommended component corresponding to the component with vulnerabilities based on a pre-trained component recommendation model and knowledge graph; wherein the component recommendation model is obtained by training the large model using training sample data; determining a test case code corresponding to the initial recommended component based on the initial recommended component; verifying the test case code based on the initial recommended component and the test case code, and determining a test score corresponding to the initial recommended component; determining the initial recommended component as a target recommended component based on the test score, and obtaining the test case code of the target recommended component. In the embodiments of the present application, a pre-trained component recommendation model and knowledge graph are used to automatically recommend components, and then by calculating the test scores of different recommended components, the effectiveness of the recommended components can be judged, thereby improving the accuracy and efficiency of component recommendations.

[0042] like Figure 1 As shown, an embodiment of the present application provides an SCA component recommendation method based on a large model, the method comprising: S101. Obtain components with vulnerabilities in the project to be tested; Specifically, SCA (Software Composition Analysis) is installed on the terminal device. By detecting the components of the project to be tested through SCA, all the components used in the project to be tested can be detected, including components with vulnerabilities.

[0043] S102, according to the components with vulnerabilities in the project to be tested, determining information of the components with vulnerabilities and corresponding vulnerability information; The terminal device uses the SCA software to perform component detection and information extraction on the test items to obtain information about each component. At the same time, the vulnerability detection of the SCA software can obtain components with vulnerabilities.

[0044] Specifically, the component information includes at least: component: Contains basic information about the component, such as the component name, the current version number used, and the license type used.

[0045] vulnerabilities: A list containing known security vulnerability information for the component, such as vulnerability ID (such as CVE number), CVSS score, indicating the severity of the vulnerability, vulnerability description, vulnerability payload sample, affected version range, and vulnerability release date.

[0046] codeUsage: describes the usage of the component in the project, such as dependency declarations in the build tool, configuration file names, code snippets that use the component in the project, and displays the interface as follows: Figure 4 shown.

[0047] S103, determining an initial recommended component corresponding to a component with a vulnerability according to a pre-trained component recommendation model and knowledge graph; wherein the component recommendation model is obtained by training a large model using training sample data; Specifically, the terminal device performs standardization processing on the acquired component information and its vulnerability information to obtain the processed standardized component information and its vulnerability information, inputs the standardized component information and its vulnerability information into the knowledge graph for search, obtains a subgraph with components as entities, inputs the relevant component information in the subgraph, as well as the standardized component information and its vulnerability information into a pre-trained component recommendation model to obtain the initial recommended component.

[0048] S104, determining the test case code corresponding to the initial recommended component according to the initial recommended component; Specifically, the terminal device generates test case codes corresponding to the initial recommended components based on the initial recommended components.

[0049] S105, verifying the test case code according to the initial recommended component and the test case code, and determining a test score corresponding to the initial recommended component; Specifically, functional unit testing is performed to verify whether the test case code is valid, and multiple valid recommended components are scored and ranked according to the compatibility of the recommended component's technology stack > functional requirements > update frequency > community activity to obtain the test score corresponding to the initial recommended component.

[0050] If the number of initially recommended components is 3, 3 test scores can be calculated.

[0051] S106. According to the test score, determine the initial recommended component as the target recommended component, and obtain the test case code of the target recommended component.

[0052] Specifically, the terminal device sorts the obtained test scores and selects the initial recommended components with high test scores as target recommended components.

[0053] like Figure 5 As shown, after SCA detects vulnerable components, the information of open source components collected from various open source component platforms and the security component recommendation model obtained through component vulnerability training are used to infer three recommended security components (initial recommended components). The security component model is called to generate test case code for valid components. The three initial recommended components are then verified for validity through the component verification module. The target recommended component and the test case code for the recommended component are determined through the effective score.

[0054] Some embodiments of the present application can automatically recommend components by adopting a pre-trained component recommendation model and knowledge graph, and then by calculating the test scores of different recommended components, the effectiveness of the recommended components can be judged to improve the accuracy and efficiency of component recommendations.

[0055] Another embodiment of the present application further supplements the large model-based SCA component recommendation method provided in the above embodiment.

