Multi-source software supply chain intelligent analysis method and system

Abstract

The invention provides a multi-source software supply chain intelligent analysis method and system. The method comprises the following steps: analyzing software component identification information submitted by a user, extracting attribute characteristics, positioning node paths among components, and generating a weighted dependency chain list containing direct and indirect dependency chains; a Bayesian network model is combined with a predefined risk index system, the risk score of each dependency relationship chain is calculated, potential supply chain threat points are identified through an anomaly detection algorithm, and a risk report is generated; the report covers the overall risk score and the threat point of the key link or component; based on the report, drawing a comprehensive risk map by using a multi-dimensional visualization algorithm, and displaying component groups with similar risk modes; and a genetic algorithm and a simulated annealing algorithm are fused to explore a high-risk area, an adjustment suggestion is proposed, and a risk mitigation strategy is generated to reduce the overall risk score. According to the technical scheme provided by the embodiment of the invention, the security and integrity of the multi-source software supply chain are improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of software engineering technology, and in particular to a multi-source software supply chain intelligent analysis method and system. Background Art

[0002] With the widespread use of open source components and third-party libraries, the complexity of software systems has increased dramatically, and dependency chains have become intricate. Developers and enterprises need an intelligent analysis method that can parse the software component identification information submitted by users and extract attribute features from it to accurately locate the node path between software components and generate a weighted dependency chain list containing direct and indirect dependency chains.

[0003] Currently, software supply chain risk management mainly relies on static code analysis, vulnerability scanning, and dependency management tools. These tools detect known vulnerabilities and insecure dependencies by scanning source code and dependent libraries. Some advanced tools also combine machine learning algorithms to identify abnormal behaviors and potential threats.

[0004] Existing software supply chain risk assessment solutions have several significant flaws. First, traditional static analysis and vulnerability scanning tools can only identify known vulnerabilities and are powerless against new attacks and unknown threats. Second, these tools often ignore indirect dependencies in the dependency chain, resulting in incomplete and inaccurate risk assessment. Furthermore, most existing solutions calculate risk scores based on predefined rules, lack flexibility and adaptability, and cannot dynamically adjust weights and assessment criteria according to actual conditions. Finally, existing visualization tools and risk mitigation measures are relatively simple, making it difficult to intuitively display complex dependencies and risk patterns, and even more difficult to provide systematic optimization strategies. Summary of the invention

[0005] The embodiments of the present application provide a multi-source software supply chain intelligent analysis method and system to solve the problems of insufficient security and low integrity of the multi-source software supply chain in the prior art.

[0006] In a first aspect, an embodiment of the present application provides a multi-source software supply chain intelligent analysis method, including: Parsing identification information of a software component submitted by a user, and extracting attribute features of the software component from the identification information; According to the attribute characteristics of the software components, the node paths associated between the software components are located to generate a dependency chain in the node path, and a weight value is assigned to the dependency chain to generate a weighted dependency chain list, wherein the dependency chain includes a direct dependency chain and an indirect dependency chain; A Bayesian network model is used in combination with a predefined risk indicator system to calculate the risk score of the dependency chain in the weighted dependency chain list, and an anomaly detection algorithm is used to identify potential supply chain threat points to generate a risk report containing an overall risk score and the supply chain threat points, wherein the supply chain threat points are key links or components that are used by attackers to undermine the integrity and security of software during software development, distribution and deployment; According to the risk report, a comprehensive risk map is drawn using a multidimensional visualization algorithm to obtain a risk view, and a genetic algorithm and a simulated annealing algorithm are integrated to explore adjustment suggestions for high-risk areas of the risk view to generate a risk mitigation strategy; wherein the comprehensive risk map is grouped and displayed using a hierarchical clustering algorithm to display components with similar risk patterns, the risk pattern is a result obtained by performing similarity judgment on the dependency chain, the supply chain threat point and the risk score, and the risk mitigation strategy is used to reduce the risk score of the software component.

[0007] Optionally, the using of the Bayesian network model in combination with a predefined risk indicator system to calculate the risk score of the dependency chain in the weighted dependency chain list includes: According to the Bayesian network model, the node paths in the weighted dependency chain list are vectorized using the Node2Vec or GraphSAGE graph embedding algorithm, and the component nodes, edge attributes and topological structures in the dependency chain are mapped to a low-dimensional vector space to obtain a dependency vector; Based on the dependency vector, the number of vulnerabilities, update frequency, and community activity indicators are normalized through a dynamic weight allocation strategy, where the weight of the number of vulnerabilities is dynamically adjusted according to the severity level of the CVE database, the update frequency weight is calculated by exponential decay in combination with the component version iteration cycle, and the community activity weight is generated based on linear interpolation of code submission frequency and issue response time to form a multi-dimensional weighted initial risk score; Using the dependency chain with assigned multi-dimensional weighted initial risk scores, the parent node risk probability in the Bayesian network is used as the feature input of the gradient boosting decision tree. Through feature engineering, component dependency depth, cross-ecological call relationship and license conflict type are extracted as additional features. The greedy algorithm is used to optimize the conditional probability convergence direction when the decision tree splits the node, and the optimized conditional probability is obtained. According to the optimized conditional probability, the Stacking ensemble learning method is used to perform meta-model fusion on the component vulnerability prediction results of the random forest classifier and the risk propagation coefficient prediction results of the LightGBM regressor. The weights of each base model are determined through cross-validation, and the risk assessment score of the dependency chain is output.

[0008] Optionally, the identifying potential supply chain threat points using an anomaly detection algorithm to generate a risk report including an overall risk score and the supply chain threat points includes: Based on the overall risk score, the isolation forest algorithm is used to perform unsupervised clustering on the topological feature vectors of the dependency chain. Combined with the supply chain attack pattern characteristics recorded in the historical attack sample library, the dynamic percentile method based on the sliding window is used to set the abnormal threshold. When the vulnerability density of the component dependency path exceeds 3 times the standard deviation of similar components in the same period, it is marked as a threat point; The BERT pre-trained model is used to identify entities in security bulletins, and dependency syntactic analysis is used to extract triple information of CVE number, affected version range, and repair solution. The knowledge graph alignment technology is used to associate and match the extracted threat information with the component metadata in the software bill of materials, generating threat point details including the vulnerability propagation path. All the overall risk scores and threat point details are summarized and collated, and the Prophet time series model is used to seasonally decompose the component vulnerability disclosure frequency and the number of dependency changes. A risk trend prediction model is built based on the LSTM neural network, and the historical risk scores, component update intervals, and community discussion heat are used as input features to generate risk fluctuation prediction curves for the next three version cycles; Visualization tools are used to build a three-dimensional topological map through the ECharts framework to present the component dependency network, a Sankey diagram is used to visualize the risk propagation path, and D3.js force-directed graph is integrated to achieve dynamic focus display of high-risk nodes, generating an interactive risk report that includes a time dimension risk trend overlay layer and a threat point thermal distribution layer.

[0009] Optionally, the dependency chain to which the multi-dimensional weighted initial risk score has been assigned is used, the parent node risk probability in the Bayesian network is used as the feature input of the gradient boosting decision tree, component dependency depth, cross-ecological call relationship and license conflict type are extracted as additional features through feature engineering, and the conditional probability convergence direction when the decision tree splits the node is optimized by a greedy algorithm to obtain the optimized conditional probability, including: Collect and organize the low-dimensional vector representation of the dependency chain and the initial risk score, extract component dependency path depth, cross-ecosystem call frequency, and license conflict type as core features, build an extended feature set based on component version iteration interval, vulnerability repair response time, and developer contribution activity, standardize the features to eliminate dimensional differences, and screen out feature subsets that have a significant impact on risk propagation through feature importance analysis to generate a multi-dimensional feature training data set; Based on the Bayesian network model, the network parameters are initialized by analyzing the correlation between the risk status of the parent node and the dependency strength of the child node. The nonlinear fitting ability of the decision tree model is used to assist in establishing the initial mapping relationship between the conditional probabilities of the nodes. The parent node risk probability, component dependency depth, and cross-ecological call frequency are used as input features of the decision tree to build a joint training framework. Using the multi-dimensional feature training data set, an alternating optimization strategy is adopted to synchronously update the conditional probability table of the Bayesian network and the splitting rule of the decision tree, the deviation between the risk probability predicted by the model and the actual vulnerability disclosure record is calculated through the loss function, and the network weight and tree structure parameters are dynamically adjusted in combination with the back-propagation algorithm. In each iteration, the optimal splitting node is selected according to the greedy algorithm to optimize the convergence direction of the conditional probability until the model converges; According to the joint training results of the joint training framework, the conditional probabilities of the sub-nodes of the high-probability propagation paths in the Bayesian network are weighted and modified, and the probability distribution parameters are refined based on the component version compatibility data in the dependency chain and the statistical results of historical attack events. The optimized conditional probability values ​​are fed back to the Bayesian network to update the dependency strength between nodes and generate optimized conditional probabilities.

[0010] Optionally, based on the overall risk score, the topological feature vectors of the dependency chain are unsupervisedly clustered using an isolation forest algorithm, and the abnormal threshold is set using a dynamic percentile method based on a sliding window in combination with the supply chain attack pattern characteristics recorded in the historical attack sample library. When the vulnerability density of the component dependency path exceeds 3 times the standard deviation of similar components in the same period, it is marked as a threat point, including: According to the overall risk score, extract the topological feature vector of the dependency chain, including component node degree centrality, dependency path length, and cross-ecological call density, and combine the supply chain attack pattern characteristics recorded in the historical attack sample library to construct a multidimensional risk feature space, normalize the features to eliminate dimensional differences, and reduce the dimension through principal component analysis to improve computing efficiency, and generate an anomaly detection model adapted to the current software ecosystem; An unsupervised clustering algorithm is used to group topological feature vectors. The high-risk sample annotations in the historical attack sample library are combined to train an anomaly detection model. The algorithm parameters are optimized through model evaluation indicators to generate a detection model that can identify outliers in the multi-dimensional risk feature space. Based on the historical data of the dependency chain, the risk score distribution range of similar components under normal operation is counted, and the initial abnormality judgment boundary is set in combination with the high-risk sample set annotated by domain experts. The dynamic percentile method based on the sliding window is used to monitor the vulnerability disclosure frequency in the component warehouse update log in real time, and the abnormal feature dimension is dynamically expanded according to the newly emerged attack vector characteristics to generate a dynamic threshold that matches the current threat environment; The anomaly detection model is combined with dynamic thresholds to analyze the risk score mutation phenomenon during component version iteration in the dependency chain, and to identify compound threat points that simultaneously meet the requirements of topological structure anomaly, excessive vulnerability density, and delayed community repair response. When the vulnerability density of a component dependency path exceeds three times the standard deviation of similar components in the same period, it is marked as a supply chain threat point and a supply chain threat point list is generated.

