Item similarity-based SCA detection method, apparatus and device, and medium

Abstract

The invention provides an SCA detection method and device based on item similarity, equipment and a medium. According to the method, under the condition that catalog fingerprint information of a to-be-detected item fails to be matched with catalog fingerprint information of each open source item in an open source item library, file fingerprint information of the to-be-detected item is matched with file fingerprint information of each target open source item in the open source item library according to a matching result of the file fingerprint information of the to-be-detected item and the file fingerprint information of each target open source item in the open source item library; evaluating the similarity between the to-be-detected item and each target open source item according to the file attribute information of the to-be-detected item and the file attribute information of each target open source item and the matching result of the file attribute information of the to-be-detected item and the file attribute information of each target open source item; and when the similarity between the to-be-detected item and the at least one target open source item meets a preset item similarity condition, or the directory fingerprint information of the to-be-detected item is successfully matched with the directory fingerprint information of the at least one open source item, detecting the to-be-detected item according to the directory fingerprint information of the to-be-detected item. And component versions corresponding to the known open source items are determined as component versions corresponding to the items to be detected, so that similar items and components are effectively matched.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, device, equipment and medium for SCA detection based on project similarity. Background Art

[0002] Traditional Software Composition Analysis (SCA) methods mainly rely on precise hash algorithms such as MD5 (Message-Digest Algorithm 5) or SHA1 (Secure Hash Algorithm 1) to generate file hash values ​​and file tree hash values ​​of the project to be detected. By comparing the file hash values ​​and file tree hash values ​​of the project to be detected with the file hash values ​​and file tree hash values ​​of known open source projects, one or more known open source projects similar to the project to be detected are determined, and then the open source components used by the project to be detected are further determined based on these known open source projects.

[0003] In the actual development process, the code of the open source components used by the project to be tested often changes. Changes to the file content and file tree structure of the project to be tested will cause large changes in the hash value, which can easily miss the match of similar projects and components, resulting in low SCA efficiency. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a SCA detection method, device, equipment and medium based on project similarity, so as to achieve the technical effect of effectively matching similar projects and components and improving SCA detection efficiency and detection accuracy.

[0005] In a first aspect, an embodiment of the present application provides a SCA detection method based on project similarity, comprising: In the case where the directory fingerprint information of the project to be detected fails to match the directory fingerprint information of each open source project in the open source project library, the similarity between the project to be detected and each target open source project is evaluated based on the matching results of the file fingerprint information of the project to be detected and the file fingerprint information of each target open source project in the open source project library, and the matching results of the file attribute information of the project to be detected and the file attribute information of each target open source project; In the case where the similarity between the project to be detected and at least one target open source project in the open source project library meets a preset project similarity condition, determining the component version corresponding to the at least one target open source project as the component version corresponding to the project to be detected; When the directory fingerprint information of the project to be detected successfully matches the directory fingerprint information of at least one open source project in the open source project library, the component version corresponding to the at least one open source project is determined as the component version corresponding to the project to be detected.

[0006] In the above implementation process, when the directory fingerprint information of the project to be detected fails to match the directory fingerprint information of each open source project in the open source project library, the project similarity between the project to be detected and each target open source project is evaluated according to the matching results of the file fingerprint information of the project to be detected and the file fingerprint information of each target open source project in the open source project library, and the matching results of the file attribute information of the project to be detected and the file attribute information of each target open source project. When the project similarity between the project to be detected and at least one target open source project meets the preset project similarity condition, or the directory fingerprint information of the project to be detected successfully matches the directory fingerprint information of at least one open source project, the component versions corresponding to these part of the known open source projects are determined as the component versions corresponding to the project to be detected. The similarity between the two projects can be comprehensively evaluated from multiple aspects such as the directory tree structure similarity at the directory level, and the file content similarity and file attribute similarity at the file level, and the similar projects of the project to be detected are accurately determined, and the component versions corresponding to the similar projects are determined as the component versions corresponding to the project to be detected, so that similar projects and components can be effectively matched in the case of adjustment of the project directory tree structure or modification of file content, thereby improving the SCA detection efficiency and detection accuracy.

[0007] Furthermore, the similarity between the project fingerprint information of each target open source project and the project fingerprint information of the project to be detected satisfies a preset project fingerprint similarity condition.

[0008] In the above implementation process, by screening at least one target open source project from the open source project library, the similarity between the project fingerprint information of each target open source project and the project fingerprint information of the project to be detected meets the preset project fingerprint similarity condition, and the target open source projects that may be similar to the project to be detected can be pre-selected for file-level project matching, so as to more quickly and accurately determine the similar projects of the project to be detected, which is conducive to further improving the SCA detection efficiency.

[0009] Further, the directory fingerprint information of the project to be detected includes the root directory fingerprint information and sub-directory fingerprint information of the project to be detected, and the directory fingerprint information of each open source project includes the root directory fingerprint information and sub-directory fingerprint information of each open source project; The method further comprises: Compare the root directory fingerprint information of the project to be detected with the root directory fingerprint information of each open source project to obtain a first comparison result; When the first comparison result is inconsistent, the root directory fingerprint information of the project to be detected is compared with the sub-directory fingerprint information of each open source project to obtain a second comparison result; When the second comparison result is inconsistent, the sub-directory fingerprint information of the project to be detected is compared with the root directory fingerprint information of each open source project to obtain a third comparison result; When the third comparison result is inconsistent, it is determined that the directory fingerprint information of the project to be detected fails to match the directory fingerprint information of each open source project; When the first comparison result, the second comparison result, or the third comparison result is consistent, it is determined that the directory fingerprint information of the project to be detected successfully matches the directory fingerprint information of the at least one open source project.

[0010] In the above implementation process, under the premise that the directory fingerprint information of the project includes the root directory fingerprint information and the sub-directory fingerprint information, the root directory fingerprint information of the project to be detected is compared with the root directory fingerprint information of each open source project, the root directory fingerprint information of the project to be detected is compared with the sub-directory fingerprint information of each open source project, and the sub-directory fingerprint information of the project to be detected is compared with the root directory fingerprint information of each open source project. All comparison results are combined to determine the directory-level matching result between the project to be detected and each open source project, which can effectively judge the complex association relationship between different projects, ensure that the open source projects and components most similar to the project to be detected are matched, and help to further improve the SCA detection efficiency.

[0011] Further, the evaluating the similarity between the project to be detected and each target open source project according to the matching result of the file fingerprint information of the project to be detected and the file fingerprint information of each target open source project in the open source project library, and the matching result of the file attribute information of the project to be detected and the file attribute information of each target open source project, includes: For each target open source project in the open source project library, evaluating a first similarity between the project to be detected and the target open source project according to a matching result between the file fingerprint information of the project to be detected and the file fingerprint information of the target open source project; According to a matching result between the file attribute information of the project to be detected and the file attribute information of the target open source project, evaluating a second similarity between the project to be detected and the target open source project; The similarity between the project to be detected and the target open source project is determined according to a first similarity between the project to be detected and the target open source project and a second similarity between the project to be detected and the target open source project.

[0012] In the above implementation process, by first separately evaluating the first similarity between the project to be detected and the target open source project according to the matching result based on the file fingerprint information, and separately evaluating the second similarity between the project to be detected and the target open source project according to the matching result based on the file attribute information, and then comprehensively evaluating the similarity between the project to be detected and the target open source project according to the first similarity and the second similarity, it is possible to ensure accurate evaluation of the similarity between the project to be detected and the target open source project, which is conducive to further improving the SCA detection accuracy.

[0013] Further, the file fingerprint information of the project to be detected includes the hash fingerprint and simhash fingerprint of each code file in the project to be detected, and the file fingerprint information of the target open source project includes the hash fingerprint and simhash fingerprint of each code file in the target open source project; Before evaluating the first similarity between the project to be detected and the target open source project according to the matching result of the file fingerprint information of the project to be detected and the file fingerprint information of the target open source project, the method further includes: Compare the hash fingerprint of each code file in the project to be detected with the hash fingerprint of each code file in the target open source project, and obtain a comparison result of the hash fingerprint of each code file in the project to be detected with the hash fingerprint of each code file in the target open source project; The simhash fingerprint of each first target code file in the project to be detected is compared with the simhash fingerprint of each code file in the target open source project respectively, and a secondary comparison result of the simhash fingerprint of each first target code file in the project to be detected and the simhash fingerprint of each code file in the target open source project is obtained; wherein the hash fingerprint of the first target code file is inconsistent with the hash fingerprint of each code file in the target open source project; According to the first comparison result and the second comparison result, a matching result between the file fingerprint information of the project to be detected and the file fingerprint information of the target open source project is determined.

