Open source software monitoring system and method, computer equipment and storage medium

Abstract

The invention relates to the field of network technology and security technology, and discloses an open source software monitoring system and method, computer equipment and a storage medium, and the system comprises the following steps: an agent module transmits a request of a packaging server to a man-in-the-middle module through an agent; the man-in-the-middle module converts the request into an http request and transmits the http request to the analysis module; the analysis module analyzes the http request and transmits the information of the open source software to the control module; the control module is used for reporting the information of the open source software to the management platform; the management platform is used for acquiring a forbidding rule and sending the forbidding rule to the control module; the control module is used for limiting the downloading request of the open source software; the management platform is also used for sending alarm information. According to the method, the key node of the corresponding software downloading protocol is analyzed in an agent mode to obtain the software package information, whether the software is forbidden or not is judged, and an alarm is given in time, so that the effects of improving troubleshooting efficiency and avoiding mistakes and omissions are achieved, and whether dependency residues on the open source software still exist or not is confirmed.

Description

Technical Field

[0001] The present invention relates to the field of network technology and security technology, and in particular to an open source software monitoring system, method, computer equipment and storage medium. Background Art

[0002] With the rapid development of the Internet, open source code has become the mainstream, and it continues to lead the innovation of new global information technology. However, there are still many hidden dangers in open source code, such as code vulnerabilities, malicious code, commercial restrictions of open source agreements, etc. The negligence of these issues often causes huge losses to enterprises. At present, the security issues of open source software usually rely on manual self-inspection and rectification. Usually, when the security risks of open source software are identified, the security department will conduct internal publicity, which mainly relies on the relevant technical personnel to check themselves and rely on the feedback of technical personnel to form a closed loop.

[0003] In the related technology, the current method of manual investigation relies on manual self-initiative. Due to the common multi-layer dependency problem of open source code, it is very likely that the open source software directly used by the technicians depends on the open source software with security risks. This increases the difficulty of manual investigation, resulting in the current investigation method not only being inefficient and prone to omissions, but also the security department being unable to obtain accurate results, which ultimately leads to the project being launched with problems, leaving security risks and business risks. Therefore, a method is needed to help the security department obtain the dependency information of open source software within the enterprise and block the use of problematic open source software. Summary of the invention

[0004] In view of this, the present invention provides an open source software monitoring system, method, computer device and storage medium to solve the problem of lack of means to obtain dependency information of open source software within an enterprise and block the use of problematic open source software.

[0005] In a first aspect, the present invention provides an open source software monitoring system, the system comprising a management platform, an agent module, a middleman module, a parsing module and a control module:

[0006] The proxy module is deployed on the packaging server, and transmits the packaging server's request to the middleman module through the proxy. The packaging server is used to provide dependency download and compilation services for open source software;

[0007] The middleman module is used to convert the request into an http request and pass the http request to the parsing module;

[0008] The parsing module is used to parse the http request according to the http request, obtain the information of the open source software corresponding to the http request, and transmit the information of the open source software to the control module;

[0009] A control module, used to report the information of open source software to the management platform;

[0010] The management platform is used to obtain the disabling rules and send the disabling rules to the control module;

[0011] A control module, used to restrict download requests for open source software according to the prohibition rules;

[0012] The management platform is also used to send alarm information based on the information of the open source software, combined with the information of the packaging server and the disabling rules.

[0013] In the present invention, through the management platform, proxy module, middleman module, parsing module and control module, the software dependency download interruption can be realized without implementing the software package download protocol. Through the proxy method, only the key nodes of the corresponding software download protocol need to be parsed to obtain the software package information, and then it can be determined whether the software is disabled, and the download request can be determined whether the request is interrupted. When the management platform receives an abnormal situation, it can promptly alert the security personnel of the enterprise to avoid security vulnerabilities and intellectual property risks caused by the use of open source software by the enterprise, thereby achieving the effect of improving the troubleshooting efficiency and avoiding errors and omissions, and can confirm whether there is still a residual dependence on the open source software by reporting the information closed loop.

[0014] In an optional implementation, the proxy module is used to set transparent proxy rules on the packaging server, and guide the request on the packaging server to the http port corresponding to the parsing module through the transparent proxy rules.

[0015] In this way, the proxy module is used to set transparent proxy rules on the packaging server, so that the requests on the packaging server can be directed to the parsing module, thereby facilitating the collection of software dependency information. While ensuring the real-time and validity of the collected information, the request can be terminated to avoid accidents caused by omissions.