[0011] Optionally, the risk report is used to draw a comprehensive risk map using a multi-dimensional visualization algorithm to obtain a risk view, including: According to the risk report, integrating dependency chain topology data, threat point spatial location information and risk score time series, constructing a structured dataset containing component coordinates, risk level labels and threat propagation direction vectors; Using a multi-dimensional visualization algorithm, the dependency chain is mapped as a connection line in three-dimensional space, the risk score is converted into a node size parameter, and the threat point location is marked as a pulse signal marker to generate an interactive spatial distribution map; Based on the visualization, density-aware clustering technology is used to automatically identify high-risk component clustering areas, and risk pattern groups are generated according to the component development team, license type, and vulnerability history similarity, to achieve a hierarchical display of threat propagation paths. Combined with the network topology, a ring layout algorithm is designed to optimize node arrangement, gradient color coding is used to represent the risk trend changes in different time windows, and focus + context visualization technology is integrated to achieve scalable display of large-scale dependent networks, generating a comprehensive risk map with multi-dimensional characteristics of time and space; The intensity of vulnerability transmission between components is displayed through the overlay of thermal maps, and the risk diffusion path in the supply chain is presented using dynamic streamline diagrams. The risk node penetration query function is provided to reveal the underlying threat evidence chain and form an actionable risk view.

[0012] Optionally, locating the node paths associated between the software components according to the attribute characteristics of the software components to generate a dependency chain in the node path, assigning weight values ​​to the dependency chains, and generating a weighted dependency chain list includes: Using the parsed software component identification information submitted by users, structural attribute features including version number, build tool type and dependency declaration file format are extracted; According to the attribute characteristics of the software components, a multi-level index model of component dependencies is established, and the explicitly declared dependencies and implicitly derived dependencies are identified through a dependency resolution engine to generate a dependency network including version constraints; Based on the dependency network, the dynamically loaded third-party library call records in the build process are traced, the interface call paths covered by the test cases are analyzed, and the actual effective dependencies are verified in combination with the continuous integration logs to generate dependency chain records accurate to the specific call links; Classify the dependency chain records, divide direct and indirect dependencies according to whether the dependency introduction method is required for the development environment and whether it is mandatory to load at runtime, assign exponentially increasing propagation weights to deeply nested cross-ecological dependencies, and generate a preliminary weighted dependency chain; Based on the comprehensive risk report, a weight correction rule engine is established to dynamically adjust the weight coefficient according to the reputation rating of the component maintainer, the binary file signature verification status and the security factors that depend on the integrity of the locked file. The rationality of the weight distribution is verified through dependency propagation simulation, and finally a weighted dependency chain list is generated after multiple rounds of iterative optimization.

[0013] In a second aspect, an embodiment of the present application provides a multi-source software supply chain intelligent analysis system, including: A parsing module, used to parse the identification information of the software component submitted by the user, and extract the attribute characteristics of the software component from the identification information; A positioning module, used to locate the node paths associated between the software components according to the attribute characteristics of the software components, so as to generate a dependency chain in the node path, assign a weight value to the dependency chain, and generate a weighted dependency chain list, wherein the dependency chain includes a direct dependency chain and an indirect dependency chain; A calculation module, for calculating the risk score of the dependency chain in the weighted dependency chain list by using a Bayesian network model combined with a predefined risk indicator system, and identifying potential supply chain threat points by using an anomaly detection algorithm to generate a risk report including an overall risk score and the supply chain threat points, wherein the supply chain threat points are key links or components that are exploited by attackers to undermine the integrity and security of software during software development, distribution and deployment; A drawing module is used to draw a comprehensive risk map based on the risk report using a multidimensional visualization algorithm to obtain a risk view, and integrate a genetic algorithm and a simulated annealing algorithm to explore adjustment suggestions for high-risk areas of the risk view to generate a risk mitigation strategy; wherein the comprehensive risk map is grouped and displayed using a hierarchical clustering algorithm to display components with similar risk patterns, the risk pattern is the result obtained by similarity judgment of the dependency chain, the supply chain threat point and the risk score, and the risk mitigation strategy is used to reduce the risk score of the software component.

[0014] In a third aspect, an embodiment of the present application provides a computing device, comprising a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a multi-source software supply chain intelligent analysis method as described in the first aspect above.

[0015] In a fourth aspect, an embodiment of the present application provides a computer storage medium storing a computer program, which, when executed by a computer, implements a multi-source software supply chain intelligent analysis method as described in the first aspect.

[0016] In an embodiment of the present application, identification information of software components submitted by users is parsed, and attribute characteristics of the software components are extracted from the identification information; node paths associated with the software components are located according to the attribute characteristics of the software components to generate dependency chains in the node paths, weight values ​​are assigned to the dependency chains, and a weighted dependency chain list is generated, wherein the dependency chains include direct dependency chains and indirect dependency chains; a Bayesian network model is used in combination with a predefined risk indicator system to calculate risk scores of dependency chains in the weighted dependency chain list, and an anomaly detection algorithm is used to identify potential supply chain threat points to generate a risk score list containing the overall risk score and the supply chain threat points. Risk report, wherein the supply chain threat point is a key link or component that is used by attackers to undermine the integrity and security of software during software development, distribution and deployment; based on the risk report, a comprehensive risk map is drawn using a multidimensional visualization algorithm to obtain a risk view, and a genetic algorithm and a simulated annealing algorithm are integrated to explore adjustment suggestions for high-risk areas of the risk view to generate a risk mitigation strategy; wherein the comprehensive risk map is grouped and displayed using a hierarchical clustering algorithm to display components with similar risk patterns, the risk pattern is the result obtained by similarity judgment of the dependency chain, the supply chain threat point and the risk score, and the risk mitigation strategy is used to reduce the risk score of the software component.

[0017] The technical solution of this application has the following beneficial effects: By analyzing the attribute characteristics and dependency chains of software components, a comprehensive risk assessment of the software supply chain is achieved to ensure that nothing is missed. Using Bayesian network models and anomaly detection algorithms, potential threat points in the supply chain are accurately identified to improve security protection capabilities. A comprehensive risk map is drawn using a multi-dimensional visualization algorithm to intuitively display risk distribution, allowing decision makers to quickly understand complex risk patterns. By integrating genetic algorithms and simulated annealing algorithms, the optimal adjustment plan for high-risk areas is explored, specific and feasible risk mitigation strategies are generated, and risk scores are effectively reduced. Through systematic risk assessment and mitigation measures, the security and integrity of the software development, distribution, and deployment process are enhanced, the attack surface is reduced, and software quality is guaranteed.

[0018] Furthermore, a graph embedding algorithm is used to convert the weighted dependency chain list into a low-dimensional vector representation to obtain a dependency vector; based on the dependency vector, a risk indicator system including indicators such as the number of vulnerabilities, update frequency, and community activity is used in combination with a multi-dimensional weight adjustment mechanism to calculate an initial risk score, and the score is assigned to the dependency chain; using the dependency chain that has been assigned an initial risk score, the Bayesian network model is combined with the gradient boosting decision tree algorithm to optimize the risk probability distribution of child nodes under the condition of a given software component parent node to obtain the optimized conditional probability; based on the optimized conditional probability, combined with an ensemble learning method, the overall risk score of the dependency chain is evaluated to obtain the final overall risk score.

[0019] The above method significantly improves the accuracy and reliability of software supply chain risk assessment, effectively captures the complex structure of the dependency chain, provides an accurate low-dimensional vector representation, ensures the flexibility and adaptability of risk assessment, optimizes the risk probability distribution of each node in the dependency chain, improves the accuracy of risk prediction, and ensures the comprehensiveness and credibility of the assessment results.

[0020] Furthermore, based on the overall risk score and combined with the adaptive threshold setting strategy, anomaly detection algorithms are used to analyze the risk scores of dependency chains, identify data points that deviate from the normal range, determine supply chain threat points, and use natural language processing technology to parse security announcements and technical documents related to these threat points, automatically extract directly related information, generate detailed threat point profiles, summarize and organize all overall risk scores and threat point details, and apply time series analysis to predict future risk trends to form a risk report. Through visualization tools, an interactive interface is created to display the risk report, and a risk report containing the overall risk score and threat point profile is generated.

[0021] The above method significantly enhances the accuracy and practicality of software supply chain risk management, avoids the problem of false positives or omissions caused by fixed thresholds, improves the efficiency and accuracy of information acquisition, helps decision makers prepare in advance, and makes complex risk reports intuitive and easy to understand, making it easier for decision makers to quickly grasp the situation and take corresponding measures. This method improves the quality and operability of risk reports as a whole, and provides strong support for the security management of the software supply chain.

[0022] In summary, this method identifies and visualizes potential threat points by intelligently analyzing the dependency chain and risk scores of the software supply chain, providing optimized risk mitigation strategies, and significantly improving the security and integrity of software development, distribution, and deployment.

[0023] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0025] Figure 1 A flowchart of a multi-source software supply chain intelligent analysis method provided by the present application is shown; Figure 2 A schematic diagram of the structure of a multi-source software supply chain intelligent analysis system provided by the present application is shown; Figure 3 A schematic diagram of the structure of a computing device provided by the present application is shown. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0027] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to different types.

