Software repository security risk detection methods, devices, computer equipment, and storage media

Abstract

This application relates to a method, apparatus, computer device, storage medium, and computer program product for security risk detection in a software repository. The method includes: establishing a dependency tree model of software packages based on version information of the packages in the software repository; the dependency tree model representing the dependencies between packages through a tree structure; matching vulnerability information in a vulnerability database with the version information of each package to obtain target packages that match the vulnerability information; performing vulnerability marking processing on the target packages in the dependency tree model, and performing risk marking processing on the nodes associated with the target packages; obtaining the security risk detection results of the software repository based on the packages with risk markings in the dependency tree model. This method can improve the timeliness, accuracy, and comprehensiveness of security risk monitoring in software repositories.

Description

Technical Field

[0001] This application relates to the field of software security technology, and in particular to a method, apparatus, computer equipment, storage medium and computer program product for detecting security risks in a software repository. Background Technology

[0002] In today's rapidly evolving digital age, software repositories, as crucial tools for code storage and version management, have become a key component of software development and maintenance. However, with the widespread use of open-source software and third-party dependencies, security risks in software repositories are becoming increasingly prominent. Issues such as malicious code injection, dependency vulnerabilities, weak passwords, and misconfigurations can lead to security vulnerabilities, thereby threatening the security of the entire application system.

[0003] Traditional security testing methods often involve identifying and fixing potential vulnerabilities in the software during the source code or build phase of the software supply chain, using static analysis and dynamic detection. However, this approach requires full access to the software's source code and dependent libraries, and it struggles to fully account for the complex dependencies between the numerous software packages within a software repository. This can lead to missed or false positives for security risks, affecting the accuracy of security risk detection results for the software repository. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, computer equipment, computer-readable storage medium, and computer program product for detecting security risks in software repositories, which can improve the accuracy of security risk detection results for software repositories, in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a method for detecting security risks in a software repository. The method includes:

[0006] Based on the version information of the software packages in the software repository, a dependency tree model of the software packages is established; the dependency tree model represents the dependency relationship between the software packages through a tree structure.

[0007] The vulnerability information in the vulnerability database is matched with the software packages and the version information to obtain the target software package that matches the vulnerability information;

[0008] In the dependency tree model, the target software package is marked for vulnerabilities, and the nodes associated with the target software package are marked for risks.

[0009] Based on the software packages with the risk markers present in the dependency tree model, the security risk detection results of the software repository are obtained.

[0010] In one embodiment, vulnerability information in a vulnerability database is matched with the software packages and version information to obtain a target software package that matches the vulnerability information, including:

[0011] The vulnerability information in the vulnerability database is matched with the software packages and version information of each software package in the dependency tree model to obtain candidate software packages in the dependency tree model that match the vulnerability information.

[0012] From the candidate software packages, the target software packages that belong to the leaf nodes in the dependency tree model are determined; the leaf node is also used to indicate that the software package corresponding to the leaf node has no dependency in the dependency tree model.

[0013] In one embodiment, within the dependency tree model, vulnerability labeling is performed on the target software package, and risk labeling is performed on the nodes associated with the target software package, including:

[0014] In the dependency tree model, the leaf nodes corresponding to the target software package are subjected to vulnerability marking processing to obtain leaf nodes marked with vulnerability tags;

[0015] Vulnerability marking and risk marking are performed on the parent node of the leaf node marked with vulnerability markers to obtain the risk data of the parent node;

[0016] The vulnerability marker is propagated to the parent node's parent nodes until the root node of the leaf node is marked with the vulnerability marker.

[0017] In one embodiment, the risk data is obtained as follows:

[0018] Obtain the risk data of each child node corresponding to the parent node;

[0019] From the risk data of each child node, the largest risk data is selected and set as the risk data of the parent node.

[0020] In one embodiment, the security risk detection result of the software repository is obtained based on the software packages with the risk marker present in the dependency tree model, including:

[0021] Obtain the dependency path information and associated vulnerability information corresponding to the software packages marked with risk in the dependency tree model;

[0022] Based on the dependency path information and the associated vulnerability information, a security risk detection result for the software repository is generated.

[0023] In one embodiment, the method further includes:

[0024] If the security risk detection result indicates that there are risky software packages in the software repository, then the dependencies of the risky software packages are obtained;

[0025] Based on the dependency relationship, the risk sub-nodes corresponding to the risk package are pruned in the dependency tree model to obtain the pruned dependency tree model.