[0016] In an optional implementation, the middleman module is used to start a TCP listening service and identify whether the request is a TCP request; when the request is a TCP request, the TCP request is converted into an HTTP request and the HTTP request is passed to the parsing module; when the request is a non-TCP request, the request is passed to the parsing module.

[0017] In this method, the TCP listening service is started through the middleman module, and when the request is a TCP request, the TCP request is converted into an HTTP request, and the request is passed to the parsing module to facilitate the subsequent collection of software dependency information.

[0018] In an optional implementation, the parsing module is used to use preset request parsing rules to determine whether the http request is a download request for open source software; when the http request is a download request for open source software, the http request is parsed according to the proxy protocol corresponding to the http request, the information of the open source software corresponding to the http request is obtained, and the information of the open source software is transmitted to the control module; when the http request is a download request for non-open source software, the proxy module is notified to forward the http request.

[0019] In this method, information is collected by parsing the key nodes of the open source proxy protocol through a parsing module, which achieves lightweight information collection while supporting multiple programming languages ​​at the same time. There is no need to additionally implement the open source proxy protocol to do tasks such as storing open source software packages.

[0020] In an optional implementation, the control module is used to determine whether the information of the open source software triggers the disabling rules based on the disabling rules. When the information of the open source software triggers the disabling rules, the download request of the open source software is controlled to be terminated or forwarded, and the information of the open source software is sent to the management platform.

[0021] In this way, the control module determines whether the information of the open source software triggers the disabling rules, thereby limiting the download requests of the open source software according to the disabling rules. The download requests for the disabled open source software can be forcibly terminated through the preset configuration, thereby avoiding the enterprise project from going online with problems.

[0022] In a second aspect, the present invention provides an open source software monitoring method, which is applied to an open source software monitoring system as described in any one of the first aspects, wherein the system includes a management platform, an agent module, a middleman module, a parsing module, and a control module, and the method includes:

[0023] The request of the packaging server is transmitted to the middleman module through the proxy. The packaging server is used to provide dependency download and compilation services for open source software;

[0024] Convert the request into an http request and pass the http request to the parsing module;

[0025] According to the http request, the http request is parsed to obtain the information of the open source software corresponding to the http request, and the information of the open source software is transmitted to the control module;

[0026] Report open source software information to the management platform;

[0027] Obtaining the disabling rules, and sending the disabling rules to the control module;

[0028] Restrict download requests for open source software based on the prohibition rules;

[0029] Based on the information of open source software, combined with the information of packaging server and disabling rules, alarm information is sent.

[0030] In the present invention, the automatic collection of dependency information of open source software is realized, which greatly improves the efficiency compared with manual identification, and the data is true and reliable. Timely reporting and alarming of dependency information of open source software can obtain intuitive feedback, identify which open source software is in use, which is at risk, and which disabled open source software still has dependencies. Download requests for disabled open source software can be forcibly terminated through preset configuration to avoid the project going online with problems due to negligence of technical personnel. At the same time, it is non-invasive to the code and has the characteristics of real-time performance. When using this service for local development, you can get real-time feedback on the disabling of software dependencies during development, and projects or codes that are no longer used will not waste resources for related processing. Avoid the legal risks caused by the use of open source software that is not commercially available open source protocol, and block the impact of security vulnerabilities of open source software on the software system.

[0031] In an optional implementation, according to the http request, the http request is parsed to obtain information of the open source software corresponding to the http request, including:

[0032] Use the preset request parsing rules to determine whether the http request is a download request for open source software;

[0033] When the http request is a download request for open source software, the http request is parsed according to the proxy protocol corresponding to the http request, the information of the open source software corresponding to the http request is obtained, and the information of the open source software is transmitted to the control module;

[0034] When HTTP requests a download request for non-open source software, the proxy module is notified to forward the HTTP request.

[0035] In this method, the information of the open source software is parsed by performing pattern recognition on the request. There is no need to implement the open source proxy protocol to perform tasks such as storage of the open source software package. It can be relatively easily expanded to support multiple programming languages ​​and corresponding proxy protocols.

[0036] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the open source software monitoring method of the above-mentioned second aspect or any corresponding embodiment thereof by executing the computer instructions.

[0037] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the open source software monitoring method of the second aspect or any corresponding embodiment thereof.