[0056] In the embodiment of the present application, component information can be obtained from various platforms, and then data cleaning of the component information is performed, that is, component information and vulnerability information are standardized: Data cleaning, specifically, is to format (standardize) the collected component information, component API call example documents, and vulnerability information according to unified specifications and store them in the component information ES knowledge base.

[0057] component: Contains basic information about the component, including the component name, the current version number used, and the license type used.

[0058] API Example: Contains the API call examples of the component, including the component function name, function parameters, API call examples, and function function annotations.

[0059] vulnerabilities: A list containing known security vulnerability information for this component, including vulnerability ID (such as CVE number), CVSS score, indicating the severity of the vulnerability, vulnerability description, vulnerability level, vulnerability payload sample, affected version range, and vulnerability release date.

[0060] recommendations: a list of recommended alternative components; name: Alternative component name.

[0061] version: Alternate component version.

[0062] functionality: description of functional requirements.

[0063] techStack: Description of technology stack compatibility.

[0064] vulnerabilityLevel: Component security level.

[0065] recommendationLevel: Component recommendation level.

[0066] According to the requirements, the data in the pre-stored component knowledge base is converted into a pre-training dataset; The specific method is as follows: By setting business requirements, querying the component information ES knowledge base, obtaining the component information corresponding to the business requirements and its associated vulnerability information (standardized information of component vulnerabilities), and using the component information and vulnerability information of each component as training sample data.

[0067] The training sample data includes basic information of components, corresponding vulnerability information and recommended components, etc.; component: contains basic information of components, vulnerabilities: list, including known security vulnerability information of the component, recommendations: list of recommended alternative components; Among them, the vulnerabilityLevel: component security level in recommendations needs to be determined according to the data in the vulnerabilities: list. If there is a vulnerability, it is determined according to the vulnerabilityLevel in the vulnerabilities: list. If there is no vulnerability, the vulnerabilityLevel value of the recommendations: recommended alternative component list is no vulnerability. The recommendationLevel: component security level in recommendations needs to be determined according to the data in the vulnerabilities: list. If there is a vulnerability, it is no (not recommended), if there is no vulnerability, it is yes (recommended).

[0068] Concatenate the key and value of each field of the data into a long text format to get the following format: "Component Name: {name}, Version: {version}, License: {license}.APIExample: Function {functionName} with Arguments {arguments}. Function Description: {functionComments}.Vulnerability ID: {id}, CVSSScore: {cvssScore}, Description: {description},Payload Example: {payload},Affected Versions: {affectedVersions}, Published Date: {publishedDate}.Recommendation: Component Name: {name}, Version: {version}, Functionality:{functionality}, Tech Stack: {techStack}, Vulnerability Level:{vulnerabilityLevel}, Recommendation Level: {recommendationLevel}. " Optionally, a pre-trained component recommendation model is obtained as follows: Acquire training sample data, wherein the training sample data is obtained from a component knowledge base according to business requirements; the training sample data at least includes component information, vulnerability information, and test cases, and the component information corresponds to the vulnerability information and the test cases respectively; The training sample data is used to train the training parameters of the large model to obtain a component recommendation model, wherein the training parameters include at least a learning rate, a loss function, and a number of training times.

[0069] like Figure 2 As shown, specifically, the pre-training data set, i.e., the training sample data, is standardized and then input into the large model (LLM) for training. The pre-training data set and training parameters are specified in the LLM large model. The training parameters include the learning rate (such as the learning rate controlled by the linear decay algorithm and the cosine annealing algorithm), the loss function, and the number of training times to generate a component recommendation model.

[0070] Some embodiments of the present application collect information from multiple open source component platforms and integrate multi-dimensional security data to obtain a comprehensive open source component data set that is structured, easy to maintain, and easy to increase, thereby reducing misjudgments caused by insufficient data dimensions; a large model is trained based on a comprehensive data set, and recommended components are effectively generated through the strategy of the large model, which greatly improves the reliability of recommendation results compared to recommendations that rely on static rules.

