Open source software monitoring system, method, computer device and storage medium

Abstract

The application relates to the fields of network technology and security technology, and discloses an open source software monitoring system and method, a computer device and a storage medium.The system comprises the following: a proxy module which transmits the request of a packaged server to an intermediate module through a proxy; the intermediate module which converts the request into an http request and transmits the http request to an analysis module; the analysis module which analyzes the http request and transmits the information of the open source software to a control module; the control module which is used for reporting the information of the open source software to a management platform; the management platform which is used for obtaining a disabling rule and sending the disabling rule to the control module; the control module which is used for limiting the download request of the open source software; and the management platform which is further used for sending alarm information.The application obtains the software package information by analyzing the key nodes of the corresponding software download protocol in the proxy mode, judges whether the software is disabled, and timely alarms, so that the effects of providing the troubleshooting efficiency and avoiding the mistakes and omissions are achieved, and it is confirmed whether there is still a residual dependence on the open source software.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network technology and security technology, and in particular to an open source software monitoring system and method, a computer device and a storage medium. BACKGROUND

[0002] Under the background of rapid development of the Internet, code open source has become mainstream, leading the innovation of global new information technology. However, there are still many hidden dangers in open source code, such as code vulnerabilities, malicious code, and commercial restrictions of open source agreements. Neglect of these problems often causes a lot of losses to enterprises. At present, the security problems of open source software usually rely on manual self-checking and rectification. When the security risks of open source software are identified, the security department usually carries out internal propaganda and guidance, mainly relying on the feedback of relevant technical personnel to form a closed loop.

[0003] In related technologies, the current manual self-checking method may have the problem that the open source software directly used by the technical personnel depends on the open source software with security risks due to the common multi-layer dependency problem of open source code, which increases the difficulty of manual checking, resulting in low efficiency and easy omission of the current checking method. The security department cannot obtain accurate results, which ultimately leads to the project being put into operation with security risks and commercial risks. Therefore, a method is needed to help the security department obtain the dependency information of open source software in the enterprise and block the use of problematic open source software. SUMMARY

[0004] Therefore, the present application provides an open source software monitoring system and method, a computer device and a storage medium to solve the problem of lack of means to obtain the dependency information of open source software in the enterprise and block the use of problematic open source software.

[0005] In a first aspect, the present application provides an open source software monitoring system, which comprises a management platform, a proxy module, a man-in-the-middle module, an analysis module and a control module.

[0006] The proxy module is deployed on a packaging server, and the request of the packaging server is transmitted to the man-in-the-middle module through the proxy. The packaging server is used to provide services for dependency download and compilation of open source software;

[0007] The man-in-the-middle module is used to convert the request into an http request and transmit the http request to the analysis module.

[0008] The analysis module is used to analyze the http request according to the http request to obtain the information of the open source software corresponding to the http request, and transmit the information of the open source software to the control module.

[0009] The control module is configured to report the information of the open source software to the management platform.

[0010] The management platform is configured to acquire the disabling rule and send the disabling rule to the control module.

[0011] The control module is configured to limit the download request of the open source software according to the disabling rule.

[0012] The management platform is further configured to send the alarm information based on the information of the open source software, the information of the packaging server and the disabling rule.

[0013] In the present application, by means of the management platform, the proxy module, the man-in-the-middle module, the parsing module and the control module, the interruption of the software dependency download can be realized without implementing the download protocol of the software package, and by means of the proxy, the key nodes of the corresponding software download protocol are only needed to be parsed to obtain the software package information, so that it can be judged whether the software is disabled and whether the download request is interrupted. When the management platform receives an abnormal condition, the relevant security personnel of the enterprise can be timely alarmed and informed, so as to avoid the security vulnerability and intellectual property risk caused by the use of the open source software by the enterprise, to achieve the effect of providing the troubleshooting efficiency and avoiding the mistakes, and to confirm whether there is still a residual dependency on the open source software through the closed-loop reporting of the information.

[0014] In an optional embodiment, the proxy module is configured to set a transparent proxy rule on the packaging server, and by means of the transparent proxy rule, the request on the packaging server is guided to the http port corresponding to the parsing module.