[0028] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0029] Figure 1 A flowchart of a multi-source software supply chain intelligent analysis method is provided for an embodiment of the present application, such as Figure 1 As shown, the method includes: 101. Parse identification information of a software component submitted by a user, and extract attribute features of the software component from the identification information; Among them, identification information includes metadata such as the software component's name, version number, release date, developer information, etc., which are used to uniquely identify and describe a software component. Attribute features are specific characteristics further extracted from identification information, such as component functional description, dependency library list, open source license type, etc. The process of parsing identification information and extracting attribute features is the basis for ensuring the accuracy of subsequent analysis and provides key data input for subsequent steps.

[0030] In this solution, the system first receives the software component identification information submitted by the user, and reads and processes the information through parsing tools (such as JSON parser or XML parser). Then, it uses natural language processing (NLP) technology and pattern matching algorithms to extract attribute features related to security and dependencies. These features will serve as the basic data for subsequent risk assessment and dependency analysis.

[0031] For example, in an open source software management platform, a user uploaded a new Python library, and the system automatically parsed the setup.py file of the library to obtain its identification information, such as the package name requests, version number 2.25.1, author Kenneth Reitz, etc. Then, the README.md document was analyzed through NLP technology to extract the function description, the list of dependent libraries (such as urllib3, chardet, etc.) and the open source license type (such as MIT License). This information provides an important basis for the subsequent generation of the dependency chain.

[0032] 102. According to the attribute characteristics of the software components, locate the node paths associated between the software components to generate a dependency chain in the node path, assign weight values ​​to the dependency chains, and generate a weighted dependency chain list, wherein the dependency chains include direct dependency chains and indirect dependency chains; A node path refers to the dependency link between software components, including direct dependencies (such as A depends on B) and indirect dependencies (such as A depends on B, and B depends on C).

[0033] The dependency chain is a specific representation of these paths, and the weight value reflects the importance or risk level of each dependency. By building a weighted dependency chain list, the potential impact of each dependency on the overall system can be more accurately assessed.

[0034] Based on the extracted attribute features, the system constructs a graph structure to represent the dependencies between software components. For each pair of dependent components, the weight value between them is calculated, taking into account factors such as the depth and frequency of the dependency and historical vulnerability records. Finally, a weighted dependency chain list containing all dependencies and their weights is generated, providing detailed dependency information for subsequent risk assessment.

[0035] Continuing with the above example, after parsing the dependencies of the requests library, the system finds that it directly depends on urllib3, which in turn indirectly depends on idna. The system builds a graph structure based on these dependencies and assigns a weight value to each dependency path. For example, the weight value of requests ->urllib3 is higher because it is a common direct dependency; while the weight value of urllib3 ->idna is slightly lower, but still needs to be considered because it is an important indirect dependency. This step lays a solid foundation for subsequent risk assessment.

[0036] 103. Using a Bayesian network model in combination with a predefined risk indicator system, calculate the risk score of the dependency chain in the weighted dependency chain list, and use an anomaly detection algorithm to identify potential supply chain threat points to generate a risk report containing an overall risk score and the supply chain threat points, wherein the supply chain threat points are key links or components that are used by attackers to undermine the integrity and security of software during software development, distribution and deployment; The Bayesian network model is a probabilistic graphical model that can capture the conditional dependencies between variables and is suitable for complex risk assessment scenarios.

[0037] The risk indicator system includes multiple dimensions, such as the number of vulnerabilities, update frequency, community activity, etc., to quantify the risk level of each dependency chain.

[0038] Anomaly detection algorithms are used to identify data points that significantly deviate from normal behavior patterns, thereby identifying potential supply chain threats. Risk reports summarize risk scores and threat point details to help decision makers fully understand and respond to risks.

[0039] Using the Bayesian network model, combined with a predefined risk indicator system, the system scores the risk of each dependency chain in the weighted dependency chain list. Then, anomaly detection algorithms (such as isolation forests or autoencoders) are applied to identify dependency chains with abnormal behavior and determine supply chain threat points. Finally, a detailed risk report is generated, including the overall risk score and threat point profile for decision makers to refer to.

[0040] In the aforementioned requests library case, the system used a Bayesian network model combined with a vulnerability database to evaluate the risk score of each dependency chain. For example, requests -> urllib3 received a high risk score due to known vulnerabilities. At the same time, the anomaly detection algorithm identified an uncommon dependency of urllib3, pyopenssl, as a possible target of supply chain attacks. The risk report generated by the system not only includes these scores, but also provides a detailed threat point profile, suggesting that the team review the security of pyopenssl and consider alternatives.

[0041] 104. Based on the risk report, a comprehensive risk map is drawn using a multidimensional visualization algorithm to obtain a risk view, and a genetic algorithm and a simulated annealing algorithm are integrated to explore adjustment suggestions for high-risk areas of the risk view to generate a risk mitigation strategy; wherein the comprehensive risk map is grouped and displayed using a hierarchical clustering algorithm to display components with similar risk patterns, the risk pattern is the result obtained by performing similarity judgment on the dependency chain, the supply chain threat point and the risk score, and the risk mitigation strategy is used to reduce the risk score of the software component.

[0042] Multi-dimensional visualization algorithms are used to transform complex dependency chains and risk scores into intuitive graphical interfaces to help users quickly understand risk distribution. Comprehensive risk maps use hierarchical clustering algorithms to group components with similar risk patterns, making it easier to identify high-risk areas. Genetic algorithms and simulated annealing algorithms are used to optimize adjustment recommendations, explore how to effectively reduce risk scores, and generate specific risk mitigation strategies.

[0043] Based on the data in the risk report, the system uses a multi-dimensional visualization algorithm to create an interactive risk map that intuitively displays the risk score and threat points of the dependency chain. Then, the risk patterns are classified through a hierarchical clustering algorithm to form a group display. Next, combining genetic algorithms and simulated annealing algorithms, the system explores the best adjustment plan for high-risk areas and proposes specific mitigation measures, such as replacing dependent libraries or strengthening security audits. Ultimately, a detailed set of risk mitigation strategies is generated to guide decision makers to take action.

[0044] Continuing with the above case, the system generated an interactive risk map showing the risk scores and threat points of the requests library and its dependent libraries. Through a hierarchical clustering algorithm, the map groups dependent libraries with similar risk patterns, such as libraries with high vulnerability rates and libraries with low update frequencies. The system then used genetic algorithms and simulated annealing algorithms to make multiple adjustment recommendations, such as replacing pyopenssl with a safer alternative or increasing regular security audits of urllib3. Finally, the system generated a detailed risk mitigation strategy report to guide the development team to take specific measures to reduce the overall risk score.

[0045] Through the implementation of steps 101 to 104, the method realizes the intelligent analysis of the whole process from parsing the identification information of software components to generating detailed risk mitigation strategies. First, by accurately parsing the identification information and extracting the attribute features, the data accuracy of the subsequent analysis is ensured. Secondly, a weighted dependency chain list is constructed to comprehensively capture the direct and indirect dependencies, providing a detailed basis for risk assessment. Thirdly, by using the Bayesian network model and anomaly detection algorithm, the system can accurately identify potential supply chain threat points and generate reliable risk reports. Finally, through multi-dimensional visualization and optimization algorithms, the system not only intuitively displays the risk distribution, but also proposes effective mitigation strategies, significantly improving the security and risk management capabilities of the software supply chain. This series of steps complement each other to form a complete risk management closed loop, providing strong support for software development, distribution and deployment.

[0046] In order to solve the complexity and uncertainty in assessing the risk of dependency chains in the software supply chain, in some embodiments, the Bayesian network model is combined with a predefined risk indicator system in step 103 to calculate the risk score of the dependency chain in the weighted dependency chain list, including: According to the Bayesian network model, the node paths in the weighted dependency chain list are vectorized using the Node2Vec or GraphSAGE graph embedding algorithm, and the component nodes, edge attributes and topological structures in the dependency chain are mapped to a low-dimensional vector space to obtain a dependency vector. Based on the dependency vector, the number of vulnerabilities, update frequency and community activity indicators are normalized through a dynamic weight allocation strategy, wherein the weight of the number of vulnerabilities is dynamically adjusted according to the severity level of the CVE database, the weight of the update frequency is calculated by exponential decay in combination with the iteration cycle of the component version, and the weight of the community activity is generated based on the linear interpolation of the code submission frequency and the issue response time, forming a multi-dimensional weighted initial Risk score; using the dependency chain that has been assigned a multi-dimensional weighted initial risk score, the risk probability of the parent node in the Bayesian network is used as the feature input of the gradient boosting decision tree, and the component dependency depth, cross-ecological call relationship and license conflict type are extracted as additional features through feature engineering. The greedy algorithm is used to optimize the conditional probability convergence direction when the decision tree splits the node to obtain the optimized conditional probability; based on the optimized conditional probability, the Stacking ensemble learning method is used to meta-model the component vulnerability prediction results of the random forest classifier and the risk propagation coefficient prediction results of the LightGBM regressor, and the weights of each base model are determined through cross-validation to output the risk assessment score of the dependency chain.

[0047] In this embodiment, Node2Vec and GraphSAGE are graph embedding algorithms that can convert complex dependency chains into low-dimensional vector forms that are easy for machine learning models to process. These vector data not only contain basic connection information between components, but also reflect the topological structure characteristics between them, which are used in the subsequent risk assessment process.

[0048] In the embodiments of the present application, firstly, we use graph embedding technology to map the dependency chain into a low-dimensional space to obtain dependency vectors; secondly, based on these vectors, we adjust the risk scores of each component through a dynamic weight allocation strategy that takes into account factors such as vulnerability severity, update cycle, and community interaction frequency; thirdly, these adjusted risk scores are input into a gradient boosting decision tree model based on a Bayesian network to optimize the selection of each split point; finally, we integrate the prediction results from the random forest and LightGBM models to obtain a more accurate risk assessment score.