[0071] Optionally, the knowledge graph is obtained by: According to the pre-stored component knowledge base, each component is regarded as a node component entity; The node component entity, API call information, vulnerability information and recommended components are combined according to the preset association relationship to obtain the triple data between the entity and the relationship; Convert triple data into vectors to obtain a knowledge graph.

[0072] Specifically, Figure 3 As shown in the figure, we build a knowledge graph GraphRAG and index of open source component information and vulnerability information: we treat each component as a node component entity (Component), and connect it with API calls, vulnerability information, and alternative components through relationships.

[0073] First, extract the component entity, and treat each component and version as a node component entity (Component), along with API calls and vulnerability information as entities. Figure 2The knowledge graph of log4j-core is shown in the figure, including the log4j 2.14.1 node component entity Component, log4j 2.14.1 APIExample instance, log4j 2.14.1 Vulnerability vulnerability, and log4j 2.14.1 Recommendation, each as an entity.

[0074] Attribute association: Component: basic information of the component. APIExample: API call example of the component. Vulnerability: security vulnerability information of the component. Recommendation: recommended information of alternative components. The relationship between each attribute and entity is established to generate a subgraph.

[0075] Relationship establishment: The relationship between HAS_API: Component and APIExample.

[0076] HAS_VULNERABILITY: The relationship between Component and Vulnerability. HAS_RECOMMENDATION: The relationship between Component and Recommendation.

[0077] After converting node component entities, API calls, vulnerability information, and recommended components into entity-relationship-entity triples in the above manner, they are indexed and converted into vectors and stored in graph databases such as Neo4j, JanusGraph, NebulaGraph, TuGraph, etc.

[0078] Some embodiments of the present application construct a knowledge graph and index of open source component information and vulnerability information, and treat each component as a node component entity, connecting it with API calls, vulnerability information, and alternative components through relationships. In this way, information is collected from multiple open source component platforms and multi-dimensional security data is integrated to generate a knowledge graph, thereby reducing misjudgments and security risks caused by insufficient data dimensions.

[0079] Optionally, based on a pre-trained component recommendation model and knowledge graph, an initial recommended component corresponding to the vulnerable component is determined, including: According to the vulnerability information and the pre-trained component recommendation model, a graph query statement corresponding to the vulnerability information is obtained, wherein the graph query statement at least includes the component name, version number, and usage of the component in the project; According to the graph query statement, a query is performed in the knowledge graph to obtain an entity subgraph in the knowledge graph, wherein the entity subgraph contains corresponding relevant component information and components corresponding to the vulnerability information. The relevant component information in the subgraph, as well as the standardized component information and its vulnerability information are input into a pre-trained component recommendation model to obtain an initial recommended component.

[0080] Some embodiments of the present application introduce an automated verification module to effectively detect the functionality and security of recommended components in actual projects. Optionally, according to the graph query statement, a query is performed in the knowledge graph to obtain an entity subgraph in the knowledge graph, including: A depth-first search method or a breadth-first search method is used to query the knowledge graph and obtain an entity subgraph in the knowledge graph corresponding to the graph query statement.

[0081] In the embodiment of the present application, after the component vulnerability information is standardized, it is input into a pre-trained component recommendation model to obtain a graph query statement, which includes the component name, component version number, and the code used by codeUsage in the project. According to the graph query statement, the entity in the knowledge graph is queried to obtain a subgraph of each component entity. The specific query method includes: Through the subgraph traversal algorithm DFS (Depth First Search Method): Query, that is, starting from the root node, search each branch as deeply as possible until it cannot go deeper, and then trace back to the previous layer of nodes.

[0082] The query can be performed through BFS (breadth-first search method): starting from the root node, traverse all adjacent nodes layer by layer, and then visit the nodes of the next layer to search for local subgraphs within N hops.

[0083] The terminal device then formats the local subgraph of the component to obtain component text information, aggregates the information as context information, and obtains the top three components and component usage example codes through summary and reasoning of the component recommendation model to achieve high availability.

[0084] Some embodiments of the present application use a depth-first search method or a breadth-first search method to perform queries in a knowledge graph to obtain an entity subgraph in the knowledge graph corresponding to a graph query statement, without having to judge all entities, thereby reducing the amount of data processing and improving data processing efficiency.