[0015] In this way, by means of the transparent proxy rule set by the proxy module on the packaging server, the request on the packaging server is guided to the parsing module, so that the collection of the software dependency information is facilitated, the real-time and effectiveness of the collected information are ensured, and the request can be interrupted to avoid the omissions causing accidents.

[0016] In an optional embodiment, the man-in-the-middle module is configured to start a tcp listening service and identify whether the request is a tcp request; when the request is a tcp request, the tcp request is converted into an http request, and the http request is transmitted to the parsing module; when the request is not a tcp request, the request is transmitted to the parsing module.

[0017] In this way, by means of the man-in-the-middle module, the tcp listening service is started, the tcp request is converted into an http request when the request is a tcp request, and the request is transmitted to the parsing module, so that the collection of the software dependency information is facilitated.

[0018] In one optional implementation, the parsing module is used to determine whether the HTTP request is a download request for open-source software using preset request parsing rules; when the HTTP request is a download request for open-source software, the module parses the HTTP request according to the proxy protocol corresponding to the HTTP request to obtain the information of the open-source software corresponding to the HTTP request, and transmits the information of the open-source software to the control module; when the HTTP request is a download request for non-open-source software, the module notifies the proxy module to forward the HTTP request.

[0019] In this approach, information is collected by parsing key nodes of the open-source proxy protocol through a parsing module. This achieves lightweight information collection while simultaneously supporting multiple programming languages, eliminating the need for additional implementation of the open-source proxy protocol to store open-source software packages.

[0020] In one optional implementation, the control module is used to determine whether the information of the open source software triggers the disabling rule based on the disabling rule. When the information of the open source software triggers the disabling rule, the control module controls the download request of the open source software to be terminated or forwarded, and sends the information of the open source software to the management platform.

[0021] In this approach, the control module determines whether the information of the open-source software triggers the disabling rule, thereby restricting the download requests of the open-source software according to the disabling rule. Download requests for disabled open-source software can be forcibly stopped through preset configuration, thus preventing enterprise projects from going live with defects.

[0022] In a second aspect, the present invention provides an open-source software monitoring method, applicable to an open-source software monitoring system as described in any of the first aspects, the system comprising a management platform, an agent module, a man-in-the-middle module, a parsing module, and a control module, the method comprising:

[0023] The request to the packaging server is transmitted to the man-in-the-middle module through a proxy. The packaging server is used to provide services for downloading and compiling dependencies for open source software.

[0024] Convert the request into an HTTP request and pass the HTTP request to the parsing module;

[0025] Based on the HTTP request, the HTTP request is parsed to obtain the information of the open source software corresponding to the HTTP request, and the information of the open source software is transmitted to the control module.

[0026] Report information about open-source software to the management platform;

[0027] Obtain the disabling rules and send them to the control module;

[0028] Download requests for open-source software are restricted according to the disabling rules;

[0029] Based on information from the open-source software, combined with information from the packaging server and disabling rules, alert messages are sent.

[0030] This invention automates the collection of dependency information for open-source software, significantly improving efficiency compared to manual identification, and ensuring the data's authenticity and reliability. Timely reporting and alerting of open-source software dependency information provides direct feedback, identifying which open-source software is in use, which poses risks, and which disabled open-source software still has dependencies. Download requests for disabled open-source software can be forcibly stopped through preset configurations, preventing projects from going live with defects due to technical personnel oversight. Simultaneously, it is non-intrusive to the code and provides real-time updates. Using this service during local development allows for real-time feedback on disabled software dependencies, ensuring that unused projects or code do not require unnecessary processing. It avoids legal risks associated with using open-source software under non-commercial open-source licenses and effectively prevents the impact of security vulnerabilities in open-source software on the software system.

[0031] In one optional implementation, the HTTP request is parsed to obtain information about the open-source software corresponding to the HTTP request, including:

[0032] Using preset request parsing rules, determine whether an HTTP request is a download request for open-source software;

[0033] When the HTTP request is a download request for open source software, the HTTP request is parsed according to the proxy protocol corresponding to the HTTP request to obtain the information of the open source software corresponding to the HTTP request, and the information of the open source software is transmitted to the control module.