[0038] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions, wherein the computer instructions are used to enable a computer to execute the open source software monitoring method of the above-mentioned second aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 Schematic diagram of the structure of an open source software monitoring system according to an embodiment of the present invention.

[0041] Figure 2 1 is a schematic diagram of the architecture of an open source software monitoring system according to an embodiment of the present invention.

[0042] Figure 3 It is a flowchart of an open source software monitoring method according to an embodiment of the present invention.

[0043] Figure 4 The figure is a flowchart of request parsing according to an embodiment of the present invention.

[0044] Figure 5 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0046] In the related technology, the current method of manual investigation relies on manual self-initiative. Due to the common multi-layer dependency problem of open source code, it is very likely that the open source software directly used by the technicians depends on the open source software with security risks. This increases the difficulty of manual investigation, resulting in the current investigation method not only being inefficient and prone to omissions, but also the security department being unable to obtain accurate results, which ultimately leads to the project being launched with problems, leaving security risks and business risks. Therefore, a method is needed to help the security department obtain the dependency information of open source software within the enterprise and block the use of problematic open source software.

[0047] In order to solve the above problems, an open source software monitoring system is provided in an embodiment of the present invention. The open source software monitoring system in this embodiment is suitable for the use scenario of discovering and monitoring the dependencies of project open source software. The open source software monitoring system provided by the present invention can realize the interruption of software dependency downloading without implementing the download protocol of the software package through the management platform, the proxy module, the middleman module, the parsing module and the control module. By means of the proxy, it is only necessary to parse the key nodes of the corresponding software download protocol to obtain the software package information, and it is possible to determine whether the software is disabled, and determine whether the download request is interrupted. When the management platform receives an abnormal situation, it can promptly alert the relevant security personnel of the enterprise to avoid security vulnerabilities and intellectual property risks caused by the use of open source software by the enterprise, thereby achieving the effect of providing troubleshooting efficiency and avoiding errors and omissions, and can confirm whether there is still residual dependence on the open source software by reporting the information closed loop.

[0048] According to an embodiment of the present invention, an open source software monitoring system embodiment is provided. Figure 1 is a schematic diagram of the structure of an open source software monitoring system according to an embodiment of the present invention. Figure 1 As shown, the open source software monitoring system includes: a management platform 5, an agent module 1, a middleman module 2, a parsing module 3 and a control module 4: the agent module 1 is deployed on the packaging server, and transmits the request of the packaging server to the middleman module 2 through the agent, and the packaging server is used to provide dependency download and compilation services of the open source software; the middleman module 2 is used to convert the request into an http request, and pass the http request to the parsing module 3; the parsing module 3 is used to parse the http request according to the http request, obtain the information of the open source software corresponding to the http request, and transmit the information of the open source software to the control module 4; the control module 4 is used to report the information of the open source software to the management platform 5; the management platform 5 is used to obtain the disabling rules and send the disabling rules to the control module 4; the control module 4 is used to restrict the download request of the open source software according to the disabling rules; the management platform 5 is also used to send alarm information based on the information of the open source software, combined with the information of the packaging server and the disabling rules.

[0049] In one example, Figure 2 is a schematic diagram of the architecture of an open source software monitoring system according to an embodiment of the present invention. Figure 2As shown, the monitoring system of open source software includes: management platform 5, proxy module 1, middleman module 2, parsing module 3, and control module 4. Proxy module 1 forwards the open source software request of the packaging server to middleman module 2; middleman module 2 is responsible for forwarding and converting TCP requests; parsing module 3 parses the programming language, version number, open source protocol and other information of the open source software that the TCP request depends on according to the proxy protocol of various programming languages, and submits it to control module 4; control module 4 reports it to management platform 5. Management platform 5 is used to view the information of open source software reported by control module 4, and initiate an alarm when receiving problematic open source software. At the same time, the name, version number and open source protocol of the open source software package that needs to be restricted can be sent to control module 4. Control module 4 can limit the download requests of these open source software according to these configurations, thereby avoiding the enterprise project from going online with problems.

[0050] The management platform 5 performs open source software management including: viewing the historical information of the open source software reported by the control module 4 on the management platform 5, including programming language, version number, open source protocol, request time, request device and other information; and disabling some open source software by sending the disabling configuration of the open source software to the control module 4, including configuring the open source software package name, version number, and open source protocol. Table 1 is the instruction table sent by the management platform 1. As shown in Table 1, the instructions sent by the management platform 1 include: RuleId disabling rule ID; Act action, including blacklist and deletion rules; Type disabling method, including protocol and package version; Licenses disabled protocol array; PackageName disabled software package name; PackageVersion disabled software package version.