[0026] Based on the pruned dependency tree model, the updated risk data corresponding to the risk package is obtained.

[0027] Secondly, this application also provides a security risk detection device for a software repository. The device includes:

[0028] The model building module is used to build a dependency tree model of the software packages based on the version information of the software packages in the software repository; the dependency tree model represents the dependency relationship between the software packages through a tree structure.

[0029] The information matching module is used to match vulnerability information in the vulnerability database with each software package and the version information to obtain a target software package that matches the vulnerability information;

[0030] The risk labeling module is used to perform vulnerability labeling on the target software package and risk labeling on the nodes associated with the target software package in the dependency tree model.

[0031] The risk detection module is used to obtain the security risk detection results of the software repository based on the software packages that have the risk marker in the dependency tree model.

[0032] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0033] Based on the version information of the software packages in the software repository, a dependency tree model of the software packages is established; the dependency tree model represents the dependency relationship between the software packages through a tree structure.

[0034] The vulnerability information in the vulnerability database is matched with the software packages and the version information to obtain the target software package that matches the vulnerability information;

[0035] In the dependency tree model, the target software package is marked for vulnerabilities, and the nodes associated with the target software package are marked for risks.

[0036] Based on the software packages with the risk markers present in the dependency tree model, the security risk detection results of the software repository are obtained.

[0037] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0038] Based on the version information of the software packages in the software repository, a dependency tree model of the software packages is established; the dependency tree model represents the dependency relationship between the software packages through a tree structure.

[0039] The vulnerability information in the vulnerability database is matched with the software packages and the version information to obtain the target software package that matches the vulnerability information;

[0040] In the dependency tree model, the target software package is marked for vulnerabilities, and the nodes associated with the target software package are marked for risks.

[0041] Based on the software packages with the risk markers present in the dependency tree model, the security risk detection results of the software repository are obtained.

[0042] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0043] Based on the version information of the software packages in the software repository, a dependency tree model of the software packages is established; the dependency tree model represents the dependency relationship between the software packages through a tree structure.

[0044] The vulnerability information in the vulnerability database is matched with the software packages and the version information to obtain the target software package that matches the vulnerability information;

[0045] In the dependency tree model, the target software package is marked for vulnerabilities, and the nodes associated with the target software package are marked for risks.

[0046] Based on the software packages with the risk markers present in the dependency tree model, the security risk detection results of the software repository are obtained.

[0047] The aforementioned security risk detection method, apparatus, computer equipment, storage medium, and computer program product for software repositories establish a dependency tree model for software packages based on their version information. The dependency tree model represents the dependencies between software packages through a tree structure. Vulnerability information from a vulnerability database is matched with the software package and version information to obtain target software packages that match the vulnerability information. Within the dependency tree model, vulnerability marking is performed on the target software packages, and risk marking is performed on the nodes associated with the target software packages. Based on the software packages with risk markings in the dependency tree model, the security risk detection results for the software repository are obtained. This method can describe the dependencies between software packages in a software repository using a dependency tree model, and propagate vulnerability and risk markings upwards through the dependency tree model. It can comprehensively and effectively consider the complex dependencies between software packages. Furthermore, it can promptly detect and assess new security risks during continuous incremental updates of software packages in the software repository, effectively improving the timeliness, accuracy, and comprehensiveness of security risk monitoring in software repositories. Attached Figure Description

[0048] Figure 1 This is a flowchart illustrating a security risk detection method for a software repository in one embodiment;

[0049] Figure 2 This is a flowchart illustrating the steps of matching vulnerability information in a vulnerability database with the information of various software packages and versions in one embodiment.

[0050] Figure 3 This is a flowchart illustrating a security risk detection method for a software repository in another embodiment;

[0051] Figure 4 This is a flowchart illustrating a security risk detection method for a software repository in another embodiment;

[0052] Figure 5 This is a structural block diagram of a security risk detection device for a software repository in one embodiment.

[0053] Figure 6 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0055] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0056] In one embodiment, such as Figure 1 As shown, a method for detecting security risks in a software repository is provided. This embodiment illustrates the method by applying it to a server. It is understood that this method can also be applied to terminals, and further to systems including both terminals and servers, and is implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0057] Step S101: Based on the version information of the software packages in the software repository, establish a dependency tree model of the software packages; the dependency tree model represents the dependency relationship between the software packages through a tree structure.