[0034] When making an HTTP request to download non-open source software, instruct the proxy module to forward the HTTP request.

[0035] In this approach, information about open-source software is parsed by performing pattern recognition on requests. There is no need to implement an additional open-source proxy protocol to store open-source software packages, and it can be relatively easily extended to support multiple programming languages ​​and corresponding proxy protocols.

[0036] Thirdly, the present invention provides a computer device, comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the open-source software monitoring method of the second aspect above or any corresponding embodiment thereof.

[0037] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute the open-source software monitoring method of the second aspect or any corresponding embodiment described above.

[0038] Fifthly, the present invention provides a computer program product, including computer instructions for causing a computer to execute the open-source software monitoring method of the second aspect above or any corresponding embodiment thereof. Attached Figure Description

[0039] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0040] Figure 1 This is a schematic diagram of the structure of an open-source software monitoring system according to an embodiment of the present invention.

[0041] Figure 2 This is a schematic diagram of the architecture of an open-source software monitoring system according to an embodiment of the present invention.

[0042] Figure 3 This is a flowchart illustrating an open-source software monitoring method according to an embodiment of the present invention.

[0043] Figure 4 This is a schematic diagram of a request parsing process according to an embodiment of the present invention.

[0044] Figure 5 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0046] In related technologies, the current method of relying on manual, self-managed investigation is prone to problems due to the common multi-layered dependency issues in open-source code. This can lead to situations where technical personnel directly use open-source software that depends on potentially vulnerable open-source software. This increases the difficulty of manual investigation, making the current method not only inefficient and prone to omissions, but also preventing security departments from obtaining accurate results. Ultimately, this results in projects being deployed with vulnerabilities, leaving security risks and commercial risks. Therefore, a method is needed to help security departments obtain dependency information on open-source software within the enterprise and block the use of problematic open-source software.

[0047] To address the aforementioned issues, this invention provides an open-source software monitoring system. This system is suitable for scenarios involving the discovery and monitoring of open-source software dependencies in projects. The open-source software monitoring system provided by this invention, through a management platform, proxy module, man-in-the-middle module, parsing module, and control module, can interrupt software dependency downloads without implementing the software package download protocol. By using a proxy, it only needs to parse the key nodes of the corresponding software download protocol to obtain package information, thus determining whether to disable the software and whether to interrupt the download request. Upon receiving anomalies, the management platform can promptly alert relevant security personnel within the enterprise, preventing security vulnerabilities and intellectual property risks arising from the use of open-source software. This achieves the effects of improving investigation efficiency, avoiding errors and omissions, and confirming whether any residual dependencies on the open-source software still exist through a closed-loop reporting information system.

[0048] According to an embodiment of the present invention, an embodiment of an open-source software monitoring system is provided. Figure 1 This is a schematic diagram of the structure of an open-source software monitoring system according to an embodiment of the present invention, such as... Figure 1 As shown, the open-source software monitoring system includes: a management platform 5, a proxy module 1, a man-in-the-middle module 2, a parsing module 3, and a control module 4. The proxy module 1 is deployed on the packaging server, transmitting requests from the packaging server to the man-in-the-middle module 2 via the proxy. The packaging server provides services for downloading and compiling dependencies for open-source software. The man-in-the-middle module 2 converts requests into HTTP requests and transmits them to the parsing module 3. The parsing module 3 parses the HTTP requests to obtain information about the corresponding open-source software and transmits this information to the control module 4. The control module 4 reports the open-source software information to the management platform 5. The management platform 5 obtains disabling rules and sends them to the control module 4. The control module 4 restricts download requests for open-source software based on the disabling rules. The management platform 5 also sends alarm information based on the open-source software information, combined with the packaging server information and the disabling rules.