[0014] In the above implementation process, by comparing the hash fingerprint of each code file in the project to be detected with the hash fingerprint of each code file in the target open source project, a first comparison result of the hash fingerprint of each code file in the project to be detected and the hash fingerprint of each code file in the target open source project is obtained, and the simhash fingerprint of each first target code file in the project to be detected is compared with the simhash fingerprint of each code file in the target open source project, and a second comparison result of the simhash fingerprint of each target code file in the project to be detected and the simhash fingerprint of each code file in the target open source project is obtained. According to the first comparison result and the second comparison result, the matching result based on the file fingerprint information is determined, and the precise matching and approximate matching capabilities of the multi-layer matching strategy can be used to comprehensively and accurately determine the matching result based on the file fingerprint information, so that similar projects and components can be effectively matched even when the project file content is slightly changed, thereby improving the SCA detection accuracy.

[0015] Further, the file attribute information of the project to be detected includes the file type, directory tree level and file size of each code file in the project to be detected, and the file attribute information of the target open source project includes the file type, directory tree level and file size of each code file in the target open source project; Before evaluating the second similarity between the project to be detected and the target open source project according to the matching result of the file attribute information of the project to be detected and the file attribute information of the target open source project, the method further includes: Classify all code files in the project to be detected that have the same file type and the same directory tree level into the same code file set, to obtain a set of all code files in the project to be detected; Classify all code files in the target open source project that have the same file type and directory tree level into the same code file set, to obtain a set of all code files in the target open source project; Determine a first code file set in the project to be detected and a second code file set in the target open source project; wherein the first code file set and the second code file set correspond to the same file type and are located at the same directory tree level; The file size of each first code file in the first code file set is matched with the file size of each second code file in the second code file set to obtain a matching result between the file attribute information of the project to be detected and the file attribute information of the target open source project.

[0016] In the above implementation process, by clustering the various code files in the project to be detected into various code file sets according to the file type and the directory tree level, and clustering the various code files in the target open source project into various code file sets according to the file type and the directory tree level, the file sizes of the same type of code files in the project to be detected and the target open source project are matched to obtain a matching result based on the file attribute information, which can ensure that the matching result based on the file attribute information accurately reflects the file attribute similarity between the two projects, so that similar projects and components can be effectively matched in cases such as project structure adjustment, thereby improving the SCA detection accuracy.

[0017] Furthermore, the file size of each first code file in the first code file set is matched with the file size of each second code file in the second code file set to obtain a matching result between the file attribute information of the project to be detected and the file attribute information of the target open source project, including: Traversing each first code file in the first code file set and traversing each second code file in the second code file set in ascending order of file size; Compare the file size of the current first code file with the file size of the current second code file to obtain a difference between the file size of the current first code file and the file size of the current second code file; If the difference does not satisfy a preset difference condition, determining a second target code file having a smaller file size between the current first code file and the current second code file, and updating the second target code file to a next code file traversed from a code file set corresponding to the second target code file, so as to re-compare and obtain a new difference; When the difference or the new difference satisfies the preset difference condition, continue traversing the next first code file in the first code file set and traversing the next code file in the second code file set for comparison until all code files in the first code file set and the second code file set have been compared; According to the comparison result between all the first code file sets in the project to be detected and all the second code file sets in the target open source project, a matching result between the file attribute information of the project to be detected and the file attribute information of the target open source project is determined.

[0018] In the above implementation process, the file sizes of similar code files in the project to be detected and the target open source project are matched one by one in ascending order of file size, and matching results based on file attribute information are obtained. This can ensure that the open source projects and components most similar to the project to be detected are matched, which is conducive to further improving the SCA detection accuracy.

[0019] Further, the first similarity between the project to be detected and the target open source project is determined according to the number of code files in the project to be detected, the number of code files in the target open source project, and the number of code files whose file fingerprint information in the project to be detected successfully matches the file fingerprint information in the target open source project; The second similarity between the project to be detected and the target open source project is determined based on the number of code files in the project to be detected, the number of code files in the target open source project, and the number of code files whose file attribute information in the project to be detected successfully matches the file attribute information of the target open source project.

[0020] In the above implementation process, the first similarity between the project to be detected and the target open source project is determined according to the number of code files in the project to be detected, the number of code files in the target open source project, and the number of code files whose file fingerprint information in the project to be detected successfully matches the file fingerprint information of the target open source project; the second similarity between the project to be detected and the target open source project is determined according to the number of code files in the project to be detected, the number of code files in the target open source project, and the number of code files whose file attribute information in the project to be detected successfully matches the file attribute information of the target open source project. The first similarity and the second similarity between the project to be detected and the target open source project can be quickly and accurately evaluated.

[0021] Furthermore, the preset project similarity condition includes that the similarity between the project to be detected and the target open source project is greater than a preset project similarity threshold.

[0022] In the above implementation process, whether the project to be detected is similar to the target open source project is determined by determining whether the similarity between the project to be detected and the target open source project is greater than a preset project similarity threshold, so that open source projects and components similar to the project to be detected can be quickly and accurately determined.

[0023] In a second aspect, an embodiment of the present application provides an SCA detection device based on project similarity, comprising: A project matching module, configured to evaluate the similarity between the project to be detected and each target open source project according to the matching results of the file fingerprint information of the project to be detected and the file fingerprint information of each target open source project in the open source project library, and the matching results of the file attribute information of the project to be detected and the file attribute information of each target open source project, if the directory fingerprint information of the project to be detected fails to match the directory fingerprint information of each open source project in the open source project library; An SCA detection module, configured to determine the component version corresponding to the at least one target open source project as the component version corresponding to the project to be detected when the similarity between the project to be detected and at least one target open source project in the open source project library meets a preset project similarity condition; The SCA detection module is further configured to determine the component version corresponding to the at least one open source project as the component version corresponding to the project to be detected when the directory fingerprint information of the project to be detected successfully matches the directory fingerprint information of at least one open source project in the open source project library.

[0024] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; when the processor executes the computer program, the method described above is implemented.

[0025] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored computer program; wherein, when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the method described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0027] Figure 1 A schematic diagram of a flow chart of a SCA detection method based on project similarity provided in the first embodiment of the present application; Figure 2 A schematic diagram of the relationship between open source projects and components exemplified in the first embodiment of the present application; Figure 3 A data flow diagram of a SCA detection method based on project similarity provided in the first embodiment of the present application; Figure 4A schematic diagram of the structure of a SCA detection device based on project similarity provided in the second embodiment of the present application; Figure 5 A schematic diagram of the structure of an electronic device provided in the third embodiment of the present application. DETAILED DESCRIPTION

[0028] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0029] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0030] Software Composition Analysis (SCA) is a technology used to identify and analyze software internal components and their relationships.

[0031] In the related art, the traditional software component analysis method mainly relies on precise hash algorithms such as MD5 (Message-Digest Algorithm 5) or SHA1 (Secure Hash Algorithm 1) to generate file hash values ​​and file tree hash values ​​of the project to be detected, and compares the file hash values ​​and file tree hash values ​​of the project to be detected with the file hash values ​​and file tree hash values ​​of known open source projects to determine one or more known open source projects similar to the project to be detected, and then further determine the open source components used by the project to be detected based on these known open source projects.

[0032] In the actual development process, the code of the open source components used by the project to be tested often changes. Changes to the file content and file tree structure of the project to be tested will cause large changes in the hash value, which can easily miss the match of similar projects and components, resulting in low SCA efficiency.

[0033] To this end, the present application proposes an SCA detection method based on project similarity. When the directory fingerprint information of the project to be detected fails to match the directory fingerprint information of each open source project in the open source project library, the project similarity between the project to be detected and each target open source project is evaluated according to the matching results of the file fingerprint information of the project to be detected and the file fingerprint information of each target open source project in the open source project library, and the matching results of the file attribute information of the project to be detected and the file attribute information of each target open source project. When the project similarity between the project to be detected and at least one target open source project meets the preset project similarity condition, or the directory fingerprint information of the project to be detected successfully matches the directory fingerprint information of at least one open source project, the component version corresponding to this part of the known open source projects is determined as the component version corresponding to the project to be detected. The similarity between the two projects can be comprehensively evaluated from multiple aspects such as the directory tree structure similarity at the directory level, the file content similarity at the file level, and the file attribute similarity, and the similarity of the similar projects of the project to be detected is accurately determined, and the component version corresponding to the similar project is determined as the component version corresponding to the project to be detected, so that similar projects and components can be effectively matched even when the project directory tree structure is adjusted or the file content is changed, thereby improving the SCA detection efficiency and detection accuracy.

[0034] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments.

[0035] Combine the following Figure 1 An SCA detection method based on project similarity according to an embodiment of the present application is described. The method provided in the embodiment of the present application can be executed by a related terminal device, and the following description is made by taking a user terminal as an example of the execution subject.