[0051] Table 1

[0052] RuleId Disable Rule ID Act Actions, including blacklist and deletion rules Type Disabling methods, including protocols and package versions Licenses Array of disabled protocols PackageName Disabled package name PackageVersion Disabled package versions

[0053] The preset forwarding rules of the proxy module 1 include: the proxy module 1 is deployed on the packaging service, which refers to the service that needs to use the code open source dependency download and compilation. Usually, the automatic packaging form of the pipeline within the enterprise will hand over the code compilation link to a specific server for processing. By setting iptables rules on the packaging server, the proxy module 1 can guide the open source software download request on the packaging server to the parsing module 3.

[0054] The middleman module 2 parses the TCP request including: the middleman module 2 parses the TCP request, converts it into an upper-layer HTTP request, other requests will be directly forwarded, and the parsed HTTP request will be passed to the parsing module 3.

[0055] The analysis module 3 analyzes the software proxy request, including: the analysis module 3 receives the http request converted by the middleman module 2, and uses the preset request analysis rules to distinguish whether it is a download request for open source software. If not, directly notify the proxy module 1 to forward the request normally; if so, parse the package name, version number, open source protocol, historical version number and other information of the open source software according to the proxy protocol of the specific programming language, and pass the corresponding information to the control module 4.

[0056] The control module 4 processes the open source software information, including: the parsing module 3 notifies the control module 4 of the open source software information through code calls, the control module 4 is responsible for reporting the open source software information to the management platform 5, receiving the open source software disabling configuration of the management platform 5, and further controlling the termination or forwarding of the request according to the disabling configuration.

[0057] The management platform 5 issues an alarm for the use of open source software, including: when the management platform 5 receives the open source software reported by the control module 4, if the disabling rule is triggered, an alarm message will be sent to the security personnel, and the security personnel will obtain the open source software information, requested equipment, and triggered disabling rules in a timely manner, so as to facilitate the investigation and repair of the reference problem of the open source software.

[0058] In an optional implementation, the proxy module 1 is used to set a transparent proxy rule on the packaging server, and guide the request on the packaging server to the http port corresponding to the parsing module 3 through the transparent proxy rule.

[0059] In one example, the proxy module 1 presets forwarding rules including: the proxy module 1 is deployed on a packaging service, wherein the packaging service refers to a service that requires downloading and compiling code open source dependencies. Usually, the automatic packaging of the pipeline within the enterprise will hand over the code compilation process to a specific server. By setting transparent proxy rules on the packaging server, the proxy module 1 can guide the open source software download request on the packaging server to the parsing module 3.

[0060] Specifically, the transparent proxy is set up through iptables to guide the tcp request to the http port corresponding to the parsing module 3 to implement the proxy. Taking 192.168.0.106:8080 as the address and port of the http service of the middleman module 2, the specific command is: iptables-t nat-AOUTPUT-p tcp-j DNAT--to-destination 192.168.0.106:8080. In addition, during the research and development process, you can also actively set the proxy to the middleman module 2. For example, when programming in the go language, set the environment variable GOPROXY to http: / / 192.168.0.106:8080 to implement forwarding.

[0061] In this way, the proxy module is used to set transparent proxy rules on the packaging server, so that the requests on the packaging server can be directed to the parsing module, thereby facilitating the collection of software dependency information. While ensuring the real-time and validity of the collected information, the request can be terminated to avoid accidents caused by omissions.

[0062] In an optional implementation, the middleman module 2 is used to start the TCP listening service and identify whether the request is a TCP request; when the request is a TCP request, the TCP request is converted into an HTTP request and the HTTP request is passed to the parsing module 3; when the request is not a TCP request, the request is passed to the parsing module 3.

[0063] In one example, the middleman module 2 parses the http request, including: the middleman module 2 starts a tcp listening service to process all http and https protocol requests, where the https request uses a self-signed certificate. In the self-signed certificate, the verification information is different from the ordinary certificate, and the binding information of the certificate is bound to the IP information of the middleman module 2. The specific certificate generation rules are: use the CA certificate generated by yourself and the SSL server certificate used by the middleman module 2, where the SSL server certificate binding information is the public and private IP addresses of the middleman module 2, and use the CA to sign the SSL server certificate. The CA corresponding to the certificate needs to be set in advance to the trusted CA list of the packaging server.

