Analysis, management and control system for security vulnerabilities and potential risks of software open source component

Abstract

The invention discloses an analysis, management and control system for security vulnerabilities and potential risks of software open source components, which comprises a data acquisition module, a data storage library, a security vulnerability detection module, a repair processing module, a monitoring and early warning module and a user interface, and relates to the technical field of risk analysis, management and control. According to the analysis and management and control system for the security vulnerabilities and the potential risks of the software open source component, the security vulnerability detection module is arranged, data are subjected to preliminary screening operation, construction operation of a software monitoring model is achieved according to initial open source component data in a data storage library, the vulnerability generation condition in the operation is detected in real time, and the security vulnerability and the potential risks of the software open source component are analyzed. According to the method and the system, the potential risk is synchronously predicted, and the condition generated by operation is fed back, so that the application software is subjected to corresponding security detection in the development stage, and the security vulnerabilities and the potential risk are processed in time, thereby assisting developers to greatly reduce the software security problem and improving the analysis, management and control efficiency of the security vulnerabilities and the potential risk.

Description

Technical Field

[0001] The present invention relates to the field of risk analysis and control technology, and in particular to an analysis and control system for security vulnerabilities and potential risks of software open source components. Background Art

[0002] With the rapid development of the software industry, the software supply chain has become increasingly complex and diverse. A complex software supply chain will introduce a series of security issues, making the overall security protection of information systems increasingly difficult. Security attacks on the software supply chain have been growing rapidly, and the harm caused has become increasingly serious. There is an urgent need for security protection against software supply chain risks.

[0003] The reference patent name is: A method and system for detecting open source component vulnerabilities (patent publication number: CN117610010A, patent publication date: 2024-02-27). The open source component vulnerability detection method includes: extracting the open source component to be detected and its corresponding version information; comparing the code data information of the component with the known vulnerability database and obtaining the known vulnerability information; using the code analysis tool to analyze the code data information of the open source component for potential vulnerability information and obtain potential vulnerability information; setting a regular detection time interval according to the data information of the known vulnerability information and the potential vulnerability information, and performing regular security detection on the open source component to be detected according to the regular detection time interval.

[0004] Based on the description in the above-mentioned documents, existing software is often released after development is completed, and the technical repair operations for subsequent security vulnerabilities are relatively complicated, the additional losses caused by the vulnerabilities are large, and there are many subsequent security funnel problems. When security vulnerability repair operations are performed based on software projects, each vulnerability needs to be repaired again, which will cause the time required for repair to be longer. For this reason, the present invention provides an analysis and control system for security vulnerabilities and potential risks of software open source components. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present invention provides an analysis and control system for security vulnerabilities and potential risks of software open source components, which solves the problem that existing software is often released after development is completed, and the technical repair operations for subsequent security vulnerabilities are relatively complicated, the additional losses caused by the vulnerabilities are large, and there are many subsequent security funnel problems. When security vulnerability repair operations are performed based on software projects, each vulnerability needs to be repaired again, which will increase the time required for repair.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: a system for analyzing and controlling security vulnerabilities and potential risks of software open source components, including:

[0007] The data collection module collects information data of open source components in software projects, and collects and stores authenticated known security vulnerability data;

[0008] Data repository, which realizes the storage of collected data and subsequent control and processing data;

[0009] The security vulnerability detection module performs preliminary screening of data, and implements the construction of a software monitoring model based on the initial open source component data in the data repository. It also reduces, adds, or modifies data based on the software monitoring model, detects vulnerabilities in operations in real time, and simultaneously predicts potential risks, and provides feedback on the situations generated by the operations.

[0010] The repair processing module handles the detected security vulnerabilities or provides corresponding repair suggestions or solutions;

[0011] The monitoring and early warning module monitors the use of various open source components of software projects in real time, and issues early warnings to maintenance personnel when security vulnerabilities and potential risks occur;

[0012] The user interface is used for users to view information during the operation and directly provide feedback on the information processing process.

[0013] Preferably, the operation of performing preliminary screening of data in the security vulnerability detection module is:

[0014] A1. After receiving the data, perform preliminary classification operations according to the required data categories;

[0015] A2. The initial open source component information used in the software project is summarized as the initial open source component dataset and marked as M. The data subsequently used in real time by the software project is summarized as the update dataset and marked as N. The data of known security vulnerabilities with certification is summarized as the known security vulnerability dataset and marked as L.

