Component security detection method and device, equipment and storage medium

Abstract

The invention provides a component security detection method and device, equipment and a storage medium, relates to the technical field of software security, and is used for avoiding a false alarm condition of security detection of an open source component and improving the accuracy of security detection of the open source component introduced into a target project. The method comprises the following steps: scanning and analyzing a target project file to obtain a target function call graph corresponding to the target project file; determining a calling condition of an open source component introduced by the target project file based on the target function calling graph; the calling condition characterizes that when the open source component is called, a target vulnerability in the open source component is determined based on a component vulnerability library; based on the target vulnerability and repair information in the vulnerability feature library, performing security detection on the open source component to obtain a corresponding security detection result; the security detection result represents whether the target vulnerability is triggered in the target project file or not.

Description

Background Art

[0002] In the process of software development, the extensive use of open source components has become a general trend. In the process of software development, the introduction of open source components can accelerate the development process, reduce costs, and promote technology sharing, but it also poses a potential threat to software security. In recent years, software supply chain security has received widespread attention. Open source component security testing is of great significance in ensuring software security, reducing software supply chain risks, and improving software quality. Therefore, the research on open source component security testing is a key issue of concern at present.

[0003] In the related art, security detection of open source components often relies on analyzing the configuration files of the software package and providing security detection results through component vulnerability library matching. However, this method ignores the issue of whether the vulnerability of the open source component is triggered. If the vulnerability of the open source component is not triggered, it means that the open source component is safe. However, through the component vulnerability library matching method, it is identified that the open source component has security risks, resulting in false positives in the security detection of the open source component. Therefore, the accuracy of security detection of the open source components introduced into the target project using the component vulnerability library matching method is low.

[0004] Therefore, how to avoid false positives in security detection of open source components and improve the accuracy of security detection of open source components introduced into target projects is a technical problem that needs to be solved at present. Summary of the invention

[0005] The embodiments of the present application provide a component security detection method, apparatus, device and storage medium to avoid false positives in security detection of open source components and improve the accuracy of security detection of open source components introduced into a target project.

[0006] In a first aspect, an embodiment of the present application provides a component safety detection method, the method comprising:

[0007] Scan and analyze the target project file to obtain the target function call graph corresponding to the target project file;

[0008] Based on the target function call graph, determine the call status of the open source components introduced by the target project file;

[0009] Characterization of the call situation: When calling an open source component, the target vulnerability in the open source component is determined based on the component vulnerability library;

[0010] Based on the target vulnerability and the repair information in the vulnerability feature library, security detection is performed on the open source components to obtain corresponding security detection results. Among them, the security detection results represent: whether the target vulnerability is triggered in the target project file.

[0011] In a second aspect, an embodiment of the present application provides a component safety detection device, the device comprising:

[0012] An acquisition unit, used to scan and analyze the target project file to acquire a target function call graph corresponding to the target project file;

[0013] A first determining unit is used to determine the calling status of the open source component introduced by the target project file based on the target function call graph;

[0014] The second determination unit is used to characterize the calling situation: when calling the open source component, determine the target vulnerability in the open source component based on the component vulnerability library;

[0015] The detection unit is used to perform security detection on the open source components based on the target vulnerability and the repair information in the vulnerability feature library, and obtain the corresponding security detection results; wherein the security detection results represent: whether the target vulnerability is triggered in the target project file.

[0016] In a possible implementation, the acquiring unit is specifically configured to:

[0017] Scan the target project file to obtain the component code of the open source component introduced by the target project file, and obtain the self-developed code of the development component in the target project file;

[0018] Analyze and process the component code to obtain a first function call graph corresponding to the component code, and analyze and process the self-developed code to obtain a second function call graph corresponding to the self-developed code;

[0019] The first function call graph and the second function call graph are merged to obtain a target function call graph.

[0020] In a possible implementation manner, the first determining unit is specifically configured to:

[0021] If it is determined based on the target function call graph that at least one of the called functions includes a function in an open source component, then the calling situation representation is determined as: calling the open source component.

[0022] In a possible implementation, if the repair information is a patch code, the detection unit is specifically configured to:

[0023] Based on the target vulnerability, obtain the patch code matching the target vulnerability from the corresponding relationship between the vulnerability and the repair information stored in the vulnerability feature library;

[0024] Determine a first abstract syntax tree corresponding to the patch code, and determine a second abstract syntax tree corresponding to the target self-developed code that calls the open source component;

[0025] Based on the first abstract syntax tree and the second abstract syntax tree, security detection is performed on the open source component.

