Software repository security risk detection method and device, computer equipment and storage medium

Abstract

The invention relates to a security risk detection method and device for a software repository, computer equipment, a storage medium and a computer program product. The method comprises the following steps: establishing a dependency tree model of a software package according to version information of the software package in a software repository; the dependency tree model represents the dependency relationship among the software packages through a tree structure; vulnerability information in a vulnerability library is matched with the software packages and the version information, and a target software package matched with the vulnerability information is obtained; in the dependency tree model, vulnerability marking processing is carried out on the target software package, and risk marking processing is carried out on nodes associated with the target software package; and obtaining a security risk detection result of the software repository according to the software package with the risk mark in the dependency tree model. By adopting the method, the timeliness, accuracy and comprehensiveness of security risk monitoring of the software repository can be improved.

Description

Technical Field

[0001] The present application relates to the field of software security technology, and in particular to a method, apparatus, computer equipment, storage medium and computer program product for detecting security risks in a software warehouse. Background Art

[0002] In today's era of rapid digital development, software warehouses, as important tools for code storage and version management, have become a key component of software development and operation and maintenance. However, with the widespread use of open source software and third-party dependencies, security risks in software warehouses have become increasingly prominent, such as malicious code injection, dependency vulnerabilities, weak passwords, and configuration errors, which may lead to security vulnerabilities and threaten the security of the entire application system.

[0003] Traditional security detection methods often use static analysis and dynamic detection to detect and fix possible vulnerabilities in the software in advance during the source code or build phase of the software supply chain. However, this approach not only requires full access to the software source code and dependent libraries, but also makes it difficult to fully consider the complex dependencies between the numerous software packages contained in the software repository, which may lead to missed or false positive security risks and affect the accuracy of the security risk detection results of the software repository. Summary of the invention

[0004] Based on this, it is necessary to provide a software warehouse security risk detection method, device, computer equipment, computer-readable storage medium and computer program product that can improve the accuracy of software warehouse security risk detection results in response to the above technical problems.

[0005] In a first aspect, the present application provides a method for detecting security risks in a software warehouse. The method comprises:

[0006] According to the version information of the software packages in the software warehouse, a dependency tree model of the software packages is established; the dependency tree model represents the dependency relationship between the software packages through a tree structure;

[0007] Matching the vulnerability information in the vulnerability library with the software packages and the version information to obtain a target software package that matches the vulnerability information;

[0008] In the dependency tree model, performing vulnerability marking processing on the target software package, and performing risk marking processing on nodes associated with the target software package;

[0009] The security risk detection result of the software warehouse is obtained according to the software packages with the risk mark in the dependency tree model.

[0010] In one embodiment, matching the vulnerability information in the vulnerability library with the software packages and the version information to obtain a target software package matching the vulnerability information includes:

[0011] Matching the vulnerability information in the vulnerability library with the software packages and the version information of the software packages in the dependency tree model to obtain candidate software packages in the dependency tree model that match the vulnerability information;

[0012] From the candidate software packages, a target software package belonging to a leaf node in the dependency tree model is determined; the belonging to a leaf node is also used to indicate that the software package corresponding to the leaf node has no dependency in the dependency tree model.

[0013] In one embodiment, in the dependency tree model, performing vulnerability marking processing on the target software package and performing risk marking processing on the nodes associated with the target software package include:

[0014] In the dependency tree model, performing vulnerability marking processing on the leaf nodes corresponding to the target software package to obtain leaf nodes marked with vulnerability marks;

[0015] Performing vulnerability marking processing and risk marking processing on the parent node of the leaf node marked with the vulnerability mark to obtain risk data of the parent node;

[0016] The vulnerability mark is further propagated to the upper nodes of the parent node until the root node of the leaf node is marked with the vulnerability mark.

[0017] In one embodiment, the risk data is obtained by:

[0018] Obtain risk data of each child node corresponding to the parent node;

[0019] The largest risk data is screened out from the risk data of each child node and is set as the risk data of the parent node.

[0020] In one embodiment, obtaining the security risk detection result of the software warehouse according to the software packages with the risk mark in the dependency tree model includes:

[0021] Obtaining dependency path information and associated vulnerability information corresponding to the software package with risk markers in the dependency tree model;

[0022] A security risk detection result of the software warehouse is generated according to the dependency path information and the associated vulnerability information.

