Software asset identification method and device, equipment and storage medium

Abstract

The invention discloses a software asset identification method, device and equipment and a storage medium, and relates to the technical field of computers, and the method comprises the following steps: identifying first software directly relied on by local closed source software of a server; analyzing a configuration file of the first software to identify second software which the closed source software indirectly depends on; and locally constructing a local dependency relationship graph between the closed source software and the first software and between the closed source software and the second software, and supplementing the local dependency relationship graph based on the software dependency relationship graph of the cloud to obtain a global dependency relationship graph between the closed source software and all local software. According to the scheme, all local software of the server can be accurately and comprehensively identified, and the dependency relationship between the software is further determined.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a software asset identification method, device, equipment and storage medium. Background Art

[0002] With the widespread use of open source software, the management and maintenance of software assets has become increasingly important. Open source software projects usually rely on numerous third-party libraries and modules, and these dependencies form a complex network.

[0003] There are two main types of traditional open source software asset identification technologies: one is software component analysis. However, software component analysis tools on the market only support the identification of directly dependent software, but not indirectly dependent software. This will lead to incomplete open source software asset identification and failure to identify indirectly dependent open source software, resulting in omissions in the open source software asset inventory process. The second is manual asset inventory, which is to sort out the list of open source software used in the software development process. However, this method has high labor costs and low accuracy. When the open source software list is not maintained in time or the maintenance personnel change, as the number of open source software introduced increases, the cost of re-maintaining the open source software list becomes higher, and it becomes more difficult to ensure the comprehensiveness of the open source software list. In addition, it is inefficient when faced with huge dependencies and cannot find deeply dependent software assets.

[0004] Therefore, the above technical problems need to be solved by those skilled in the art urgently. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide a software asset identification method, device, equipment and storage medium, which can accurately and comprehensively identify all local software on the server and further determine the dependencies between the software. The specific scheme is as follows:

[0006] A first aspect of the present application provides a software asset identification method, comprising:

[0007] Identify the first software that the closed-source software local to the server directly depends on;

[0008] Parsing a configuration file of the first software to identify a second software that the closed-source software indirectly depends on;

[0009] A local dependency graph between the closed-source software and the first software and the second software is constructed locally, and the local dependency graph is supplemented based on the software dependency graph in the cloud to obtain a global dependency graph between the closed-source software and all local software.

[0010] Optionally, the first software and the second software are open source software.

[0011] Optionally, the first software that the local closed-source software of the identification server directly depends on includes:

[0012] Identify the first software that the local closed-source software on the server directly depends on by detecting the file suffix;

[0013] and / or, identifying the first software that the local closed-source software of the server directly depends on by detecting the configuration file;

[0014] And / or, identifying the first software that the local closed-source software of the server directly depends on by collecting package manager information.

[0015] Optionally, parsing the configuration file of the first software to identify the second software on which the closed-source software indirectly depends includes:

[0016] Extracting a configuration file of the first software, and parsing the configuration file of the first software according to the software type and the configuration file format to obtain software information of the first software;

[0017] Based on the software information, second software that the closed-source software indirectly depends on is identified.

[0018] Optionally, the software information includes version information and software package name of the first software, and target dependency relationship between the first software and third software; the third software is software that the first software directly or indirectly depends on;

[0019] Accordingly, the step of identifying the second software that the closed-source software indirectly depends on based on the software information includes:

[0020] Based on the target dependency relationship, the third software on which the first software directly or indirectly depends is used as the second software on which the closed-source software indirectly depends.

[0021] Optionally, locally constructing a local dependency graph between the closed-source software and the first software and the second software includes:

[0022] A local dependency graph is constructed with the closed-source software, the first software and the second software as nodes, and with the dependency relationship between the closed-source software and the first software and the direct dependency relationship between the first software and the second software as edges.

[0023] Optionally, the software dependency graph is constructed based on all software in the cloud and is used to characterize the dependency relationship between any two software;

[0024] Accordingly, the process of constructing the software dependency graph includes:

[0025] The software dependency graph is constructed by taking each software as a node and taking the dependency relationship between any two software as an edge.