[0026] In a possible implementation, the detection unit is specifically used to:

[0027] Based on a graph isomorphism algorithm, the first abstract syntax tree is compared with the second abstract syntax tree to obtain a first comparison result;

[0028] If the first comparison result indicates that the first abstract syntax tree exists in the second abstract syntax tree, a target vulnerability that triggers the open source component in the target project file is determined, and a position that triggers the target vulnerability is determined based on a position of the first abstract syntax data in the second abstract syntax tree.

[0029] In a possible implementation, if the repair information is a patch configuration, the detection unit is specifically configured to:

[0030] Based on the target vulnerability, obtain the patch configuration matching the target vulnerability from the corresponding relationship between the vulnerability and the repair information stored in the vulnerability feature library;

[0031] Perform security checks on open source components based on patch configuration and configuration files of the target self-developed code that calls open source components.

[0032] In a possible implementation, the detection unit is specifically used to:

[0033] If the configuration file of the target self-developed code contains a patch configuration, the target vulnerability of the open source component is determined to be triggered in the target project file.

[0034] In one possible implementation, the target self-developed code is reversely acquired based on the function call chain associated with the development component. The function call chain represents: a call link from a function that calls an open source component to a function that calls the target self-developed code.

[0035] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory and a processor, wherein the memory is used to store a computer program; and the processor is used to execute the computer program to implement the steps of the component safety detection method provided in the embodiment of the present application.

[0036] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of the component security detection method provided in the embodiment of the present application are implemented.

[0037] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program, and the computer program is stored in a computer-readable storage medium; when the processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, so that the electronic device performs the steps of the component security detection method provided in the embodiment of the present application.

[0038] The above solution of the present application has at least the following beneficial effects:

[0039] The component security detection method, device, electronic device and storage medium provided in the embodiments of the present application relate to the field of software security technology, and are used to avoid false positives in the security detection of open source components, and improve the accuracy of security detection of open source components introduced in the target project; in the embodiments of the present application, when performing security detection on the open source components introduced in the target project:

[0040] First, the target project file is scanned and analyzed to obtain the target function call graph corresponding to the target project file; then, based on the target function call graph, the call status of the open source component introduced by the target project file is determined, and whether the introduced open source component is called is analyzed; and then in the call status characterization: when calling the open source component, the target vulnerability in the open source component is determined based on the component vulnerability library, and the open source component is security tested based on the target vulnerability and the repair information in the vulnerability feature library, and the security test result representing whether the target vulnerability is triggered in the target project file is obtained. When the open source component is called and used in the target project, the open source component may pose a potential threat to the security of the target software. At this time, the target vulnerability in the open source component is determined, and the target vulnerability is matched with the repair information in the vulnerability feature library. Through the matching method, it is accurately identified whether the target vulnerability is triggered in the target project, and the accuracy of the judgment of whether the vulnerability is triggered is improved, thereby avoiding the situation of false positives in the security detection of the open source component introduced in the target project due to the vulnerability of the open source component not being triggered or the open source component not being called, reducing the false positive rate of the open source component security detection, improving the accuracy of the open source component security detection, and thus improving the security level of the software supply chain.

[0041] Other features and advantages of the present application will be described in the subsequent description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0043] Figure 1 A flow chart of a component safety detection method provided in an embodiment of the present application;

[0044] Figure 2 A flowchart of a security detection of open source components based on target vulnerabilities and patch codes provided in an embodiment of the present application;

[0045] Figure 3 A schematic diagram of a function call chain provided in an embodiment of the present application;

[0046] Figure 4 A specific implementation diagram of a security detection of open source components based on target vulnerabilities and patch codes provided in an embodiment of the present application;

[0047] Figure 5 A flowchart of security detection of open source components based on target vulnerabilities and patch configurations provided in an embodiment of the present application;

[0048] Figure 6 A system flow chart of component safety detection provided in an embodiment of the present application;

[0049] Figure 7 A structural diagram of a component safety detection device provided in an embodiment of the present application;

[0050] Figure 8 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0052] Some of the terms used in the embodiments of the present application are explained below to facilitate understanding by those skilled in the art.

[0053] The software supply chain refers to all the components that are directly involved in developing an application. The main focus of software supply chain security is to combine risk management and cybersecurity principles. This allows the detection, mitigation, and minimization of risks associated with these third-party components in the application.

[0054] Abstract Syntax Tree (AST): It is a tree representation of the abstract syntax structure of the source code. Each node in the tree represents a structure in the source code (such as expression, statement, declaration, etc.). By parsing the source code, redundant grammatical information (such as brackets, semicolons, etc.) is removed, and only the elements that are critical to understanding the program logic are retained. AST makes it easier for compilers and other tools to understand and manipulate the code, such as for optimization, code generation, static analysis, etc.

[0055] Graph isomorphism means that two graphs are structurally identical, that is, there is a one-to-one correspondence between each vertex in one graph and a vertex in the other graph, and this mapping preserves the edge connectivity. In other words, if two graphs are isomorphic, they can be made identical by relabeling the vertices.