[0023] In one embodiment, the method further comprises:

[0024] If the security risk detection result indicates that there is a risky software package in the software warehouse, obtaining the dependency relationship of the risky software package;

[0025] Based on the dependency relationship, pruning the risk sub-nodes corresponding to the risk software package in the dependency tree model to obtain a pruned dependency tree model;

[0026] According to the pruned dependency tree model, updated risk data corresponding to the risk software package is obtained.

[0027] In a second aspect, the present application also provides a software warehouse security risk detection device. The device comprises:

[0028] A model building module is used to build a dependency tree model of the software package according to the version information of the software package in the software warehouse; the dependency tree model represents the dependency relationship between the software packages through a tree structure;

[0029] An information matching module, used to match the vulnerability information in the vulnerability library with the software packages and the version information to obtain a target software package that matches the vulnerability information;

[0030] A risk marking module, used to perform vulnerability marking processing on the target software package and risk marking processing on nodes associated with the target software package in the dependency tree model;

[0031] The risk detection module is used to obtain the security risk detection result of the software warehouse according to the software packages with the risk mark in the dependency tree model.

[0032] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0033] According to the version information of the software packages in the software warehouse, a dependency tree model of the software packages is established; the dependency tree model represents the dependency relationship between the software packages through a tree structure;

[0034] Matching the vulnerability information in the vulnerability library with the software packages and the version information to obtain a target software package that matches the vulnerability information;

[0035] In the dependency tree model, performing vulnerability marking processing on the target software package, and performing risk marking processing on nodes associated with the target software package;

[0036] The security risk detection result of the software warehouse is obtained according to the software packages with the risk mark in the dependency tree model.

[0037] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0038] According to the version information of the software packages in the software warehouse, a dependency tree model of the software packages is established; the dependency tree model represents the dependency relationship between the software packages through a tree structure;

[0039] Matching the vulnerability information in the vulnerability library with the software packages and the version information to obtain a target software package that matches the vulnerability information;

[0040] In the dependency tree model, performing vulnerability marking processing on the target software package, and performing risk marking processing on nodes associated with the target software package;

[0041] The security risk detection result of the software warehouse is obtained according to the software packages with the risk mark in the dependency tree model.

[0042] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0043] According to the version information of the software packages in the software warehouse, a dependency tree model of the software packages is established; the dependency tree model represents the dependency relationship between the software packages through a tree structure;

[0044] Matching the vulnerability information in the vulnerability library with the software packages and the version information to obtain a target software package that matches the vulnerability information;

[0045] In the dependency tree model, performing vulnerability marking processing on the target software package, and performing risk marking processing on nodes associated with the target software package;

[0046] The security risk detection result of the software warehouse is obtained according to the software packages with the risk mark in the dependency tree model.

[0047] The above-mentioned software warehouse security risk detection method, device, computer equipment, storage medium and computer program product establish a dependency tree model of the software package according to the version information of the software package in the software warehouse; the dependency tree model represents the dependency relationship between each software package through a tree structure; the vulnerability information in the vulnerability library is matched with each software package and version information to obtain a target software package that matches the vulnerability information; in the dependency tree model, the target software package is subjected to vulnerability marking processing, and the nodes associated with the target software package are subjected to risk marking processing; according to the software packages with risk markings in the dependency tree model, the security risk detection results of the software warehouse are obtained. By adopting this method, the dependency relationship between each software package in the software warehouse can be described through the dependency tree model, and the vulnerability marking and risk marking can be propagated upward through the dependency tree model, so that the complex dependency relationship between each software package can be comprehensively and effectively considered. When the software packages in the subsequent software warehouse are continuously and incrementally updated, the newly added security risks can also be timely discovered and evaluated, which effectively improves the timeliness, accuracy and comprehensiveness of the security risk monitoring of the software warehouse. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A schematic diagram of a process for detecting security risks of a software warehouse in one embodiment;

[0049] Figure 2 A flowchart of the steps of matching vulnerability information in a vulnerability database with each software package and version information in one embodiment;

[0050] Figure 3 A schematic diagram of a flow chart of a method for detecting security risks of a software warehouse in another embodiment;

[0051] Figure 4 A schematic diagram of a flow chart of a method for detecting security risks of a software warehouse in another embodiment;

[0052] Figure 5 is a structural block diagram of a security risk detection device for a software warehouse in one embodiment;

[0053] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0055] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0056] In one embodiment, Figure 1 As shown, a method for detecting security risks in a software warehouse is provided. This embodiment uses the method applied to a server as an example for illustration. It is understandable that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0057] Step S101, establishing a dependency tree model of the software packages according to the version information of the software packages in the software warehouse; the dependency tree model represents the dependency relationship between the software packages through a tree structure.