[0026] Optionally, the cloud-based software dependency graph supplements the local dependency graph to obtain a global dependency graph between the closed-source software and all local software, including:

[0027] Using the second software as an index node, searching for a fourth software that has a dependency relationship with the second software from a software dependency graph in the cloud;

[0028] A subgraph including the second software and the fourth software is extracted from the software dependency graph, and the subgraph is merged with the local dependency graph to obtain a global dependency graph between the closed-source software and all local software.

[0029] A second aspect of the present application provides a software asset identification device, comprising:

[0030] A first identification module, used to identify a first software that the local closed-source software of the server directly depends on;

[0031] A second identification module, configured to parse a configuration file of the first software to identify a second software that the closed-source software indirectly depends on;

[0032] A relationship graph construction module is used to locally construct a local dependency graph between the closed-source software and the first software and the second software, and to supplement the local dependency graph based on the software dependency graph in the cloud to obtain a global dependency graph between the closed-source software and all local software.

[0033] A third aspect of the present application provides an electronic device, comprising a processor and a memory; wherein the memory is used to store a computer program, and the computer program is loaded and executed by the processor to implement the aforementioned software asset identification method.

[0034] A fourth aspect of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are loaded and executed by a processor, the aforementioned software asset identification method is implemented.

[0035] In this application, the first software that the local closed-source software of the server directly depends on is first identified; the configuration file of the first software is parsed to identify the second software that the closed-source software indirectly depends on; a local dependency graph between the closed-source software and the first software and the second software is constructed locally, and the local dependency graph is supplemented based on the software dependency graph in the cloud to obtain a global dependency graph between the closed-source software and all local software. It can be seen that this application first identifies the first software that the local closed-source software directly depends on, and then further identifies the second software that the closed-source software indirectly depends on by parsing the information in the configuration file in the first software, and then integrates all the software that the closed-source software depends on to locally construct a local dependency graph between the closed-source software and the first software and the second software, and the local dependency graph contains the dependency relationship between all local closed-source software and software. In addition, this application also needs to supplement the local dependency graph based on the software dependency graph in the cloud to obtain the software information that the closed-source software deeply depends on. That is, this application can complete the asset sorting of all local software, including deeply dependent software, through the combination of local and cloud, so as to achieve full identification of software assets and solve the problem of underreporting in traditional software component identification technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0037] Figure 1 A flowchart of a software asset identification method disclosed in this application;

[0038] Figure 2 A flowchart of a software asset identification method disclosed in this application;

[0039] Figure 3 A specific example diagram of a global dependency graph disclosed in this application;

[0040] Figure 4 A flowchart of a specific software asset identification method disclosed in this application;

[0041] Figure 5 A schematic diagram of the structure of a software asset identification device disclosed in this application;

[0042] Figure 6 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0043] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] There are two main types of traditional open source software asset identification technologies: one is software component analysis. However, software component analysis tools on the market only support the identification of directly dependent software, but not indirectly dependent software. This will lead to incomplete open source software asset identification and failure to identify indirectly dependent open source software, resulting in omissions in the open source software asset inventory process. The second is manual asset inventory, which is to sort out the list of open source software used in the software development process. However, this method has high labor costs and low accuracy. When the open source software list is not maintained in time or the maintenance personnel change, as the number of open source software introduced increases, the cost of re-maintaining the open source software list becomes higher, and it becomes more difficult to ensure the comprehensiveness of the open source software list. In addition, it is inefficient when faced with huge dependencies and cannot find deeply dependent software assets.

[0045] Figure 1 A flowchart of a software asset identification method provided in an embodiment of the present application. Figure 1 As shown, the software asset identification method includes:

[0046] Step S11: Identify the first software that the local closed-source software on the server directly depends on.