[0036] Please see Figure 1 , Figure 1 The first embodiment of the present application provides a SCA detection method based on project similarity, including steps S101 to S103: S101. When the directory fingerprint information of the project to be detected fails to match the directory fingerprint information of each open source project in the open source project library, the similarity between the project to be detected and each target open source project is evaluated based on the matching results of the file fingerprint information of the project to be detected and the file fingerprint information of each target open source project in the open source project library, and the matching results of the file attribute information of the project to be detected and the file attribute information of each target open source project; S102: when the similarity between the project to be detected and at least one target open source project in the open source project library meets a preset project similarity condition, determine the component version corresponding to the at least one target open source project as the component version corresponding to the project to be detected; S103: When the directory fingerprint information of the project to be detected successfully matches the directory fingerprint information of at least one open source project in the open source project library, determine the component version corresponding to the at least one open source project as the component version corresponding to the project to be detected.

[0037] As an example, multiple known open source projects are collected in advance to establish an open source project library. When it is necessary to perform SCA detection on an unknown open source project, i.e., a project to be detected, the directory fingerprint information, file fingerprint information, and file attribute information of the project to be detected are obtained, and the directory fingerprint information, file fingerprint information, and file attribute information of each open source project in the open source project library are obtained.

[0038] Among them, the directory fingerprint information of the project to be detected is the directory hash value of the directory tree of the project to be detected generated by the hash algorithm, specifically, the file hash values ​​of all code files under the directory tree of the project to be detected are sorted in the order of file hash values ​​from large to small or small to large, and the obtained file hash value sequence is calculated by the hash algorithm, the file fingerprint information of the project to be detected includes the file hash value of each code file in the project to be detected generated by the hash algorithm, and the file attribute information of the project to be detected includes the file attribute information of each code file in the project to be detected, which is used to indicate the file attribute. Similarly, the directory fingerprint information of the open source project is the directory hash value of the directory tree of the open source project generated by the hash algorithm, specifically, the file hash values ​​of all code files under the directory tree of the open source project are sorted in the order of file hash values ​​from large to small or small to large, and the obtained file hash value sequence is calculated by the hash algorithm, the file fingerprint information of the open source project includes the file hash value of each code file in the open source project generated by the hash algorithm, and the file attribute information of the open source project includes the file attribute information of each code file in the open source project, which is used to indicate the file attribute.

[0039] After obtaining the directory fingerprint information of the project to be detected and the directory fingerprint information of each open source project, the directory fingerprint information of the project to be detected is matched with the directory fingerprint information of each open source project to obtain a matching result of the directory fingerprint information of the project to be detected and the directory fingerprint information of each open source project.

[0040] In the case where the directory fingerprint information of the project to be detected fails to match the directory fingerprint information of each open source project, it is considered that the directory tree of the project to be detected is not related to the directory tree of each open source project. From the directory level, there is no association relationship between the detection project and the open source projects. At this time, the file-level project matching continues. After obtaining the file fingerprint information and file attribute information of the project to be detected, as well as the file fingerprint information and file attribute information of each target open source project in the open source project library, firstly, the file fingerprint information of the project to be detected is matched with the file fingerprint information of each target open source project to obtain the matching result of the file fingerprint information of the project to be detected and the file fingerprint information of each target open source project, and the file attribute information of the project to be detected is matched with the file attribute information of each target open source project to obtain the matching result of the file attribute information of the project to be detected and the file attribute information of each target open source project. Then, according to the matching result of the file fingerprint information of the project to be detected and the file fingerprint information of each target open source project in the open source project library, as well as the matching result of the file attribute information of the project to be detected and the file attribute information of each target open source project, the similarity between the project to be detected and each target open source project is evaluated. Finally, it is determined whether the similarity between the project to be detected and each target open source project meets the preset project similarity condition.

[0041] It should be noted that the target open source project can be any open source project in the open source project library, or it can be a specified open source project in the open source project library.

[0042] When the similarity between the project to be detected and at least one target open source project meets the preset project similarity condition, it is considered that although there is no association between the detection project and this part of the target open source projects at the directory level, the detection project is similar to this part of the target open source projects at the file level. At this time, the component version corresponding to this part of the target open source projects is determined, and the component version corresponding to this part of the target open source projects is used as the component version corresponding to the project to be detected, thereby completing the matching of similar components of the project to be detected.

[0043] When the similarity between the project to be detected and each target open source project does not meet the preset project similarity condition, it is considered that there is no association between the detection project and each target open source project at the directory level, and the detection project is not similar to each target open source project at the file level. At this time, it can be determined that there are no similar projects and components of the project to be detected in the open source project library.

[0044] When the directory fingerprint information of the project to be detected successfully matches the directory fingerprint information of at least one open source project, it is considered that the directory tree of the project to be detected is related to the directory tree of this part of the open source projects. From the directory level, there is an association between the detection project and this part of the open source projects. At this time, the component version corresponding to this part of the open source projects is determined, and the component version corresponding to this part of the open source projects is used as the component version corresponding to the project to be detected, thereby completing the matching of similar components of the project to be detected.

[0045] By first performing directory-level project matching between the project to be detected and each open source project, and then performing file-level project matching between the project to be detected and each target open source project when the directory-level project matching fails, the impact of the directory tree structure adjustment and file content change of the project to be detected on the project matching can be fully considered, and the similarity between the project to be detected and the known open source projects can be fully and accurately captured. In addition, in the file-level project matching process, in addition to project matching based on file fingerprint information, file attribute information is also introduced for project matching. The similarity between the project to be detected and the known open source projects is comprehensively evaluated based on the matching results based on file fingerprint information and the matching results based on file attribute information. The similarity between the project to be detected and the known open source projects can be accurately captured even when the contents of a large number of files in the project to be detected are changed, so that similar projects and components can be effectively matched even when the project directory tree structure is adjusted or the file content is changed, thereby improving the SCA detection efficiency and detection accuracy.

[0046] In the embodiment of the present application, when the directory fingerprint information of the project to be detected fails to match the directory fingerprint information of each open source project in the open source project library, the project similarity between the project to be detected and each target open source project is evaluated according to the matching results of the file fingerprint information of the project to be detected and the file fingerprint information of each target open source project in the open source project library, and the matching results of the file attribute information of the project to be detected and the file attribute information of each target open source project. When the project similarity between the project to be detected and at least one target open source project meets the preset project similarity condition, or the directory fingerprint information of the project to be detected successfully matches the directory fingerprint information of at least one open source project, the component versions corresponding to these part of the known open source projects are determined as the component versions corresponding to the project to be detected. The similarity between the two projects can be comprehensively evaluated from multiple aspects such as the directory tree structure similarity at the directory level, and the file content similarity and file attribute similarity at the file level, and the similarity of the project to be detected can be accurately determined, and the component versions corresponding to the similar projects are determined as the component versions corresponding to the project to be detected, so that similar projects and components can be effectively matched even when the project directory tree structure is adjusted or the file content is changed, thereby improving the SCA detection efficiency and detection accuracy.

[0047] In an optional embodiment, the similarity between the project fingerprint information of each target open source project and the project fingerprint information of the project to be detected satisfies a preset project fingerprint similarity condition.

[0048] As an example, considering the large number of open source projects in the open source project library, in order to further improve the SCA detection efficiency, open source projects that may be similar to the project to be detected can be preliminarily screened out from the open source project library as target open source projects for file-level project matching.

[0049] Determine the preset project fingerprint similarity conditions based on actual application requirements.

[0050] Obtain the project fingerprint information of the project to be detected, and obtain the project fingerprint information of each open source project in the open source project library.

[0051] The project fingerprint information of the project to be detected is a vector generated according to the file fingerprint information of the project to be detected. Similarly, the project fingerprint information of the open source project is a vector generated according to the file fingerprint information of the open source project.

[0052] For each open source project in the open source project library, evaluate the similarity between the project fingerprint information of the project to be detected and the project fingerprint information of the open source project, and determine whether the similarity meets the preset project fingerprint similarity condition. If the similarity meets the preset project fingerprint similarity condition, it is considered that at least part of the code files in the open source project are similar to at least part of the code files in the project to be detected, and the possibility that the open source project is similar to the project to be detected is high. At this time, the open source project is determined as the target open source project; if the similarity does not meet the preset project fingerprint similarity condition, it is considered that the possibility that the open source project is similar to the project to be detected is low, and no processing is performed.

[0053] In a preferred implementation of this embodiment, the open source project library stores project information of multiple open source projects; wherein the project information of the open source projects includes project fingerprint information, directory fingerprint information, file fingerprint information and file attribute information of the open source projects, as well as component versions corresponding to the open source projects.

[0054] As an exemplary example, in order to quickly obtain the project information of the open source projects required in the SCA detection process, the project information of multiple open source projects can be stored in the open source project library at the stage of establishing the open source project library.

[0055] The project information of the open source project includes the project fingerprint information, directory fingerprint information, file fingerprint information and file attribute information of the open source project, as well as the component version corresponding to the open source project.