[0064] The middleman module 2 forwards the request and parses the http request and return information. If the source station returns an exception, it returns to the upstream normally; if the source station returns normally, it passes the meta information of the request to the parsing module 3. Table 2 is a meta information table of the request. As shown in Table 2, the meta information of the request may include: Path request path; Method request type, such as Get, Post; Domain request domain name; RequestBody request parameters; ResponseBody return parameters.

[0065] Table 2

[0066] Path Request path Method The type of request, such as Get, Post Domain Requested domain name RequestBody Request Parameters ResponseBody Return Parameter

[0067] In this method, the TCP listening service is started through the middleman module, and when the request is a TCP request, the TCP request is converted into an HTTP request, and the request is passed to the parsing module to facilitate the subsequent collection of software dependency information.

[0068] In an optional implementation, the parsing module 3 is used to use preset request parsing rules to determine whether the http request is a download request for open source software; when the http request is a download request for open source software, the http request is parsed according to the proxy protocol corresponding to the http request, the information of the open source software corresponding to the http request is obtained, and the information of the open source software is transmitted to the control module 4; when the http request is a download request for non-open source software, the proxy module 1 is notified to forward the http request.

[0069] In one example, parsing module 3 parses software proxy requests including: parsing module 3 receives http request converted by middleman module 2, and uses preset request parsing rules to distinguish whether it is a download request for open source software; if not, directly notifies proxy module 1 to forward the request normally; if so, parses the package name, version number, open source protocol, historical version number and other information of the open source software according to the proxy protocol of the specific programming language, and passes the corresponding information to control module 4.

[0070] For example, when downloading a software package, the npm package management system of nodejs will call the request of https: / / registry.npmmirror.com / acorn-dynamic-import / 1.0.0. The requested Path is acorn-dynamic-import / 1.0.0, the Method is Get, the Domain is registry.npmmirror.com, the RequestBody is empty, and the ResponseBody is a json string containing package information "{"name":"acorn-dynamic-import","description":"Support dynamic imports in acorn","main":"index.js"..."

[0071] Parsing module 3 can judge that it is an npm package and the language is nodejs according to the result returned by ResponseBody. The package name is obtained from the name field of json in ResponseBody: acorn-dynamic-import, the version number is obtained from the version field: 1.0.0, and the open source agreement is parsed from the license field: MIT. The historical version information is obtained by requesting https: / / registry.npmmirror.com / acorn-dynamic-import.

[0072] For example, in the go language, when using the go get command to download a software package, a request to https: / / proxy.golang.com.cn / github.com / sirupsen / logrus / @v / v1.8.1.mod will be called. The requested Path is github.com / sirupsen / logrus / @v / v1.8.1.mod, the Method is Get, the Domain is proxy.golang.com.cn, the RequestBody is empty, and the ResponseBody is the string "module github.com / sirupsen / logrus..."

[0073] Parsing module 3 can determine that it is a go language package and the language is go through the information such as the module carried by ResponseBody and the supported go version. Through the go language package proxy rules, the module of ResponseBody can be judged to have the package name: github.com / sirupsen / logrus, and compared with the Path, the version number is parsed as: v1.8.1, and the package file is obtained by requesting the https: / / proxy.golang.com.cn / github.com / sirupsen / logrus / @v / v1.8.1.zip interface, decompressing it to obtain the LICENSE file, parsing the open source agreement as: MIT, and obtaining the historical version by calling https: / / proxy.golang.com.cn / github.com / sirupsen / logrus / @v / list.

[0074] In this method, information is collected by parsing the key nodes of the open source proxy protocol through a parsing module, which achieves lightweight information collection while supporting multiple programming languages ​​at the same time. There is no need to additionally implement the open source proxy protocol to do tasks such as storing open source software packages.

[0075] In an optional embodiment, the control module 4 is used to determine whether the information of the open source software triggers the disabling rules based on the disabling rules. When the information of the open source software triggers the disabling rules, the download request of the open source software is controlled to be terminated or forwarded, and the information of the open source software is sent to the management platform 5.