[0056] Project Object Model (POM) file: refers to the pom.xml file saved in XML format in a software project. This file is used to manage the software project's source code, configuration files, developer information and roles, issue tracking system, organizational information, project authorization, project structure, project dependencies, and other information related to the software project.

[0057] Entity jar package: The entity jar package usually contains some data model classes (i.e. entity classes), which can be referenced and used by other projects.

[0058] Configuration file: A file associated with a computer program, a text file containing system or application configuration; used to store configuration information, variables, default values, preferences, and other detailed information. It can record certain settings of the program and be used to adjust the operation of the automatic execution program; it can store changes made by the user to preserve the correctness of the program.

[0059] The term “exemplary” hereafter means “serving as an example, example, or illustration.” Any embodiment described as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0060] The terms "first" and "second" in the following text are used for descriptive purposes only and should not be understood as explicitly or implicitly indicating relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present application, unless otherwise specified, the meaning of "plurality" is two or more.

[0061] The term "and / or" in the following text describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0062] Hereinafter, the term "at least one" means one or more, and "plurality" means two or more; the term "at least one" means one or more, and "multiple" means two or more.

[0063] The terms "comprises," "comprising," and "having," and their variations, hereinbelow, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such process, method, product, or apparatus.

[0064] The following is a brief introduction to the design concept of the embodiment of the present application:

[0065] In the process of software development, the extensive use of open source components has become a general trend. In the process of software development, the introduction of open source components can accelerate the development process, reduce costs, and promote technology sharing, but it also poses a potential threat to software security. In recent years, software supply chain security has received widespread attention. Open source component security testing is of great significance in ensuring software security, reducing supply chain risks, and improving software quality.

[0066] In related technologies, security detection of open source components often relies on matching component vulnerability libraries, that is, first analyzing the configuration files of the project software to obtain the names, version numbers and other information of the open source components introduced by the project software, and then matching the names, version numbers and other information of the open source components with the information stored in the component vulnerability library, and giving security detection results based on the matching results. If the component vulnerability library contains the name, version number and other information of the open source component, it means that the open source component has security risks.

[0067] However, the component vulnerability library matching method ignores the issue of whether the vulnerability of the open source component is triggered. If the vulnerability of the open source component is not triggered, it means that the open source component is safe for the project software. However, the component vulnerability library matching method identifies that the open source component has security risks, resulting in false positives in the security detection of the open source component. Therefore, the accuracy of security detection of the open source components introduced in the target project using the component vulnerability library matching method is low.

[0068] In view of this, the embodiments of the present application provide a component security detection method, apparatus, equipment and storage medium. In the embodiments of the present application, based on the target function call graph corresponding to the target project file, the calling situation of the open source component introduced by the target project file is analyzed, and then the target vulnerability in the called open source component is determined, and the target vulnerability is matched with the repair information in the vulnerability feature library. Through the matching method, it is accurately identified whether the target vulnerability is triggered, and the accuracy of the judgment whether the vulnerability is triggered is improved, thereby avoiding the false alarm of the security detection of the open source component introduced in the target project due to the vulnerability of the open source component not being triggered or the open source component not being called, reducing the false alarm rate of the open source component security detection, improving the accuracy of the open source component security detection, and thus improving the security level of the software supply chain.

[0069] The component safety detection method of the present application is described in detail below with reference to the drawings in the specification.

[0070] See also Figure 1 , Figure 1 A flow chart of a component safety detection method provided in an embodiment of the present application includes the following steps:

[0071] Step S100, scanning and analyzing the target project file to obtain a target function call graph corresponding to the target project file.

[0072] Through steps A1 to A3, the target project file is scanned and analyzed, and a target function call graph corresponding to the target project file is obtained for detailed description.

[0073] Step A1: Scan the target project file to obtain the component code of the open source component introduced by the target project file, and obtain the self-developed code of the development component in the target project file;

[0074] The target project files include but are not limited to: pom files or entity jar packages in the target project.

[0075] When the target project file is a pom file, the pom file will list the component information of the open source components introduced by the target project file;

[0076] When the target project file is a physical jar package, component information of the open source components introduced by the target project file can also be determined by performing component analysis on the physical jar package.

[0077] Component information includes: component code, component configuration file, component name, component version number, etc. Therefore, the target project file can be scanned to obtain the component code of the open source component introduced by the target project file, and then the self-developed code of the development component in the target project file can be obtained based on the project code and component code of the target project file.

[0078] Step A2: Analyze and process the component code to obtain a first function call graph corresponding to the component code, and analyze and process the self-developed code to obtain a second function call graph corresponding to the self-developed code.