[0056] In actual applications, multiple open source projects can be crawled from the Internet. Each open source project is divided into multiple project versions. Its version information includes directory tree, number of files and commit information, as well as common home_url, doc_url, source_url, repo_url, homepage, forks_count, project description and license information, to obtain all project versions of the open source project and their version information. For each project version of an open source project, the component and component version corresponding to the project version are determined according to the version information of the project version. For example, the component version with the same component version number as the project version number of the project version is determined as the component version corresponding to the project version, or, when the home_url, doc_url and repo_url in the version information of the component version is consistent with the home_url, doc_url and repo_url in the version information of the project version, the component version is determined as the component version corresponding to the project version, and according to the component versions corresponding to each project version of the open source project, the component versions corresponding to the open source project are sorted out, thereby obtaining the component versions corresponding to multiple open source projects. For example, the relationship between an open source project and a component is as follows: Figure 2 shown.

[0057] For each open source project, each code file in the open source project is preprocessed, where the preprocessing includes file filtering, for example, filtering out code files with a file size smaller than a preset file size, such as 100 bytes, and special files such as hidden files, using a hash algorithm to generate a file hash value for each preprocessed code file in the open source project, determining the file attributes of each preprocessed code file in the open source project, and generating a vector based on the file hash value of each preprocessed code file in the open source project, using a hash algorithm to generate a directory hash value of the directory tree of the open source project, thereby building an open source project library.

[0058] In an optional implementation of this embodiment, the preset project fingerprint similarity condition includes that the similarity between the project fingerprint information of the project to be detected and the project fingerprint information of the open source project is greater than a preset project fingerprint similarity threshold.

[0059] The embodiment of the present application screens at least one target open source project from the open source project library. The similarity between the project fingerprint information of each target open source project and the project fingerprint information of the project to be detected meets the preset project fingerprint similarity condition. The target open source projects that may be similar to the project to be detected can be pre-selected for file-level project matching, and similar projects of the project to be detected can be determined more quickly and accurately, which is conducive to further improving the SCA detection efficiency.

[0060] In an optional embodiment, the directory fingerprint information of the project to be detected includes the root directory fingerprint information and sub-directory fingerprint information of the project to be detected, and the directory fingerprint information of each open source project includes the root directory fingerprint information and sub-directory fingerprint information of each open source project; The method further comprises steps S104 to S106: S104, comparing the root directory fingerprint information of the project to be detected with the root directory fingerprint information of each open source project to obtain a first comparison result; S105. When the first comparison result is inconsistent, compare the fingerprint information of the root directory of the project to be detected with the fingerprint information of the subdirectories of each open source project to obtain a second comparison result; S106. When the second comparison result is inconsistent, the sub-directory fingerprint information of the project to be detected is compared with the root directory fingerprint information of each open source project to obtain a third comparison result; S107: If the third comparison result is inconsistent, it is determined that the directory fingerprint information of the project to be detected fails to match the directory fingerprint information of each open source project; S108: When the first comparison result, the second comparison result, or the third comparison result is consistent, determine that the directory fingerprint information of the project to be detected successfully matches the directory fingerprint information of at least one open source project.

[0061] As an example, the directory fingerprint information of the project to be detected includes the root directory fingerprint information and sub-directory fingerprint information of the project to be detected. Similarly, the directory fingerprint information of each open source project in the open source project library includes the root directory fingerprint information and sub-directory fingerprint information of each open source project.

[0062] Under this premise, considering that from the directory level, different open source projects may have complex association relationships such as being the same, being included, or containing, and it is necessary to prioritize matching the same projects and application requirements of components of the project to be detected, the root directory fingerprint information of the project to be detected is compared with the root directory fingerprint information of each open source project to obtain a first comparison result. If the root directory fingerprint information of the project to be detected is inconsistent with the root directory fingerprint information of each open source project, the first comparison result is inconsistent. If the root directory fingerprint information of the project to be detected is consistent with the root directory fingerprint information of at least one open source project, the first comparison result is consistent.

[0063] When the first comparison result is inconsistent, the root directory fingerprint information of the project to be detected continues to be compared with the sub-directory fingerprint information of each open source project to obtain a second comparison result. If the root directory fingerprint information of the project to be detected is inconsistent with the sub-directory fingerprint information of each open source project, the second comparison result is inconsistent. If the root directory fingerprint information of the project to be detected is consistent with the sub-directory fingerprint information of at least one open source project, the second comparison result is consistent.

[0064] When the second comparison result is inconsistent, continue to compare the sub-directory fingerprint information of the project to be detected with the root directory fingerprint information of each open source project to obtain a third comparison result. If the sub-directory fingerprint information of the project to be detected is inconsistent with the root directory fingerprint information of each open source project, the third comparison result is inconsistent. If the sub-directory fingerprint information of the project to be detected is consistent with the root directory fingerprint information of at least one open source project, the third comparison result is consistent.

[0065] When the third comparison result is inconsistent, it is determined that the directory fingerprint information of the project to be detected fails to match the directory fingerprint information of each open source project.

[0066] When the first comparison result, the second comparison result, or the third comparison result is consistent, it is determined that the directory fingerprint information of the project to be detected successfully matches the directory fingerprint information of at least one open source project.

[0067] It can be understood that if the first comparison result is a consistency, that is, the root directory fingerprint information of the project to be detected is consistent with the root directory fingerprint information of at least one open source project, then it is considered that the project to be detected and this part of the open source projects are the same project, and the directory fingerprint information of the project to be detected matches the directory fingerprint information of this part of the open source projects successfully; if the second comparison result is a consistency, that is, the root directory fingerprint information of the project to be detected is consistent with the sub-directory fingerprint information of at least one open source project, then it is considered that the project to be detected belongs to each open source project in this part of the open source projects, and the directory fingerprint information of the project to be detected matches the directory fingerprint information of this part of the open source projects successfully; if the third comparison result is a consistency, that is, the sub-directory fingerprint information of the project to be detected is the same as the root directory fingerprint information of at least one open source project, then it is considered that the project to be detected includes each open source project in this part of the open source projects, and the directory fingerprint information of the project to be detected matches the directory fingerprint information of this part of the open source projects successfully; if the first comparison result, the second comparison result and the third comparison result are inconsistent, then it is considered that there is no association between the detection project and the various open source projects from the directory level, and the directory fingerprint information of the project to be detected fails to match the directory fingerprint information of the various open source projects.

[0068] The embodiment of the present application, under the premise that the directory fingerprint information of the project includes root directory fingerprint information and sub-directory fingerprint information, sequentially compares the root directory fingerprint information of the project to be detected with the root directory fingerprint information of each open source project, compares the root directory fingerprint information of the project to be detected with the sub-directory fingerprint information of each open source project, and compares the sub-directory fingerprint information of the project to be detected with the root directory fingerprint information of each open source project, and comprehensively determines the directory-level matching result between the project to be detected and each open source project based on all the comparison results. This can effectively judge the complex association relationship between different projects, ensure that the open source projects and components most similar to the project to be detected are matched, and help to further improve the SCA detection efficiency.

[0069] In an optional embodiment, the similarity between the project to be detected and each target open source project is evaluated based on the matching results of the file fingerprint information of the project to be detected and the file fingerprint information of each target open source project in the open source project library, as well as the matching results of the file attribute information of the project to be detected and the file attribute information of each target open source project, including: for each target open source project in the open source project library, evaluating the first similarity between the project to be detected and the target open source project based on the matching results of the file fingerprint information of the project to be detected and the file fingerprint information of the target open source project; evaluating the second similarity between the project to be detected and the target open source project based on the matching results of the file attribute information of the project to be detected and the file attribute information of the target open source project; determining the similarity between the project to be detected and the target open source project based on the first similarity between the project to be detected and the target open source project, and the second similarity between the project to be detected and the target open source project.

[0070] As an example, after obtaining the matching results of the file fingerprint information of the project to be detected and the file fingerprint information of each target open source project, as well as the matching results of the file attribute information of the project to be detected and the file attribute information of each target open source project, for each target open source project, the first similarity between the project to be detected and the target open source project is evaluated based on the matching results of the file fingerprint information of the project to be detected and the file fingerprint information of the target open source project, and the second similarity between the project to be detected and the target open source project is evaluated based on the matching results of the file attribute information of the project to be detected and the file attribute information of the target open source project, and then the similarity between the project to be detected and the target open source project is determined based on the first similarity between the project to be detected and the target open source project, thereby obtaining the similarity between the project to be detected and each target open source project.

[0071] In practical applications, a weight for the first similarity and a weight for the second similarity may be preset, and the first similarity and the second similarity may be weighted and summed according to the weight of the first similarity and the weight of the second similarity to obtain the overall similarity.

[0072] The embodiment of the present application first separately evaluates the first similarity between the project to be detected and the target open source project according to the matching result based on the file fingerprint information, and separately evaluates the second similarity between the project to be detected and the target open source project according to the matching result based on the file attribute information, and then comprehensively evaluates the similarity between the project to be detected and the target open source project according to the first similarity and the second similarity, thereby ensuring accurate evaluation of the similarity between the project to be detected and the target open source project, which is conducive to further improving the SCA detection accuracy.