[0058] Among them, software repository refers to a file repository that centrally stores and maintains the software used in the operating system and its various versions. Commonly used package management tools such as yum and apt are based on software repositories.

[0059] Among them, software package refers to the basic unit in the software warehouse, which usually contains a main program and its required library files, configuration files, etc., so as to facilitate installation and management as a whole.

[0060] Dependency refers to other software packages and their version requirements that a software package depends on for normal operation. This dependency can be direct or transitive.

[0061] Among them, the Dependency Tree Model refers to a data structure model that models software packages and their dependencies in a tree structure, with features such as a single root and directed acyclic.

[0062] Specifically, the server can use a warehouse scanner to perform a full scan of the software warehouse to obtain software information such as all software packages, versions, and metadata in the software warehouse. Then, based on the scanned software information, the software packages of each version are organized into a tree structure according to the dependency relationship, and the dependency tree model of each version of the software package is obtained. The risk data (such as risk value) of all nodes in the dependency tree model is initialized to 0. Moreover, the modeling method of the dependency tree model makes the analysis process highly structured and has good scalability, and can efficiently analyze large-scale software warehouses containing tens of thousands of software packages and versions.

[0063] Step S102, matching the vulnerability information in the vulnerability database with each software package and version information to obtain a target software package that matches the vulnerability information.

[0064] Vulnerability information refers to information describing the defects of a software package. The vulnerabilities of a software package can be exploited by attackers to perform some malicious actions. Vulnerabilities include CVE (Common Vulnerabilities and Exposures), which is a standardized name for identifying information security vulnerabilities. It assigns an ID number to each publicly disclosed software vulnerability and provides relevant descriptions and reference information.

[0065] The vulnerability database stores a variety of vulnerability information. In practical applications, the vulnerability database may also be a CVE vulnerability database (a public vulnerability database).

[0066] Specifically, the server can accurately match the vulnerability information in the vulnerability library with the versions of the software packages in the dependency tree model and their corresponding version information, obtain a version of the software package in the dependency tree model that matches the vulnerability information, and set the version of the software package as a candidate software package; and filter out the target software package that needs to be marked from the candidate software packages.

[0067] Step S103: In the dependency tree model, vulnerability marking is performed on the target software package, and risk marking is performed on the nodes associated with the target software package.

[0068] Among them, vulnerability marking refers to the use of significant marks such as color and symbols to indicate that the software package version corresponding to the node has security risks.

[0069] The risk tag refers to indicating the risk level of the software package version corresponding to the node through risk data (such as risk value, risk score).

[0070] Specifically, the server performs vulnerability marking processing on the target software package that matches the vulnerability information. For example, the leaf node corresponding to the target software package in the dependency tree model can be colored to mark the corresponding software package version as having security risks. Then, according to the dependency rules, the server propagates the vulnerability marking of the leaf node upward along the dependency tree model and performs risk marking until it reaches the root node.

[0071] Step S104, obtaining a security risk detection result of the software warehouse according to the software packages with risk marks in the dependency tree model.

[0072] The security risk detection results are used to describe the software packages with vulnerabilities in the software repository and their version information, the risk level of their vulnerabilities, their dependency paths, and other detailed information about security risks.

[0073] Specifically, when outputting security risk detection results, the server can read the version information, dependency path information, vulnerability tags, associated vulnerability information and risk data of all software packages with risk tags in the dependency tree model to generate security risk detection results for the overall security status of the software warehouse.

[0074] In the above-mentioned software warehouse security risk detection method, a software package dependency tree model is established according to the version information of the software package in the software warehouse; the dependency tree model represents the dependency relationship between each software package through a tree structure; the vulnerability information in the vulnerability library is matched with each software package and version information to obtain a target software package that matches the vulnerability information; in the dependency tree model, the target software package is subjected to vulnerability marking processing, and the nodes associated with the target software package are subjected to risk marking processing; according to the software packages with risk markings in the dependency tree model, the security risk detection results of the software warehouse are obtained. By adopting this method, the dependency relationship between each software package in the software warehouse can be described through the dependency tree model, and the vulnerability markings and risk markings can be propagated upward through the dependency tree model, so that the complex dependency relationship between each software package can be comprehensively and effectively considered. When the software packages in the subsequent software warehouse are continuously and incrementally updated, new security risks can also be discovered and evaluated in a timely manner, which effectively improves the timeliness, accuracy and comprehensiveness of security risk monitoring of the software warehouse.