[0049] In one example, Figure 2 This is a schematic diagram of the architecture of an open-source software monitoring system according to an embodiment of the present invention, such as... Figure 2As shown, the open-source software monitoring system includes: a management platform 5, a proxy module 1, a man-in-the-middle module 2, a parsing module 3, and a control module 4. The proxy module 1 forwards open-source software requests from the packaging server to the man-in-the-middle module 2; the man-in-the-middle module 2 is responsible for forwarding and converting TCP requests; the parsing module 3, based on the proxy protocols of various programming languages, parses the programming language, version number, open-source license, and other information of the open-source software that the TCP request depends on, and submits this information to the control module 4; the control module 4 reports this information to the management platform 5. The management platform 5 is used to view the information of the open-source software reported by the control module 4, and initiates an alarm when it receives problematic open-source software. Simultaneously, it can send the names, version numbers, and open-source licenses of open-source software packages that need to be restricted to the control module 4. The control module 4 can then restrict download requests for these open-source software packages based on these configurations, thereby preventing enterprise projects from going live with defects.

[0050] Management platform 5 manages open-source software by: viewing historical information of open-source software reported by control module 4, including programming language, version number, open-source license, request time, and requesting device; and disabling some open-source software by issuing disabling configurations to control module 4, including configuring open-source package names, version numbers, and open-source licenses. Table 1 shows the instruction table issued by management platform 1. As shown in Table 1, the instructions issued by management platform 1 include: RuleId (disabling rule ID); Act (action, including blacklist and deletion rules); Type (disabling method, including license and package version); Licenses (array of disabled protocols); PackageName (disabling package name); and PackageVersion (disabling package version).

[0051] Table 1

[0052] RuleId Rule ID Act Action, contains black list, delete rule Type The way of ban, including protocol, package version Licenses Ban protocol array PackageName Ban software package package name PackageVersion Ban software package version

[0053] Proxy module 1 has pre-defined forwarding rules, including: Proxy module 1 is deployed on a packaging service, which refers to a service that requires downloading and compiling open-source code dependencies. Typically, in an enterprise's automated packaging pipeline, the code compilation stage is handled by a specific server. Proxy module 1 can redirect open-source software download requests from the packaging server to parsing module 3 by configuring iptables rules on the packaging server.

[0054] The process of parsing TCP requests by the man-in-the-middle module 2 includes: parsing the TCP request, converting it into an upper-layer HTTP request, forwarding other requests directly, and passing the parsed HTTP request to the parsing module 3.

[0055] The parsing module 3 parses software proxy requests by receiving HTTP requests converted by the man-in-the-middle module 2, using preset request parsing rules to distinguish whether it is a download request for open-source software. If not, it directly notifies the proxy module 1 to forward the request normally; if so, it parses the package name, version number, open-source license, historical version number, and other information of the open-source software according to the proxy protocol of the specific programming language, and passes the corresponding information to the control module 4.

[0056] The control module 4 processes open-source software information, including: the parsing module 3 notifies the control module 4 of the open-source software information through code calls; the control module 4 is responsible for reporting the open-source software information to the management platform 5; receiving the open-source software disabling configuration from the management platform 5; and further controlling the termination or forwarding of the request based on the disabling configuration.

[0057] The management platform 5 will issue alarms for the use of open source software. When the management platform 5 receives an open source software report from the control module 4, if a disabling rule is triggered, it will send an alarm message to the security personnel. The security personnel will be able to obtain the open source software information, request the device, and the triggered disabling rule in a timely manner, which will facilitate the investigation and repair of the reference problem of the open source software.

[0058] In one optional implementation, the proxy module 1 is used to set transparent proxy rules on the packaging server, and through the transparent proxy rules, the requests on the packaging server are directed to the HTTP port corresponding to the parsing module 3.

[0059] In one example, the default forwarding rules for proxy module 1 include: proxy module 1 is deployed on a packaging service, which refers to a service that requires downloading and compiling open-source code dependencies. Typically, in an enterprise's automated packaging pipeline, the compilation stage is handled by a specific server. By setting transparent proxy rules on the packaging server, proxy module 1 can redirect open-source software download requests from the packaging server to parsing module 3.