[0079] In a possible implementation, the component code and the self-developed code are analyzed and processed by using the IDEA code analysis tool to obtain a first function call graph corresponding to the component code and a second function call graph corresponding to the self-developed code.

[0080] Step A3: merge the first function call graph and the second function call graph to obtain a target function call graph.

[0081] When both open source components and development components exist in the target project file, the function call graphs of the two parts need to be merged to obtain the target function call graph of the target project file. When merging the two parts of the function call graph, it involves merging the nodes and edges of the two parts of the function call graph. If there are the same functions or call relationships in the two function call graphs, the same functions or call relationships are merged into one node or edge.

[0082] Step S101, based on the target function call graph, determining the calling status of the open source components introduced by the target project file.

[0083] In a possible implementation, when determining the calling status of the open source component introduced by the target project file based on the target function call graph: if it is determined based on the target function call graph that at least one of the called functions includes a function in the open source component, then determining the calling status representation: calling the open source component.

[0084] That is to say, when any function in an open source component is called, it is determined that the open source component is called; in a possible scenario, the function called in the open source component is called a tainted function, and the tainted function being called is called tainted function reachable.

[0085] Step S102, characterizing the calling situation: when calling an open source component, determining a target vulnerability in the open source component based on a component vulnerability library.

[0086] When an open source component is called in the target project file, the open source component may pose a potential threat to the security of the target project file. Therefore, in order to ensure the security of the target project file by the open source component, it is necessary to identify whether there is a target vulnerability in the open source component and determine whether the target vulnerability is triggered. If the target vulnerability exists in the open source component but is not triggered, it means that the open source component does not affect the security of the target project file. If the target vulnerability is triggered, it means that the open source component poses a potential threat to the security of the target project file.

[0087] Therefore, in order to accurately identify whether the open source component poses a potential threat to the security of the target project file, the target vulnerability in the open source component is first obtained; specifically, the name, version number and other information of the open source component are matched with the name, version number and other information stored in the component vulnerability library. If the match is successful, it is determined that there is a vulnerability in the open source component, and the successfully matched vulnerability in the component vulnerability library is used as the target vulnerability of the open source component; among them, the target vulnerability is uniquely represented by an ID, such as a CVE number or a CNNVD number.

[0088] It should be noted that if the calling situation indicates that: the open source component is not called, it means that the open source component does not affect the security of the target project file, and there is no need to execute steps S102 and S103; or, there is no vulnerability in the open source component, it means that the open source component does not affect the security of the target project file, and there is no need to execute step S103.

[0089] Step S103, based on the target vulnerability and the repair information in the vulnerability feature library, a security check is performed on the open source component to obtain a corresponding security check result; wherein the security check result indicates whether the target vulnerability is triggered in the target project file.

[0090] The vulnerability feature library stores the corresponding relationship between vulnerabilities and repair information, and the repair information includes but is not limited to: repair suggestions, patch codes, and patch configurations. It should be noted that the vulnerability feature library is pre-built, and the vulnerability feature library can be pre-built according to the crawler acquisition method.

[0091] In an embodiment of the present application, when the repair information is a repair suggestion, it is necessary to obtain at least one of the patch code and patch configuration according to the repair suggestion, and further perform security checks on the open source components based on the target vulnerability and the patch code and patch configuration; when the repair information is at least one of the patch code and patch configuration, security checks on the open source components can be performed directly based on the target vulnerability and the patch code and patch configuration.

[0092] In a possible implementation, when obtaining patch code or patch configuration according to the repair suggestion, if the repair suggestion is a patch acquisition link, the corresponding patch code can be obtained based on the patch acquisition link; if the repair suggestion is a patch language description, the patch configuration can be obtained based on the patch language description.

[0093] The following describes in detail security testing of open source components based on target vulnerabilities and patch codes, and security testing of open source components based on target vulnerabilities and patch configurations.

[0094] 1. Perform security checks on open source components based on target vulnerabilities and patch codes:

[0095] See also Figure 2 , Figure 2 A flowchart of a security detection of an open source component based on a target vulnerability and a patch code provided in an embodiment of the present application specifically includes the following steps:

[0096] Step S200, based on the target vulnerability, obtain a patch code matching the target vulnerability from the corresponding relationship between the vulnerability and the patch code stored in the vulnerability feature library.

[0097] Step S201, determining a first abstract syntax tree corresponding to the patch code, and determining a second abstract syntax tree corresponding to the target self-developed code that calls the open source component.

[0098] In one possible implementation, based on the patch code context, the patch code is analyzed and processed to obtain first abstract syntax data corresponding to the patch code; and based on the target self-developed code context, the target self-developed code is analyzed to obtain a second abstract syntax tree corresponding to the target self-developed code.

