Software supply chain risk detection protection method and system

Abstract

The invention provides a software supply chain risk detection protection method and system, and the method comprises the steps: obtaining a third-party component from a software supply chain, and analyzing the multi-level dynamic behaviors of the third-party component; predicting a risk behavior pattern by using a Bayesian network algorithm, and constructing a behavior pattern library; monitoring a behavior of the third-party component during operation, and recording a behavior data stream; identifying an abnormal behavior deviating from a normal behavior mode by applying a time sequence anomaly detection algorithm of deep learning; evaluating risk levels of the abnormal behaviors by using a graph neural network, and generating an abnormal behavior list in combination with relevance and propagation paths among the behaviors; according to the list, a response strategy in the safety control measure library is dynamically adjusted through an adaptive strategy selection algorithm, and safety control measures are formulated for the third-party component. According to the invention, the identification and prediction capabilities of potential risk behaviors are improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of software supply chain technology, and in particular, to a software supply chain risk detection and protection method and system. Background Art

[0002] In modern software development and deployment, third-party components are widely used in various applications, greatly improving development efficiency. However, these third-party components may contain unknown vulnerabilities or malicious code, thus introducing potential security risks. To address this challenge, existing software supply chain security solutions mainly rely on static analysis, sandbox isolation, and rule-based detection methods. Static analysis identifies potential risks through code review and dependency analysis, and can find problems in the pre-compilation stage; sandbox isolation places third-party components in an isolated environment to run and restricts their access to system resources to reduce risks; rule-based detection uses predefined rule sets to detect known abnormal behaviors. Although these methods guarantee the security of the software supply chain to a certain extent, they each have their own limitations and it is difficult to fully capture and evaluate the complex behaviors of third-party components in the actual operating environment.

[0003] Existing technologies usually combine static analysis, sandbox isolation, and rule-based detection to achieve risk assessment and protection of third-party components. Static analysis methods identify potential security vulnerabilities and non-compliant code segments by scanning source code and dependency graphs. However, static analysis is limited to the code level and cannot capture the behavioral characteristics of third-party components during actual runtime. Sandbox isolation technology reduces the impact of potential threats by creating a controlled execution environment to limit the access of third-party components to system resources. However, traditional sandbox technology only provides basic isolation functions and lacks fine-grained monitoring and in-depth analysis of component behavior. In addition, rule-based detection methods use predefined rule sets to match known abnormal behavior patterns. Although this method is simple and direct, it has limited detection capabilities for new attacks and complex behavior patterns. Overall, existing technologies can discover and mitigate some security issues to a certain extent, but they are still insufficient in terms of comprehensiveness and intelligence.

[0004] Although existing technologies provide effective protection measures in some aspects, they still have significant defects, especially in comprehensive monitoring and intelligent assessment. Static analysis methods cannot capture runtime behavior and are powerless for dynamically loaded code or dependency changes; while sandbox isolation technology can provide basic isolation, it lacks fine-grained monitoring and in-depth analysis of component behavior, making it difficult to detect hidden malicious behavior. Rule-based detection methods can only detect known threats, have poor adaptability to new attacks and complex behavior patterns, and are prone to false positives or omissions. In addition, existing methods usually focus on risk assessment in a single dimension and fail to combine advanced technologies such as multi-level behavior analysis, time series anomaly detection, and graph neural networks, resulting in incomplete and inaccurate risk assessment. Therefore, there is an urgent need for a more intelligent and comprehensive method to comprehensively monitor and evaluate the behavior of third-party components and improve the security and response efficiency of the software supply chain. Summary of the invention

[0005] The embodiments of the present application provide a software supply chain risk detection and protection method and system to solve the problem of low recognition and prediction capabilities of potential risk behaviors in the prior art.

[0006] In a first aspect, an embodiment of the present application provides a software supply chain risk detection and protection method, comprising: Obtain third-party components in the software supply chain and analyze multi-level dynamic behaviors from the third-party components; Based on the multi-level dynamic behavior, using a Bayesian network algorithm to predict risk behavior patterns in the third-party components and generate a behavior pattern library; According to the behavior pattern library, the behavior of the third-party component at runtime is monitored using differential execution sandbox technology, so as to obtain and record the behavior data flow of the third-party component at runtime using a fine-grained resource access tracking mechanism; Based on the behavior data stream, a deep learning time series anomaly detection algorithm is applied to identify abnormal behaviors that deviate from normal behavior patterns in the behavior pattern library, and a graph neural network algorithm is used to evaluate the risk level of the abnormal behaviors, and a list of abnormal behaviors is generated by combining the correlation and propagation path between the abnormal behaviors; According to the abnormal behavior list, a response strategy from a predefined security control measure library is dynamically adjusted through an adaptive strategy selection algorithm to formulate security control measures for the third-party component.