[0058] A software repository is a centralized repository of files that stores and maintains the software used in an operating system and its various versions. Commonly used package management tools such as yum and apt are based on software repositories.

[0059] A software package is a basic unit in a software repository. It typically contains a main program and its required library files, configuration files, etc., making it easy to install and manage as a whole.

[0060] In this context, a dependency refers to other software packages and their version requirements that a software package depends on for it to function properly. Such dependencies can be direct or transitive.

[0061] The Dependency Tree Model is a data structure model that models software packages and their dependencies in a tree structure, featuring characteristics such as a single root and directed acyclic nature.

[0062] Specifically, the server can perform a full scan of the software repository using a repository scanner to obtain software information such as all packages, versions, and metadata. Then, based on the scanned software information, the packages of each version are organized into a tree structure according to their dependencies, resulting in a dependency tree model for each version of the packages. The risk data (e.g., risk values) of all nodes in the dependency tree model are initialized to 0. Furthermore, the dependency tree model's modeling method makes the analysis process highly structured, has excellent scalability, and can efficiently analyze large-scale software repositories containing tens of thousands of packages and versions.

[0063] Step S102: Match the vulnerability information in the vulnerability database with the software package and version information to obtain the target software package that matches the vulnerability information.

[0064] Vulnerability information refers to information describing defects in software packages. These vulnerabilities can be exploited by attackers to perform malicious actions. Vulnerabilities include CVEs (Common Vulnerabilities and Exposures), a standardized name for identifying information security vulnerabilities. It assigns an ID number to each publicly disclosed software vulnerability and provides related descriptions and reference information.

[0065] The vulnerability database stores information on various vulnerabilities. In practical applications, the vulnerability database can also be the CVE vulnerability database (a public vulnerability database).

[0066] Specifically, the server can perform precise matching between vulnerability information in the vulnerability database and various versions of software packages and their corresponding version information in the dependency tree model to obtain a certain version of the software package that matches the vulnerability information in the dependency tree model, and set the software package of that version as a candidate software package; and select the target software package that needs to be marked from the candidate software packages.

[0067] Step S103: In the dependency tree model, the target software package is marked for vulnerabilities, and the nodes associated with the target software package are marked for risks.

[0068] Among them, vulnerability marking refers to the use of colors, symbols, and other prominent markings to indicate that the software package version corresponding to a node has a security risk.

[0069] Risk labeling refers to indicating the risk level of the software package version corresponding to a node through risk data (such as risk value and risk score).

[0070] Specifically, the server performs vulnerability marking on target software packages that match the vulnerability information. For example, it can color the leaf nodes corresponding to the target software package in the dependency tree model to indicate that the corresponding software package version has a security risk. Then, according to the dependency rules, the server propagates the vulnerability markings of the leaf nodes upwards along the dependency tree model and marks the risks until the root node is marked.

[0071] Step S104: Based on the software packages marked with risk in the dependency tree model, obtain the security risk detection results of the software repository.

[0072] Among them, the security risk detection results are used to describe the software packages with vulnerabilities in the software repository, their version information, the degree of risk of the vulnerabilities, their dependency paths, and other detailed information about security risks.

[0073] Specifically, when outputting security risk detection results, the server can read the version information, dependency path information, vulnerability tags, associated vulnerability information, and risk data of all software packages with risk tags in the dependency tree model, and generate security risk detection results for the overall security status of the software repository.

[0074] The aforementioned security risk detection method for software repositories establishes a dependency tree model based on the version information of the software packages in the repository. This model represents the dependencies between packages using a tree structure. Vulnerability information from a vulnerability database is matched with the package and version information to obtain target packages that match the vulnerability information. Within the dependency tree model, vulnerability tags are applied to the target packages, and risk tags are applied to the nodes associated with them. Based on the risk-tagged packages in the dependency tree model, the security risk detection results for the software repository are obtained. This method describes the dependencies between software packages in the repository using a dependency tree model and propagates vulnerability and risk tags upwards through the model. It comprehensively and effectively considers the complex dependencies between packages, and can promptly identify and assess new security risks during continuous incremental updates to the software repository, effectively improving the timeliness, accuracy, and comprehensiveness of security risk monitoring in the software repository.

[0075] In one embodiment, such as Figure 2 As shown, step S102 above involves matching the vulnerability information in the vulnerability database with the software package and version information to obtain the target software package that matches the vulnerability information. Specifically, this includes the following:

[0076] Step S201: Match the vulnerability information in the vulnerability database with the software packages and version information of each software package in the dependency tree model to obtain candidate software packages that match the vulnerability information in the dependency tree model.