[0075] In one embodiment, Figure 2 As shown, the above step S102 matches the vulnerability information in the vulnerability library with each software package and version information to obtain a target software package that matches the vulnerability information, which specifically includes the following contents:

[0076] Step S201 , matching the vulnerability information in the vulnerability database with the software packages and the version information of the software packages in the dependency tree model to obtain candidate software packages that match the vulnerability information in the dependency tree model.

[0077] The candidate software package refers to a software package of a certain version that matches the vulnerability information in the dependency tree model.

[0078] Specifically, the server can traverse the dependency tree model and accurately match each vulnerability information in the vulnerability library with the software package and its version information corresponding to each node in the dependency tree model. In fact, each node in the dependency tree model is a software package of different versions. If a certain version of the software package is detected to match the vulnerability information in the vulnerability library, the software package of this version is set as a candidate software package. If a certain version of the software package is detected to not match all the vulnerability information in the vulnerability library, the software package and its version information corresponding to the next node in the dependency tree model will continue to be detected.

[0079] Step S202, determining the target software package that is a leaf node in the dependency tree model from the candidate software packages; being a leaf node is also used to indicate that the software package corresponding to the leaf node has no dependency in the dependency tree model.

[0080] Specifically, the server will match the vulnerability information with the target software package of the leaf node candidate software package in the dependency tree model. It can be understood that the leaf node is the bottom node of the dependency tree and has no further dependencies, so the software package corresponding to the leaf node has no dependencies in the dependency tree model, that is, the software package version corresponding to the leaf node can be used directly without installing other dependent software packages.

[0081] Furthermore, the server can also modify the risk data corresponding to the target software package, such as modifying the risk data of the target software package from the initial 0 to the vulnerability score of the corresponding vulnerability information (such as CVE vulnerability). The vulnerability score can be a CVSS Score; CVSS Score (Common Vulnerability Scoring System Score) is an open standard for evaluating the severity of security vulnerabilities in computer systems. CVSS Score consists of three main parts: basic score (calculated based on basic factors of the vulnerability, such as vulnerability type, exploitability, attack vector, scope of vulnerability impact, etc.), environmental score (adjusting the basic score according to the specific network environment, taking into account factors such as the specific permissions of the system, network topology, and vulnerability of the victim) and improvement score (measuring the extent to which the vulnerability has been fixed).

[0082] In this embodiment, vulnerability information in the vulnerability library is used to detect candidate software packages that match the vulnerability information in the dependency tree model, and then the target software packages that belong to the leaf nodes in the dependency tree model are determined from the candidate software packages, so that subsequent steps can perform vulnerability marking processing and risk marking processing from bottom to top in the dependency tree model based on the target software packages of the leaf nodes, thereby realizing the detection of the security and health of the entire software ecosystem of the software warehouse, and does not repeatedly scan the dependencies of the software packages. While improving the accuracy of security risk monitoring of the software warehouse, it also improves the efficiency of security risk monitoring of the software warehouse.

[0083] In one embodiment, the above step S103, in the dependency tree model, performs vulnerability marking processing on the target software package, and performs risk marking processing on the nodes associated with the target software package, specifically including the following contents: in the dependency tree model, performs vulnerability marking processing on the leaf nodes corresponding to the target software package to obtain leaf nodes marked with vulnerability marks; performs vulnerability marking processing and risk marking processing on the parent nodes of the leaf nodes marked with vulnerability marks to obtain risk data of the parent nodes; and continues to propagate the vulnerability mark to the upper nodes of the parent node until the root node of the leaf node is marked with the vulnerability mark.

[0084] Specifically, in the dependency tree model, the leaf nodes corresponding to the target software package are subjected to vulnerability coloring. For example, different coloring colors can be set for different types of CVE vulnerabilities to distinguish different CVE vulnerability types, thereby obtaining leaf nodes marked with vulnerability tags. The leaf nodes can also be subjected to risk tagging to obtain risk data of the leaf nodes, such as setting the risk data of the leaf nodes to the vulnerability score corresponding to the vulnerability information that matches them. The server propagates the vulnerability tags and risk tags of the leaf nodes upward along the dependency tree according to the dependency relationship in the dependency tree model, and also performs vulnerability tagging and risk tagging on the parent nodes of the leaf nodes marked with vulnerability tags, to obtain the vulnerability tags and risk data of the parent nodes. Afterwards, the vulnerability tags are continued to be propagated to the parent nodes corresponding to the parent nodes of the leaf nodes, and the parent nodes corresponding to the parent nodes of the leaf nodes are subjected to risk tagging, until the root nodes of the leaf nodes are also marked with vulnerability tags and risk tags.