[0049] Here is a specific example: Suppose we want to evaluate the security of an open source project. First, we parse all dependency declaration files of the project, extract all direct and indirect dependencies, and convert them into dependency vectors using the GraphSAGE algorithm. Second, we calculate the initial risk score for each dependency based on the vulnerability severity, component version iteration cycle, and time interval between code submission and issue response recorded in the CVE database. Third, we input these risk scores into the gradient boosting decision tree model together with other features extracted from the dependency chain to optimize the splitting rules of each node. Finally, we use the Stacking method to combine the prediction results of the random forest and LightGBM models, and determine the optimal combination weights through cross-validation to obtain the final risk score for each dependency. Through the above steps, we can not only identify high-risk dependency paths, but also propose targeted mitigation measures.

[0050] In order to further improve the ability to identify potential threat points in the software supply chain, in some embodiments, the use of anomaly detection algorithms to identify potential supply chain threat points to generate a risk report containing an overall risk score and the supply chain threat points includes: Based on the overall risk score, the isolation forest algorithm is used to perform unsupervised clustering on the topological feature vectors of the dependency chain. Combined with the supply chain attack pattern characteristics recorded in the historical attack sample library, the dynamic percentile method based on the sliding window is used to set the abnormal threshold. When the vulnerability density of the component dependency path exceeds 3 times the standard deviation of similar components in the same period, it is marked as a threat point; the security announcement is recognized by the BERT pre-training model, and the CVE number, affected version range and repair solution triple information are extracted by combining dependency syntax analysis. The knowledge graph alignment technology is used to associate and match the extracted threat information with the component metadata in the software bill of materials to generate threat point details containing the vulnerability propagation path; all the overall The risk scores and details of the threat points are summarized and organized, and the Prophet time series model is used to seasonally decompose the component vulnerability disclosure frequency and the number of dependency changes. A risk trend prediction model is built based on the LSTM neural network, and historical risk scores, component update intervals, and community discussion heat are used as input features to generate risk fluctuation prediction curves for the next three version cycles. Visualization tools are used to build a three-dimensional topological map through the ECharts framework to present the component dependency network, a Sankey diagram is used to visualize the risk propagation path, and a D3.js force-directed graph is integrated to achieve dynamic focus display of high-risk nodes, generating an interactive risk report that includes a time dimension risk trend overlay layer and a threat point thermal distribution layer.

[0051] In this embodiment, Isolation Forest is an algorithm for anomaly detection that can effectively identify a small number of outliers from a large amount of normal data. BERT (Bidirectional Encoder Representations from Transformers) is a pre-trained language model that can be used to extract structured information from text, such as CVE numbers and their related repair suggestions. Knowledge graphs provide a way to represent relationships between entities, which helps to associate scattered security intelligence.

[0052] In the embodiments of the present application, first, we use the isolation forest algorithm to analyze the topological feature vectors of the dependency chain based on the overall risk assessment results to determine which components may become threat points; secondly, we use the BERT model to process public security announcements, extract important information such as CVE numbers and affected version ranges, and associate them with existing component information through knowledge graph technology; thirdly, we summarize all the risk scores and detailed threat information collected, use the Prophet model to analyze the time series characteristics, and use the LSTM network to predict future risk trends; finally, we use visualization tools, including ECharts and D3.js, to create an interactive risk report interface, which not only shows the dependencies between components, but also highlights potential high-risk areas.

[0053] Here is a specific example: Suppose we want to analyze the security of an open source software. First, we use the isolation forest algorithm to perform unsupervised clustering of its dependency chain based on its overall risk score and set an abnormal threshold. Second, we apply the BERT model to parse the recent security announcement, extract the CVE number, the affected version and its repair solution, and associate and match it with the component metadata in the software bill of materials through the knowledge graph technology. Third, we summarize all the risk scores and threat point details, use the Prophet model to seasonally decompose the vulnerability disclosure frequency, and build a risk fluctuation prediction model for the next three version cycles based on the LSTM neural network. Finally, we use the ECharts framework to build a three-dimensional topology diagram to display the component dependency network, use the Sankey diagram to visualize the risk propagation path, and integrate the D3.js force-directed graph to realize the dynamic focus display of high-risk nodes. Through the above steps, we can not only accurately identify potential threat points in the software supply chain, but also provide clear and intuitive risk mitigation strategy guidance to the development team.

[0054] In order to further improve the accuracy of identifying risk propagation paths in the software supply chain, in some embodiments, the dependency chain to which the multi-dimensional weighted initial risk score has been assigned is used, the parent node risk probability in the Bayesian network is used as the feature input of the gradient boosting decision tree, and the component dependency depth, cross-ecological call relationship and license conflict type are extracted as additional features through feature engineering. The greedy algorithm is used to optimize the conditional probability convergence direction when the decision tree splits the node, and the optimized conditional probability is obtained, including: The low-dimensional vector representation of the dependency chain and the initial risk score are collected and organized, and the component dependency path depth, cross-ecological call frequency and license conflict type are extracted as core features. An extended feature set is constructed by combining the component version iteration interval, vulnerability repair response time and developer contribution activity. The features are standardized to eliminate dimensional differences, and feature subsets with significant impact on risk propagation are screened out through feature importance analysis to generate a multidimensional feature training data set. Based on the Bayesian network model, the network parameters are initialized through the correlation analysis between the parent node risk state and the child node dependency strength, and the nonlinear fitting ability of the decision tree model is used to assist in establishing the initial mapping relationship between the conditional probabilities of the nodes. The parent node risk probability, component dependency depth and cross-ecological call frequency are used as input features of the decision tree to construct a A joint training framework is constructed; using the multi-dimensional feature training data set, an alternating optimization strategy is adopted to synchronously update the conditional probability table of the Bayesian network and the splitting rule of the decision tree, the deviation between the risk probability predicted by the model and the actual vulnerability disclosure record is calculated through the loss function, and the network weight and tree structure parameters are dynamically adjusted in combination with the back-propagation algorithm. In each iteration, the optimal splitting node is selected according to the greedy algorithm to optimize the convergence direction of the conditional probability until the model converges; according to the joint training results of the joint training framework, the conditional probability of the child nodes of the high-probability propagation path in the Bayesian network is weighted and corrected, the probability distribution parameters are refined based on the component version compatibility data in the dependency chain and the statistical results of historical attack events, and the optimized conditional probability value is fed back to the Bayesian network to update the dependency strength between nodes to generate optimized conditional probability.

[0055] In this embodiment, the Bayesian network is a probabilistic graphical model for representing dependencies between variables and is suitable for uncertainty reasoning. The gradient boosting decision tree (GBDT) is a powerful machine learning method that is good at handling nonlinear relationships. The greedy algorithm is an algorithm that takes the best or optimal selection strategy in the current state at each step in order to achieve the best or optimal result globally. These technologies combined can effectively analyze and predict the risk propagation path in the software supply chain.

[0056] In the embodiments of the present application, first, we extracted key features such as component dependency depth, cross-ecological call frequency, and license conflict type from the dependency chain, and constructed a comprehensive feature set in combination with other extended features; secondly, we used the Bayesian network model to analyze the relationship between the risk status of the parent node and the dependency strength of the child node, so as to initialize our model parameters; thirdly, we adopted an alternating optimization strategy to synchronously adjust the parameters of the Bayesian network and decision tree model during each iteration to ensure that the model can accurately reflect the actual situation; finally, based on the results of the joint training framework, we fine-tuned the relevant parameters of the high-probability propagation path in the Bayesian network to improve the accuracy of the overall model.

[0057] Here is a specific example: Suppose we want to evaluate the risk propagation of an open source software project. First, we collected the version information, license type and historical vulnerability records of all dependent components of the project, calculated the initial risk score of each component, and extracted the component dependency depth, cross-ecological call frequency and license conflict type as core features; secondly, we analyzed the closeness of the dependencies between components based on the Bayesian network model and converted these relationships into the initial parameters of the model; thirdly, we used the training data set containing the above features and continuously adjusted the parameters of the Bayesian network and decision tree models through alternating optimization strategies until the model prediction results were consistent with the actual vulnerability disclosure records; finally, based on the feedback from the joint training framework, we optimized the conditional probability of the nodes involved in the high-risk propagation path in the Bayesian network, so as to more accurately reflect the changes in the dependency strength between components. Through the above steps, we not only improved our understanding of the risk propagation path of the software supply chain, but also provided strong support for subsequent risk management.

[0058] In order to further improve the accuracy of identifying potential threat points in the software supply chain, in some embodiments, based on the overall risk score, the topological feature vectors of the dependency chain are unsupervisedly clustered using the isolation forest algorithm, and the abnormal threshold is set using the dynamic percentile method based on the sliding window in combination with the supply chain attack pattern characteristics recorded in the historical attack sample library. When the vulnerability density of the component dependency path exceeds 3 times the standard deviation of similar components in the same period, it is marked as a threat point, including: According to the overall risk score, extract the topological feature vector of the dependency chain, including the component node degree centrality, dependency path length, and cross-ecological call density, and combine the supply chain attack pattern characteristics recorded in the historical attack sample library to construct a multidimensional risk feature space. Normalize the features to eliminate dimensional differences, and reduce the dimension through principal component analysis to improve computational efficiency, and generate an anomaly detection model that is adapted to the current software ecology. Use an unsupervised clustering algorithm to group the topological feature vectors, combine the high-risk sample annotations in the historical attack sample library, train the anomaly detection model, optimize the algorithm parameters through the model evaluation index, and generate a detection model that can identify outliers in the multidimensional risk feature space. Based on the historical data of the dependency chain, statistically analyze the similar groups. The risk score distribution range of the component under normal operation is used to set the initial anomaly judgment boundary in combination with the high-risk sample set annotated by domain experts. The dynamic percentile method based on sliding windows is used to monitor the vulnerability disclosure frequency in the component warehouse update log in real time. The anomaly feature dimension is dynamically expanded according to the newly emerged attack vector characteristics to generate a dynamic threshold that matches the current threat environment. The anomaly detection model is combined with the dynamic threshold to analyze the risk score mutation phenomenon during component version iteration in the dependency chain, and identify compound threat points that simultaneously meet the requirements of topological structure anomaly, excessive vulnerability density, and delayed community repair response. When the vulnerability density of the component dependency path exceeds 3 times the standard deviation of similar components in the same period, it is marked as a supply chain threat point, and a supply chain threat point list is generated.