[0060] Specifically, transparent proxying uses iptables settings to redirect TCP requests to the HTTP port corresponding to the resolution module 3. Taking 192.168.0.106:8080 as the address and port of the HTTP service for the man-in-the-middle module 2, the command is: `iptables -t nat-AOUTPUT -p tcp -j DNAT --to-destination 192.168.0.106:8080`. Furthermore, during development, proxying to the man-in-the-middle module 2 can be actively configured. For example, in Go programming, the environment variable `GOPROXY` can be set to `http: / / 192.168.0.106:8080` to achieve forwarding.

[0061] In this approach, transparent proxy rules are set on the packaging server through the proxy module, which enables requests on the packaging server to be directed to the parsing module. This facilitates the collection of software dependency information, ensures the real-time nature and effectiveness of the collected information, and allows requests to be stopped to avoid oversights and unexpected problems.

[0062] In one optional implementation, the man-in-the-middle module 2 is used to start a TCP listening service to identify whether the request is a TCP request; when the request is a TCP request, the TCP request is converted into an HTTP request and the HTTP request is passed to the parsing module 3; when the request is not a TCP request, the request is passed to the parsing module 3.

[0063] In one example, the process of parsing an HTTP request by the man-in-the-middle module 2 includes: starting a TCP listening service to handle all HTTP and HTTPS requests. HTTPS requests use a self-signed certificate. The verification information in the self-signed certificate differs from that of a regular certificate. The certificate's binding information is linked to the IP address of the man-in-the-middle module 2. The specific certificate generation rules are: using a self-generated CA certificate and the SSL server certificate used by the man-in-the-middle module 2. The SSL server certificate is bound to the public and private IP addresses of the man-in-the-middle module 2, and the CA signs the SSL server certificate. The CA corresponding to the certificate needs to be added to the trusted CA list of the packaging server beforehand.

[0064] The middleman module 2 forwards the request and parses the HTTP request and response information. If the origin server returns an error, it returns a normal response to the upstream server; if the origin server returns a normal response, it passes the request's metadata to the parsing module 3. Table 2 is the request metadata table. As shown in Table 2, the request metadata can include: Path (request path); Method (request type, such as GET or POST); Domain (request domain); RequestBody (request parameters); and ResponseBody (return parameters).

[0065] Table 2

[0066] Path Request path Method Request type, such as Get, Post Domain Request domain name RequestBody Request parameters ResponseBody Return parameters

[0067] In this approach, a TCP listening service is initiated through a man-in-the-middle module. When a request is a TCP request, it is converted into an HTTP request and then passed to the parsing module, which facilitates the subsequent collection of software dependency information.

[0068] In one optional implementation, the parsing module 3 is used to determine whether the HTTP request is a download request for open-source software using preset request parsing rules; when the HTTP request is a download request for open-source software, the HTTP request is parsed according to the proxy protocol corresponding to the HTTP request to obtain the information of the open-source software corresponding to the HTTP request, and the information of the open-source software is transmitted to the control module 4; when the HTTP request is a download request for non-open-source software, the proxy module 1 is notified to forward the HTTP request.

[0069] In one example, parsing module 3 parses software proxy requests by receiving an HTTP request converted by man-in-the-middle module 2, using preset request parsing rules to distinguish whether it is a download request for open-source software. If not, it directly notifies proxy module 1 to forward the request normally; if so, it parses the package name, version number, open-source license, historical version number, and other information of the open-source software according to the proxy protocol of the specific programming language, and passes the corresponding information to control module 4.

[0070] For example, in a Node.js npm package management system, when downloading a package, a request is made to https: / / registry.npmmirror.com / acorn-dynamic-import / 1.0.0. The request path is acorn-dynamic-import / 1.0.0, the method is Get, the domain is registry.npmmirror.com, the request body is empty, and the response body is a JSON string containing package information: "{"name":"acorn-dynamic-import","description":"Support dynamic imports in acorn","main":"index.js"……".

[0071] Parsing module 3 can determine that the package is an npm package and the language is Node.js based on the result returned by the ResponseBody. From the JSON data in the ResponseBody, it obtains the package name (acorn-dynamic-import) from the `name` field, the version number (1.0.0) from the `version` field, and the open-source license (MIT) from the `license` field. Historical version information is then obtained by requesting https: / / registry.npmmirror.com / acorn-dynamic-import.