[0047] In this embodiment, it is first necessary to identify the first software that the local closed-source software directly depends on. Among them, in the context of software and programming, direct dependency generally refers to a software component explicitly declaring its requirement for another component in order to work properly or provide a specific function. In a specific implementation, the above-mentioned first software specifically refers to open source software, that is, this application first needs to identify the open source software that the local closed-source software directly depends on. Among them, open source software refers to a software program whose source code is publicly released and allows free use, modification and distribution; closed-source software refers to software whose source code is not publicly released.

[0048] Specifically, the above-mentioned identification of the first software that the local closed-source software of the server directly depends on includes: identifying the first software that the local closed-source software of the server directly depends on by detecting the file suffix; and / or identifying the first software that the local closed-source software of the server directly depends on by detecting the configuration file; and / or identifying the first software that the local closed-source software of the server directly depends on by collecting the information of the package manager. That is, the present application discloses a plurality of methods for identifying the open source software assets that the closed-source software directly depends on.

[0049] Among them, when detecting file suffixes, specifically, dependent software files ending with .jar, .war, .ear, etc. are detected; when detecting configuration files of open source software, specifically, project configuration files such as pom.xml, composer.json, gradle.build are retrieved, and the information in the configuration files and the referenced dependent software information are parsed and extracted, including the dependent software name and version information; when collecting package manager information, specifically, locally dependent open source software information is obtained by executing commands such as maven and pipdeptree, including software name, software version, etc.

[0050] Step S12: parsing the configuration file of the first software to identify the second software on which the closed-source software indirectly depends.

[0051] In this embodiment, after identifying the first software that the local closed-source software directly depends on, the second software that the closed-source software indirectly depends on is further identified by parsing the information in the configuration file in the first software. It should be pointed out that the above-mentioned second software specifically also refers to open source software, that is, this application needs to successively identify the open source software that the local closed-source software directly depends on and the open source software that it indirectly depends on. Among them, indirect dependency refers to the dependency relationship introduced by other software that a software directly depends on. For example, software A directly depends on software B, and software B directly depends on software C, then software C is an indirect dependency of software A.

[0052] Step S13: construct a local dependency graph between the closed-source software and the first software and the second software locally, and supplement the local dependency graph based on the software dependency graph in the cloud to obtain a global dependency graph between the closed-source software and all local software.

[0053] In this embodiment, it can be seen from the above content that the types of the first software and the second software are both open source software. Therefore, the software that the closed source software directly depends on is recorded as the first open source software, and the software that the closed source software indirectly depends on is recorded as the second open source software. Then, by integrating all the open source software that the closed source software depends on, a local dependency graph between the closed source software and the first open source software and the second open source software can be constructed locally. The local dependency graph contains the dependency relationships between all local closed source software and open source software. In addition, if Figure 2As shown, this application also needs to supplement the local dependency graph based on the software dependency graph of all open source software in the cloud to obtain the information of open source software that the closed source software deeply depends on, so as to obtain the global dependency graph between the closed source software and all local open source software. That is, this application can complete the asset combing of all local open source software, including deeply dependent open source software, through the local and cloud joint method, so as to realize the full identification of open source software assets and solve the problem of underreporting of traditional software component identification technology.

[0054] It should be pointed out that the above-mentioned software dependency graph is constructed based on all software in the cloud and is used to characterize the dependency relationship between any two software; accordingly, the construction process of the software dependency graph includes: taking each software as a node and the dependency relationship between any two software as an edge to construct the software dependency graph. It can be understood that the above-mentioned software dependency graph is specifically constructed based on all open source software in the cloud, that is, the present application pre-builds a full open source software environment in the cloud environment, and extracts the open source software that the currently parsed open source software depends on by parsing the configuration files contained in the open source software. Repeating the above process can obtain multiple dependency relationships between open source software, and then use the dependency relationship between any two open source software as an edge to connect all open source software nodes, so that a complete open source software dependency graph can be obtained in the cloud environment.