[0085] In actual applications, vulnerability tags can be set for nodes according to the needs of actual scenarios. For example, when marking vulnerabilities for parent nodes, the same vulnerability tags as those for child nodes can be set for parent nodes, that is, the same vulnerability tags are set for the root nodes from leaf nodes to leaf nodes; different vulnerability tags can also be set for each node according to the risk data of each node, that is, the corresponding vulnerability tags are set according to the vulnerability risk level of the node.

[0086] In addition, a whitelist mechanism can be introduced during the vulnerability tagging process to filter out certain acceptable known low-risk vulnerabilities to avoid false positives.

[0087] In this embodiment, vulnerability marking and risk marking are performed on the leaf nodes corresponding to the target software package, and the vulnerability marking and risk marking are continuously propagated to the upper parent node along the dependency relationship of the leaf nodes until the root node of the leaf node is marked with a vulnerability marking. This fully considers the complex dependency relationships between the software package versions in the software warehouse, ensures that any software package version affected by the vulnerability is not missed, and avoids the problem of repeated detection of software package versions in traditional vulnerability scanning tools, effectively improving the timeliness, accuracy and comprehensiveness of security risk monitoring of the software warehouse.

[0088] In one embodiment, the risk data in the above steps is obtained by: acquiring the risk data of each child node corresponding to the parent node; and screening out the largest risk data from the risk data of each child node and setting it as the risk data of the parent node.

[0089] Specifically, when risk marking is performed for the parent node of a leaf node or the parent node's upper parent node, the risk data of all lower child nodes of the parent node can be read. The server can filter out the maximum risk data from the risk data of all lower child nodes of the parent node and set it as the risk data of the parent node.

[0090] For example, assume that parent node A includes three child nodes: child node B (risk data is 80), child node C (risk data is 70) and child node D (a leaf node with risk data of 60). On the one hand, it means that the software package version corresponding to parent node A depends on the software package versions corresponding to child nodes B, C and D. On the other hand, the risk data of parent node A should be 80, which has the largest risk data among the child nodes.

[0091] In addition, the software warehouse can also be continuously monitored. If a new software package is added to the software warehouse or a version change of the software package is detected, the above steps S101 to S103 are executed to achieve synchronous update of the dependency tree model, dependency relationships, vulnerability tags, risk tags and other contents.

[0092] In this embodiment, the maximum risk data is screened out from the risk data of each child node and set as the risk data of the parent node, indicating that the risk data of the parent node is related to the child node with which it has a dependency relationship, that is, the parent node needs to bear the maximum risk among its child nodes. While realizing the risk marking processing of the software packages in the software warehouse, it also takes into account the dependency relationship between the software packages, greatly improving the accuracy and rationality of the risk marking.

[0093] In one embodiment, the above step S104 obtains the security risk detection result of the software warehouse based on the software packages with risk marks in the dependency tree model, which specifically includes the following contents: obtaining the dependency path information and associated vulnerability information corresponding to the software packages with risk marks in the dependency tree model; generating the security risk detection result of the software warehouse based on the dependency path information and the associated vulnerability information.

[0094] Specifically, the server can read the version information, dependency path information, vulnerability tags, associated vulnerability information, and risk data of the software packages with risk tags in the dependency tree model; then generate a report that fully describes the security risk situation of the software warehouse based on the read information, and send the report as the security risk detection result to the administrator (or management end) of the software warehouse. Furthermore, the server can also classify the security risk detection results by risk level or priority, and then output them to the administrator.

[0095] In this embodiment, the security risk detection results of the software warehouse are generated according to the dependency path information and associated vulnerability information corresponding to the software packages with risk marks in the dependency tree model, so that the relevant personnel of the software warehouse can view the security risk detection results. In addition, in addition to simply outputting a list of risky software packages, complete dependency path information is provided, which intuitively presents the propagation chain of security vulnerabilities in the supply chain, which is very valuable for analyzing and assessing risks, so that risk vulnerabilities in the software warehouse can be repaired and processed in a timely manner, greatly improving the stability of the software warehouse.