[0072] In the Go language, when using the `go get` command to download a package, it will make a request to `https: / / proxy.golang.com.cn / github.com / sirupsen / logrus / @v / v1.8.1.mod`. The request path is `github.com / sirupsen / logrus / @v / v1.8.1.mod`, the method is `Get`, the domain is `proxy.golang.com.cn`, the request body is empty, and the response body is the string "module github.com / sirupsen / logrus...".

[0073] The parsing module 3, through the module and supported Go versions carried in the ResponseBody, can determine that it is a Go language package, and the language is Go. Using the Go language package proxy rules, the module in the ResponseBody determines the package name as github.com / sirupsen / logrus. Comparing this with the Path, the version number is parsed as v1.8.1. The package file is obtained by requesting the API https: / / proxy.golang.com.cn / github.com / sirupsen / logrus / @v / v1.8.1.zip, and the LICENSE file is extracted. The open-source license is parsed as MIT, and historical versions are obtained by calling https: / / proxy.golang.com.cn / github.com / sirupsen / logrus / @v / list.

[0074] In this approach, information is collected by parsing key nodes of the open-source proxy protocol through a parsing module. This achieves lightweight information collection while simultaneously supporting multiple programming languages, eliminating the need for additional implementation of the open-source proxy protocol to store open-source software packages.

[0075] In one optional implementation, the control module 4 is used to determine whether the information of the open source software triggers the disabling rule based on the disabling rule. When the information of the open source software triggers the disabling rule, the control module 4 controls the download request of the open source software to be terminated or forwarded, and sends the information of the open source software to the management platform 5.

[0076] In one example, the control module 4 processes open-source software information by: parsing module 3 notifying the control module 4 of open-source software information via code calls, whereby the open-source software information includes programming language, package name, open-source license, current version, and history versions; the control module 4 communicates with the management platform 5 via gRPC, reporting the open-source software information to the management platform 5, receiving the open-source software disabling configuration from the management platform 5, and further determining whether to trigger the disabling rule based on the disabling configuration, and controlling whether to terminate or forward the request. For example, if the disabling rule is to disable the AGPL and GPL licenses, and the package's open-source license is AGPL, then the request will be interrupted.

[0077] The management platform 1 will issue alarms for the use of open source software. When the management platform 1 receives the open source software reported by the control module 4, if the disabling rule is triggered, it will send an alarm message to the security personnel so that the security personnel can obtain the open source software information, request the device, and the triggered disabling rule in a timely manner, which will facilitate the investigation and repair of the reference problem of the open source software.

[0078] In this approach, the control module determines whether the information of the open-source software triggers the disabling rule, thereby restricting the download requests of the open-source software according to the disabling rule. Download requests for disabled open-source software can be forcibly stopped through preset configuration, thus preventing enterprise projects from going live with defects.

[0079] The open-source software monitoring system provided in this embodiment, through a management platform, proxy module, man-in-the-middle module, parsing module, and control module, can interrupt software dependency downloads without implementing the software package download protocol. By using a proxy, it only needs to parse the key nodes of the corresponding software download protocol to obtain the software package information, thus determining whether to disable the software and whether to interrupt the download request. Upon receiving anomalies, the management platform can promptly alert relevant security personnel within the enterprise, preventing security vulnerabilities and intellectual property risks arising from the use of open-source software. This achieves the effects of improving investigation efficiency, avoiding errors and omissions, and confirming whether any residual dependencies on the open-source software still exist through a closed-loop reporting information system.

[0080] This embodiment provides an open-source software monitoring method, which can be used in the aforementioned open-source software monitoring system. The system includes a management platform, an agent module, a man-in-the-middle module, a parsing module, and a control module. Figure 3 This is a flowchart of an open-source software monitoring method according to an embodiment of the present invention, such as... Figure 3 As shown, the process includes the following steps:

[0081] Step S301: The request from the packaging server is transmitted to the man-in-the-middle module through a proxy.

[0082] In this embodiment of the invention, the packaging server is used to provide services for downloading and compiling dependencies for open-source software.