[0073] In an optional embodiment, the file fingerprint information of the project to be detected includes hash fingerprints and simhash fingerprints of each code file in the project to be detected, and the file fingerprint information of the target open source project includes hash fingerprints and simhash fingerprints of each code file in the target open source project; before evaluating the first similarity between the project to be detected and the target open source project according to the matching result of the file fingerprint information of the project to be detected and the file fingerprint information of the target open source project, it also includes: comparing the hash fingerprint of each code file in the project to be detected with the hash fingerprint of each code file in the target open source project, and obtaining a primary comparison result of the hash fingerprint of each code file in the project to be detected and the hash fingerprint of each code file in the target open source project; comparing the simhash fingerprint of each first target code file in the project to be detected with the simhash fingerprint of each code file in the target open source project, and obtaining a secondary comparison result of the simhash fingerprint of each first target code file in the project to be detected and the simhash fingerprint of each code file in the target open source project; wherein the hash fingerprint of the first target code file is inconsistent with the hash fingerprint of each code file in the target open source project; and determining the matching result of the file fingerprint information of the project to be detected and the file fingerprint information of the target open source project according to the primary comparison result and the secondary comparison result.

[0074] As an example, an accurate hash algorithm is used to obtain the hash fingerprint of each code file in the project to be detected, and a simhash algorithm is used to obtain the simhash fingerprint of each code file in the project to be detected, so that the file fingerprint information of the project to be detected includes the hash fingerprint and simhash fingerprint of each code file in the project to be detected. Similarly, for each target open source project, an accurate hash algorithm is used to obtain the hash fingerprint of each code file in the target open source project, and a simhash algorithm is used to obtain the simhash fingerprint of each code file in the target open source project, so that the file fingerprint information of the target open source project includes the hash fingerprint and simhash fingerprint of each code file in the target open source project.

[0075] For each code file in the project to be detected, the hash fingerprint of the current code file is compared with the hash fingerprints of each code file in the target open source project to obtain a comparison result of the hash fingerprint of the current code file and the hash fingerprint of each code file in the target open source project. Among them, the comparison result of the hash fingerprint of the current code file and the hash fingerprint of each code file in the target open source project is: the comparison is consistent or the comparison is inconsistent.

[0076] If the hash fingerprint of the current code file is consistent with the hash fingerprint of at least one code file in the target open source project, the current code file is considered to be the same file as this part of the code file. At this time, it is determined that the file fingerprint information of the current code file successfully matches the file fingerprint information of the target open source project.

[0077] If the hash fingerprint of the current code file is inconsistent with the hash fingerprint of each code file in the target open source project, it is considered that the current code file and each code file in the target open source project are different files. At this time, the current code file is determined to be the first target code file, and the simhash fingerprint of the first target code file is continued to be compared with the simhash fingerprint of each code file in the target open source project to obtain a secondary comparison result of the simhash fingerprint of the first target code file and the simhash fingerprint of each code file in the target open source project. Among them, the secondary comparison result of the simhash fingerprint of the first target code file and the simhash fingerprint of each code file in the target open source project is: whether the Hamming distance between the simhash fingerprint of the first target code file and the simhash fingerprint of each code file in the target open source project is less than a preset Hamming distance threshold.

[0078] If the Hamming distance between the simhash fingerprint of the first target code file and the simhash fingerprint of at least one code file in the target open source project is less than a preset Hamming distance threshold, the first target code file and this part of the code files are considered to be similar files. At this time, it is determined that the file fingerprint information of the first target code file matches the file fingerprint information of the target open source project successfully.

[0079] If the Hamming distance between the simhash fingerprint of the first target code file and the simhash fingerprints of each code file in the target open source project is greater than or equal to the preset Hamming distance threshold, it is considered that the current first target code file and the code files in the target open source project are not similar files. At this time, it is determined that the file fingerprint information of the first target code file fails to match the file fingerprint information of the target open source project.

[0080] According to the first comparison result and the second comparison result obtained in the above comparison process, the matching result between the file fingerprint information of the project to be detected and the file fingerprint information of the target open source project is determined.

[0081] By adopting a multi-layer matching strategy of hash fingerprint and simhash fingerprint to perform project matching based on file fingerprint information, the precise matching and approximate matching capabilities of the multi-layer matching strategy can be utilized to comprehensively and accurately determine the matching results based on file fingerprint information, ensuring that the similarity of file fingerprint information between the project to be detected and the known open source project is accurately captured when the project file content is slightly changed, effectively avoiding the problem of missing detection caused by slight changes in the project file content, and improving the SCA detection accuracy.

[0082] The embodiment of the present application compares the hash fingerprint of each code file in the project to be detected with the hash fingerprint of each code file in the target open source project, obtains a primary comparison result of the hash fingerprint of each code file in the project to be detected and the hash fingerprint of each code file in the target open source project, compares the simhash fingerprint of each first target code file in the project to be detected with the simhash fingerprint of each code file in the target open source project, obtains a secondary comparison result of the simhash fingerprint of each target code file in the project to be detected and the simhash fingerprint of each code file in the target open source project, determines a matching result based on the file fingerprint information according to the primary comparison result and the secondary comparison result, and can use the precise matching and approximate matching capabilities of the multi-layer matching strategy to comprehensively and accurately determine the matching result based on the file fingerprint information, so that similar projects and components can be effectively matched even when the project file content is slightly changed, thereby improving the SCA detection accuracy.

[0083] In an optional embodiment, the file attribute information of the project to be detected includes the file type, the directory tree level and the file size of each code file in the project to be detected, and the file attribute information of the target open source project includes the file type, the directory tree level and the file size of each code file in the target open source project; before evaluating the second similarity between the project to be detected and the target open source project according to the matching result of the file attribute information of the project to be detected and the file attribute information of the target open source project, it also includes: dividing all code files with the same file type and directory tree level in the project to be detected into the same code file set to obtain the set of all code files in the project to be detected; dividing all code files with the same file type and directory tree level in the target open source project into the same code file set to obtain the set of all code files in the target open source project; determining a first code file set in the project to be detected and a second code file set in the target open source project; wherein the first code file set and the second code file set correspond to the same file type and the same directory tree level; respectively matching the file size of each first code file in the first code file set with the file size of each second code file in the second code file set to obtain the matching result of the file attribute information of the project to be detected and the file attribute information of the target open source project.

[0084] Exemplarily, the file attribute information of the project to be detected includes the file type, directory tree level and file size of each code file in the project to be detected. Similarly, for each target open source project, the file attribute information of the target open source project includes the file type, directory tree level and file size of each code file in the target open source project.

[0085] Under this premise, each code file in the two projects, the project to be detected and the target open source project, is clustered according to the file type and the directory tree level. Specifically, all code files with the same file type and directory tree level in the project to be detected are divided into the same code file set to obtain the set of all code files in the project to be detected, and all code files with the same file type and directory tree level in the target open source project are divided into the same code file set to obtain the set of all code files in the target open source project.

[0086] For each combination of a file type and a directory tree level, a code file set corresponding to the file type and the directory tree level is selected from each code file set in the project to be detected as a first code file set, and a code file set corresponding to the file type and the directory tree level is selected from each code file set in the target open source project as a second code file set. It can be understood that the first code file set and the second code file set correspond to the same file type and the same directory tree level.

[0087] For each first code file in the first code file set, the file size of the current first code file is matched with the file size of each second code file in the second code file set. If the file size of the current first code file successfully matches the file size of at least one second code file in the second code file set, it is considered that the current first code file and this part of the second code files are similar files. At this time, it is determined that the file attribute information of the current first code file matches the file attribute information of the target open source project successfully; if the file size of the current first code file fails to match the file size of each second code file in the second code file set, it is considered that the current first code file and the second code files in the second code file set are different files. At this time, it is determined that the file attribute information of the current first code file fails to match the file attribute information of the target open source project, thereby obtaining a matching result between the file attribute information of the project to be detected and the file attribute information of the target open source project.

[0088] It should be noted that if there is a first code file set in the project to be detected that corresponds to a certain file type and a certain directory tree level, and there is no second code file set corresponding to the file type and the directory tree level in the target open source project, then it can be directly determined that the file attribute information of each first code file in the first code file set fails to match the file attribute information of the target open source project.

[0089] Project matching is performed by introducing file attribute information such as file type, directory tree level and file size. In the process of project matching based on file attribute information, the code files in the project are first clustered into code file sets according to the file type and the directory tree level, and then the file sizes of the same code files in the two projects are matched to obtain the matching results based on the file attribute information. This can ensure that the matching results based on the file attribute information accurately reflect the file attribute similarity between the two projects, so that when the structure of the project to be detected is adjusted, the similarity between the project to be detected and the known open source project can still be accurately captured, so that similar projects and components can be effectively matched in the case of project structure adjustment, thereby improving the SCA detection accuracy.

[0090] The embodiment of the present application clusters each code file in the project to be detected into each code file set according to the file type and the directory tree level, clusters each code file in the target open source project into each code file set according to the file type and the directory tree level, matches the file sizes of the same type of code files in the project to be detected and the target open source project, and obtains a matching result based on the file attribute information. It can ensure that the matching result based on the file attribute information accurately reflects the file attribute similarity between the two projects, so that similar projects and components can be effectively matched in situations such as project structure adjustment, thereby improving the SCA detection accuracy.