[0096] In one embodiment, the security risk detection method for the software warehouse further includes: if the security risk detection result indicates that there is a risky software package in the software warehouse, obtaining the dependency relationship of the risky software package; based on the dependency relationship, pruning the risk sub-nodes corresponding to the risky software package in the dependency tree model to obtain a pruned dependency tree model; and obtaining updated risk data corresponding to the risky software package based on the pruned dependency tree model.

[0097] The risk sub-node represents a sub-node that causes the risk software package to have risks among the lower-level sub-nodes of the node corresponding to the risk software package.

[0098] Specifically, for a software package version with risks detected in the security risk detection results, if the software package version causes the node to be at risk due to risk propagation, that is, the original risk is the child node at the lower level of the software package version, but is affected by the upward propagation of risk tags and vulnerability tags, making the software package version also at risk, then the dependency relationship of the software package version can be modified, for example, the risk child nodes corresponding to the risk software are pruned in the dependency tree model to obtain a pruned dependency tree model. Then, the server recalculates the risk data of the risk software package according to the dependency relationship of each node in the pruned dependency tree model, and the server obtains the updated risk data corresponding to the risk software package.

[0099] In this embodiment, in the dependency tree model, by pruning the risk sub-nodes corresponding to the risk software package, the risks caused by the upward propagation of dependencies can be resolved; then, based on the pruned dependency tree model, the risk data corresponding to the risk software package is updated, which not only adapts to the dynamic changes of the actual software warehouse rather than a one-time static analysis, thereby improving the timeliness and accuracy of the evaluation results, but also realizes the risk response of the related dependent software packages in the software warehouse, thereby improving the security and stability of the software warehouse.

[0100] In one embodiment, Figure 3 As shown, another method for detecting security risks of a software warehouse is provided, which is described by taking the method applied to a server as an example, and includes the following steps:

[0101] Step S301, establishing a dependency tree model of the software packages according to the version information of the software packages in the software repository; the dependency tree model represents the dependency relationship between the software packages through a tree structure.

[0102] Step S302, matching the vulnerability information in the vulnerability database with the software packages and the version information of the software packages in the dependency tree model to obtain candidate software packages that match the vulnerability information in the dependency tree model.

[0103] Step S303, determining the target software package that is a leaf node in the dependency tree model from the candidate software packages; being a leaf node is also used to indicate that the software package corresponding to the leaf node has no dependency in the dependency tree model.

[0104] Step S304: In the dependency tree model, a leaf node corresponding to the target software package is subjected to vulnerability marking processing to obtain a leaf node marked with a vulnerability mark.

[0105] Step S305, performing vulnerability marking processing and risk marking processing on the parent node of the leaf node marked with the vulnerability mark to obtain the risk data of the parent node.

[0106] Step S306, continue to propagate the vulnerability mark to the upper nodes of the parent node until the root node of the leaf node is marked with the vulnerability mark.

[0107] Step S307, obtaining a security risk detection result of the software warehouse according to the software packages with risk marks in the dependency tree model.

[0108] The above-mentioned software warehouse security risk detection method can achieve the following beneficial effects: it can describe the dependency relationship between each software package in the software warehouse through the dependency tree model, and propagate vulnerability tags and risk tags upward through the dependency tree model, and can comprehensively and effectively consider the complex dependency relationship between each software package. When the software packages in the subsequent software warehouse are continuously and incrementally updated, new security risks can also be discovered and evaluated in a timely manner, which effectively improves the timeliness, accuracy and comprehensiveness of security risk monitoring of the software warehouse.

[0109] In order to more clearly illustrate the software warehouse security risk detection method provided by the embodiment of the present disclosure, the software warehouse security risk detection method is specifically described below with a specific embodiment. Figure 4 As shown, another software warehouse security risk detection method is provided, which can be applied to the server, and specifically includes the following contents:

[0110] Step 1: The repository scanner performs a full scan of the software repository to obtain all software packages, versions, and metadata information.

[0111] Step 2: Based on the acquired information, the dependency analysis module builds a software package dependency tree model, organizes the software package versions into a tree structure according to the dependency relationship, and initializes the risk score of all nodes to 0.

[0112] Step 3: The vulnerability association module accurately matches the vulnerability information obtained from the CVE vulnerability rule base with the corresponding software package and version.

[0113] Step 4: The vulnerability marking module traverses the dependency tree, colors the vulnerability of the software package version (leaf node) that matches the CVE, and modifies the corresponding risk score of the version. The score is the CVSS Score of the corresponding CVE vulnerability.