[0016] A3. Use the classified data set for subsequent use.

[0017] Preferably, the operation of judging the dependency of the initial open source component dataset M is:

[0018] a21. Select any initial open source component data subset, and search for dependent and dependent open source component data subsets based on the first initial open source component data subset;

[0019] a22. Based on the dependent open source component data subset, continue to search for the dependent and dependent open source component data subsets related to the current subset; based on the dependent open source component data subset, continue to search for the dependent and dependent open source component data subsets related to the current subset;

[0020] a23, and extracting the starting dependent open source component data subset using the first initial open source component data subset as a node, and at the same time reordering the data subsets in the initial open source component data set M according to the dependency order.

[0021] Preferably, the operation of implementing the software monitoring model construction based on the data in the data repository in the security vulnerability detection module is:

[0022] B1. Introduce the reordered initial open source component dataset M, and use the system's inspection tools to perform compliance audits on the licenses of each open source component;

[0023] B2. The open source components that meet the requirements are summarized and constructed to form a software monitoring model, and then the real-time operation data is introduced into the software monitoring model for dynamic preview.

[0024] Preferably, the security vulnerability detection step of performing security vulnerability detection based on the software monitoring model by performing data reduction, addition or modification operations is as follows:

[0025] C1. Introduce the updated data set N into the software monitoring model, and perform data detection operations on the open source components in sequence according to the dependency relationships;

[0026] C2. Scan the data after the open source component is run, mark the data with abnormal changes, extract the abnormal change data and compare it with the security vulnerability dataset L, and classify the same data as known abnormal vulnerability data after comparison, and classify the different data as unknown abnormal vulnerability data after comparison;

[0027] C3, and transmit the known abnormal vulnerability data and the unknown abnormal vulnerability data to the repair processing module for processing, so as to determine the potential risk of continuing the operation.

[0028] Preferably, the expression for comparing the abnormal change data in C2 with the security vulnerability data set L is:

[0029]

[0030] F represents the judgment result of abnormal change data, n∩L represents the intersection comparison operation between abnormal change data and security vulnerability data set L, n represents the extracted abnormal change data, p represents known abnormal vulnerability data, and q represents unknown abnormal vulnerability data.

[0031] Preferably, the abnormal change data in C3 and the security vulnerability data set L are transmitted to the repair processing module for processing as follows:

[0032] c21. Extracting a security vulnerability data subset corresponding to the detected open source component from the security vulnerability dataset L according to the detected open source component;

[0033] c22. When processing based on known abnormal vulnerability data p, trace the corresponding repair data according to the security vulnerability data set L, and introduce the repair data into the software monitoring model for repair operations;

[0034] c23. When processing based on unknown abnormal vulnerability data q, formulate corresponding repair steps and perform repair operations according to the impact of the data.

[0035] Preferably, the corresponding repair steps formulated in c23 are:

[0036] D1. Extract the abnormal vulnerability data q and the optimized data y in the corresponding operation, and determine whether to replace the updated data according to the weight ratio of the abnormal vulnerability data q and the optimized data y;

[0037] D2, then prioritize the impact scope of the abnormal vulnerability data q, and modify the introduced data corresponding to the abnormal vulnerability data q, and then introduce the modified data into the software monitoring model for re-detection;

[0038] D3, and continuously update and iterate the D2 operation until the abnormal vulnerability data is fixed and subsequent project updates can be carried out.

[0039] Preferably, the D1 weight ratio determines whether it is necessary to replace the updated data in the following steps: determining the weight ratio of abnormal vulnerability data q and optimized data y based on the software monitoring model; when the beneficial weight ratio of the optimized data y is greater than the loss weight ratio of the abnormal vulnerability data q, the current data update operation meets the construction requirements of the software project.

[0040] Preferably, the operation of modifying the introduced data corresponding to the abnormal vulnerability data q in the D2 operation is:

[0041] d21. Based on the data introduced by tracing the source of abnormal vulnerability data q, insert patches or modify the data according to the vulnerability situation;

[0042] d22. Then introduce the software monitoring model for testing to ensure that there are no security vulnerabilities in the updated model, and introduce the previous abnormal vulnerability data q for repair verification operations. If there are no problems, proceed with subsequent operations.