[0076] In one example, the control module 4 processes the open source software information including: the parsing module 3 notifies the control module 4 of the open source software information through code calls, wherein the open source software information includes programming language: Language, package name: PackageName, open source agreement: License, version in use: PackageVersion, and history version: HistoryVersions; the control module 4 communicates with the management platform 5 through grpc connection, reports the open source software information to the management platform 5, receives the open source software disabling configuration of the management platform 5, and further determines whether to trigger the disabling rule according to the disabling configuration, and controls whether to terminate or forward the request. For example, if the disabling rule is to disable the AGPL and GPL agreements, and the open source agreement of the package is AGPL, the request is interrupted.

[0077] The management platform 1 issues an alarm for the use of open source software, including: when the management platform 1 receives the open source software reported by the control module 4, if the disabling rule is triggered, an alarm message will be sent to the security personnel, so that the security personnel can obtain the open source software information, request equipment, and triggered disabling rules in time, so as to facilitate the investigation and repair of the reference problem of the open source software.

[0078] In this way, the control module determines whether the information of the open source software triggers the disabling rules, thereby limiting the download requests of the open source software according to the disabling rules. The download requests for the disabled open source software can be forcibly terminated through the preset configuration, thereby avoiding the enterprise project from going online with problems.

[0079] The open source software monitoring system provided in this embodiment can interrupt the software dependency download through the management platform, proxy module, middleman module, parsing module and control module without implementing the software package download protocol. It only needs to parse the key nodes of the corresponding software download protocol to obtain the software package information through the proxy method, and then it can be determined whether the software is disabled and whether the download request is interrupted. When the management platform receives an abnormal situation, it can promptly notify the security personnel of the enterprise to avoid security vulnerabilities and intellectual property risks caused by the use of open source software by the enterprise, thereby achieving the effect of improving the troubleshooting efficiency and avoiding errors and omissions, and can confirm whether there is still a residual dependence on the open source software through the closed loop of reporting information.

[0080] In this embodiment, a method for monitoring open source software is provided, which can be used in the above-mentioned open source software monitoring system. The system includes a management platform, an agent module, a middleman module, a parsing module, and a control module. Figure 3 is a flow chart of an open source software monitoring method according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0081] Step S301, transmitting the request of the packaging server to the middleman module through the proxy.

[0082] In an embodiment of the present invention, the packaging server is used to provide dependency downloading and compiling services for open source software.

[0083] Step S302, convert the request into an http request, and pass the http request to the parsing module.

[0084] Step S303: according to the http request, the http request is parsed to obtain the information of the open source software corresponding to the http request, and the information of the open source software is transmitted to the control module.

[0085] In an optional implementation, according to the http request, the http request is parsed to obtain information of the open source software corresponding to the http request, including:

[0086] Step a1: using preset request parsing rules to determine whether the http request is a download request for open source software.

[0087] Step a2, when the http request is a download request for open source software, the http request is parsed according to the proxy protocol corresponding to the http request, the information of the open source software corresponding to the http request is obtained, and the information of the open source software is transmitted to the control module.

[0088] Step a3: when an HTTP request is made for downloading non-open source software, the proxy module is notified to forward the HTTP request.

[0089] In this method, the information of the open source software is parsed by performing pattern recognition on the request. There is no need to implement the open source proxy protocol to perform tasks such as storage of the open source software package. It can be relatively easily expanded to support multiple programming languages ​​and corresponding proxy protocols.

[0090] Step S304: reporting the information of the open source software to the management platform.

[0091] Step S305, obtaining a disabling rule, and sending the disabling rule to the control module.

[0092] Step S306: restricting the download request of the open source software according to the prohibition rule.

[0093] Step S307: Send warning information based on the information of the open source software, combined with the information of the packaging server and the disabling rules.

[0094] In one implementation scenario, Figure 4 is a schematic diagram of a request parsing process according to an embodiment of the present invention, such as Figure 4As shown, the process of request parsing may include: directing the TCP request to the proxy module; determining whether the request is an HTTP protocol, and forwarding the request to the source station when the request is a non-HTTP protocol; parsing the TCP request as an HTTP request when the request is an HTTP protocol; determining whether the HTTP request is an open source protocol, and forwarding the request to the source station when the HTTP request is a non-open source protocol; parsing the open source software information when the HTTP request is an open source protocol; reporting the open source software information to the management platform to determine whether to disable the open source software; forwarding the request to the source station when the open source software is not disabled; and terminating the request when the open source software is disabled.