[0059] In this embodiment, Isolation Forest is an effective unsupervised learning method for identifying a few outliers from the data. The topological feature vector includes information such as component node degree centrality, dependency path length, and cross-ecological call density, which are used to evaluate the complex relationships and potential risks between components. Principal component analysis (PCA) is a dimensionality reduction technique that can help simplify high-dimensional data sets while retaining important information of the original data as much as possible. The dynamic percentile rule allows the threshold of anomaly detection to be dynamically adjusted based on the latest data, thereby better adapting to the changing security environment.

[0060] In the embodiments of the present application, first, we extracted the key topological features of the dependency chain according to the overall risk score, and constructed a multidimensional risk feature space through normalization and principal component analysis; secondly, we used the isolation forest algorithm to perform unsupervised clustering on these feature vectors, and optimized the model parameters in combination with historical attack samples to ensure that anomalies can be effectively identified; thirdly, based on the historical data of the dependency chain and the high-risk sample set provided by domain experts, we set a preliminary anomaly determination boundary, and used the dynamic percentile method based on the sliding window to update the anomaly threshold in real time; finally, we applied the above model to the actual software supply chain environment, and identified those compound threat points with abnormal topological structures, high vulnerability density, and delayed community repair response by analyzing the risk score mutation during component version iteration.

[0061] Here is a specific example: Suppose we want to conduct a security assessment on an open source software project. First, we extract the node degree centrality, dependency path length, and cross-ecological call density of all dependent components based on their overall risk score, and generate a multidimensional risk feature space adapted to the current project through PCA processing; secondly, we apply the isolation forest algorithm to perform unsupervised clustering on these features, optimize the model parameters based on historical attack cases, and establish an efficient anomaly detection model; thirdly, based on the historical data of the project and the opinions of domain experts, we set the initial anomaly judgment boundary, and continuously monitor and adjust the anomaly threshold through the dynamic percentile method; finally, we use this anomaly detection model to analyze the risk score changes when the component version is updated, and find that the vulnerability density of a component is significantly higher than the standard deviation of similar components by more than three times, and there is a problem of delayed repair response, so it is marked as a supply chain threat point. Through the above steps, we not only successfully identify potential security threats, but also provide important basis for subsequent risk management and mitigation strategies.

[0062] In order to further improve the visualization analysis capability of software supply chain risks, in some embodiments, the step 104 uses a multi-dimensional visualization algorithm to draw a comprehensive risk map based on the risk report to obtain a risk view, including: According to the risk report, the dependency chain topology data, threat point spatial location information and risk score time series are integrated to construct a structured data set containing component coordinates, risk level labels and threat propagation direction vectors; using a multidimensional visualization algorithm, the dependency chain is mapped as a connecting line in three-dimensional space, the risk score is converted into a node size parameter, and the threat point location is marked as a pulse signal marker to generate an interactive spatial distribution map; based on the visualization representation, the density-aware clustering technology is used to automatically delineate the high-risk component clustering area, and the risk pattern grouping is generated according to the component's development team, license type and vulnerability history similarity to achieve a hierarchical display of the threat propagation path; combined with the network topology, a ring layout algorithm is designed to optimize the node arrangement, gradient color coding is used to represent the risk trend changes in different time windows, and focus + context visualization technology is integrated to achieve scalable display of large-scale dependency networks, generating a comprehensive risk map containing spatiotemporal multidimensional features; the vulnerability contagion intensity between components is displayed by overlaying thermal layers, and the risk diffusion path in the supply chain is presented using dynamic streamline diagrams, and a risk node penetration query function is provided to reveal the underlying threat evidence chain to form an actionable risk view.

[0063] In this embodiment, multidimensional visualization algorithms refer to a series of technologies used to present complex data relationships, such as three-dimensional spatial mapping, thermal layer overlay, etc. Density-aware clustering is an algorithm that can identify dense areas in a data set, which helps to discover high-risk component groups. The ring layout algorithm is a method specially designed to optimize the node arrangement, making the network diagram clearer and easier to read. These technologies and methods work together to effectively help users understand complex software supply chain risks.

[0064] In the embodiment of the present application, first, we integrated all relevant data extracted from the risk report, including the topological structure of the dependency chain, the spatial location of each threat point, and the risk score that changes over time, to form a detailed structured data set; secondly, we mapped these data into three-dimensional space, using connecting lines to represent the dependency chain, the node size to reflect the risk score, and the pulse signal marker to indicate the location of the threat point; thirdly, we used density-aware clustering technology to identify areas where high-risk components are concentrated, and classified these areas according to factors such as development team, license type, and vulnerability history; finally, we applied a ring layout algorithm to optimize the visual effect of the entire network diagram, used color gradient coding to display the risk trend of different time periods, and implemented an interactive large-scale network browsing function, thereby generating a comprehensive risk map that is both detailed and easy to understand.

[0065] Here is a specific example: Suppose we want to create a risk view for a large open source project. First, we collected the topological data of all dependent components of the project, the spatial location of threat points and their risk scores over time, and constructed a dataset containing component coordinates, risk level labels and threat propagation direction vectors; second, we used multidimensional visualization tools to convert dependency chains into connecting lines in three-dimensional space, adjusted the node size to intuitively display the risk score, and highlighted the threat points with pulse signal markers; third, we used density-aware clustering technology to identify high-risk component clusters and classified these areas according to development team affiliation, license type and historical vulnerability status; finally, we used a ring layout to optimize node distribution, used color gradients to show the risk trend changes in the past few months, and integrated focus + context technology to allow users to zoom in to view the details of a specific component, while providing risk node penetration query functions to reveal potential threat evidence chains. Through the above steps, we can not only clearly display the overall risk status of the software supply chain, but also provide the ability to deeply explore each risk point, greatly enhancing the effectiveness and efficiency of risk management.

[0066] In order to further improve the accuracy and security of dependency management in the software supply chain, in some embodiments, locating the node paths associated between the software components according to the attribute characteristics of the software components to generate a dependency chain in the node path, assigning a weight value to the dependency chain, and generating a weighted dependency chain list includes: By using the software component identification information submitted by the parsed user, the structured attribute features including the version number, the type of the build tool and the format of the dependency declaration file are extracted; according to the attribute features of the software component, a multi-level index model of the component dependency is established, and the explicitly declared dependency and the implicitly derived dependency are identified by the dependency parsing engine to generate a dependency network including version constraints; based on the dependency network, the dynamically loaded third-party library call records in the build process are traced, the interface call paths covered by the test cases are analyzed, and the actual effective dependencies are verified in combination with the continuous integration log to generate dependency chain records accurate to the specific call links; the dependency chain records are classified and processed, and direct and indirect dependencies are divided according to the dimensions of whether the dependency introduction method is required for the development environment and whether it is forced to be loaded at runtime, and exponentially increasing propagation weights are assigned to deeply nested cross-ecological dependencies to generate a preliminary weighted dependency chain; based on the risk report, a weight correction rule engine is established to dynamically adjust the weight coefficient according to the component maintainer reputation rating, the binary file signature verification status and the security factors of the dependency lock file integrity, and the rationality of the weight allocation is verified through the dependency propagation simulation, and finally a weighted dependency chain list that has undergone multiple rounds of iterative optimization is generated.

[0067] In this embodiment, the dependency resolution engine refers to a technology for identifying and analyzing dependencies between components in a software project. The multi-level index model is a data structure that can effectively organize and retrieve complex dependencies. The propagation weight is used to quantify the influence of dependencies in the network and help distinguish the importance of direct dependencies and indirect dependencies.

[0068] In the embodiment of the present application, first, we extract key attributes such as version number, build tool type, etc. from the software component identification information provided by the user to understand the specific situation of each component; second, we use this information to build a detailed dependency network, including both explicitly declared dependencies and implicit dependencies; third, we deeply explore the call records and test cases in the build process to ensure that all actual effective dependencies are accurately recorded; finally, we classify these dependency chains according to their nature, and assign appropriate weights according to their position and role in the network, thereby generating a comprehensive and detailed weighted dependency chain list.

[0069] Here is a specific example: Suppose we want to create a dependency chain list for a mobile application. First, we parse all component identification information of the project and extract detailed properties including version number and build tool type. Second, we build a multi-level index model of component dependencies based on this information, identify all explicit and implicit dependencies using the dependency resolution engine, and form a detailed dependency network. Third, we carefully track all dynamically loaded third-party library call records during the build process, analyze the interface call paths covered by the test cases, and verify the actual effective dependencies through the continuous integration log, and obtain dependency chain records accurate to the specific call links. Then, we divide dependencies into direct and indirect categories according to whether the dependency is required by the development environment or only loaded at runtime, and assign exponentially increasing propagation weights to those dependencies that are deeply nested across ecosystems. Finally, we refer to factors such as the reputation rating of the component maintainer and the binary file signature status to adjust the weight coefficient of the dependency chain, and verify the rationality of the weight allocation by simulating dependency propagation. Through the above steps, we not only clarify the dependencies between components, but also evaluate their importance and potential risks in the entire software supply chain, greatly improving the maintainability and security of the project.