[0043] The present invention provides an analysis and control system for security vulnerabilities and potential risks of software open source components. Compared with the prior art, it has the following beneficial effects:

[0044] (1) The analysis and control system for security vulnerabilities and potential risks of software open source components is provided with a security vulnerability detection module to perform preliminary screening operations on data, and implement the construction operation of the software monitoring model based on the initial open source component data in the data repository, and perform data reduction, addition or modification operations based on the software monitoring model, and detect the occurrence of vulnerabilities in operations in real time, and simultaneously predict potential risks, and provide feedback on the conditions generated by the operations, so that the application software can perform corresponding security inspections during the development stage, and deal with security vulnerabilities and potential risks in a timely manner, thereby assisting developers to significantly reduce software security issues and improve the efficiency of analysis and control of security vulnerabilities and potential risks.

[0045] (2) The analysis and control system for security vulnerabilities and potential risks of software open source components introduces the update data set into the software monitoring model, scans the data after the open source component is run, and marks the data part with abnormal changes. At the same time, the abnormal change data is extracted and compared with the security vulnerability data set L, and the same data after comparison is classified as known abnormal vulnerability data, and the different data after comparison is classified as unknown abnormal vulnerability data. The repair processing module is used to perform repair operations, so that the known abnormal vulnerability data can be directly traced to complete the rapid repair operation, and the unknown abnormal vulnerability data is processed by formulating a specific repair method, thereby improving the efficiency of software open source component security vulnerability processing and improving the security of the final software.

[0046] (3) The analysis and control system for security vulnerabilities and potential risks of software open source components traces the data part introduced based on the abnormal vulnerability data q, and inserts patches or modifies the data part according to the vulnerability situation. It then introduces the software monitoring model for detection to ensure that there are no security vulnerabilities in the updated model. The previous abnormal vulnerability data q is then introduced for repair and verification operations, thereby ensuring that the security vulnerability processing operations are maintained in stages during the development process, and reducing the loss of the development source while improving security. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 The principle block diagram of the analysis and control system of the present invention;

[0048] Figure 2 This is a flowchart of the preliminary screening operation of the security vulnerability detection module of the present invention;

[0049] Figure 3 Constructing an operation flow chart for the software monitoring model of the security vulnerability detection module of the present invention;

[0050] Figure 4 The following is a flow chart of the security vulnerability detection operation of the security vulnerability detection module of the present invention. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] See also Figure 1-Figure 4 , the present invention provides two technical solutions:

[0053] Embodiment 1: A system for analyzing and controlling security vulnerabilities and potential risks of software open source components, comprising:

[0054] The data collection module collects information data of open source components in software projects, and collects and stores authenticated known security vulnerability data;

[0055] Data repository, which realizes the storage of collected data and subsequent control and processing data;

[0056] The security vulnerability detection module performs preliminary screening of data, and implements the construction of a software monitoring model based on the initial open source component data in the data repository. It also reduces, adds, or modifies data based on the software monitoring model, detects vulnerabilities in operations in real time, and simultaneously predicts potential risks, and provides feedback on the situations generated by the operations.

[0057] The repair processing module handles the detected security vulnerabilities or provides corresponding repair suggestions or solutions;

[0058] The monitoring and early warning module monitors the use of various open source components of software projects in real time, and issues early warnings to maintenance personnel when security vulnerabilities and potential risks occur;

[0059] The user interface is used for users to view information during the operation and directly provide feedback on the information processing process.

[0060] The monitoring and early warning module has real-time monitoring capabilities, which can dynamically track the updates of open source components and issue early warning notifications in a timely manner when new security vulnerabilities or potential risks are discovered. This mechanism helps developers respond to security issues in a timely manner and reduce the scope of security risks.

[0061] The user interface provides an intuitive and easy-to-use user interface, which allows users to view security vulnerabilities and potential risk information, as well as repair suggestions and solutions. This design reduces the user's learning cost and improves the system's ease of use and user experience.

[0062] Among them, by setting up a security vulnerability detection module, a preliminary screening operation is performed on the data, and the software monitoring model is constructed based on the initial open source component data in the data repository, and data reduction, addition or modification operations are performed based on the software monitoring model. The vulnerability generation in the operation is detected in real time, and potential risks are predicted simultaneously, and the situation generated by the operation is fed back. In this way, the application software can perform corresponding security testing in the development stage, and deal with security vulnerabilities and potential risks in a timely manner, thereby assisting developers to significantly reduce software security issues and improve the efficiency of analysis and control of potential risks of security vulnerabilities.