[0055] In a specific implementation, the above-mentioned cloud-based software dependency graph supplements the local dependency graph to obtain a global dependency graph between the closed-source software and all local software, including: using the second software as an index node, searching for the fourth software that has a dependency relationship with the second software from the cloud-based software dependency graph; extracting a subgraph including the second software and the fourth software from the software dependency graph, and merging the subgraph with the local dependency graph to obtain a global dependency graph between the closed-source software and all local software. That is, the present application uses the second open source software that the closed-source software indirectly depends on as an index node, searches for the remaining open source software that has a dependency relationship with the second open source software from the software dependency graph corresponding to all cloud-based open source software, namely, the fourth open source software, and extracts this part of the content and merges it with the local dependency graph to obtain a global dependency graph between the closed-source software and all local open source software.

[0056] It can be understood that the above has identified the first open source software that the local closed source software directly depends on and the second open source software that it indirectly depends on. In actual scenarios, the second open source software may also depend on other open source software, so the closed source software and other open source software also form a deeper indirect dependency relationship. Therefore, this embodiment uses the open source software dependency graph in the cloud to supplement the local dependency graph, thereby obtaining all the open source software that the closed source software depends on. Specifically, this embodiment uses the second open source software as an index node and calls the API (Application Program Interface) interface to find the fourth open source software that has a dependency relationship with the second open source software from the open source software dependency graph, and then extracts a subgraph including the second open source software and the fourth open source software from the open source software dependency graph, so as to use the subgraph to supplement the local dependency graph. The specific approach can be to directly merge the subgraph with the local dependency graph to obtain a global dependency graph between the closed source software and all local open source software. Among them, when searching for the fourth open source software that has a dependency relationship with the second open source software from the software dependency graph, the software name and version of the second open source software can be specifically searched. In addition, in order to avoid missing some open source software in the aforementioned identification process, the closed source software, the first open source software and the second open source software can all be used as index nodes to query the open source software dependency graph in the cloud, so as to obtain more comprehensive sub-graph information.

[0057] In this way, the present application can obtain the indirectly dependent open source software and dependency relationships that are missing from the local dependency graph from the software dependency graph in the cloud, and form a global dependency graph of the customer's local open source software. Through the nodes (open source software) and edges (dependencies) in the cloud open source software dependency graph, the asset combing of all local open source software can be completed, including deeply dependent open source software.

[0058] Figure 3 This is a specific example of a global dependency graph disclosed in the present application. The solid lines in the graph represent direct dependencies and indirect dependencies in the local dependency graph, the solid circles represent directly dependent open source software and indirectly dependent open source software in the local dependency graph, and the dotted lines and dotted circles in the graph represent indirect dependencies and indirectly dependent open source software supplemented from the open source software dependency graph in the cloud. That is, the present application forms a two-level software dependency structure by sorting out the relationship between open source software dependencies and dependencies, identifying the next-level dependent software of each dependent software, and when multiple related structures are connected at the end, a complete multi-level dependency chain of dependent software will eventually be formed, identifying deeply dependent open source software assets. Compared with traditional open source software asset identification technology, the coverage of open source software that can be identified by the present application is more comprehensive.

[0059] In this application, the first software that the local closed-source software of the server directly depends on is first identified; the configuration file of the first software is parsed to identify the second software that the closed-source software indirectly depends on; a local dependency graph between the closed-source software and the first software and the second software is constructed locally, and the local dependency graph is supplemented based on the software dependency graph in the cloud to obtain a global dependency graph between the closed-source software and all local software. It can be seen that this application first identifies the first software that the local closed-source software directly depends on, and then further identifies the second software that the closed-source software indirectly depends on by parsing the information in the configuration file in the first software, and then integrates all the software that the closed-source software depends on to locally construct a local dependency graph between the closed-source software and the first software and the second software, and the local dependency graph contains the dependency relationship between all local closed-source software and software. In addition, this application also needs to supplement the local dependency graph based on the software dependency graph in the cloud to obtain the software information that the closed-source software deeply depends on. That is, this application can complete the asset sorting of all local software, including deeply dependent software, through the combination of local and cloud, so as to achieve full identification of software assets and solve the problem of underreporting in traditional software component identification technology.