[0095] The open source software monitoring method provided in this embodiment realizes the automatic collection of dependency information of open source software, greatly improves efficiency compared with manual identification, and the data is authentic and reliable. Timely reporting and alarming of dependency information of open source software can obtain intuitive feedback, identify which open source software is in use, which is at risk, and which disabled open source software still has dependencies. Download requests for disabled open source software can be forcibly terminated through preset configuration to avoid the project going online with problems due to negligence of technical personnel. At the same time, it is non-invasive to the code and has the characteristics of real-time performance. When using this service for local development, you can obtain real-time feedback on the disabling of software dependencies during development, and projects or codes that are no longer used will not waste resources for related processing. Avoid the legal risks caused by the use of open source software that is not commercially available open source protocol, and block the impact of security vulnerabilities of open source software on the software system.

[0096] The embodiment of the present invention also provides a computer device for executing the above Figure 3 The open source software monitoring method shown.

[0097] See also Figure 5 , Figure 5 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 5 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 5A processor 10 is taken as an example.

[0098] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0099] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0100] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0101] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0102] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 5 The example of connecting through bus is taken in the following.

[0103] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0104] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0105] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0106] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. An open source software monitoring system, characterized in that: The system includes a management platform, an agent module, a middleman module, a parsing module and a control module: The proxy module is deployed on a packaging server, and transmits the request of the packaging server to the middleman module through the proxy. The packaging server is used to provide dependency download and compilation services of open source software; The middleman module is used to convert the request into an http request and pass the http request to the parsing module; The parsing module is used to parse the http request according to the http request, obtain information of the open source software corresponding to the http request, and transmit the information of the open source software to the control module; The control module is used to report the information of the open source software to the management platform; The management platform is used to obtain the disabling rule and send the disabling rule to the control module; The control module is used to restrict the download request of the open source software according to the disabling rule; The management platform is also used to send alarm information based on the information of the open source software, combined with the information of the packaging server and the disabling rule.

2. The system according to claim 1, characterized in that The proxy module is used to set transparent proxy rules on the packaging server, and through the transparent proxy rules, the requests on the packaging server are guided to the http port corresponding to the parsing module.

3. The system according to claim 1, characterized in that The middleman module is used to start the TCP listening service and identify whether the request is a TCP request; if the request is a TCP request, convert the TCP request into an HTTP request and pass the HTTP request to the parsing module; When the request is not a TCP request, the request is passed to the parsing module.

4. The system according to claim 1, characterized in that The parsing module is used to use preset request parsing rules to determine whether the http request is a download request for open source software; when the http request is a download request for open source software, the http request is parsed according to the proxy protocol corresponding to the http request to obtain information about the open source software corresponding to the http request, and the information about the open source software is transmitted to the control module; When the http request is a download request for non-open source software, the proxy module is notified to forward the http request.

5. The system according to claim 1, characterized in that The control module is used to determine whether the information of the open source software triggers the disabling rule based on the disabling rule. When the information of the open source software triggers the disabling rule, the control module controls the download request of the open source software to be terminated or forwarded, and sends the information of the open source software to the management platform.

6. A method for monitoring open source software, characterized in that: Applied to the open source software monitoring system according to any one of claims 1 to 5, the system comprises a management platform, an agent module, a middleman module, a parsing module, and a control module, and the method comprises: Transmitting the request of the packaging server to the middleman module through a proxy, the packaging server is used to provide dependency download and compilation services of the open source software; Convert the request into an http request, and pass the http request to the parsing module; According to the http request, the http request is parsed to obtain information of the open source software corresponding to the http request, and the information of the open source software is transmitted to the control module; Reporting the information of the open source software to the management platform; Acquire a disabling rule, and send the disabling rule to the control module; According to the prohibition rule, restricting download requests for the open source software; Based on the information of the open source software, combined with the information of the packaging server and the disabling rule, an alarm message is sent.

7. The method according to claim 6, characterized in that The step of parsing the http request according to the http request to obtain information of the open source software corresponding to the http request includes: Using preset request parsing rules, determine whether the http request is a download request for open source software; When the http request is a download request for open source software, the http request is parsed according to a proxy protocol corresponding to the http request to obtain information of the open source software corresponding to the http request, and the information of the open source software is transmitted to the control module; When the http request is a download request for non-open source software, the proxy module is notified to forward the http request.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the open source software monitoring method according to any one of claims 6 to 7 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the open source software monitoring method according to any one of claims 6 to 7.

10. A computer program product, characterized in that The method comprises computer instructions for causing a computer to execute the open source software monitoring method according to any one of claims 6 to 7.

Images