[0085] Optionally, according to the test score, the initial recommended component is determined as the target recommended component, and the test case code of the target recommended component is obtained, including: Sort the test scores from largest to smallest; The initial recommended component corresponding to the test score greater than the preset value is determined as the target recommended component.

[0086] The terminal device establishes a sequence number for the three initially recommended components generated, verifies the generated usage sample code by calling the test case code verification module, and verifies the sample code for the components and the component usage sample code in turn. The sample code performs functional unit testing. If it can be called normally, it is a valid recommended component. If it cannot be called normally or has a vulnerability, it is an invalid component. If there are multiple valid recommended components in the verification result, they are ranked according to the technology stack compatibility > functional requirements > update frequency > community activity to obtain the best valid recommended component, such as Figure 6 shown.

[0087] In some embodiments of the present application, after verifying the validity of the three initially recommended security components through a component verification module, the security component model is called to generate test case codes for the valid components, and the recommended valid components and the test case codes for the components are determined after effective scoring, thereby improving the quality and credibility of the recommended components.

[0088] This application collects information from multiple open source component platforms and integrates multi-dimensional security data to reduce misjudgments and security risks caused by insufficient data dimensions; based on the security component recommendation model obtained through large model training, it more accurately recommends safe alternative components to ensure the reliability of the recommendation results; introduces an automated verification module to effectively detect the functionality and security of recommended components in actual projects; automatically provides use cases and test cases to ensure the efficiency of the development process; automates scoring and optimization recommendations, automatically generates scores after verification, and only components with efficient scores are recommended for use, improving the quality and credibility of recommended components.

[0089] It should be noted that each implementable method in this embodiment may be implemented separately, or may be implemented in combination in any combination without conflict, and this application is not limited thereto.

[0090] Another embodiment of the present application provides a large model-based SCA component recommendation device, which is used to execute the large model-based SCA component recommendation method provided in the above embodiment.

[0091] like Figure 7 , which is a schematic diagram of the structure of the SCA component recommendation device based on a large model provided by an embodiment of the present application. The SCA component recommendation device based on a large model includes an acquisition module 701, a first determination module 702, a second determination module 703, a third determination module 704, a calculation module 705 and a recommendation module 706, wherein: The acquisition module 701 is used to obtain components with vulnerabilities in the project to be tested; The first determination module 702 is used to determine information of the vulnerable components and corresponding vulnerability information according to the vulnerable components in the project to be tested; The second determination module 703 is used to determine the initial recommended component corresponding to the component with a vulnerability according to the pre-trained component recommendation model and knowledge graph; wherein the component recommendation model is obtained by training the large model using the training sample data; The third determination module 704 is used to determine the test case code corresponding to the initial recommended component according to the initial recommended component; The calculation module 705 is used to verify the test case code based on the initial recommended component and the test case code, and determine the test score corresponding to the initial recommended component; The recommendation module 706 is used to determine the initial recommended component as the target recommended component according to the test score, and obtain the test case code of the target recommended component.

[0092] Some embodiments of the present application can automatically recommend components by adopting a pre-trained component recommendation model and knowledge graph, and then by calculating the test scores of different recommended components, the effectiveness of the recommended components can be judged to improve the accuracy and efficiency of component recommendations.

[0093] Regarding the device in this embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0094] Another embodiment of the present application further supplements the large model-based SCA component recommendation device provided in the above embodiment.

[0095] Optionally, the device further comprises an establishing module, the establishing module being configured to: Acquire training sample data, wherein the training sample data is obtained from a component knowledge base according to business requirements; the training sample data at least includes component information, vulnerability information, and test cases, and the component information corresponds to the vulnerability information and the test cases respectively; The training sample data is used to train the training parameters of the large model to obtain a component recommendation model, wherein the training parameters include at least a learning rate, a loss function, and a number of training times.