[0083] Step S302: Convert the request into an HTTP request and pass the HTTP request to the parsing module.

[0084] Step S303: Based on the HTTP request, parse the HTTP request to obtain the information of the open source software corresponding to the HTTP request, and transmit the information of the open source software to the control module.

[0085] In one optional implementation, the HTTP request is parsed to obtain information about the open-source software corresponding to the HTTP request, including:

[0086] Step a1: Use the preset request parsing rules to determine whether the HTTP request is a download request for open source software.

[0087] Step a2: When the HTTP request is a download request for open-source software, the HTTP request is parsed according to the proxy protocol corresponding to the HTTP request to obtain the information of the open-source software corresponding to the HTTP request, and the information of the open-source software is transmitted to the control module.

[0088] Step a3: When making an HTTP request to download non-open source software, notify the proxy module to forward the HTTP request.

[0089] In this approach, information about open-source software is parsed by performing pattern recognition on requests. There is no need to implement an additional open-source proxy protocol to store open-source software packages, and it can be relatively easily extended to support multiple programming languages ​​and corresponding proxy protocols.

[0090] Step S304: Report the information of the open source software to the management platform.

[0091] Step S305: Obtain the disabling rules and send the disabling rules to the control module.

[0092] Step S306: Restrict download requests for open-source software according to the disabling rules.

[0093] Step S307: Based on the information from the open-source software, combined with the information from the packaging server and the disabling rules, send an alarm message.

[0094] In one implementation scenario, Figure 4 This is a schematic diagram of a request parsing process according to an embodiment of the present invention, such as... Figure 4As shown, the request parsing process may include: redirecting the TCP request to the proxy module; determining whether the request is an HTTP protocol, and forwarding the request to the origin server if the request is not an HTTP protocol; parsing the TCP request as an HTTP request if the request is an HTTP protocol; determining whether the HTTP request is an open-source protocol, and forwarding the request to the origin server if the HTTP request is not an open-source protocol; parsing the open-source software information if the HTTP request is an open-source protocol; reporting the open-source software information to the management platform and determining whether to disable the open-source software; forwarding the request to the origin server if the open-source software is not disabled; and terminating the request if the open-source software is disabled.

[0095] The open-source software monitoring method provided in this embodiment automates the collection of open-source software dependency information, significantly improving efficiency compared to manual identification, and ensuring data accuracy and reliability. Timely reporting and alerting of open-source software dependency information provides intuitive feedback, identifying which open-source software is in use, which poses risks, and which disabled open-source software still has dependencies. Download requests for disabled open-source software can be forcibly stopped through preset configurations, preventing projects from going live with defects due to technical personnel oversight. Simultaneously, it is non-intrusive to the code and provides real-time updates. Using this service during local development allows for real-time feedback on disabled software dependencies, ensuring that resources are not wasted on handling projects or code no longer in use. It avoids legal risks associated with using open-source software under non-commercial open-source licenses and effectively blocks the impact of security vulnerabilities in open-source software on the software system.

[0096] This invention also provides a computer device for performing the above-described... Figure 3 The open-source software monitoring method shown.

[0097] Please see Figure 5 , Figure 5 This is a schematic diagram of the structure of a computer device provided in an optional embodiment of the present invention, such as... Figure 5 As shown, the computer device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 5Take a processor 10 as an example.

[0098] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0099] The memory 20 stores instructions executable by at least one processor 10 to cause the at least one processor 10 to perform the method shown in the above embodiments.

[0100] The memory 20 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the computer device. Furthermore, the memory 20 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 20 may optionally include memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0101] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0102] The computer device also includes an input device 30 and an output device 40. The processor 10, memory 20, input device 30, and output device 40 can be connected via a bus or other means. Figure 5 Taking the example of a connection between China and Israel via a bus.

[0103] Input device 30 can receive input numerical or character information, and generate key signal inputs related to user settings and function control of the computer device, such as a touchscreen, keypad, mouse, trackpad, touchpad, joystick, one or more mouse buttons, trackball, joystick, etc. Output device 40 may include display devices, auxiliary lighting devices (e.g., LEDs), and haptic feedback devices (e.g., vibration motors). The aforementioned display devices include, but are not limited to, liquid crystal displays, light-emitting diodes, displays, and plasma displays. In some alternative embodiments, the display device may be a touchscreen.