[0063] In the embodiment of the present invention, the operation of preliminary screening of data in the security vulnerability detection module is:

[0064] A1. After receiving the data, perform preliminary classification operations according to the required data categories;

[0065] A2. The initial open source component information used in the software project is summarized as the initial open source component dataset and marked as M. The data subsequently used in real time by the software project is summarized as the update dataset and marked as N. The data of known security vulnerabilities with certification is summarized as the known security vulnerability dataset and marked as L.

[0066] A3. Use the classified data set for subsequent use.

[0067] In the embodiment of the present invention, the operation of judging the dependency of the initial open source component dataset M is:

[0068] a21. Select any initial open source component data subset, and search for dependent and dependent open source component data subsets based on the first initial open source component data subset;

[0069] a22. Based on the dependent open source component data subset, continue to search for the dependent and dependent open source component data subsets related to the current subset; based on the dependent open source component data subset, continue to search for the dependent and dependent open source component data subsets related to the current subset;

[0070] a23, and extracting the starting dependent open source component data subset using the first initial open source component data subset as a node, and at the same time reordering the data subsets in the initial open source component data set M according to the dependency order.

[0071] In the embodiment of the present invention, the operation of building a software monitoring model based on the data in the data repository in the security vulnerability detection module is:

[0072] B1. Introduce the reordered initial open source component dataset M, and use the system's inspection tools to perform compliance audits on the licenses of each open source component;

[0073] B2. The open source components that meet the requirements are summarized and constructed to form a software monitoring model, and then the real-time operation data is introduced into the software monitoring model for dynamic preview.

[0074] In the embodiment of the present invention, the steps of performing security vulnerability detection by performing data reduction, addition or modification operations based on the software monitoring model in the security vulnerability detection module are as follows:

[0075] C1. Introduce the updated data set N into the software monitoring model, and perform data detection operations on the open source components in sequence according to the dependency relationships;

[0076] C2. Scan the data after the open source component is run, mark the data with abnormal changes, extract the abnormal change data and compare it with the security vulnerability dataset L, and classify the same data as known abnormal vulnerability data after comparison, and classify the different data as unknown abnormal vulnerability data after comparison;

[0077] C3, and transmit the known abnormal vulnerability data and the unknown abnormal vulnerability data to the repair processing module for processing, so as to determine the potential risk of continuing the operation.

[0078] Among them, by introducing the update data set into the software monitoring model, the data after the open source component is run is scanned, and the data part with abnormal changes is marked. At the same time, the abnormal change data is extracted and compared with the security vulnerability data set L, and the same data after comparison is classified as known abnormal vulnerability data, and the different data after comparison is classified as unknown abnormal vulnerability data. The repair processing module is used to perform repair operations, so that the known abnormal vulnerability data can be directly traced to complete the rapid repair operation, and the unknown abnormal vulnerability data is processed by formulating a specific repair method, thereby improving the efficiency of security vulnerability processing of software open source components and improving the security of mature software.

[0079] In the embodiment of the present invention, the expression for comparing the abnormal change data in C2 with the security vulnerability data set L is:

[0080]

[0081] F represents the judgment result of abnormal change data, n∩L represents the intersection comparison operation between abnormal change data and security vulnerability data set L, n represents the extracted abnormal change data, p represents known abnormal vulnerability data, and q represents unknown abnormal vulnerability data.

[0082] In the embodiment of the present invention, the abnormal change data in C3 and the security vulnerability data set L are transmitted to the repair processing module for processing as follows:

[0083] c21. Extracting a security vulnerability data subset corresponding to the detected open source component from the security vulnerability dataset L according to the detected open source component;

[0084] c22. When processing based on known abnormal vulnerability data p, trace the corresponding repair data according to the security vulnerability data set L, and introduce the repair data into the software monitoring model for repair operations;

[0085] c23. When processing based on unknown abnormal vulnerability data q, formulate corresponding repair steps and perform repair operations according to the impact of the data.

[0086] In the embodiment of the present invention, the corresponding repair steps formulated in c23 are:

[0087] D1. Extract the abnormal vulnerability data q and the optimized data y in the corresponding operation, and determine whether to replace the updated data according to the weight ratio of the abnormal vulnerability data q and the optimized data y;

[0088] D2, then prioritize the impact scope of the abnormal vulnerability data q, and modify the introduced data corresponding to the abnormal vulnerability data q, and then introduce the modified data into the software monitoring model for re-detection;

[0089] D3, and continuously update and iterate the D2 operation until the abnormal vulnerability data is fixed and subsequent project updates can be carried out.