[0096] Some embodiments of the present application collect information from multiple open source component platforms and integrate multi-dimensional security data to obtain a comprehensive open source component data set that is structured, easy to maintain, and easy to increase, thereby reducing misjudgments caused by insufficient data dimensions; a large model is trained based on a comprehensive data set, and recommended components are effectively generated through the strategy of the large model, which greatly improves the reliability of recommendation results compared to recommendations that rely on static rules.

[0097] Optionally, build modules for: According to the pre-stored component knowledge base, each component is regarded as a node component entity; The node component entity, API call information, vulnerability information and recommended components are combined according to the preset association relationship to obtain the triple data between the entity and the relationship; Convert triple data into vectors to obtain a knowledge graph.

[0098] Some embodiments of the present application construct a knowledge graph and index of open source component information and vulnerability information, and treat each component as a node component entity, connecting it with API calls, vulnerability information, and alternative components through relationships. In this way, information is collected from multiple open source component platforms and multi-dimensional security data is integrated to generate a knowledge graph, thereby reducing misjudgments and security risks caused by insufficient data dimensions.

[0099] Optionally, the second determining module is used to: According to the vulnerability information and the pre-trained component recommendation model, a graph query statement corresponding to the vulnerability information is obtained, wherein the graph query statement at least includes the component name, version number, and usage of the component in the project; According to the graph query statement, a query is performed in the knowledge graph to obtain an entity subgraph in the knowledge graph, wherein the entity subgraph contains corresponding relevant component information and components corresponding to the vulnerability information. The relevant component information in the subgraph, as well as the standardized component information and its vulnerability information are input into a pre-trained component recommendation model to obtain an initial recommended component.

[0100] Some embodiments of the present application introduce an automated verification module to effectively detect the functionality and security of recommended components in actual projects. Optionally, the second determining module is used to: A depth-first search method or a breadth-first search method is used to query the knowledge graph and obtain an entity subgraph in the knowledge graph corresponding to the graph query statement.

[0101] Some embodiments of the present application use a depth-first search method or a breadth-first search method to perform queries in a knowledge graph to obtain an entity subgraph in the knowledge graph corresponding to a graph query statement, without having to judge all entities, thereby reducing the amount of data processing and improving data processing efficiency.

[0102] Optionally, recommended modules for: Sort the test scores from largest to smallest; The initial recommended component corresponding to the test score greater than the preset value is determined as the target recommended component.

[0103] In some embodiments of the present application, after verifying the validity of the three initially recommended security components through a component verification module, the security component model is called to generate test case codes for the valid components, and the recommended valid components and the test case codes for the components are determined after effective scoring, thereby improving the quality and credibility of the recommended components.

[0104] Regarding the device in this embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0105] It should be noted that each implementable method in this embodiment may be implemented separately, or may be implemented in combination in any combination without conflict, and this application is not limited thereto.

[0106] The embodiments of the present application also provide a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the operation of the method corresponding to any embodiment of the SCA component recommendation method based on a large model provided in the above embodiments can be implemented.

[0107] An embodiment of the present application further provides a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operations corresponding to any embodiment of the SCA component recommendation method based on a large model provided in the above embodiments.

[0108] like Figure 8 As shown, some embodiments of the present application provide an electronic device 800, which includes: a memory 810, a processor 820, and a computer program stored in the memory 810 and executable on the processor 820, wherein the processor 820 can implement a method of any embodiment of the above-mentioned large model-based SCA component recommendation method when reading the program from the memory 810 through a bus 830 and executing the program.

[0109] Processor 820 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 820 can be a microprocessor.

[0110] The memory 810 may be used to store instructions executed by the processor 820 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 820 of the disclosed embodiment may be used to execute instructions in the memory 810 to implement the method shown above. The memory 810 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0111] The above are only embodiments of the present application and are not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0112] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0113] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A SCA component recommendation method based on a large model, characterized in that: The method comprises: Get the components with vulnerabilities in the project to be tested; According to the components with vulnerabilities in the project to be tested, determining information of the components with vulnerabilities and corresponding vulnerability information; Determine the initial recommended component corresponding to the vulnerable component according to the pre-trained component recommendation model and knowledge graph; wherein the component recommendation model is obtained by training a large model using training sample data; According to the initial recommended components, determining the test case code corresponding to the initial recommended components; According to the initial recommended component and the test case code, verifying the test case code and determining a test score corresponding to the initial recommended component; According to the test score, the initial recommended component is determined as a target recommended component, and a test case code of the target recommended component is obtained.