[0099] The target self-developed code is obtained based on the function call chain associated with the development component. The function call chain represents the call link from calling the function of the open source component to calling the function of the target self-developed code. For example, see Figure 3 , Figure 3 A schematic diagram of a function call chain provided for an embodiment of the present application includes the calling situation of the development component calling the open source component, and gives the calling situation of the self-developed function in the self-developed code of the development component, as well as the calling situation of the open source component function in the component code of the open source component, and the open source component function that is called last is called the tainted function.

[0100] Therefore, based on Figure 3 The function call chain shown can be used to reversely obtain the target self-developed code of the corresponding target development component.

[0101] Step S202: Perform security detection on the open source component based on the first abstract syntax tree and the second abstract syntax tree.

[0102] When performing security detection on an open source component based on a first abstract syntax tree and a second abstract syntax tree, the first abstract syntax tree is compared with the second abstract syntax tree based on a graph isomorphism algorithm to obtain a first comparison result; if the first comparison result indicates that: the first abstract syntax tree exists in the second abstract syntax tree, then it is determined that a target vulnerability of the open source component is triggered in the target project file, which means that the target vulnerability is reachable; if the first comparison result indicates that: the first abstract syntax tree does not exist in the second abstract syntax tree, then it is determined that the target vulnerability of the open source component is not triggered in the target project file.

[0103] In one possible implementation, after determining the target vulnerability that triggers the open source component in the target project file, the location of the triggering target vulnerability is determined based on the position of the first abstract syntax data in the second abstract syntax tree, so as to trace the outbreak point of the target vulnerability, improve the accuracy of the judgment that the vulnerability is accessible, and then improve the accuracy of security detection of open source components, effectively reduce false alarms, and improve the transparency of the software supply chain.

[0104] See also Figure 4 , Figure 4 A specific implementation diagram of a security detection of open source components based on target vulnerabilities and patch codes provided in an embodiment of the present application includes the following steps:

[0105] Step S400, based on the target vulnerability, obtaining a patch code matching the target vulnerability from the corresponding relationship between the vulnerability and the patch code stored in the vulnerability feature library;

[0106] Step S401, analyzing and processing the patch code based on the patch code context to obtain first abstract syntax data corresponding to the patch code;

[0107] Step S402, based on the function call chain associated with the development component, reversely obtain the target self-developed code that calls the open source component;

[0108] Step S403: Analyze the target self-developed code based on the target self-developed code context to obtain a second abstract syntax tree corresponding to the target self-developed code;

[0109] Step S404, traversing the root node of the second abstract syntax tree;

[0110] Step S405, for each root node in the second abstract syntax tree, determine whether it matches the root node of the first abstract syntax tree, if the match is successful, execute step S406, otherwise execute step S409;

[0111] Step S406, checking whether the remaining part of the first abstract syntax tree can be matched in the current node subtree of the second abstract syntax tree, if it is matched, executing step S407, otherwise executing step S408;

[0112] Step S407, determining that the first abstract syntax tree exists in the second abstract syntax tree and the target vulnerability is reachable;

[0113] Step S408, backtracking to the previous node;

[0114] Step S409, determining that the first abstract syntax tree does not exist in the second abstract syntax tree and the target vulnerability is unreachable;

[0115] Step S410: output the security detection result.

[0116] In this application, the graph isomorphism algorithm is used to determine whether the AST of the patch code exists in the AST of the target self-developed code, thereby improving the matching accuracy. The AST of the patch code is compared with the AST of the target self-developed code to determine whether the target vulnerability is reachable, thereby improving the accuracy of the judgment that the vulnerability is reachable.

[0117] 2. Perform security checks on open source components based on target vulnerabilities and patch configurations:

[0118] See also Figure 5 , Figure 5 A flowchart of security detection of open source components based on target vulnerabilities and patch configurations provided in an embodiment of the present application specifically includes the following steps:

[0119] Step S500: based on the target vulnerability, a patch configuration matching the target vulnerability is obtained from the corresponding relationship between the vulnerability and the patch configuration stored in the vulnerability feature library.

[0120] Step S501, determine whether the configuration file of the target self-developed code that calls the open source component contains the patch configuration, if it does, execute step S502, otherwise execute step S503.

[0121] In one possible implementation, the target self-developed code is reversely acquired based on the function call chain associated with the development component. The function call chain represents: a call link from a function that calls an open source component to a function that calls the target self-developed code.

[0122] Step S502, the configuration file of the target self-developed code includes a patch configuration, and it is determined that the target vulnerability of the open source component is triggered in the target project file, and the target vulnerability is reachable.

[0123] Step S503: The configuration file of the target self-developed code does not include a patch configuration, and it is determined that the target vulnerability of the open source component is not triggered in the target project file, and the target vulnerability is unreachable.

[0124] Step S504: output the security detection result.