[0077] In this context, a candidate package refers to a version of a package that matches the vulnerability information in the dependency tree model.

[0078] Specifically, the server can traverse the dependency tree model, precisely matching each vulnerability information in the vulnerability database with the corresponding software package and its version information for each node in the dependency tree model. In fact, each node in the dependency tree model represents a different version of the software package. If a software package version matches a vulnerability in the vulnerability database, that version is set as a candidate software package. If a software package version does not match any vulnerability information in the vulnerability database, the server continues to check the software package and its version information corresponding to the next node in the dependency tree model.

[0079] Step S202: From the candidate packages, determine the target packages that belong to the leaf nodes in the dependency tree model; belonging to the leaf nodes also indicates that the packages corresponding to the leaf nodes have no dependencies in the dependency tree model.

[0080] Specifically, the server will target the device package that matches the vulnerability information in the dependency tree model and belongs to the leaf node candidate package. It's understandable that the leaf node is the lowest level node in the dependency tree, with no further dependencies. Therefore, the package corresponding to the leaf node also has no dependencies in the dependency tree model. In other words, the package version corresponding to the leaf node can be used directly without installing other dependent packages.

[0081] Furthermore, the server can also modify the risk data corresponding to the target software package, such as changing the risk data of the target software package from the initial 0 to the vulnerability score of the corresponding vulnerability information (e.g., CVE vulnerability). The vulnerability score can be the CVSS Score; the CVSS Score (Common Vulnerability Scoring System Score) is an open standard used to assess the severity of security vulnerabilities in computer systems. The CVSS Score consists of three main parts: a base score (calculated based on the basic factors of the vulnerability, such as vulnerability type, exploitability, attack vector, and the scope of the vulnerability's impact), an environment score (adjusting the base score according to the specific network environment, considering factors such as specific system privileges, network topology, and the vulnerability of the victim), and an improvement score (measuring the degree to which the vulnerability has been patched).

[0082] In this embodiment, vulnerability information from a vulnerability database is used to detect candidate software packages that match the vulnerability information in a dependency tree model. Then, target software packages belonging to leaf nodes in the dependency tree model are determined from the candidate software packages. This allows subsequent steps to perform vulnerability marking and risk marking processing from bottom to top in the dependency tree model based on the target software packages at the leaf nodes. This enables the detection of the security and health of the entire software ecosystem of the software repository without repeatedly scanning the dependencies of software packages. This improves both the accuracy and efficiency of security risk monitoring in the software repository.

[0083] In one embodiment, step S103 above, in the dependency tree model, performs vulnerability marking processing on the target software package and risk marking processing on the nodes associated with the target software package, specifically includes the following: in the dependency tree model, performs vulnerability marking processing on the leaf nodes corresponding to the target software package to obtain leaf nodes marked with vulnerability; performs vulnerability marking and risk marking processing on the parent nodes of the leaf nodes marked with vulnerability to obtain the risk data of the parent nodes; and continues to propagate the vulnerability marking to the upper-level nodes of the parent nodes until the root node of the leaf nodes is marked with vulnerability.

[0084] Specifically, in the dependency tree model, the leaf nodes corresponding to the target software package are marked with vulnerability labels. For example, different colors can be set for different types of CVE vulnerabilities to distinguish them, thus obtaining leaf nodes marked with vulnerability labels. Risk labels can also be applied to the leaf nodes to obtain their risk data, such as setting the risk data to the vulnerability score corresponding to the vulnerability information they match. Based on the dependencies in the dependency tree model, the server propagates the vulnerability and risk labels of the leaf nodes upwards along the dependency tree. The parent nodes of the leaf nodes marked with vulnerability labels are also marked with vulnerability and risk labels, obtaining the parent nodes' vulnerability labels and risk data. Then, the vulnerability labels continue to propagate to the parent nodes corresponding to the parent nodes of the leaf nodes, and risk labels are applied to the parent nodes corresponding to the parent nodes of the leaf nodes, until the root node of the leaf nodes is also marked with vulnerability and risk labels.

[0085] In practical applications, vulnerability tags can be set for nodes according to the needs of the actual scenario. For example, when tagging a parent node, the parent node can be set with the same vulnerability tag as the child nodes, that is, the same vulnerability tag can be set for all nodes from leaf nodes to the root node; or different vulnerability tags can be set for each node according to the risk data of each node, that is, the corresponding vulnerability tag can be set according to the vulnerability risk level of the node.