[0104] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods shown in the above embodiments.

[0105] A portion of this invention can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to the invention through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0106] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. An open-source software monitoring system, characterized in that, The system includes a management platform, an agent module, a man-in-the-middle module, a parsing module, and a control module. The proxy module is deployed on the packaging server and transmits requests from the packaging server to the man-in-the-middle module through the proxy. The packaging server is used to provide services for downloading and compiling dependencies of open source software. The proxy module is used to set transparent proxy rules on the packaging server and, through the transparent proxy rules, redirect requests from the packaging server to the HTTP port corresponding to the parsing module. The middleman module is used to convert the request into an HTTP request and pass the HTTP request to the parsing module; The parsing module is used to parse the HTTP request according to the HTTP request, obtain the information of the open source software corresponding to the HTTP request, and transmit the information of the open source software to the control module. The control module is used to report the information of the open-source software to the management platform; The management platform is used to obtain the disabling rules and send the disabling rules to the control module; The control module is used to restrict download requests for the open-source software according to the disabling rules; The management platform is also used to send alarm information based on the information of the open source software, combined with the information of the packaging server and the disabling rules.

2. The system according to claim 1, characterized in that, The man-in-the-middle module is used to start a TCP listening service to identify whether the request is a TCP request; when the request is a TCP request, the TCP request is converted into an HTTP request and the HTTP request is passed to the parsing module. When the request is not a TCP request, the request is passed to the parsing module.

3. The system according to claim 1, characterized in that, The parsing module is used to determine whether the HTTP request is a download request for open source software using preset request parsing rules; when the HTTP request is a download request for open source software, the module parses the HTTP request according to the proxy protocol corresponding to the HTTP request to obtain the information of the open source software corresponding to the HTTP request, and transmits the information of the open source software to the control module. When the HTTP request requests the download of non-open source software, the proxy module is notified to forward the HTTP request.

4. The system according to claim 1, characterized in that, The control module is used to determine whether the information of the open source software triggers the disabling rule based on the disabling rule. When the information of the open source software triggers the disabling rule, the module controls the download request of the open source software to be terminated or forwarded, and sends the information of the open source software to the management platform.

5. An open-source software monitoring method, characterized in that, Applied to the open-source software monitoring system as described in any one of claims 1-4, the system comprising a management platform, an agent module, a man-in-the-middle module, a parsing module, and a control module, the method comprising: The request to the packaging server is transmitted to the man-in-the-middle module through a proxy. The packaging server is used to provide services for downloading and compiling dependencies for open-source software. The request is converted into an HTTP request, and the HTTP request is passed to the parsing module; Based on the HTTP request, the HTTP request is parsed to obtain the information of the open source software corresponding to the HTTP request, and the information of the open source software is transmitted to the control module; The information of the open-source software is reported to the management platform; Obtain the disabling rules and send the disabling rules to the control module; According to the aforementioned disabling rules, download requests for the open-source software are restricted; Based on the information from the open-source software, combined with the information from the packaging server and the disabling rules, an alarm message is sent.

6. The method according to claim 5, characterized in that, The step of parsing the HTTP request to obtain information about the open-source software corresponding to the HTTP request includes: Using preset request parsing rules, determine whether the HTTP request is a download request for open-source software; When the HTTP request is a download request for open-source software, the HTTP request is parsed according to the proxy protocol corresponding to the HTTP request to obtain the information of the open-source software corresponding to the HTTP request, and the information of the open-source software is transmitted to the control module. When the HTTP request requests the download of non-open source software, the proxy module is notified to forward the HTTP request.

7. A computer device, characterized in that, include: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the open-source software monitoring method of any one of claims 5 to 6 by executing the computer instructions.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to execute the open-source software monitoring method of any one of claims 5 to 6.

9. A computer program product, characterized in that, Includes computer instructions for causing a computer to execute the open-source software monitoring method as described in any one of claims 5 to 6.

Images