[0060] Figure 4 A specific software asset identification method flow chart provided in the embodiment of the present application. Figure 4 As shown, the software asset identification method includes:

[0061] Step S21: Identify the first software that the local closed-source software on the server directly depends on.

[0062] Step S22: extracting the configuration file of the first software, and parsing the configuration file of the first software according to the open source software type and the configuration file format to obtain the software information of the first software.

[0063] In this embodiment, after identifying the first open source software that the closed source software directly depends on, it is necessary to further extract the configuration file of the first open source software, and then parse the configuration file of the first open source software according to the open source software type and the configuration file format, so as to obtain the software information of the first open source software. It is understandable that generally, the packaged open source software will contain a configuration file, and by extracting the configuration file in the open source software package and parsing the configuration file according to the open source software type, such as Java, .NET, and the configuration file format, the information in the configuration file for the open source software can be extracted.

[0064] Step S23: Identify second software that the closed-source software indirectly depends on based on the software information.

[0065] In this embodiment, the second open source software that the closed source software indirectly depends on is specifically identified based on the software information of the first open source software.

[0066] Specifically, the above-mentioned software information includes the version information and software package name of the first software, and the target dependency relationship between the first software and the third software; the third software is the software that the first software directly depends on or indirectly depends on; accordingly, the identifying the second software that the closed-source software indirectly depends on based on the software information includes: based on the target dependency relationship, the third software that the first software directly depends on or indirectly depends on is used as the second software that the closed-source software indirectly depends on.

[0067] That is, parsing the configuration file of the first open source software is mainly to obtain the version information and software package name of the first open source software, as well as the dependencies with other open source software introduced in the first open source software. It should be pointed out that the type of the third software mentioned above is specifically open source software, which is hereinafter referred to as the third open source software, that is, this application needs to obtain the target dependency relationship between the first open source software and the third open source software, and the third open source software can be the open source software that the first open source software directly or indirectly depends on.

[0068] Accordingly, when identifying the second open source software that the closed source software indirectly depends on based on the software information, specifically based on the target dependency relationship, the third open source software that the first open source software directly or indirectly depends on is regarded as the second open source software that the closed source software indirectly depends on. That is, the open source software that has a direct dependency relationship or an indirect dependency relationship with the first open source software is the second open source software that has an indirect dependency relationship with the closed source software.

[0069] Step S24: construct a local dependency graph with the closed-source software, the first software and the second software as nodes, and with the dependency relationship between the closed-source software and the first software, and the direct dependency relationship between the first software and the second software as edges.

[0070] In this embodiment, when constructing a local dependency graph, the closed source software, the first open source software and the second open source software are used as nodes, the dependency relationship between the closed source software and the first open source software, and the direct dependency relationship between the first open source software and the second open source software are used as edges, and points are connected by lines to form a local dependency graph.

[0071] Step S25: Supplement the local dependency graph based on the cloud-based software dependency graph to obtain a global dependency graph between the closed-source software and all local software.

[0072] In this embodiment, for the specific process of the above steps S21 and S25, reference may be made to the corresponding contents disclosed in the above embodiments, which will not be described again here.

[0073] It can be seen that this application aims at the deficiencies of the existing open source software asset identification technology, and proposes a method for identifying open software assets based on software dependencies. First, the first open source software that the local closed source software directly depends on is identified, and the configuration file in the first open source software is extracted. By parsing the information in the configuration file, more second open source software that is indirectly dependent locally is further identified, and then all the local dependent open source software information is integrated to form a local dependency graph, which includes the dependency relationship between all local closed source software and open source software. Finally, the open source software dependency graph built in the cloud is referenced to supplement the dependency relationship, forming a complete global dependency graph on the client side, focusing on supplementing the dependency relationship between open source software and open source software, and supplementing the deep indirect dependency open source software dependency relationship in the local dependency graph, thereby effectively solving the current problem of incomplete identification of open source software assets.