[0090] In an embodiment of the present invention, the step of replacing the weight ratio D1 to determine whether it is necessary to update the data is: determining the weight ratio of the abnormal vulnerability data q and the optimized data y based on the software monitoring model. When the beneficial weight ratio of the optimized data y is greater than the loss weight ratio of the abnormal vulnerability data q, the current data update operation meets the construction requirements of the software project.

[0091] In the embodiment of the present invention, the operation of modifying the introduced data corresponding to the abnormal vulnerability data q in the D2 operation is:

[0092] d21. Based on the data introduced by tracing the source of abnormal vulnerability data q, insert patches or modify the data according to the vulnerability situation;

[0093] d22. Then introduce the software monitoring model for testing to ensure that there are no security vulnerabilities in the updated model, and introduce the previous abnormal vulnerability data q for repair verification operations. If there are no problems, proceed with subsequent operations.

[0094] Among them, the data part is introduced based on the source tracing of the abnormal vulnerability data q, and patches are inserted or data modification operations are performed on the data part according to the vulnerability situation. Then, the software monitoring model is introduced for detection to ensure that there are no security vulnerabilities in the updated model. The previous abnormal vulnerability data q is introduced for repair verification operations, so as to ensure that the phased security vulnerability handling operations are maintained during the development process, and reduce the loss of development source while improving security.

[0095] The difference between Example 2 and Example 1 is that the existing software open source component security vulnerability and potential risk analysis and control system and the software open source component security vulnerability and potential risk analysis and control system of the present invention are applied in the project development operations of multiple software of the enterprise, and the efficiency of security vulnerability detection and the time to complete the corresponding repair process are recorded. The specific results are shown in Table 1:

[0096] Table 1 Record status table

[0097] Detection vulnerability time Vulnerability repair time Vulnerability repair success rate Existing analysis and control system 96s 144s 86％ Analysis and control system of the present invention 26s 58s 100％

[0098] To sum up, by applying the analysis and control system for security vulnerabilities and potential risks of software open source components of the present invention in the software project development operations of an enterprise, the time used for security vulnerability detection and the time for repairing security vulnerabilities are shortened, and the success rate of repairing vulnerabilities is higher, and it can be better applied in the software development operations of an enterprise.

[0099] Meanwhile, the contents not described in detail in this specification belong to the prior art known to those skilled in the art.

[0100] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0101] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. An analysis and control system for security vulnerabilities and potential risks of software open source components, characterized by: include: The data collection module collects information data of open source components in software projects, and collects and stores authenticated known security vulnerability data; Data repository, which realizes the storage of collected data and subsequent control and processing data; The security vulnerability detection module performs preliminary screening of data, and implements the construction of a software monitoring model based on the initial open source component data in the data repository. It also reduces, adds, or modifies data based on the software monitoring model, detects vulnerabilities in operations in real time, and simultaneously predicts potential risks, and provides feedback on the situations generated by the operations. The repair processing module handles the detected security vulnerabilities or provides corresponding repair suggestions or solutions; The monitoring and early warning module monitors the use of various open source components of software projects in real time, and issues early warnings to maintenance personnel when security vulnerabilities and potential risks occur; The user interface is used for users to view information during the operation and directly provide feedback on the information processing process.

2. The system for analyzing and controlling security vulnerabilities and potential risks of software open source components according to claim 1 is characterized in that: The operation of preliminary screening of data in the security vulnerability detection module is: A1. After receiving the data, perform preliminary classification operations according to the required data categories; A2. The initial open source component information used in the software project is summarized as the initial open source component dataset and marked as M. The data subsequently used in real time by the software project is summarized as the update dataset and marked as N. The data of known security vulnerabilities with certification is summarized as the known security vulnerability dataset and marked as L. A3. Use the classified data set for subsequent use.