[0086] In addition, a whitelist mechanism can be introduced during the vulnerability labeling process to filter out certain acceptable known low-risk vulnerabilities and avoid false alarms.

[0087] In this embodiment, by performing vulnerability and risk marking processing on the leaf nodes corresponding to the target software package, and continuing to propagate the vulnerability and risk markings to the upper-level parent nodes along the dependency relationship of the leaf nodes until the root node of the leaf node is marked with a vulnerability, the complex dependency relationship between the versions of various software packages in the software repository is comprehensively considered. This ensures that no software package version affected by a vulnerability is missed, and also avoids the problem of repeated detection of software package versions in traditional vulnerability scanning tools. This effectively improves the timeliness, accuracy and comprehensiveness of security risk monitoring of the software repository.

[0088] In one embodiment, the risk data in the above steps is obtained as follows: obtain the risk data of each child node corresponding to the parent node; filter out the largest risk data from the risk data of each child node and set it as the risk data of the parent node.

[0089] Specifically, when marking a risk for the parent node of a leaf node or its parent's superparent node, the risk data of all its child nodes can be read. The server can then filter out the highest risk data from all the child nodes of the parent node and set it as the parent node's risk data.

[0090] For example, suppose parent node A has three child nodes: child node B (risk data is 80), child node C (risk data is 70), and child node D (a leaf node with risk data of 60). This means that the software package version corresponding to parent node A depends on the software package versions corresponding to child nodes B, C, and D. Furthermore, the risk data of parent node A should be the highest risk data among its child nodes, which is 80.

[0091] In addition, the software repository can be continuously monitored. If a new software package is added or a software package version is changed, the above steps S101 to S103 are executed to synchronize the update of the dependency tree model, dependency relationships, vulnerability markers and risk markers.

[0092] In this embodiment, by filtering out the largest risk data from the risk data of each child node and setting it as the risk data of the parent node, it is shown that the risk data of the parent node is related to the child nodes with which it has a dependency relationship. That is, the parent node must bear the largest risk among its child nodes. While realizing the risk marking processing of software packages in the software repository, it also takes into account the dependency relationship between software packages, which greatly improves the accuracy and rationality of risk marking.

[0093] In one embodiment, step S104 above, which obtains the security risk detection result of the software repository based on the software packages marked with risk in the dependency tree model, specifically includes the following: obtaining the dependency path information and associated vulnerability information corresponding to the software packages marked with risk in the dependency tree model; and generating the security risk detection result of the software repository based on the dependency path information and associated vulnerability information.

[0094] Specifically, the server can read version information, dependency path information, vulnerability tags, associated vulnerability information, and risk data of software packages marked with risk in the dependency tree model; then, based on the read information, it generates a comprehensive report describing the security risks of the software repository, and sends this report as the security risk detection result to the software repository administrator (or management terminal). Furthermore, the server can also classify the security risk detection results according to risk level or priority before outputting them to the administrator.

[0095] In this embodiment, based on the dependency path information and associated vulnerability information of software packages marked with risks in the dependency tree model, a security risk detection result for the software repository is generated, allowing relevant personnel in the software repository to view the security risk detection result. Furthermore, in addition to simply outputting a list of risky software packages, it provides complete dependency path information and intuitively presents the propagation chain of security vulnerabilities in the supply chain. This is highly valuable for risk analysis and assessment, enabling timely remediation of vulnerabilities in the software repository and significantly improving its stability.

[0096] In one embodiment, the above-mentioned software repository security risk detection method further includes: if the security risk detection result indicates that there is a risky software package in the software repository, then obtaining the dependency relationship of the risky software package; based on the dependency relationship, pruning the risky child nodes corresponding to the risky software package in the dependency tree model to obtain the pruned dependency tree model; and obtaining the updated risk data corresponding to the risky software package according to the pruned dependency tree model.

[0097] Among them, the risk child node represents the child node in the lower-level child node of the node corresponding to the risk package that causes the risk package to have a risk.

[0098] Specifically, for a software package version detected as having a risk in the security risk detection results, if the risk in this software package version is due to risk propagation (i.e., the original risk was in a lower-level child node of this software package version, but due to the upward propagation of risk and vulnerability markers, this also makes the software package version risky), then the dependency relationship of this software package version can be modified. For example, the risky child nodes corresponding to the risky software can be pruned in the dependency tree model to obtain a pruned dependency tree model. Then, the server recalculates the risk data of the risky software package based on the dependency relationships of each node in the pruned dependency tree model, thus obtaining the updated risk data corresponding to the risky software package.