[0074] See also Figure 5 As shown, the embodiment of the present application also discloses a software asset identification device, including:

[0075] A first identification module 11, used to identify a first software that the local closed-source software of the server directly depends on;

[0076] A second identification module 12, configured to parse a configuration file of the first software to identify a second software that the closed-source software indirectly depends on;

[0077] The relationship graph construction module 13 is used to locally construct a local dependency graph between the closed-source software and the first software and the second software, and supplement the local dependency graph based on the software dependency graph in the cloud to obtain a global dependency graph between the closed-source software and all local software.

[0078] The present application discloses a first identification module for identifying the first software that the local closed-source software of the server directly depends on; a second identification module for parsing the configuration file of the first software to identify the second software that the closed-source software indirectly depends on; a relationship graph construction module for locally constructing a local dependency graph between the closed-source software and the first software and the second software, and supplementing the local dependency graph based on the software dependency graph in the cloud to obtain a global dependency graph between the closed-source software and all local software. It can be seen that the present application first identifies the first software that the local closed-source software directly depends on, and then further identifies the second software that the closed-source software indirectly depends on by parsing the information of the configuration file in the first software, and then integrates all the software that the closed-source software depends on to locally construct a local dependency graph between the closed-source software and the first software and the second software, and the local dependency graph contains the dependency relationship between all local closed-source software and software. In addition, the present application also needs to supplement the local dependency graph based on the software dependency graph in the cloud to obtain the software information that the closed-source software deeply depends on. That is, this application can complete the asset sorting of all local software, including deeply dependent software, through the combination of local and cloud, so as to achieve full identification of software assets and solve the problem of underreporting in traditional software component identification technology.

[0079] In some specific implementations, the first software and the second software are open source software.

[0080] In some specific implementations, the first identification module 11 is specifically used to identify the first software that the local closed-source software of the server directly depends on by detecting the file suffix.

[0081] In some specific implementations, the first identification module 11 is specifically used to identify the first software that the local closed-source software of the server directly depends on by detecting a configuration file.

[0082] In some specific implementations, the first identification module 11 is specifically used to identify the first software that the local closed-source software of the server directly depends on by collecting package manager information.

[0083] In some specific implementations, the second identification module 12 may specifically include:

[0084] A file parsing unit, used to extract a configuration file of the first software, and parse the configuration file of the first software according to the software type and the configuration file format to obtain software information of the first software;

[0085] A file identification unit is used to identify, based on the software information, a second open source software on which the closed source software indirectly depends.

[0086] In some specific implementations, the software information includes version information and software package name of the first software, and a target dependency relationship between the first software and third software; the third software is software that the first software directly or indirectly depends on;

[0087] Correspondingly, the file identification unit is specifically configured to use, based on the target dependency relationship, a third software that the first software directly or indirectly depends on as the second software that the closed-source software indirectly depends on.

[0088] In some specific implementations, the relationship diagram construction module 13 specifically includes:

[0089] A local relationship graph construction unit is used to construct a local dependency graph using the closed-source software, the first software and the second software as nodes, and the dependency relationship between the closed-source software and the first software, and the direct dependency relationship between the first software and the second software as edges.

[0090] In some specific implementations, the software dependency graph is constructed based on all software in the cloud and is used to characterize the dependency relationship between any two software;

[0091] Accordingly, the software asset identification device further includes:

[0092] The cloud relationship graph construction unit is used to construct the software dependency graph by taking each software as a node and taking the dependency relationship between any two software as an edge.

[0093] In some specific implementations, the relationship graph construction module 13 may specifically include:

[0094] A search unit, configured to use the second software as an index node to search for a fourth software having a dependency relationship with the second software from a software dependency graph in the cloud;

[0095] A merging unit is used to extract a subgraph including the second software and the fourth software from the software dependency graph, and merge the subgraph with the local dependency graph to obtain a global dependency graph between the closed-source software and all local software.

[0096] Furthermore, an embodiment of the present application also provides an electronic device. Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0097] Figure 6The present invention provides a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the software asset identification method disclosed in any of the aforementioned embodiments.

[0098] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0099] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon may include an operating system 221, a computer program 222 and data 223, etc. The storage method can be temporary storage or permanent storage.