3. The system for analyzing and controlling security vulnerabilities and potential risks of software open source components according to claim 2 is characterized in that: The operation of judging the dependency of the initial open source component dataset M is as follows: a21. Select any initial open source component data subset, and search for dependent and dependent open source component data subsets based on the first initial open source component data subset; a22. Based on the dependent open source component data subset, continue to search for the dependent and dependent open source component data subsets related to the current subset; based on the dependent open source component data subset, continue to search for the dependent and dependent open source component data subsets related to the current subset; a23, and extracting the starting dependent open source component data subset using the first initial open source component data subset as a node, and at the same time reordering the data subsets in the initial open source component data set M according to the dependency order.

4. The system for analyzing and controlling security vulnerabilities and potential risks of software open source components according to claim 3 is characterized in that: The operations of building a software monitoring model based on the data in the data repository in the security vulnerability detection module are: B1. Introduce the reordered initial open source component dataset M, and use the system's inspection tools to perform compliance audits on the licenses of each open source component; B2. The open source components that meet the requirements are summarized and constructed to form a software monitoring model, and then the real-time operation data is introduced into the software monitoring model for dynamic preview.

5. The system for analyzing and controlling security vulnerabilities and potential risks of software open source components according to claim 2 is characterized in that: The steps of performing security vulnerability detection by performing data reduction, addition or modification operations based on the software monitoring model in the security vulnerability detection module are as follows: C1. Introduce the updated data set N into the software monitoring model, and perform data detection operations on the open source components in sequence according to the dependency relationships; C2. Scan the data after the open source component is run, mark the data with abnormal changes, extract the abnormal change data and compare it with the security vulnerability dataset L, and classify the same data as known abnormal vulnerability data after comparison, and classify the different data as unknown abnormal vulnerability data after comparison; C3, and transmit the known abnormal vulnerability data and the unknown abnormal vulnerability data to the repair processing module for processing, so as to determine the potential risk of continuing the operation.

6. The system for analyzing and controlling security vulnerabilities and potential risks of software open source components according to claim 5 is characterized in that: The expression for comparing the abnormal change data in C2 with the security vulnerability data set L is: F represents the judgment result of abnormal change data, n∩L represents the intersection comparison operation between abnormal change data and security vulnerability data set L, n represents the extracted abnormal change data, p represents known abnormal vulnerability data, and q represents unknown abnormal vulnerability data.

7. The system for analyzing and controlling security vulnerabilities and potential risks of software open source components according to claim 5 is characterized in that: The abnormal change data in C3 and the security vulnerability data set L are transmitted to the repair processing module for processing as follows: c21. Extracting a security vulnerability data subset corresponding to the detected open source component from the security vulnerability dataset L according to the detected open source component; c22. When processing based on known abnormal vulnerability data p, trace the corresponding repair data according to the security vulnerability data set L, and introduce the repair data into the software monitoring model for repair operations; c23. When processing based on unknown abnormal vulnerability data q, formulate corresponding repair steps and perform repair operations according to the impact of the data.

8. The system for analyzing and controlling security vulnerabilities and potential risks of software open source components according to claim 7 is characterized in that: The corresponding repair steps formulated in c23 are: D1. Extract the abnormal vulnerability data q and the optimized data y in the corresponding operation, and determine whether to replace the updated data according to the weight ratio of the abnormal vulnerability data q and the optimized data y; D2, then prioritize the impact scope of the abnormal vulnerability data q, and modify the introduced data corresponding to the abnormal vulnerability data q, and then introduce the modified data into the software monitoring model for re-detection; D3, and continuously update and iterate the D2 operation until the abnormal vulnerability data is fixed and subsequent project updates can be carried out.

9. The system for analyzing and controlling security vulnerabilities and potential risks of software open source components according to claim 8, characterized in that: The D1 weight ratio determines whether it is necessary to replace the updated data in the following steps: determine the weight ratio of the abnormal vulnerability data q and the optimized data y based on the software monitoring model. When the beneficial weight ratio of the optimized data y is greater than the loss weight ratio of the abnormal vulnerability data q, the current data update operation meets the construction requirements of the software project.

10. The system for analyzing and controlling security vulnerabilities and potential risks of software open source components according to claim 8, characterized in that: The operation of modifying the introduced data corresponding to the abnormal vulnerability data q in the D2 operation is: d21. Based on the data part introduced by tracing the abnormal vulnerability data q, a patch is inserted or a data modification operation is performed on the data part according to the vulnerability situation; d22. Then introduce the software monitoring model for testing to ensure that there are no security vulnerabilities in the updated model, and introduce the previous abnormal vulnerability data q for repair verification operations. If there are no problems, proceed with subsequent operations.

Images