[0099] In this embodiment, by pruning the risky child nodes corresponding to risky software packages in the dependency tree model, the risks arising from the upward propagation of dependencies can be resolved. Furthermore, based on the pruned dependency tree model, the risk data corresponding to the risky software packages is updated. This not only adapts to the dynamic changes of the actual software repository, rather than a one-time static analysis, improving the timeliness and accuracy of the evaluation results, but also enables risk management of related dependent software packages in the software repository, thereby improving the security and stability of the software repository.

[0100] In one embodiment, such as Figure 3 As shown, another method for detecting security risks in software repositories is provided. Taking the application of this method to a server as an example, the method includes the following steps:

[0101] Step S301: Based on the version information of the software packages in the software repository, establish a dependency tree model of the software packages; the dependency tree model represents the dependency relationship between the software packages through a tree structure.

[0102] Step S302: Match the vulnerability information in the vulnerability database with the software packages and version information of each software package in the dependency tree model to obtain candidate software packages that match the vulnerability information in the dependency tree model.

[0103] Step S303: From the candidate packages, determine the target packages that belong to the leaf nodes in the dependency tree model; belonging to the leaf nodes also indicates that the packages corresponding to the leaf nodes have no dependencies in the dependency tree model.

[0104] Step S304: In the dependency tree model, perform vulnerability marking processing on the leaf nodes corresponding to the target software package to obtain leaf nodes marked with vulnerability tags.

[0105] Step S305: Perform vulnerability marking and risk marking processing on the parent node of the leaf node marked with vulnerability markers to obtain the risk data of the parent node.

[0106] Step S306: Propagate the vulnerability marker to the parent node's parent nodes until the root node of the leaf node is marked with the vulnerability marker.

[0107] Step S307: Based on the software packages marked with risk in the dependency tree model, obtain the security risk detection results of the software repository.

[0108] The aforementioned software repository security risk detection method can achieve the following beneficial effects: it can describe the dependency relationships between software packages in the software repository through a dependency tree model, and propagate vulnerability and risk tags upward through the dependency tree model. It can comprehensively and effectively consider the complex dependency relationships between software packages. When software packages in the software repository are continuously updated incrementally, new security risks can also be discovered and evaluated in a timely manner, effectively improving the timeliness, accuracy and comprehensiveness of software repository security risk monitoring.

[0109] To more clearly illustrate the security risk detection method for software repositories provided in this disclosure, a specific embodiment is used below to specifically describe the method. For example... Figure 4 As shown, another method for detecting security risks in software repositories is provided, which can be applied to servers, and specifically includes the following:

[0110] Step 1: The repository scanner performs a full scan of the software repository to obtain all software packages, versions, and metadata information.

[0111] Step 2: Based on the acquired information, the dependency analysis module establishes a software package dependency tree model, organizes software package versions into a tree structure according to their dependencies, and initializes the risk score of all nodes to 0.

[0112] Step 3: The vulnerability association module will accurately match the vulnerability information obtained from the CVE vulnerability rule base with the corresponding software package and version.

[0113] Step 4: The vulnerability marking module traverses the dependency tree, colors the package versions (leaf nodes) that match the CVE, and modifies the corresponding risk score for that version. The score is the CVSS Score of the corresponding CVE vulnerability.

[0114] Step 5: The vulnerability marking and propagation module propagates the vulnerability markings of leaf nodes upwards along the dependency tree according to the dependency rules, marks the risk of their parent nodes, and increases their risk score. The score is the maximum of the risk scores of all child nodes. This step is repeated until the root node.

[0115] Step 6: The monitoring module monitors repository updates. Once a new software package or version change is detected, steps 2-5 above are executed again.

[0116] Step 7: The report generation module will generate a report by combining the software packages marked with security risks, their dependency paths, and CVE details.

[0117] Step 8: The report output module categorizes reports by risk level or priority and outputs them to the administrator.

[0118] Step 9: For existing risk nodes, if the risk of a node is caused by risk propagation, the dependency relationship should be modified, the association with the corresponding leaf node should be removed, and then the risk score of the parent node should be recalculated based on the risk score of the changed child nodes.