[0114] Step 5: The tag propagation module propagates the vulnerability tag of the leaf node upward along the dependency tree according to the dependency rules, marks the risk of its parent node, and increases its risk score. The score is the maximum value of the risk scores of each child node. Repeat this step until the root node.

[0115] Step 6: The monitoring module monitors the repository updates and re-executes the above steps 2-5 once a new software package or version change is found.

[0116] Step 7: The report generation module generates a report by integrating the software packages marked with security risks, their dependency paths and CVE details.

[0117] Step 8: The report output module categorizes the reports by risk level or priority and outputs them to the administrator.

[0118] Step 9: For the processing of existing risk nodes, if the risk of the node is caused by risk propagation, the dependency relationship should be modified, and then the association with the corresponding leaf node should be cut off, and then the risk score of the parent node should be recalculated based on the risk score of the changed child node.

[0119] This embodiment has at least the following beneficial effects: (1) By establishing a complete software package dependency tree model and propagating CVE vulnerability tags upward along the dependency chain, the complex dependencies between software packages can be fully considered to ensure that no software package version affected by the vulnerability is missed. This is lacking in the prior art, thereby solving the problem of limited vulnerability coverage of the existing solution. (2) The CVE vulnerability information is accurately matched with the specific software package and its version, thereby reducing the false alarm rate and avoiding false alarms for irrelevant software packages. However, traditional vulnerability scanning tools often rely too much on general pattern matching and cannot achieve such precise association, resulting in a large number of false alarms. (3) By continuously monitoring the update of the software repository and performing incremental dependency analysis and vulnerability tagging, new security risks can be discovered and evaluated in a timely manner. This method adapts to the dynamic changes of the actual software repository rather than a one-time static analysis, thereby improving the timeliness and accuracy of the evaluation results. (4) The modeling method of the dependency tree model makes the analysis process highly structured, thereby having good scalability. This solution can efficiently analyze large-scale software repositories containing tens of thousands of software packages and versions, meeting the needs of real application scenarios. However, manual analysis one by one is obviously impossible to achieve. (5) In addition to simply outputting a list of risky software packages, the solution also provides a complete dependency path, intuitively presenting the propagation chain of security vulnerabilities in the supply chain. This information output is very valuable for analyzing and assessing risks, but existing technologies often find it difficult to present such a complete perspective. (6) Flexible rule configuration interfaces are reserved for multiple links in the solution, such as vulnerability filtering and tag propagation, which can be customized according to actual needs, improving the scalability and practicality of the solution.

[0120] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0121] Based on the same inventive concept, the embodiment of the present application also provides a software warehouse security risk detection device for implementing the software warehouse security risk detection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of the security risk detection device for one or more software warehouses provided below can refer to the limitations of the software warehouse security risk detection method above, and will not be repeated here.

[0122] In one embodiment, Figure 5 As shown, a software warehouse security risk detection device 500 is provided, including: a model building module 501, an information matching module 502, a risk marking module 503 and a risk detection module 504, wherein:

[0123] The model building module 501 is used to build a dependency tree model of the software packages according to the version information of the software packages in the software warehouse; the dependency tree model represents the dependency relationship between the software packages through a tree structure.

[0124] The information matching module 502 is used to match the vulnerability information in the vulnerability database with each software package and version information to obtain a target software package that matches the vulnerability information.

[0125] The risk marking module 503 is used to perform vulnerability marking processing on the target software package and perform risk marking processing on the nodes associated with the target software package in the dependency tree model.

[0126] The risk detection module 504 is used to obtain the security risk detection result of the software warehouse according to the software packages with risk marks in the dependency tree model.

[0127] In one embodiment, the information matching module 502 is also used to match the vulnerability information in the vulnerability library with the software packages and version information of each software package in the dependency tree model to obtain candidate software packages that match the vulnerability information in the dependency tree model; from the candidate software packages, determine the target software package that belongs to the leaf node in the dependency tree model; belonging to the leaf node is also used to indicate that the software package corresponding to the leaf node has no dependencies in the dependency tree model.

[0128] In one embodiment, the risk marking module 503 is also used to perform vulnerability marking processing on the leaf nodes corresponding to the target software package in the dependency tree model to obtain leaf nodes marked with vulnerability markings; perform vulnerability marking processing and risk marking processing on the parent nodes of the leaf nodes marked with vulnerability markings to obtain risk data of the parent nodes; and continue to propagate the vulnerability marking to the upper nodes of the parent node until the root node of the leaf node is marked with the vulnerability marking.