[0125] In this application, the patch configuration is compared with the configuration file of the target self-developed code to determine whether the target vulnerability is reachable, thereby improving the accuracy of the judgment of vulnerability reachability.

[0126] See also Figure 6 , Figure 6 A system flow chart of component safety detection provided in an embodiment of the present application; Figure 6 It can be seen that:

[0127] First, the target project file uploaded by the user is obtained, and the open source component detection is performed on the target project file to obtain the introduced open source component information;

[0128] Then obtain the function call graph of the introduced open source components, and scan the self-developed code files to obtain the function call graph of the self-developed project;

[0129] Then, based on the function call graph of the introduced open source components and the function call graph of the self-developed project, the overall function call graph of the target project file is obtained;

[0130] Further based on the overall function call graph, it is determined that if any function (tainted function) in the open source component is called, then the tainted function is reachable; and the target vulnerability in the open source component is determined, and the vulnerability feature library is matched based on the target vulnerability;

[0131] Finally, the vulnerability repair suggestions, vulnerability patches, and patch configurations are analyzed; if patch configuration is provided, the self-developed code configuration file is compared. If the self-developed code configuration file contains the patch configuration, the vulnerability is reachable and the security detection result is output; if patch code is provided, the patch code is analyzed to form AST1, the self-developed code block is obtained based on the tainted function call chain, the self-developed code block is contextually analyzed to form AST2, and AST1 and AST2 are compared based on the graph isomorphism algorithm. If AST2 contains AST1, the vulnerability is reachable and the security detection result is output.

[0132] In this application, the target project file is first scanned and analyzed to obtain the target function call graph corresponding to the target project file; then, based on the target function call graph, the call situation of the open source component introduced by the target project file is determined, and whether the introduced open source component is called is analyzed; and then in the call situation characterization: when calling the open source component, based on the component vulnerability library, the target vulnerability in the open source component is determined, and based on the target vulnerability and the repair information in the vulnerability feature library, the open source component is security tested to obtain the security test result representing whether the target vulnerability is triggered in the target project file. When the open source component is called and used in the target project, the open source component may pose a potential threat to the security of the target software. At this time, the target vulnerability in the open source component is determined, and the target vulnerability is matched with the repair information in the vulnerability feature library. The matching method is used to accurately identify whether the target vulnerability is triggered in the target project, and the accuracy of the judgment of whether the vulnerability is triggered is improved, thereby avoiding the situation where the security detection of the open source component introduced in the target project is falsely reported due to the vulnerability of the open source component not being triggered or the open source component not being called, reducing the false alarm rate of the security detection of the open source component, and improving the accuracy of the security detection of the open source component, thereby improving the security level of the software supply chain.

[0133] It should be noted that the embodiments described above are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0134] Based on the same inventive concept, an embodiment of the present application also provides a component safety detection device, the principle of which is similar to the method of the above embodiment. Therefore, the implementation of the device can refer to the implementation of the above component safety detection method, and the repeated parts will not be repeated.

[0135] See also Figure 7 , Figure 7 A structural diagram of a component safety detection device provided in an embodiment of the present application, the component safety detection device 700 includes:

[0136] The acquisition unit 701 is used to scan and analyze the target project file to acquire the target function call graph corresponding to the target project file;

[0137] A first determining unit 702 is used to determine the calling status of the open source component introduced by the target project file based on the target function call graph;

[0138] The second determination unit 703 is used to characterize the calling situation: when calling the open source component, determine the target vulnerability in the open source component based on the component vulnerability library;

[0139] The detection unit 704 is used to perform security detection on the open source component based on the target vulnerability and the repair information in the vulnerability feature library, and obtain corresponding security detection results; wherein the security detection results represent whether the target vulnerability is triggered in the target project file.

[0140] In a possible implementation, the acquiring unit 701 is specifically configured to:

[0141] Scan the target project file to obtain the component code of the open source component introduced by the target project file, and obtain the self-developed code of the development component in the target project file;

[0142] Analyze and process the component code to obtain a first function call graph corresponding to the component code, and analyze and process the self-developed code to obtain a second function call graph corresponding to the self-developed code;

[0143] The first function call graph and the second function call graph are merged to obtain a target function call graph.

[0144] In a possible implementation manner, the first determining unit 702 is specifically configured to:

[0145] If it is determined based on the target function call graph that at least one of the called functions includes a function in an open source component, then the calling situation representation is determined as: calling the open source component.

[0146] In a possible implementation, if the repair information is a patch code, the detection unit 704 is specifically configured to:

[0147] Based on the target vulnerability, obtain the patch code matching the target vulnerability from the corresponding relationship between the vulnerability and the repair information stored in the vulnerability feature library;

[0148] Determine a first abstract syntax tree corresponding to the patch code, and determine a second abstract syntax tree corresponding to the target self-developed code that calls the open source component;

[0149] Based on the first abstract syntax tree and the second abstract syntax tree, security detection is performed on the open source component.