[0119] This embodiment has at least the following beneficial effects: (1) By establishing a complete software package dependency tree model and propagating CVE vulnerability markers upward along the dependency chain, the complex dependency relationships between software packages can be fully considered, ensuring that no software package version affected by the vulnerability is missed. This is lacking in the prior art, thus solving the problem of limited vulnerability coverage in the existing solution. (2) By accurately matching CVE vulnerability information with specific software packages and their versions, the false alarm rate is reduced, and false alarms for irrelevant software packages are avoided. Traditional vulnerability scanning tools often rely too much on general pattern matching and cannot achieve such accurate association, resulting in more false alarms. (3) By continuously monitoring the updates of the software repository and performing incremental dependency analysis and vulnerability marking, new security risks can be discovered and assessed in a timely manner. This approach adapts to the dynamic changes of the actual software repository, rather than a one-time static analysis, thereby improving the timeliness and accuracy of the assessment results. (4) The modeling method of the dependency tree model makes the analysis process highly structured, thus having good scalability. This solution can efficiently analyze large-scale software repositories containing tens of thousands of software packages and versions, meeting the needs of real-world application scenarios. Manual analysis is obviously impossible. (5) In addition to simply outputting a list of software packages with risks, this solution also provides a complete dependency path, intuitively presenting the propagation chain of security vulnerabilities in the supply chain. This kind of information output is very valuable for risk analysis and assessment, while existing technologies often cannot present such a complete perspective. (6) Many aspects of this solution, such as vulnerability filtering and label propagation, have reserved flexible rule configuration interfaces, which can be customized according to actual needs, improving the scalability and practicality of the solution.

[0120] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0121] Based on the same inventive concept, this application also provides a software repository security risk detection device for implementing the software repository security risk detection method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more software repository security risk detection device embodiments provided below can be found in the limitations of the software repository security risk detection method described above, and will not be repeated here.

[0122] In one embodiment, such as Figure 5 As shown, a security risk detection device 500 for a software repository is provided, comprising: a model building module 501, an information matching module 502, a risk marking module 503, and a risk detection module 504, wherein:

[0123] The model building module 501 is used to build a dependency tree model of software packages based on the version information of the software packages in the software repository; the dependency tree model represents the dependency relationship between software packages through a tree structure.

[0124] The information matching module 502 is used to match vulnerability information in the vulnerability database with the software package and version information to obtain the target software package that matches the vulnerability information.

[0125] The risk labeling module 503 is used to perform vulnerability labeling on the target software package and risk labeling on the nodes associated with the target software package in the dependency tree model.

[0126] The risk detection module 504 is used to obtain the security risk detection results of the software repository based on the software packages with risk tags in the dependency tree model.

[0127] In one embodiment, the information matching module 502 is further configured to match the vulnerability information in the vulnerability database with the software packages and version information of each software package in the dependency tree model to obtain candidate software packages that match the vulnerability information in the dependency tree model; from the candidate software packages, determine the target software packages that belong to the leaf nodes in the dependency tree model; belonging to the leaf nodes is also used to indicate that the software packages corresponding to the leaf nodes have no dependencies in the dependency tree model.

[0128] In one embodiment, the risk marking module 503 is further configured to perform vulnerability marking processing on the leaf nodes corresponding to the target software package in the dependency tree model to obtain leaf nodes marked with vulnerability tags; perform vulnerability marking processing and risk marking processing on the parent nodes of the leaf nodes marked with vulnerability tags to obtain risk data of the parent nodes; and continue to propagate the vulnerability tags to the upper-level nodes of the parent nodes until the root node of the leaf node is marked with a vulnerability tag.

[0129] In one embodiment, the software repository security risk detection device 500 further includes a risk determination module, which is used to obtain the risk data of each child node corresponding to the parent node; and to filter out the largest risk data from the risk data of each child node and set it as the risk data of the parent node.

[0130] In one embodiment, the risk detection module 504 is further configured to obtain dependency path information and associated vulnerability information corresponding to software packages with risk markers in the dependency tree model; and generate security risk detection results for the software repository based on the dependency path information and associated vulnerability information.

[0131] In one embodiment, the security risk detection device 500 for the software repository further includes a risk processing module, which is used to obtain the dependency relationship of the risk package if the security risk detection result indicates that there is a risk package in the software repository; based on the dependency relationship, prune the risk child nodes corresponding to the risk package in the dependency tree model to obtain the pruned dependency tree model; and obtain the updated risk data corresponding to the risk package according to the pruned dependency tree model.