[0129] In one embodiment, the software warehouse security risk detection device 500 further includes a risk determination module for obtaining risk data of each child node corresponding to the parent node; and screening out the largest risk data from the risk data of each child node and setting it as the risk data of the parent node.

[0130] In one embodiment, the risk detection module 504 is further used to obtain dependency path information and associated vulnerability information corresponding to the software packages with risk tags in the dependency tree model; and generate security risk detection results for the software warehouse based on the dependency path information and associated vulnerability information.

[0131] In one embodiment, the security risk detection device 500 for a software warehouse also includes a risk processing module, which is used to obtain the dependency relationship of the risk software package if the security risk detection result indicates that there is a risk software package in the software warehouse; based on the dependency relationship, prune the risk sub-nodes corresponding to the risk software package in the dependency tree model to obtain a pruned dependency tree model; and obtain updated risk data corresponding to the risk software package based on the pruned dependency tree model.

[0132] Each module in the security risk detection device of the software warehouse can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0133] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 6As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as software packages, version information, dependencies, etc. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a security risk detection method for a software warehouse is implemented.

[0134] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0135] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0136] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0137] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0138] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0139] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0140] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the present application. It should be noted that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for detecting security risks in a software warehouse, characterized in that: The method comprises: According to the version information of the software packages in the software warehouse, a dependency tree model of the software packages is established; the dependency tree model represents the dependency relationship between the software packages through a tree structure; Matching the vulnerability information in the vulnerability library with the software packages and the version information to obtain a target software package that matches the vulnerability information; In the dependency tree model, performing vulnerability marking processing on the target software package, and performing risk marking processing on nodes associated with the target software package; The security risk detection result of the software warehouse is obtained according to the software packages with the risk mark in the dependency tree model.

2. The method according to claim 1, characterized in that The step of matching the vulnerability information in the vulnerability database with the software packages and the version information to obtain a target software package that matches the vulnerability information includes: Matching the vulnerability information in the vulnerability library with the software packages and the version information of the software packages in the dependency tree model to obtain candidate software packages in the dependency tree model that match the vulnerability information; From the candidate software packages, a target software package belonging to a leaf node in the dependency tree model is determined; the belonging to a leaf node is also used to indicate that the software package corresponding to the leaf node has no dependency in the dependency tree model.

3. The method according to claim 2, characterized in that In the dependency tree model, performing vulnerability marking processing on the target software package and performing risk marking processing on the nodes associated with the target software package include: In the dependency tree model, performing vulnerability marking processing on the leaf nodes corresponding to the target software package to obtain leaf nodes marked with vulnerability marks; Performing vulnerability marking processing and risk marking processing on the parent node of the leaf node marked with the vulnerability mark to obtain risk data of the parent node; The vulnerability mark is further propagated to the upper nodes of the parent node until the root node of the leaf node is marked with the vulnerability mark.

4. The method according to claim 3, characterized in that The risk data is obtained in the following manner: Obtain risk data of each child node corresponding to the parent node; The largest risk data is screened out from the risk data of each child node and is set as the risk data of the parent node.

5. The method according to claim 1, characterized in that The step of obtaining the security risk detection result of the software warehouse according to the software packages with the risk mark in the dependency tree model includes: Obtaining dependency path information and associated vulnerability information corresponding to the software package with risk mark in the dependency tree model; A security risk detection result of the software warehouse is generated according to the dependency path information and the associated vulnerability information.

6. The method according to claim 1, characterized in that The method further comprises: If the security risk detection result indicates that there is a risky software package in the software warehouse, obtaining the dependency relationship of the risky software package; Based on the dependency relationship, pruning the risk sub-nodes corresponding to the risk software package in the dependency tree model to obtain a pruned dependency tree model; According to the pruned dependency tree model, updated risk data corresponding to the risk software package is obtained.

7. A security risk detection device for a software warehouse, characterized in that: The device comprises: A model building module is used to build a dependency tree model of the software package according to the version information of the software package in the software warehouse; the dependency tree model represents the dependency relationship between the software packages through a tree structure; An information matching module, used to match the vulnerability information in the vulnerability library with the software packages and the version information to obtain a target software package that matches the vulnerability information; A risk marking module, used to perform vulnerability marking processing on the target software package and risk marking processing on nodes associated with the target software package in the dependency tree model; The risk detection module is used to obtain the security risk detection result of the software warehouse according to the software packages with the risk mark in the dependency tree model.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images