[0070] This application considers that in order to accurately assess the risk level in the dependency chain, a comprehensive risk assessment formula system has been developed; this system is based on a low-dimensional vector representation of the dependency chain (dependency vector ), combined with multi-dimensional risk indicators, by introducing time decay factors and nonlinear transformations, quantifying various risk attributes and generating quantitative risk characteristics To further improve accuracy, the weights are dynamically adjusted according to the importance of different risk indicators, and adaptive learning rate and Bayesian optimization methods are introduced to generate risk weights that reflect the impact of different risk factors. Finally, the adjusted weights are used to perform weighted calculations on the quantitative risk characteristics, and exponential decay and nonlinear terms are introduced to comprehensively evaluate the overall risk level of the dependency chain to obtain the initial risk score. , so a new alternative is proposed, which includes: The initial risk score is calculated based on the dependency vector using a predefined risk indicator system in combination with a multi-dimensional weight adjustment mechanism, including: The graph embedding algorithm is used to convert the data in the dependency chain into a low-dimensional vector representation, and a regularization term is introduced to prevent overfitting to generate a dependency vector. ; Wherein, the dependency vector It is obtained by calculating the following formula: ; in, is the dependency vector of the dependency chain, It is the graph data corresponding to the dependency chain. is the time since the last update, is the mean of the time intervals, is the standard deviation of the time interval, are the weight matrix and bias vector of the first layer, is the activation function, is the number of network layers, Represents the set of all parameters, It is parameters, The neural network The weight matrix of the layer, The neural network The bias vector of the layer, is the standard deviation of the time interval; The following is a detailed explanation of each parameter: : Low-dimensional vector representation of dependency chains; The complex graph data in the dependency chain is converted into a low-dimensional vector through a graph embedding algorithm to capture the key features of the dependency chain; : Graph data (adjacency matrix or edge list) corresponding to the dependency chain; extracted from the actual dependency network to describe the connection relationship between nodes; : No. The weight matrix and bias vector of the layer neural network; optimized through the training process (such as gradient descent) to capture nonlinear patterns in graph data; : Activation functions (such as ReLU, Sigmoid, etc.) are used to introduce nonlinear characteristics; nonlinear activation functions enable the model to better capture complex relationships in the data; : The number of layers in the neural network; multi-layer structures can learn and abstract features in graph data more deeply; : The time since the last update; records the last update time of each dependency; : The mean of the time intervals. The update time intervals of all dependencies are counted and their average value is calculated.

[0071] : Standard deviation of time intervals. Statistics the update time intervals of all dependencies and calculate their standard deviation.

[0072] : The set of all parameters, including weight matrices and bias vectors, contains all parameters optimized during model training.

[0073] :No. parameters, obtained through the model training process, specifically refer to the elements in each weight matrix and bias vector.

[0074] The following is an introduction to the design reasons of each sub-item: Deep Neural Networks :Use a multi-layer neural network to encode the graph data of the dependency chain, and capture complex dependencies and features through layer-by-layer transformation and nonlinear activation functions. The weight matrix of each layer and the bias vector Through training optimization, we ensure that the model can effectively learn and express the key information in the graph data.

[0075] Time decay factor: A time decay factor in the form of a Gaussian distribution is introduced so that newer dependencies have a greater impact on the final result, while the influence of older dependencies gradually weakens, which reflects the time sensitivity and ensures that the model can dynamically adapt to changes in dependencies.

[0076] Regularization term : By squaring and summing all parameters, the L2 regularization term is introduced to prevent the model from overfitting. The regularization term helps maintain the generalization ability of the model and ensures that it performs well on unseen data.

[0077] The purpose of adding the neural network output to the time decay factor and the regularization term is to comprehensively consider the static characteristics of the dependency chain (encoded by the neural network) and the time-varying factors (through the time decay factor), while adding regularization to prevent overfitting. This combination enables the model to fully capture the spatiotemporal characteristics of the dependency chain and maintain good generalization performance.

[0078] Here is a specific example: Assume there is a simple dependency chain graph data , contains 5 nodes and 7 edges; using a two-layer neural network , the activation function is ReLU , and introduce regularization terms to prevent overfitting; The specific parameters are as follows: : Layer 1 weight matrix and bias vector; : Layer 2 weight matrix and bias vector; ; Including all parameters, assuming , each parameter ; Substituting into the formula we get: ; Assumptions Known and trained, we can calculate Specific values: ; Conclusion Explanation: Dependency Vector It provides a compact representation of the dependency chain, capturing the importance and interdependencies of individual nodes. A lower value indicates that the risk of the node is relatively small, while a higher value means a greater potential risk. This result provides a solid foundation for subsequent risk assessment, helping decision makers better understand and respond to potential risks in the dependency chain, especially in areas such as supply chain management and cybersecurity.

[0079] According to the dependency vector , combined with the risk indicator system, the risk attributes of the dependency chain are quantified, and the time decay factor and nonlinear transformation are introduced to obtain the quantitative risk characteristics; wherein the quantitative risk characteristics It is obtained by calculating the following formula: ; in, is a quantitative risk characteristic, is the number of risk indicators, It is The weight of the risk indicator, is a nonlinear transformation function used to increase expressive power. represents the vector dot product, is the eigenvector or characterizing vector, They are and The L2 norm of ; The following is a detailed explanation of each parameter: : No. The quantitative risk characteristics of a dependency chain; it combines the influence of multiple risk indicators and quantifies the risk attributes of the dependency chain by introducing time decay factors and nonlinear transformations; this value reflects the risk of a specific dependency chain in the first The overall risk level in each risk dimension is an important basis for subsequent risk assessment and decision-making; : The number of risk indicators; each risk indicator They are all measures of risk in a specific aspect of the dependency chain, such as the number of vulnerabilities, update frequency, supplier information, etc. By considering multiple risk indicators, the overall risk status of the dependency chain can be more comprehensively assessed; The size depends on the number of risk factors included in the specific application scenario; : It is The weights of the risk indicators reflect the relative importance of different risk indicators in the overall risk assessment. By dynamically adjusting the importance of each risk indicator, the model can better adapt to different application scenarios and ensure the accuracy and reliability of risk assessment results. The choice of weights can be optimized based on historical data or expert knowledge. : It is a nonlinear transformation function used to increase expressive power and capture complex risk patterns; common choices include hyperbolic tangent function (tanh), sigmoid function, etc. Nonlinear transformation enables the model to better handle complex nonlinear relationships and improve the flexibility and accuracy of risk assessment; by introducing , the model can adjust the expression of risk characteristics in a wider range, enhancing its adaptability and robustness; : represents the dependency vector and The characteristic vector of the risk index The dot product between them measures the similarity of two vectors in direction. The larger the value, the closer the two vectors are. By calculating the dot product, the degree of association between the dependency chain and the specific risk indicator can be evaluated, thus providing a basis for risk quantification. :It is with Risk indicators Related feature vectors; it converts risk indicators into representations in low-dimensional space, which is convenient for mathematical operations and model processing; each feature vector contains multiple dimensions, each dimension represents a feature or attribute, reflecting the specific information of the risk indicator; through feature vectors, the model can more accurately capture and quantify the impact of risk indicators on dependency chains; : They are the dependency vectors and the eigenvector The L2 norm (i.e., Euclidean norm) of the vector is used to measure the length or modulus of the vector and is used to standardize the dot product calculation to ensure the effectiveness of the cosine similarity. By dividing by the L2 norm, the influence of the vector length can be eliminated and the focus can be placed on their directional similarity, thereby more accurately evaluating the correlation between the dependency chain and the risk indicator.

[0080] Here is a specific example: Assume there are three risk indicators The corresponding eigenvectors are ; The weights are ; Assumptions , calculated: ; Assume that the calculation results are: ; Quantitative risk characteristics This value reflects the dependency chain at the The risk level in each risk dimension. A lower quantitative risk characteristic value indicates that the risk of the dependency chain in this risk dimension is relatively small and the system is relatively stable; a higher quantitative risk characteristic value means that there is a greater potential risk and further attention and measures are needed to reduce the risk.

[0081] The weight of each indicator is dynamically adjusted according to the importance of different risk indicators, and adaptive learning rate and Bayesian optimization method are introduced to reflect the impact of different risk factors on the overall risk and generate risk weights; wherein, the risk weight Calculated by the following formula: ; in, is the risk weight, which is used to measure the difference between the predicted value and the actual value. is the mean of the loss function, is the standard deviation of the loss function, is the initial weight vector, is the optimal weight configuration obtained through Bayesian optimization, is the sample size, It is The predicted value of samples, It is The true label or target value of each sample is output by the model. is the square of the prediction error for each sample, is the weight matrix; The following is a detailed explanation of each parameter: : A dynamically adjusted risk weight vector; it optimizes the weight configuration of each risk indicator based on the historical performance of the loss function and current data, so that the model can more accurately reflect the impact of different risk factors on the overall risk; by introducing adaptive learning rate and Bayesian optimization method, the model can flexibly adjust the weights to improve the accuracy and robustness of risk assessment; : The mean of the loss function, which represents the historical average level of the difference between the model's predicted values ​​and the actual values; by comparing the current loss with the historical mean, the model can evaluate its own performance changes and adjust the weights accordingly to optimize future performance; : is the standard deviation of the loss function, which measures the magnitude of the change in the loss value; a larger standard deviation indicates that the loss fluctuates more and the model may not be stable enough; a smaller standard deviation means that the loss is more consistent and the model performance is more stable; by introducing the standard deviation, the model can respond more sensitively to changes in loss and adjust the weight configuration in a timely manner; : is the initial weight vector of the model; it is the starting point for weight adjustment, usually based on random initialization or pre-training results; through step-by-step optimization, the model can start from the initial weight vector and find the best weight configuration to minimize the loss function; : It is the optimal weight configuration obtained by Bayesian optimization or other optimization methods; it represents the weight combination that minimizes the loss function on a given data set; through continuous iterative optimization, the model can gradually approach this optimal configuration and improve the accuracy of the prediction; : is the total number of samples in the dataset; it is used to calculate the average loss, ensuring that the loss function reflects the performance of the entire dataset rather than the anomalies of individual samples; a larger number of samples can make the loss estimate more stable and reliable; :It is The predicted value of a sample is output by the model; it is the model's prediction result for the input data, which is used to compare with the true label to evaluate the model's prediction performance; : It is The true label or target value of each sample; it is the target predicted by the model and is used to measure the difference between the model prediction value and the actual situation; by comparing the predicted value and the true label, the accuracy of the model can be evaluated; :It is The square of the prediction error of each sample; it amplifies the impact of larger errors, making the model pay more attention to samples with larger prediction deviations; by minimizing the sum of squared prediction errors, the model can optimize its own parameters and improve the accuracy of predictions; : It is the weight matrix in the model, which is used to connect the neurons in the input layer and the hidden layer, or between the hidden layers; it determines the learning ability and expression ability of the model; through optimization algorithms such as gradient descent, the model can continuously adjust the weight matrix to minimize the loss function and improve the prediction performance.