[0132] The modules in the aforementioned software repository security risk detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0133] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 6As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores data such as software packages, version information, and dependencies. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a method for detecting security risks in a software repository.

[0134] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0135] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0136] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0137] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0138] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0139] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0140] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for detecting security risks in a software repository, characterized in that, The method includes: Based on the version information of the software packages in the software repository, a dependency tree model of the software packages is established; the dependency tree model represents the dependency relationship between the software packages through a tree structure. The vulnerability information in the vulnerability database is matched with the software packages and version information of each software package in the dependency tree model to obtain candidate software packages in the dependency tree model that match the vulnerability information. From the candidate software packages, the target software packages that belong to the leaf nodes in the dependency tree model are determined; the leaf node is further used to indicate that the software package corresponding to the leaf node has no dependencies in the dependency tree model. In the dependency tree model, the leaf nodes corresponding to the target software package are subjected to vulnerability marking processing to obtain leaf nodes marked with vulnerability tags; Vulnerability marking and risk marking are performed on the parent node of the leaf node marked with vulnerability markers to obtain the risk data of the parent node; The vulnerability marker is propagated to the parent node's parent nodes until the root node of the leaf node is marked with the vulnerability marker. Based on the version information, dependency path information, associated vulnerability information, vulnerability tags, and risk data of the software packages with the risk tags in the dependency tree model, the security risk detection results of the software repository are obtained.

2. The method according to claim 1, characterized in that, The risk data was obtained in the following manner: Obtain the risk data of each child node corresponding to the parent node; From the risk data of each child node, the largest risk data is selected and set as the risk data of the parent node.

3. The method according to claim 1, characterized in that, The step of obtaining the security risk detection result of the software repository based on the software packages with the risk markers present in the dependency tree model includes: Obtain the dependency path information and associated vulnerability information corresponding to the software packages marked with risk in the dependency tree model; Based on the dependency path information and the associated vulnerability information, a security risk detection result for the software repository is generated.

4. The method according to claim 1, characterized in that, The method further includes: If the security risk detection result indicates that there are risky software packages in the software repository, then the dependencies of the risky software packages are obtained; Based on the dependency relationship, the risk sub-nodes corresponding to the risk package are pruned in the dependency tree model to obtain the pruned dependency tree model. Based on the pruned dependency tree model, the updated risk data corresponding to the risk package is obtained.

5. A security risk detection device for a software repository, characterized in that, The device includes: The model building module is used to build a dependency tree model of the software packages based on the version information of the software packages in the software repository; the dependency tree model represents the dependency relationship between the software packages through a tree structure. The information matching module is used to match vulnerability information in the vulnerability database with each software package and its version information in the dependency tree model to obtain candidate software packages that match the vulnerability information in the dependency tree model; from the candidate software packages, the target software packages that belong to the leaf nodes in the dependency tree model are determined; the "belonging to the leaf node" is also used to indicate that the software package corresponding to the leaf node has no dependencies in the dependency tree model; The risk labeling module is used to perform vulnerability labeling processing on the leaf nodes corresponding to the target software package in the dependency tree model to obtain leaf nodes marked with vulnerability labels; perform vulnerability labeling and risk labeling processing on the parent nodes of the leaf nodes marked with vulnerability labels to obtain the risk data of the parent nodes; and continue to propagate the vulnerability labels to the upper-level nodes of the parent nodes until the root node of the leaf nodes is marked with the vulnerability labels. The risk detection module is used to obtain the security risk detection results of the software repository based on the version information, dependency path information, associated vulnerability information, vulnerability tags, and risk data of the software packages with the risk tags in the dependency tree model.

6. The apparatus according to claim 5, characterized in that, The security risk detection device for the software repository also includes a risk determination module; The risk determination module is used to obtain the risk data of each child node corresponding to the parent node; From the risk data of each child node, the largest risk data is selected and set as the risk data of the parent node.

7. The apparatus according to claim 5, characterized in that, The security risk detection device for the software repository also includes a risk processing module; The risk processing module is used to obtain the dependency relationship of the risky software package if the security risk detection result indicates that there is a risky software package in the software repository. Based on the dependency relationship, the risk sub-nodes corresponding to the risk package are pruned in the dependency tree model to obtain the pruned dependency tree model. Based on the pruned dependency tree model, the updated risk data corresponding to the risk package is obtained.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 4.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

Images