[0100] Among them, the operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20 to realize the operation and processing of the massive data 223 in the memory 22 by the processor 21, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the software asset identification method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks. The data 223 can include the image quality control strategy collected by the electronic device 20, etc.

[0101] Furthermore, an embodiment of the present application also discloses a storage medium, in which a computer program is stored. When the computer program is loaded and executed by a processor, the steps of the software asset identification method disclosed in any of the aforementioned embodiments are implemented.

[0102] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0103] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0104] The software asset identification method, device, equipment and storage medium provided by the present invention are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A software asset identification method, characterized in that: include: Identify the first software that the closed-source software local to the server directly depends on; Parsing a configuration file of the first software to identify a second software that the closed-source software indirectly depends on; A local dependency graph between the closed-source software and the first software and the second software is constructed locally, and the local dependency graph is supplemented based on the software dependency graph in the cloud to obtain a global dependency graph between the closed-source software and all local software.

2. The software asset identification method according to claim 1, characterized in that: The types of the first software and the second software are open source software.

3. The software asset identification method according to claim 1, characterized in that: The first software directly dependent on the local closed-source software of the identification server includes: Identify the first software that the local closed-source software on the server directly depends on by detecting the file suffix; and / or, identifying the first software that the local closed-source software of the server directly depends on by detecting the configuration file; And / or, identifying the first software that the local closed-source software of the server directly depends on by collecting package manager information.

4. The software asset identification method according to claim 1, characterized in that: The parsing of the configuration file of the first software to identify the second software on which the closed-source software indirectly depends includes: Extracting a configuration file of the first software, and parsing the configuration file of the first software according to the software type and the configuration file format to obtain software information of the first software; Based on the software information, second software that the closed-source software indirectly depends on is identified.

5. The software asset identification method according to claim 4, characterized in that: The software information includes the version information and software package name of the first software, and the target dependency relationship between the first software and third software; the third software is software that the first software directly or indirectly depends on; Accordingly, the step of identifying the second software that the closed-source software indirectly depends on based on the software information includes: Based on the target dependency relationship, the third software on which the first software directly or indirectly depends is used as the second software on which the closed-source software indirectly depends.

6. The software asset identification method according to claim 1, characterized in that: The locally constructing a local dependency graph between the closed-source software and the first software and the second software includes: A local dependency graph is constructed with the closed-source software, the first software and the second software as nodes, and with the dependency relationship between the closed-source software and the first software and the direct dependency relationship between the first software and the second software as edges.

7. The software asset identification method according to any one of claims 1 to 6, characterized in that: The software dependency graph is constructed based on all software in the cloud and is used to characterize the dependency relationship between any two software; Accordingly, the process of constructing the software dependency graph includes: The software dependency graph is constructed by taking each software as a node and taking the dependency relationship between any two software as an edge.

8. The software asset identification method according to claim 7, characterized in that: The cloud-based software dependency graph supplements the local dependency graph to obtain a global dependency graph between the closed-source software and all local software, including: Using the second software as an index node, searching for a fourth software that has a dependency relationship with the second software from a software dependency graph in the cloud; A subgraph including the second software and the fourth software is extracted from the software dependency graph, and the subgraph is merged with the local dependency graph to obtain a global dependency graph between the closed-source software and all local software.

9. A software asset identification device, characterized in that: include: A first identification module, used to identify a first software that the local closed-source software of the server directly depends on; A second identification module, configured to parse a configuration file of the first software to identify a second software that the closed-source software indirectly depends on; A relationship graph construction module is used to locally construct a local dependency graph between the closed-source software and the first software and the second software, and to supplement the local dependency graph based on the software dependency graph in the cloud to obtain a global dependency graph between the closed-source software and all local software.

10. An electronic device, characterized in that: The electronic device comprises a processor and a memory, wherein: The memory is used to store computer programs; The computer program is loaded and executed by the processor to implement the software asset identification method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: Used to store computer executable instructions, which, when loaded and executed by a processor, implement the software asset identification method according to any one of claims 1 to 8.

Images