[0091] In an optional embodiment, the file size of each first code file in the first code file set is matched with the file size of each second code file in the second code file set to obtain a matching result between the file attribute information of the project to be detected and the file attribute information of the target open source project, including: traversing each first code file in the first code file set and traversing each second code file in the second code file set in ascending order of file size; comparing the file size of the current first code file with the file size of the current second code file to obtain the difference between the file size of the current first code file and the file size of the current second code file; and determining, if the difference does not meet a preset difference condition, whether the current first code file and the current second code file are matched. A second target code file with a smaller file size in the file, and updating the second target code file to the next code file traversed from the code file set corresponding to the second target code file, so as to re-compare and obtain a new difference; when the difference or the new difference meets the preset difference condition, continue to traverse the next first code file in the first code file set, and traverse the next code file in the second code file set for comparison, until all code files in the first code file set and the second code file set have been compared. According to the comparison results between all the first code file sets in the project to be detected and all the second code file sets in the target open source project, determine the matching result of the file attribute information of the project to be detected and the file attribute information of the target open source project.

[0092] Exemplarily, after obtaining the first code file set and the second code file set, each first code file in the first code file set and each second code file in the second code file set are traversed in ascending order of file size, that is, in order of file size from small to large, and the file size of the current first code file is compared with the file size of the current second code file to obtain the difference between the file size of the current first code file and the file size of the current second code file.

[0093] When the difference does not meet the preset difference condition, it is considered that the two code files involved in the comparison, that is, the current first code file and the current second code file, are different files. At this time, the code file with the smaller file size between the current first code file and the current second code file is determined as the second target code file, and the second target code file is updated to the next code file traversed from the code file set corresponding to the second target code file, so as to re-compare and obtain a new difference.

[0094] For example, assuming that the file size of the current first code file is smaller and the file size of the current second code file is larger, the current first code file will be updated to the next first code file in the first code file set, and then the file size of the current first code file will be compared with the file size of the current second code file to obtain a new difference.

[0095] When the difference or the new difference meets the preset difference condition, the two code files involved in the comparison are considered to be similar files. At this time, it is determined that the file attribute information of the code file involved in the comparison in the project to be detected (that is, the current first code file or the next first code file in the first code file set) matches the file attribute information of the target open source project successfully, and the next first code file in the first code file set and the next code file in the second code file set are traversed for comparison until all code files in the first code file set and the second code file set have been compared.

[0096] According to this operation, the matching result of the file attribute information of the project to be detected and the file attribute information of the target open source project is determined according to the comparison result between all the first code file sets in the project to be detected and all the second code file sets in the target open source project.

[0097] In an optional implementation of this embodiment, the preset difference condition includes that the difference is less than a preset difference threshold.

[0098] The embodiment of the present application obtains a matching result based on file attribute information by matching the file sizes of similar code files in the project to be detected and the target open source project one by one in ascending order of file size. This can ensure that the open source projects and components most similar to the project to be detected are matched, which is conducive to further improving the SCA detection accuracy.

[0099] In an optional embodiment, the first similarity between the project to be detected and the target open source project is determined based on the number of code files in the project to be detected, the number of code files in the target open source project, and the number of code files whose file fingerprint information in the project to be detected successfully matches the file fingerprint information of the target open source project; the second similarity between the project to be detected and the target open source project is determined based on the number of code files in the project to be detected, the number of code files in the target open source project, and the number of code files whose file attribute information in the project to be detected successfully matches the file attribute information of the target open source project.

[0100] As an example, for each target open source project, after obtaining the matching result of the file fingerprint information of the project to be detected and the file fingerprint information of the target open source project, the number of code files in the project to be detected is counted, the number of code files in the target open source project is counted, and based on the matching result of the file fingerprint information of the project to be detected and the file fingerprint information of the target open source project, the number of code files whose file fingerprint information in the project to be detected and the file fingerprint information of the target open source project are successfully matched are counted, and based on the number of code files in the project to be detected, the number of code files in the target open source project, and the number of code files whose file fingerprint information in the project to be detected and the file fingerprint information of the target open source project are successfully matched, the first similarity between the project to be detected and the target open source project is determined.

[0101] In an optional implementation of the present embodiment, the first similarity between the project to be detected and the target open source project is equal to the ratio of the number of code files whose file fingerprint information in the project to be detected successfully matches the file fingerprint information of the target open source project to the number of target code files; wherein the number of target code files is the minimum value between the number of code files in the project to be detected and the number of code files in the target open source project.

[0102] For example, assuming that the number of code files in the project to be detected is a, the number of code files in the target open source project is b, and the number of code files whose file fingerprint information in the project to be detected successfully matches the file fingerprint information of the target open source project is c, where a, b, and c are all positive integers, and a≥c, then the first similarity between the project to be detected and the target open source project = .

[0103] After obtaining the matching result of the file attribute information of the project to be detected and the file attribute information of the target open source project, the number of code files in the project to be detected, the number of code files in the target open source project, and the number of code files whose file attribute information in the project to be detected successfully matches the file attribute information of the target open source project based on the matching result of the file attribute information of the project to be detected and the file attribute information of the target open source project are counted, and the second similarity between the project to be detected and the target open source project is determined based on the number of code files in the project to be detected, the number of code files in the target open source project, and the number of code files whose file attribute information in the project to be detected successfully matches the file attribute information of the target open source project.

[0104] In an optional implementation of the present embodiment, the second similarity between the project to be detected and the target open source project is equal to the ratio of the number of code files whose file attribute information in the project to be detected successfully matches the file attribute information in the target open source project to the number of target code files; wherein the number of target code files is the minimum value between the number of code files in the project to be detected and the number of code files in the target open source project.

[0105] Assume that the number of code files in the project to be detected is a, the number of code files in the target open source project is b, and the number of code files whose file attribute information in the project to be detected successfully matches the file attribute information of the target open source project is d, where a, b and d are all positive integers, and a≥d, then the second similarity between the project to be detected and the target open source project = .

[0106] The embodiment of the present application determines the first similarity between the project to be detected and the target open source project according to the number of code files in the project to be detected, the number of code files in the target open source project, and the number of code files whose file fingerprint information in the project to be detected successfully matches the file fingerprint information of the target open source project; determines the second similarity between the project to be detected and the target open source project according to the number of code files in the project to be detected, the number of code files in the target open source project, and the number of code files whose file attribute information in the project to be detected successfully matches the file attribute information of the target open source project, so as to quickly and accurately evaluate the first similarity and the second similarity between the project to be detected and the target open source project.

[0107] In an optional embodiment, the preset project similarity condition includes that the similarity between the project to be detected and the target open source project is greater than a preset project similarity threshold.

[0108] As an example, after obtaining the similarity between the project to be detected and each target open source project, the similarity between the project to be detected and each target open source project is compared with a preset project similarity threshold. If the similarity between the project to be detected and any target open source project is greater than the preset project similarity threshold, the project to be detected is considered to be similar to the target open source project. At this time, the component version corresponding to the target open source project is determined, and the component version corresponding to the target open source project is used as the component version corresponding to the project to be detected, thereby completing the matching of similar components of the project to be detected; if the similarity between the project to be detected and each target open source project is less than or equal to the preset project similarity threshold, the project to be detected is considered to be dissimilar to each target open source project. At this time, it can be determined that there are no similar projects and components of the project to be detected in the open source project library.

[0109] In practical applications, in order to preferentially match the open source projects and components that are most similar to the project to be detected, the preset project similarity condition may also be determined to include the similarity between the project to be detected and the target open source project being the maximum value in the project similarity set, wherein the project similarity set includes the similarity between the project to be detected and each target open source project.

[0110] The embodiment of the present application determines whether the project to be detected is similar to the target open source project by determining whether the similarity between the project to be detected and the target open source project is greater than a preset project similarity threshold, and can quickly and accurately determine open source projects and components similar to the project to be detected.

[0111] In order to more clearly illustrate a SCA detection method based on project similarity provided in the first embodiment of the present application, a data flow diagram of applying the SCA detection method based on project similarity is as follows: Figure 3 shown.

[0112] The first embodiment of the present application provides an SCA detection method based on project similarity. For project directory tree structure adjustments, the directory fingerprint information of the two projects is matched first. Since the directory fingerprint information of the project is obtained by sorting the file hash values ​​of each code file under the project's directory tree in sequence according to the file hash value size and hashing, it is possible to eliminate the interference of the project directory tree structure adjustment on the project relationship matching, obtain the project relationship that does not depend on the directory tree structure, and solve the dependency analysis problem between complex projects. For the case of slight changes in the content of the project file, the simhash algorithm is added for matching to ensure that even if the file content is slightly changed, the association between the current version of the project and the original version can be accurately captured. For the case of similar project structures, file attribute information is further introduced to calculate the project similarity, thereby improving the reliability of detection.