[0150] In a possible implementation, the detection unit 704 is specifically configured to:

[0151] Based on a graph isomorphism algorithm, the first abstract syntax tree is compared with the second abstract syntax tree to obtain a first comparison result;

[0152] If the first comparison result indicates that the first abstract syntax tree exists in the second abstract syntax tree, a target vulnerability that triggers the open source component in the target project file is determined, and a position that triggers the target vulnerability is determined based on a position of the first abstract syntax data in the second abstract syntax tree.

[0153] In a possible implementation, if the repair information is a patch configuration, the detection unit 704 is specifically configured to:

[0154] Based on the target vulnerability, obtain the patch configuration matching the target vulnerability from the corresponding relationship between the vulnerability and the repair information stored in the vulnerability feature library;

[0155] Perform security checks on open source components based on patch configuration and configuration files of the target self-developed code that calls open source components.

[0156] In a possible implementation, the detection unit 704 is specifically configured to:

[0157] If the configuration file of the target self-developed code contains a patch configuration, the target vulnerability of the open source component is determined to be triggered in the target project file.

[0158] In one possible implementation, the target self-developed code is reversely acquired based on the function call chain associated with the development component. The function call chain represents: a call link from a function that calls an open source component to a function that calls the target self-developed code.

[0159] It should be noted that although several units (or modules) of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units (or modules) described above can be concretized in one unit (or module). Conversely, the features and functions of one unit (or module) described above can be further divided into multiple units (or modules) for concretization. Of course, when implementing the present application, the functions of each unit (or module) can also be implemented in the same one or more software or hardware.

[0160] In the embodiments of the present application, the term unit (or module) refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of an overall module or unit that includes the function of the module or unit.

[0161] After introducing the component safety detection method and device according to the exemplary embodiment of the present application, another exemplary embodiment of the present application, an electronic device, is introduced next.

[0162] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0163] In a possible implementation, the electronic device provided in the embodiment of the present application may include at least a processor and a memory. The memory stores a computer program, and when the computer program is executed by the processor, the processor executes any step in the component safety detection method of various exemplary embodiments in the present application.

[0164] In this embodiment, the structure of the electronic device can be as follows Figure 8 As shown, it includes a memory 801 , a communication module 803 and one or more processors 802 .

[0165] The memory 801 is used to store computer programs executed by the processor 802. The memory 801 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and programs required for running the instant messaging function, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0166] The memory 801 may be a volatile memory, such as a random-access memory (RAM); the memory 801 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or the memory 801 may be any other medium that can be used to carry or store a desired computer program in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 801 may be a combination of the above memories.

[0167] The processor 802 may include one or more central processing units (CPU) or a digital processing unit, etc. The processor 802 is used to implement the above-mentioned component security detection method when calling the computer program stored in the memory 801 .

[0168] The communication module 803 is used to communicate with the target device and other servers.

[0169] The specific connection medium between the memory 801, the communication module 803 and the processor 802 is not limited in the embodiment of the present application. Figure 8 In the embodiment, the memory 801 and the processor 802 are connected via a bus 804. The bus 804 is Figure 8 The connections between the other components are described with bold lines, which are only for illustrative purposes and are not intended to be limiting. The bus 804 can be divided into an address bus, a data bus, a control bus, etc. For ease of description, Figure 8 The diagram shows that only one thick line is used, but this does not mean that there is only one bus or only one type of bus.

[0170] The memory 801 stores a computer storage medium, and the computer storage medium stores computer executable instructions, and the computer executable instructions are used to implement the component safety detection method of the embodiment of the present application. The processor 802 is used to execute the above-mentioned component safety detection method.

[0171] In some possible implementations, various aspects of the component security detection method provided in the present application may also be implemented in the form of a program product, which includes a computer program. When the program product is run on an electronic device, the computer program is used to enable the electronic device to execute the steps of the component security detection method according to various exemplary implementations of the present application described above in this specification.

[0172] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0173] The program product of the embodiment of the present application can adopt a portable compact disk read-only memory (CD-ROM) and include a computer program, and can be run on a computing device. However, the program product of the present application is not limited to this. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with a command execution system, device or device.

[0174] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with a command execution system, apparatus, or device.

[0175] The computer program embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0176] Computer programs for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The computer program may be executed entirely on the user computing device, partially on the user equipment, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any variety of models including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0177] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain a computer-usable computer program.

[0178] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program commands. These computer program commands can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable device to generate a machine, so that the commands executed by the processor of the computer or other programmable device generate commands for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that specifies functions in one or more boxes.