[0082] Here is a specific example: Assuming the loss function has the mean , standard deviation , initial weight , the best weight configuration , sample size , the sum of squares of the prediction errors ; The value to be brought in is: ; Assuming the gradient , calculated: ; Risk weighted , these weights reflect the relative importance of different risk indicators in the overall risk assessment. A lower risk weight indicates that the risk indicator has less impact on the overall risk and the system is relatively stable; a higher risk weight means that there is a greater potential risk and further attention and measures are needed to reduce the risk.

[0083] Using the risk weights Quantitative risk characteristics Perform weighted calculations, introduce exponential decay and nonlinear terms to increase the expressiveness of the model, comprehensively evaluate the risk level of the dependency chain, and obtain the initial risk score ; Wherein, the initial risk score Calculated by the following formula: ; in, is the initial risk score, is the number of risk indicators, It is The adjusted weight of each risk indicator is and are the mean and standard deviation of the quantitative risk characteristics, is the shortest path distance between nodes in the dependency chain, and are the mean and standard deviation of the shortest path distance, respectively.

[0084] The following is a detailed explanation of each parameter: :The initial risk score of the dependency chain combines the influence of multiple risk indicators and their weights; it increases the expressiveness of the model by introducing exponential reduction and nonlinear terms, and reflects the overall risk level of the dependency chain; a lower initial risk score indicates that the risk of the dependency chain is relatively small and the system is relatively stable; a higher score means that there is a greater potential risk, which requires further attention and measures to reduce the risk; : Indicates the number of risk indicators; each risk indicator They are all measures of risk in a specific aspect of the dependency chain, such as the number of vulnerabilities, update frequency, supplier information, etc. By considering multiple risk indicators, the overall risk status of the dependency chain can be more comprehensively assessed; The size depends on the number of risk factors included in the specific application scenario; :It is The adjusted weights of the risk indicators are used to evaluate the risk. These weights reflect the relative importance of different risk indicators in the overall risk assessment. By dynamically adjusting the importance of each risk indicator, the model can better adapt to different application scenarios and ensure the accuracy and reliability of risk assessment results. The choice of weights can be optimized based on historical data or expert knowledge. : All quantitative risk characteristics The mean of , which indicates the average level of risk characteristics; It is the standard deviation of the quantitative risk characteristics, which measures the variation of the risk characteristic value. By introducing the mean and standard deviation, the model can standardize the quantitative risk characteristics, eliminate the impact of outliers, and enhance the sensitivity to risk changes. This helps to more accurately capture the distribution of risk characteristics, thereby improving the accuracy of risk assessment. : is the shortest path distance between nodes in a dependency chain; it measures the closeness of the connections between nodes in the dependency chain; shorter distances generally mean stronger dependencies and a higher likelihood of risk propagation, while longer distances may indicate weaker dependencies and a lower likelihood of risk propagation; by considering the shortest path distance, the model can more accurately assess the structural complexity and potential risks of dependency chains; and : is the shortest path distance The mean of , which indicates the average connection density between nodes in the dependency chain; is the standard deviation of the shortest path distance, which measures the magnitude of change in path distance. By introducing the mean and standard deviation, the model can standardize the shortest path distance, eliminate the impact of outliers, and enhance sensitivity to path changes. This helps to more accurately capture the structural characteristics of the dependency chain, thereby improving the accuracy of risk assessment.

[0085] Here is a specific example: Assume the mean of the quantitative risk characteristics , standard deviation , the mean of the shortest path distance , standard deviation , the specific shortest path distance ; Substituting specific values ​​into the above formula, we can get: ; The calculation results are: ; Through the above calculation, we get the initial risk score , this score reflects the overall risk level of the dependency chain. A lower initial risk score indicates that the risk of the dependency chain is relatively small and the system is relatively stable; a higher score means that there is a greater potential risk and further attention and measures are needed to reduce the risk. This assessment result can provide strong support for fields such as supply chain management and network security, helping decision makers better understand and respond to potential risks.

[0086] Figure 2A schematic diagram of a multi-source software supply chain intelligent analysis device (or system) is provided for an embodiment of the present application, such as Figure 2 As shown, the device comprises: The parsing module 21 is used to parse the identification information of the software component submitted by the user and extract the attribute characteristics of the software component from the identification information; A positioning module 22, configured to locate the node paths associated between the software components according to the attribute characteristics of the software components, so as to generate a dependency chain in the node path, assign a weight value to the dependency chain, and generate a weighted dependency chain list, wherein the dependency chain includes a direct dependency chain and an indirect dependency chain; A calculation module 23 is used to calculate the risk score of the dependency chain in the weighted dependency chain list by using a Bayesian network model combined with a predefined risk indicator system, and identify potential supply chain threat points using an anomaly detection algorithm to generate a risk report including an overall risk score and the supply chain threat points, wherein the supply chain threat points are key links or components that are used by attackers to undermine the integrity and security of software during software development, distribution and deployment; A drawing module 24 is used to draw a comprehensive risk map based on the risk report using a multidimensional visualization algorithm to obtain a risk view, and integrate a genetic algorithm and a simulated annealing algorithm to explore adjustment suggestions for high-risk areas of the risk view to generate a risk mitigation strategy; wherein the comprehensive risk map is grouped and displayed using a hierarchical clustering algorithm to display components with similar risk patterns, the risk pattern is a result obtained by performing a similarity judgment on the dependency chain, the supply chain threat point and the risk score, and the risk mitigation strategy is used to reduce the risk score of the software component.

[0087] Figure 2 The multi-source software supply chain intelligent analysis device can perform Figure 1 The implementation principle and technical effects of the multi-source software supply chain intelligent analysis method described in the illustrated embodiment are not described in detail. The specific manner in which each module and unit performs operations in the multi-source software supply chain intelligent analysis device in the above embodiment has been described in detail in the embodiment of the method, and will not be described in detail here.

[0088] In one possible design, Figure 2 The multi-source software supply chain intelligent analysis device of the embodiment shown can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32; The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0089] The processing component 32 is used for the above Figure 1 The multi-source software supply chain intelligent analysis method of the embodiment.

[0090] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component may also be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the above method.

[0091] The storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0092] Of course, the computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0093] The input / output interface provides an interface between the processing component and the peripheral interface module, which may be an output device, an input device, etc.

[0094] The communication component is configured to facilitate, among other things, wired or wireless communications between the computing device and other devices.

[0095] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. In this case, the computing device can refer to a cloud server, and the above-mentioned processing components, storage components, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0096] The present application also provides a computer storage medium storing a computer program, wherein the computer program can achieve the above-mentioned Figure 1 The multi-source software supply chain intelligent analysis method of the illustrated embodiment.

[0097] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0098] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0099] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A multi-source software supply chain intelligent analysis method, characterized in that: include: Parsing identification information of a software component submitted by a user, and extracting attribute features of the software component from the identification information; According to the attribute characteristics of the software components, the node paths associated between the software components are located to generate a dependency chain in the node path, and a weight value is assigned to the dependency chain to generate a weighted dependency chain list, wherein the dependency chain includes a direct dependency chain and an indirect dependency chain; A Bayesian network model is used in combination with a predefined risk indicator system to calculate the risk score of the dependency chain in the weighted dependency chain list, and an anomaly detection algorithm is used to identify potential supply chain threat points to generate a risk report containing an overall risk score and the supply chain threat points, wherein the supply chain threat points are key links or components that are used by attackers to undermine the integrity and security of software during software development, distribution and deployment; According to the risk report, a comprehensive risk map is drawn using a multidimensional visualization algorithm to obtain a risk view, and a genetic algorithm and a simulated annealing algorithm are integrated to explore adjustment suggestions for high-risk areas of the risk view to generate a risk mitigation strategy; wherein the comprehensive risk map is grouped and displayed using a hierarchical clustering algorithm to display components with similar risk patterns, the risk pattern is a result obtained by performing similarity judgment on the dependency chain, the supply chain threat point and the risk score, and the risk mitigation strategy is used to reduce the risk score of the software component.

2. The method according to claim 1, characterized in that The Bayesian network model is used in combination with a predefined risk indicator system to calculate the risk score of the dependency chain in the weighted dependency chain list, including: According to the Bayesian network model, the node paths in the weighted dependency chain list are vectorized using the Node2Vec or GraphSAGE graph embedding algorithm, and the component nodes, edge attributes and topological structures in the dependency chain are mapped to a low-dimensional vector space to obtain a dependency vector; Based on the dependency vector, the number of vulnerabilities, update frequency, and community activity indicators are normalized through a dynamic weight allocation strategy, where the weight of the number of vulnerabilities is dynamically adjusted according to the severity level of the CVE database, the update frequency weight is calculated by exponential decay in combination with the component version iteration cycle, and the community activity weight is generated based on linear interpolation of code submission frequency and issue response time to form a multi-dimensional weighted initial risk score; Using the dependency chain with assigned multi-dimensional weighted initial risk scores, the parent node risk probability in the Bayesian network is used as the feature input of the gradient boosting decision tree. Through feature engineering, component dependency depth, cross-ecological call relationship and license conflict type are extracted as additional features. The greedy algorithm is used to optimize the conditional probability convergence direction when the decision tree splits the node, and the optimized conditional probability is obtained. According to the optimized conditional probability, the Stacking ensemble learning method is used to perform meta-model fusion on the component vulnerability prediction results of the random forest classifier and the risk propagation coefficient prediction results of the LightGBM regressor. The weights of each base model are determined through cross-validation, and the risk assessment score of the dependency chain is output.