[0113] Compared with the traditional SCA solution based on the precise hash algorithm, the embodiment of the present application provides the SCA system with a robust approximate matching capability, which can effectively match similar projects and components even when the project directory tree structure is adjusted or the file content is changed. At the same time, it significantly enhances the SCA system's ability to adapt to dynamic changes in the directory tree structure and complex file structure, provides high-precision matching of large-scale file changes, and provides strong support for software development and compliance management.

[0114] Please see Figure 4 , Figure 4 A structural schematic diagram of an SCA detection device based on project similarity provided for the second embodiment of the present application. The second embodiment of the present application provides an SCA detection device based on project similarity, including: a project matching module 201, which is used to evaluate the similarity between the project to be detected and each target open source project according to the matching results of the file fingerprint information of the project to be detected and the file fingerprint information of each target open source project in the open source project library, and the matching results of the file attribute information of the project to be detected and the file attribute information of each target open source project in the open source project library when the directory fingerprint information of the project to be detected fails to match the directory fingerprint information of each open source project in the open source project library; an SCA detection module 202, which is used to determine the component version corresponding to the at least one target open source project as the component version corresponding to the project to be detected when the similarity between the project to be detected and at least one target open source project in the open source project library meets the preset project similarity condition; the SCA detection module 202 is also used to determine the component version corresponding to the at least one open source project as the component version corresponding to the project to be detected when the directory fingerprint information of the project to be detected matches the directory fingerprint information of at least one open source project in the open source project library successfully.

[0115] In an optional embodiment, the similarity between the project fingerprint information of each target open source project and the project fingerprint information of the project to be detected satisfies a preset project fingerprint similarity condition.

[0116] In an optional embodiment, the directory fingerprint information of the project to be detected includes the root directory fingerprint information and sub-directory fingerprint information of the project to be detected, and the directory fingerprint information of each open source project includes the root directory fingerprint information and sub-directory fingerprint information of each open source project; the project matching module 201 is further used to: compare the root directory fingerprint information of the project to be detected with the root directory fingerprint information of each open source project to obtain a first comparison result; when the first comparison result is inconsistent, compare the root directory fingerprint information of the project to be detected with the sub-directory fingerprint information of each open source project to obtain a second comparison result; when the second comparison result is inconsistent, compare the sub-directory fingerprint information of the project to be detected with the root directory fingerprint information of each open source project to obtain a third comparison result; when the third comparison result is inconsistent, determine that the directory fingerprint information of the project to be detected fails to match the directory fingerprint information of each open source project; when the first comparison result, the second comparison result or the third comparison result is consistent, determine that the directory fingerprint information of the project to be detected matches the directory fingerprint information of at least one open source project successfully.

[0117] In an optional embodiment, the similarity between the project to be detected and each target open source project is evaluated based on the matching results of the file fingerprint information of the project to be detected and the file fingerprint information of each target open source project in the open source project library, as well as the matching results of the file attribute information of the project to be detected and the file attribute information of each target open source project, including: for each target open source project in the open source project library, evaluating the first similarity between the project to be detected and the target open source project based on the matching results of the file fingerprint information of the project to be detected and the file fingerprint information of the target open source project; evaluating the second similarity between the project to be detected and the target open source project based on the matching results of the file attribute information of the project to be detected and the file attribute information of the target open source project; determining the similarity between the project to be detected and the target open source project based on the first similarity between the project to be detected and the target open source project, and the second similarity between the project to be detected and the target open source project.

[0118] In an optional embodiment, the file fingerprint information of the project to be detected includes the hash fingerprint and simhash fingerprint of each code file in the project to be detected, and the file fingerprint information of the target open source project includes the hash fingerprint and simhash fingerprint of each code file in the target open source project; the project matching module 201 is further used to compare the hash fingerprint of each code file in the project to be detected with the hash fingerprint of each code file in the target open source project before evaluating the first similarity between the project to be detected and the target open source project according to the matching result of the file fingerprint information of the project to be detected and the file fingerprint information of the target open source project, so as to obtain the hash fingerprint of each code file in the project to be detected. The simhash fingerprint of each first target code file in the project to be detected is compared with the simhash fingerprint of each code file in the target open source project, and a secondary comparison result of the simhash fingerprint of each first target code file in the project to be detected and the simhash fingerprint of each code file in the target open source project is obtained; wherein, the hash fingerprint of the first target code file is inconsistent with the hash fingerprint of each code file in the target open source project; according to the primary comparison result and the secondary comparison result, the matching result of the file fingerprint information of the project to be detected and the file fingerprint information of the target open source project is determined.

[0119] In an optional embodiment, the file attribute information of the project to be detected includes the file type, the directory tree level and the file size of each code file in the project to be detected, and the file attribute information of the target open source project includes the file type, the directory tree level and the file size of each code file in the target open source project; the project matching module 201 is also used to divide all code files with the same file type and directory tree level in the project to be detected into the same code file set before evaluating the second similarity between the project to be detected and the target open source project based on the matching result of the file attribute information of the project to be detected and the file attribute information of the target open source project, so as to obtain all code files in the project to be detected. A code file set; classify all code files with the same file type and directory tree level in the target open source project into the same code file set to obtain all code file sets in the target open source project; determine the first code file set in the project to be detected and the second code file set in the target open source project; wherein the first code file set and the second code file set correspond to the same file type and the same directory tree level; respectively match the file size of each first code file in the first code file set with the file size of each second code file in the second code file set to obtain a matching result of the file attribute information of the project to be detected and the file attribute information of the target open source project.

[0120] In an optional embodiment, the file size of each first code file in the first code file set is matched with the file size of each second code file in the second code file set to obtain a matching result between the file attribute information of the project to be detected and the file attribute information of the target open source project, including: traversing each first code file in the first code file set and traversing each second code file in the second code file set in ascending order of file size; comparing the file size of the current first code file with the file size of the current second code file to obtain the difference between the file size of the current first code file and the file size of the current second code file; and determining the difference between the file size of the current first code file and the file size of the current second code file when the difference does not meet the preset difference condition. A second target code file with a smaller file size in the detected file is selected, and the second target code file is updated to the next code file traversed from the code file set corresponding to the second target code file, so as to re-compare and obtain a new difference; when the difference or the new difference meets the preset difference condition, the next first code file in the first code file set and the next code file in the second code file set are continued to be traversed for comparison until all code files in the first code file set and the second code file set are compared; according to the comparison result between all the first code file sets in the project to be detected and all the second code file sets in the target open source project, the matching result of the file attribute information of the project to be detected and the file attribute information of the target open source project is determined.

[0121] In an optional embodiment, the first similarity between the project to be detected and the target open source project is determined based on the number of code files in the project to be detected, the number of code files in the target open source project, and the number of code files whose file fingerprint information in the project to be detected successfully matches the file fingerprint information of the target open source project; the second similarity between the project to be detected and the target open source project is determined based on the number of code files in the project to be detected, the number of code files in the target open source project, and the number of code files whose file attribute information in the project to be detected successfully matches the file attribute information of the target open source project.

[0122] In an optional embodiment, the preset project similarity condition includes that the similarity between the project to be detected and the target open source project is greater than a preset project similarity threshold.

[0123] The implementation process of the functions and effects of each module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, which will not be repeated here.

[0124] Please see Figure 5 , Figure 5The third embodiment of the present application provides an electronic device 30, comprising a processor 301, a memory 302, and a computer program stored in the memory 302 and configured to be executed by the processor 301; when the processor 301 executes the computer program, the method described in the first embodiment of the present application is implemented and the same beneficial effects can be achieved.

[0125] The processor 301 may implement the method described in the first embodiment of the present application when reading the computer program from the memory 302 via the bus 303 and executing the computer program.

[0126] Processor 301 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 301 can be a microprocessor.

[0127] The memory 302 may be used to store instructions executed by the processor 301 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some functions or all functions of one or more modules described in the embodiments of the present application. The processor 301 of this embodiment may be used to execute instructions in the memory 302 to implement the method described in the first embodiment of the present application. The memory 302 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0128] The fourth embodiment of the present application provides a computer-readable storage medium, which includes a stored computer program; wherein, when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the method described in the first embodiment of the present application, and can achieve the same beneficial effects as the method.