[0179] These computer program commands may also be stored in a computer-readable memory capable of directing a computer or other programmable device to operate in a specific manner, so that the commands stored in the computer-readable memory produce an article of manufacture comprising a command device, the command device implementing the process Figure 1 A process or multiple processes and / or boxes Figure 1 Specify the function in one or more boxes.

[0180] These computer program commands can also be loaded onto a computer or other programmable device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the commands executed on the computer or other programmable device provide the instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0181] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0182] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A component safety detection method, characterized in that: The method comprises: Scan and analyze the target project file to obtain a target function call graph corresponding to the target project file; Based on the target function call graph, determining the calling status of the open source component introduced by the target project file; In the calling situation characterization: when calling the open source component, determining a target vulnerability in the open source component based on a component vulnerability library; Based on the target vulnerability and the repair information in the vulnerability feature library, a security check is performed on the open source component to obtain a corresponding security check result; wherein the security check result indicates whether the target vulnerability is triggered in the target project file.

2. The method according to claim 1, characterized in that The scanning and analyzing of the target project file to obtain a target function call graph corresponding to the target project file includes: Scan the target project file to obtain component codes of open source components introduced by the target project file, and obtain self-developed codes of development components in the target project file; Analyzing and processing the component code to obtain a first function call graph corresponding to the component code, and analyzing and processing the self-developed code to obtain a second function call graph corresponding to the self-developed code; The first function call graph and the second function call graph are merged to obtain the target function call graph.

3. The method according to claim 1, characterized in that The determining, based on the target function call graph, a calling condition of the open source component introduced by the target project file includes: If it is determined based on the target function call graph that at least one of the called functions includes a function in the open source component, then the calling situation representation is determined as: calling the open source component.

4. The method according to claim 1, characterized in that If the repair information is a patch code; The performing security detection on the open source component based on the repair information of the target vulnerability and the vulnerability feature library includes: Based on the target vulnerability, obtaining a patch code matching the target vulnerability from the corresponding relationship between the vulnerability and the repair information stored in the vulnerability feature library; Determine a first abstract syntax tree corresponding to the patch code, and determine a second abstract syntax tree corresponding to the target self-developed code that calls the open source component; Based on the first abstract syntax tree and the second abstract syntax tree, security detection is performed on the open source component.

5. The method according to claim 4, characterized in that The performing security detection on the open source component based on the first abstract syntax tree and the second abstract syntax tree includes: Based on a graph isomorphism algorithm, comparing the first abstract syntax tree with the second abstract syntax tree to obtain a first comparison result; If the first comparison result indicates that the first abstract syntax tree exists in the second abstract syntax tree, a target vulnerability that triggers the open source component in the target project file is determined, and a position that triggers the target vulnerability is determined based on a position of the first abstract syntax data in the second abstract syntax tree.

6. The method according to claim 1, characterized in that If the repair information is a patch configuration; the security detection of the open source component based on the target vulnerability and the repair information in the vulnerability feature library includes: Based on the target vulnerability, obtaining a patch configuration matching the target vulnerability from the corresponding relationship between the vulnerability and the repair information stored in the vulnerability feature library; Based on the patch configuration and the configuration file of the target self-developed code that calls the open source component, the open source component is subjected to security detection.

7. The method according to claim 6, characterized in that The security detection of the open source component based on the patch configuration and the configuration file of the target self-developed code that calls the open source component includes: If the configuration file of the target self-developed code includes the patch configuration, it is determined that the target vulnerability of the open source component is triggered in the target project file.

8. The method according to claim 4 or 6, characterized in that The target self-developed code is acquired in reverse based on the function call chain associated with the development component, and the function call chain represents: a call link from calling the function of the open source component to calling the function of the target self-developed code.

9. A component safety detection device, characterized in that: The device comprises: An acquisition unit, used to scan and analyze the target project file to acquire a target function call graph corresponding to the target project file; A first determining unit is used to determine the calling status of the open source component introduced by the target project file based on the target function call graph; A second determination unit is configured to characterize the calling situation: when calling the open source component, determine a target vulnerability in the open source component based on a component vulnerability library; The detection unit is used to perform security detection on the open source component based on the target vulnerability and the repair information in the vulnerability feature library to obtain a corresponding security detection result; wherein the security detection result represents: whether the target vulnerability is triggered in the target project file.

10. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of any one of the methods of claims 1-8.

11. A computer-readable storage medium, characterized in that: It comprises a computer program. When the computer program is run on an electronic device, the computer program is used to make the electronic device execute the steps of any one of the methods of claims 1-8.

12. A computer program product, characterized in that The computer program product comprises: a computer program code, and when the computer program code is run on a computer, the computer is enabled to execute the steps of any one of the methods as claimed in claims 1 to 8.

Images