2. The SCA component recommendation method based on a large model according to claim 1, characterized in that: The pre-trained component recommendation model is obtained in the following way: Acquire training sample data, wherein the training sample data is obtained from a component knowledge base according to business requirements; the training sample data at least includes component information, vulnerability information and test cases, and the component information corresponds to the vulnerability information and the test cases respectively; The training sample data is used to train the training parameters of the large model to obtain the component recommendation model, wherein the training parameters include at least a learning rate, a loss function and a number of training times.

3. The SCA component recommendation method based on a large model according to claim 1, characterized in that: The knowledge graph is obtained in the following way: According to the pre-stored component knowledge base, each component is regarded as a node component entity; The node component entity, API call information, vulnerability information and recommended components are combined according to preset association relationships to obtain triple data between entities and relationships; The triple data is converted into a vector to obtain the knowledge graph.

4. The SCA component recommendation method based on a large model according to claim 1, characterized in that: The determining, based on the pre-trained component recommendation model and knowledge graph, an initial recommended component corresponding to the vulnerable component includes: According to the component information and its vulnerability information, and the pre-trained component recommendation model, a graph query statement corresponding to the component information and its vulnerability information is obtained, wherein the graph query statement at least includes the component name, version number, and usage of the component in the project; According to the graph query statement, a query is performed in the knowledge graph to obtain an entity subgraph in the knowledge graph, wherein the entity subgraph contains corresponding relevant component information and components corresponding to the vulnerability information, and the relevant component information in the subgraph, as well as the standardized component information and its vulnerability information are input into a pre-trained component recommendation model to obtain an initial recommended component.

5. The SCA component recommendation method based on a large model according to claim 4 is characterized in that: The querying in the knowledge graph according to the graph query statement to obtain the entity subgraph in the knowledge graph includes: A depth-first search method or a breadth-first search method is used to query the knowledge graph to obtain an entity subgraph in the knowledge graph corresponding to the graph query statement.

6. The SCA component recommendation method based on a large model according to claim 1, characterized in that: The step of determining the initial recommended component as a target recommended component according to the test score and obtaining a test case code of the target recommended component includes: Sorting the test scores in descending order; The initial recommended component corresponding to the test score being greater than a preset value is determined as the target recommended component.

7. A SCA component recommendation device based on a large model, characterized in that: The device comprises: Acquisition module, used to obtain components with vulnerabilities in the project to be tested; A first determination module, configured to determine information of the vulnerable component and corresponding vulnerability information according to the vulnerable component in the project to be tested; A second determination module is used to determine an initial recommended component corresponding to the vulnerable component based on a pre-trained component recommendation model and a knowledge graph; wherein the component recommendation model is obtained by training a large model using training sample data; A third determination module is used to determine the test case code corresponding to the initial recommended component according to the initial recommended component; A calculation module, used to verify the test case code according to the initial recommended components and the test case code, and determine the test score corresponding to the initial recommended components; The recommendation module is used to determine the initial recommended component as a target recommended component according to the test score, and obtain the test case code of the target recommended component.

8. The large model-based SCA component recommendation device according to claim 7, characterized in that: The device also includes a building module, the building module is used to: Acquire training sample data, wherein the training sample data is obtained from a component knowledge base according to business requirements; the training sample data at least includes component information, vulnerability information and test cases, and the component information corresponds to the vulnerability information and the test cases respectively; The training sample data is used to train the training parameters of the large model to obtain the component recommendation model, wherein the training parameters include at least a learning rate, a loss function and a number of training times.

9. An electronic device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor can implement the large model-based SCA component recommendation method as described in any one of claims 1 to 6 when executing the program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the program, when executed by a processor, can implement the large model-based SCA component recommendation method described in any one of claims 1 to 6.

Images