[0129] In summary, the embodiments of the present application provide an SCA detection method, apparatus, device and medium based on project similarity. The SCA detection method based on project similarity includes: when the directory fingerprint information of the project to be detected fails to match the directory fingerprint information of each open source project in the open source project library, the similarity between the project to be detected and each target open source project is evaluated according to the matching results of the file fingerprint information of the project to be detected and the file fingerprint information of each target open source project in the open source project library, and the matching results of the file attribute information of the project to be detected and the file attribute information of each target open source project; when the similarity between the project to be detected and at least one target open source project in the open source project library meets the preset project similarity condition, the component version corresponding to the at least one target open source project is determined as the component version corresponding to the project to be detected; when the directory fingerprint information of the project to be detected successfully matches the directory fingerprint information of at least one open source project in the open source project library, the component version corresponding to the at least one open source project is determined as the component version corresponding to the project to be detected. In the embodiment of the present application, when the directory fingerprint information of the project to be detected fails to match the directory fingerprint information of each open source project in the open source project library, the project similarity between the project to be detected and each target open source project is evaluated according to the matching results of the file fingerprint information of the project to be detected and the file fingerprint information of each target open source project in the open source project library, and the matching results of the file attribute information of the project to be detected and the file attribute information of each target open source project. When the project similarity between the project to be detected and at least one target open source project meets the preset project similarity condition, or the directory fingerprint information of the project to be detected successfully matches the directory fingerprint information of at least one open source project, the component versions corresponding to these part of the known open source projects are determined as the component versions corresponding to the project to be detected. The similarity between the two projects can be comprehensively evaluated from multiple aspects such as the directory tree structure similarity at the directory level, and the file content similarity and file attribute similarity at the file level, and the similarity of the project to be detected can be accurately determined, and the component versions corresponding to the similar projects are determined as the component versions corresponding to the project to be detected, so that similar projects and components can be effectively matched even when the project directory tree structure is adjusted or the file content is changed, thereby improving the SCA detection efficiency and detection accuracy.

[0130] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0131] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0132] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program codes.

[0133] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0134] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0135] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A SCA detection method based on project similarity, characterized in that: include: In the case where the directory fingerprint information of the project to be detected fails to match the directory fingerprint information of each open source project in the open source project library, the similarity between the project to be detected and each target open source project is evaluated based on the matching results of the file fingerprint information of the project to be detected and the file fingerprint information of each target open source project in the open source project library, and the matching results of the file attribute information of the project to be detected and the file attribute information of each target open source project; In the case where the similarity between the project to be detected and at least one target open source project in the open source project library meets a preset project similarity condition, determining the component version corresponding to the at least one target open source project as the component version corresponding to the project to be detected; When the directory fingerprint information of the project to be detected successfully matches the directory fingerprint information of at least one open source project in the open source project library, the component version corresponding to the at least one open source project is determined as the component version corresponding to the project to be detected.

2. The method according to claim 1, characterized in that: The similarity between the project fingerprint information of each target open source project and the project fingerprint information of the project to be detected meets a preset project fingerprint similarity condition.

3. The method according to claim 1, characterized in that The directory fingerprint information of the project to be detected includes the root directory fingerprint information and sub-directory fingerprint information of the project to be detected, and the directory fingerprint information of each open source project includes the root directory fingerprint information and sub-directory fingerprint information of each open source project; The method further comprises: Compare the root directory fingerprint information of the project to be detected with the root directory fingerprint information of each open source project to obtain a first comparison result; When the first comparison result is inconsistent, the root directory fingerprint information of the project to be detected is compared with the sub-directory fingerprint information of each open source project to obtain a second comparison result; When the second comparison result is inconsistent, the sub-directory fingerprint information of the project to be detected is compared with the root directory fingerprint information of each open source project to obtain a third comparison result; When the third comparison result is inconsistent, it is determined that the directory fingerprint information of the project to be detected fails to match the directory fingerprint information of each open source project; When the first comparison result, the second comparison result, or the third comparison result is consistent, it is determined that the directory fingerprint information of the project to be detected successfully matches the directory fingerprint information of the at least one open source project.

4. The method according to claim 1, characterized in that The evaluating the similarity between the project to be detected and each target open source project according to the matching result of the file fingerprint information of the project to be detected and the file fingerprint information of each target open source project in the open source project library, and the matching result of the file attribute information of the project to be detected and the file attribute information of each target open source project, comprises: For each target open source project in the open source project library, evaluating a first similarity between the project to be detected and the target open source project according to a matching result between the file fingerprint information of the project to be detected and the file fingerprint information of the target open source project; According to a matching result between the file attribute information of the project to be detected and the file attribute information of the target open source project, evaluating a second similarity between the project to be detected and the target open source project; The similarity between the project to be detected and the target open source project is determined according to a first similarity between the project to be detected and the target open source project and a second similarity between the project to be detected and the target open source project.

5. The method according to claim 4, characterized in that The file fingerprint information of the project to be detected includes the hash fingerprint and simhash fingerprint of each code file in the project to be detected, and the file fingerprint information of the target open source project includes the hash fingerprint and simhash fingerprint of each code file in the target open source project; Before evaluating the first similarity between the project to be detected and the target open source project according to the matching result of the file fingerprint information of the project to be detected and the file fingerprint information of the target open source project, the method further includes: Compare the hash fingerprint of each code file in the project to be detected with the hash fingerprint of each code file in the target open source project, and obtain a comparison result of the hash fingerprint of each code file in the project to be detected with the hash fingerprint of each code file in the target open source project; The simhash fingerprint of each first target code file in the project to be detected is compared with the simhash fingerprint of each code file in the target open source project respectively, and a secondary comparison result of the simhash fingerprint of each first target code file in the project to be detected and the simhash fingerprint of each code file in the target open source project is obtained; wherein the hash fingerprint of the first target code file is inconsistent with the hash fingerprint of each code file in the target open source project; According to the first comparison result and the second comparison result, a matching result between the file fingerprint information of the project to be detected and the file fingerprint information of the target open source project is determined.

6. The method according to claim 4, characterized in that The file attribute information of the project to be detected includes the file type, directory tree level and file size of each code file in the project to be detected, and the file attribute information of the target open source project includes the file type, directory tree level and file size of each code file in the target open source project; Before evaluating the second similarity between the project to be detected and the target open source project according to the matching result of the file attribute information of the project to be detected and the file attribute information of the target open source project, the method further includes: Classify all code files with the same file type and directory tree level in the project to be detected into the same code file set to obtain a set of all code files in the project to be detected; Classify all code files in the target open source project that have the same file type and directory tree level into the same code file set, to obtain a set of all code files in the target open source project; Determine a first code file set in the project to be detected and a second code file set in the target open source project; wherein the first code file set and the second code file set correspond to the same file type and are located at the same directory tree level; The file size of each first code file in the first code file set is matched with the file size of each second code file in the second code file set to obtain a matching result between the file attribute information of the project to be detected and the file attribute information of the target open source project.

7. The method according to claim 6, characterized in that The matching of the file size of each first code file in the first code file set with the file size of each second code file in the second code file set to obtain the matching result of the file attribute information of the project to be detected and the file attribute information of the target open source project includes: Traversing each first code file in the first code file set and traversing each second code file in the second code file set in ascending order of file size; Compare the file size of the current first code file with the file size of the current second code file to obtain a difference between the file size of the current first code file and the file size of the current second code file; If the difference does not satisfy a preset difference condition, determining a second target code file having a smaller file size between the current first code file and the current second code file, and updating the second target code file to a next code file traversed from a code file set corresponding to the second target code file, so as to re-compare and obtain a new difference; When the difference or the new difference satisfies the preset difference condition, continue traversing the next first code file in the first code file set and traversing the next code file in the second code file set for comparison until all code files in the first code file set and the second code file set have been compared; According to the comparison result between all the first code file sets in the project to be detected and all the second code file sets in the target open source project, a matching result between the file attribute information of the project to be detected and the file attribute information of the target open source project is determined.

8. The method according to claim 4, characterized in that The first similarity between the project to be detected and the target open source project is determined according to the number of code files in the project to be detected, the number of code files in the target open source project, and the number of code files whose file fingerprint information in the project to be detected successfully matches the file fingerprint information in the target open source project; The second similarity between the project to be detected and the target open source project is determined based on the number of code files in the project to be detected, the number of code files in the target open source project, and the number of code files whose file attribute information in the project to be detected successfully matches the file attribute information of the target open source project.

9. The method according to any one of claims 1 to 8, characterized in that: The preset project similarity condition includes that the similarity between the project to be detected and the target open source project is greater than a preset project similarity threshold.

10. A SCA detection device based on project similarity, characterized in that: include: A project matching module, configured to evaluate the similarity between the project to be detected and each target open source project according to the matching results of the file fingerprint information of the project to be detected and the file fingerprint information of each target open source project in the open source project library, and the matching results of the file attribute information of the project to be detected and the file attribute information of each target open source project, if the directory fingerprint information of the project to be detected fails to match the directory fingerprint information of each open source project in the open source project library; An SCA detection module, configured to determine the component version corresponding to the at least one target open source project as the component version corresponding to the project to be detected when the similarity between the project to be detected and at least one target open source project in the open source project library meets a preset project similarity condition; The SCA detection module is further configured to determine the component version corresponding to the at least one open source project as the component version corresponding to the project to be detected when the directory fingerprint information of the project to be detected successfully matches the directory fingerprint information of at least one open source project in the open source project library.

11. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor; when the processor executes the computer program, the method according to any one of claims 1 to 9 is implemented.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program; wherein, when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the method according to any one of claims 1 to 9.

Images