3. The method according to claim 1, characterized in that: The use of anomaly detection algorithms to identify potential supply chain threat points to generate a risk report containing an overall risk score and the supply chain threat points includes: Based on the overall risk score, the isolation forest algorithm is used to perform unsupervised clustering on the topological feature vectors of the dependency chain. Combined with the supply chain attack pattern characteristics recorded in the historical attack sample library, the dynamic percentile method based on the sliding window is used to set the abnormal threshold. When the vulnerability density of the component dependency path exceeds 3 times the standard deviation of similar components in the same period, it is marked as a threat point; The BERT pre-trained model is used to identify entities in security bulletins, and dependency syntactic analysis is used to extract triple information of CVE number, affected version range, and repair solution. The knowledge graph alignment technology is used to associate and match the extracted threat information with the component metadata in the software bill of materials, generating threat point details including the vulnerability propagation path. All the overall risk scores and threat point details are summarized and collated, and the Prophet time series model is used to seasonally decompose the component vulnerability disclosure frequency and the number of dependency changes. A risk trend prediction model is built based on the LSTM neural network, and the historical risk scores, component update intervals, and community discussion heat are used as input features to generate risk fluctuation prediction curves for the next three version cycles; Visualization tools are used to build a three-dimensional topological map through the ECharts framework to present the component dependency network, a Sankey diagram is used to visualize the risk propagation path, and D3.js force-directed graph is integrated to achieve dynamic focus display of high-risk nodes, generating an interactive risk report that includes a time dimension risk trend overlay layer and a threat point thermal distribution layer.

4. The method according to claim 2, characterized in that: The method utilizes the dependency chain with assigned multi-dimensional weighted initial risk scores, uses the parent node risk probability in the Bayesian network as the feature input of the gradient boosting decision tree, extracts component dependency depth, cross-ecological call relationship and license conflict type as additional features through feature engineering, and uses a greedy algorithm to optimize the conditional probability convergence direction when the decision tree splits the node, and obtains the optimized conditional probability, including: Collect and organize the low-dimensional vector representation of the dependency chain and the initial risk score, extract component dependency path depth, cross-ecosystem call frequency, and license conflict type as core features, build an extended feature set based on component version iteration interval, vulnerability repair response time, and developer contribution activity, standardize the features to eliminate dimensional differences, and screen out feature subsets that have a significant impact on risk propagation through feature importance analysis to generate a multi-dimensional feature training data set; Based on the Bayesian network model, the network parameters are initialized by analyzing the correlation between the risk status of the parent node and the dependency strength of the child node. The nonlinear fitting ability of the decision tree model is used to assist in establishing the initial mapping relationship between the conditional probabilities of the nodes. The parent node risk probability, component dependency depth, and cross-ecological call frequency are used as input features of the decision tree to build a joint training framework. Using the multi-dimensional feature training data set, an alternating optimization strategy is adopted to synchronously update the conditional probability table of the Bayesian network and the splitting rule of the decision tree, the deviation between the risk probability predicted by the model and the actual vulnerability disclosure record is calculated through the loss function, and the network weight and tree structure parameters are dynamically adjusted in combination with the back-propagation algorithm. In each iteration, the optimal splitting node is selected according to the greedy algorithm to optimize the convergence direction of the conditional probability until the model converges; According to the joint training results of the joint training framework, the conditional probabilities of the sub-nodes of the high-probability propagation paths in the Bayesian network are weighted and modified, and the probability distribution parameters are refined based on the component version compatibility data in the dependency chain and the statistical results of historical attack events. The optimized conditional probability values ​​are fed back to the Bayesian network to update the dependency strength between nodes and generate optimized conditional probabilities.

5. The method according to claim 3, characterized in that: Based on the overall risk score, the isolation forest algorithm is used to perform unsupervised clustering on the topological feature vectors of the dependency chain. Combined with the supply chain attack pattern characteristics recorded in the historical attack sample library, the dynamic percentile method based on the sliding window is used to set the abnormal threshold. When the vulnerability density of the component dependency path exceeds 3 times the standard deviation of similar components in the same period, it is marked as a threat point, including: According to the overall risk score, extract the topological feature vector of the dependency chain, including component node degree centrality, dependency path length, and cross-ecological call density, and combine the supply chain attack pattern characteristics recorded in the historical attack sample library to construct a multidimensional risk feature space, normalize the features to eliminate dimensional differences, and reduce the dimension through principal component analysis to improve computing efficiency, and generate an anomaly detection model adapted to the current software ecosystem; An unsupervised clustering algorithm is used to group topological feature vectors. The high-risk sample annotations in the historical attack sample library are combined to train an anomaly detection model. The algorithm parameters are optimized through model evaluation indicators to generate a detection model that can identify outliers in the multi-dimensional risk feature space. Based on the historical data of the dependency chain, the risk score distribution range of similar components under normal operation is counted, and the initial abnormality judgment boundary is set in combination with the high-risk sample set annotated by domain experts. The dynamic percentile method based on the sliding window is used to monitor the vulnerability disclosure frequency in the component warehouse update log in real time, and the abnormal feature dimension is dynamically expanded according to the newly emerged attack vector characteristics to generate a dynamic threshold that matches the current threat environment; The anomaly detection model is combined with dynamic thresholds to analyze the risk score mutation phenomenon during component version iteration in the dependency chain, and to identify compound threat points that simultaneously meet the requirements of topological structure anomaly, excessive vulnerability density, and delayed community repair response. When the vulnerability density of a component dependency path exceeds three times the standard deviation of similar components in the same period, it is marked as a supply chain threat point and a supply chain threat point list is generated.

6. The method according to claim 1, characterized in that According to the risk report, a comprehensive risk map is drawn using a multi-dimensional visualization algorithm to obtain a risk view, including: According to the risk report, integrating dependency chain topology data, threat point spatial location information and risk score time series, constructing a structured dataset containing component coordinates, risk level labels and threat propagation direction vectors; Using a multi-dimensional visualization algorithm, the dependency chain is mapped as a connection line in three-dimensional space, the risk score is converted into a node size parameter, and the threat point location is marked as a pulse signal marker to generate an interactive spatial distribution map; Based on the visualization, density-aware clustering technology is used to automatically identify high-risk component clustering areas, and risk pattern groups are generated according to the component development team, license type, and vulnerability history similarity, to achieve a hierarchical display of threat propagation paths. Combined with the network topology, a ring layout algorithm is designed to optimize node arrangement, gradient color coding is used to represent the risk trend changes in different time windows, and focus + context visualization technology is integrated to achieve scalable display of large-scale dependent networks, generating a comprehensive risk map with multi-dimensional characteristics of time and space; The intensity of vulnerability transmission between components is displayed through the overlay of thermal maps, and the risk diffusion path in the supply chain is presented using dynamic streamline diagrams. The risk node penetration query function is provided to reveal the underlying threat evidence chain and form an actionable risk view.

7. The method according to claim 1, characterized in that The step of locating the node paths associated between the software components according to the attribute characteristics of the software components to generate a dependency chain in the node path, assigning a weight value to the dependency chain, and generating a weighted dependency chain list includes: Using the parsed software component identification information submitted by users, structural attribute features including version number, build tool type and dependency declaration file format are extracted; According to the attribute characteristics of the software components, a multi-level index model of component dependencies is established, and the explicitly declared dependencies and implicitly derived dependencies are identified through a dependency resolution engine to generate a dependency network including version constraints; Based on the dependency network, the dynamically loaded third-party library call records in the build process are traced, the interface call paths covered by the test cases are analyzed, and the actual effective dependencies are verified in combination with the continuous integration logs to generate dependency chain records accurate to the specific call links; Classify the dependency chain records, divide direct and indirect dependencies according to whether the dependency introduction method is required for the development environment and whether it is mandatory to load at runtime, assign exponentially increasing propagation weights to deeply nested cross-ecological dependencies, and generate a preliminary weighted dependency chain; Based on the risk report, a weight correction rule engine is established to dynamically adjust the weight coefficient according to the reputation rating of the component maintainer, the binary file signature verification status and the security factors of the dependency locked file integrity. The rationality of the weight distribution is verified through dependency propagation simulation, and finally a weighted dependency chain list is generated after multiple rounds of iterative optimization.

8. A multi-source software supply chain intelligent analysis system, characterized in that: include: A parsing module, used to parse the identification information of the software component submitted by the user, and extract the attribute characteristics of the software component from the identification information; A positioning module, used to locate the node paths associated between the software components according to the attribute characteristics of the software components, so as to generate a dependency chain in the node path, assign a weight value to the dependency chain, and generate a weighted dependency chain list, wherein the dependency chain includes a direct dependency chain and an indirect dependency chain; A calculation module, for calculating the risk score of the dependency chain in the weighted dependency chain list by using a Bayesian network model combined with a predefined risk indicator system, and identifying potential supply chain threat points by using an anomaly detection algorithm to generate a risk report including an overall risk score and the supply chain threat points, wherein the supply chain threat points are key links or components that are exploited by attackers to undermine the integrity and security of software during software development, distribution and deployment; A drawing module is used to draw a comprehensive risk map based on the risk report using a multidimensional visualization algorithm to obtain a risk view, and integrate a genetic algorithm and a simulated annealing algorithm to explore adjustment suggestions for high-risk areas of the risk view to generate a risk mitigation strategy; wherein the comprehensive risk map is grouped and displayed using a hierarchical clustering algorithm to display components with similar risk patterns, the risk pattern is the result obtained by similarity judgment of the dependency chain, the supply chain threat point and the risk score, and the risk mitigation strategy is used to reduce the risk score of the software component.

9. A computing device, characterized in that It comprises a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a multi-source software supply chain intelligent analysis method as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that: A computer program is stored, and when the computer program is executed by a computer, a multi-source software supply chain intelligent analysis method as described in any one of claims 1 to 7 is implemented.

Images