[0007] Optionally, based on the behavior data stream, a deep learning time series anomaly detection algorithm is applied to identify abnormal behaviors that deviate from normal behavior patterns in the behavior pattern library, and a graph neural network algorithm is used to evaluate the risk level of the abnormal behaviors, and a list of abnormal behaviors is generated in combination with the correlation and propagation path between the abnormal behaviors, including: The behavior data stream is modeled using a long short-term memory network or a deep learning model of a gated recurrent unit, and local and global features in the behavior data stream are extracted through a multi-scale sliding window, time series features are extracted from the behavior data stream, and a time series prediction model is constructed based on the time series features; According to the historical behavior data stream records of normal behavior patterns in the behavior pattern library, the time series prediction model is trained and verified to obtain an anomaly detection model; Inputting the data in the behavior data stream into the anomaly detection model, judging whether the specific behavior of the third-party component during operation deviates from the normal behavior pattern in the behavior pattern library through the probability distribution output by the anomaly detection model, and when the anomaly detection model identifies a behavior that deviates from the normal behavior pattern, recording the occurrence time of the behavior, the system resources involved and the specific operation type, and capturing the contextual environment information of the abnormal behavior, to obtain a record of the behavior identified as abnormal; By using the behavior records, by analyzing the temporal relationship and resource dependency relationship between the abnormal behaviors, a behavior graph representing the correlation between the abnormal behaviors is constructed, and node weights and edge weights are introduced to quantify the impact scope and severity of the abnormal behaviors. A graph neural network algorithm is applied to evaluate the risk level of the abnormal behaviors from the behavior graph. In combination with the correlation between the abnormal behaviors and the propagation path of the abnormal behaviors in the network, the risk score is optimized through multiple rounds of iterations to generate the risk level of each abnormal behavior. Based on the risk level, cluster analysis is performed on the abnormal behaviors to identify potential attack patterns, and specific information of the abnormal behaviors is summarized to generate an abnormal behavior list including abnormal behavior classification, risk score and disposal suggestions.

[0008] Optionally, the behavior records are used to analyze the temporal relationship and resource dependency relationship between the abnormal behaviors, to construct a behavior graph representing the correlation between the abnormal behaviors, to introduce node weights and edge weights to quantify the impact scope and severity of the abnormal behaviors, to apply a graph neural network algorithm to evaluate the risk level of the abnormal behaviors from the behavior graph, and to optimize the risk score through multiple rounds of iterations in combination with the correlation between the abnormal behaviors and the propagation path of the abnormal behaviors in the network, to generate a risk level for each abnormal behavior, including: Extract key information from the behavior record, wherein the key information includes the time of occurrence, the system resources involved, the type of operation performed, and the context information of the behavior, and extract the execution subject, target object, and operation result information of the abnormal behavior to construct a more comprehensive behavior feature representation; By analyzing the temporal relationship between abnormal behaviors, the time interval and sequential dependency of the behaviors are calculated to determine the relevance of abnormal behaviors in the time dimension; by analyzing the resource dependency between abnormal behaviors, the access overlap and dependency intensity of the behaviors on system resources are calculated to determine the relevance of abnormal behaviors in the resource dimension; According to the key information and the correlation analysis results, a node is created for each abnormal behavior, and a weight is assigned to each node. The weight value is dynamically calculated according to the impact scope and severity of the abnormal behavior. At the same time, according to the logical relationship between the abnormal behaviors, edges between the nodes are created, and a weight is assigned to each edge. The weight value is dynamically calculated according to the correlation strength between the abnormal behaviors, so as to obtain a behavior map representing the interaction between the abnormal behaviors; Using graph embedding technology, the behavior graph is converted into a representation in a low-dimensional vector space, and the vector representations of nodes and edges are optimized through multiple rounds of iterations to retain the structural information and semantic information in the graph, thereby obtaining an optimized graph representation; The graph representation is deep-learned using a graph neural network algorithm. The importance of neighbor node information is dynamically adjusted by introducing an attention mechanism. The representation of each node in the behavior graph is updated by multi-layer aggregation of neighbor node information of nodes in the behavior graph. A multi-dimensional risk assessment model is constructed by combining the propagation path of abnormal behaviors and the dependency of system resources. The behavioral risk information evaluated by the graph neural network is obtained by combining the correlation between the abnormal behaviors and the propagation mode of the abnormal behaviors in the network. Based on the behavioral risk information, a comprehensive risk score is calculated for each abnormal behavior taking into account the direct harm and potential transmission risk of the abnormal behavior. The risk score is optimized through multiple rounds of iterations, and the scoring parameters are dynamically adjusted to reflect the real-time impact of the abnormal behavior. The score is mapped to a unified risk interval through normalization processing. According to the predefined risk threshold or distribution, a dynamic grading strategy is used to assign a corresponding risk level to each abnormal behavior, and an explanatory description of the risk level is generated at the same time, including the source of the risk and the scope of impact.

[0009] Optionally, the graph representation is deep-learned using a graph neural network algorithm, the importance of neighbor node information is dynamically adjusted by introducing an attention mechanism, the representation of each node in the behavior graph is updated by multi-layer aggregation of neighbor node information of nodes in the behavior graph, a multi-dimensional risk assessment model is constructed in combination with the propagation path of abnormal behaviors and the dependency of system resources, and the behavior risk information evaluated by the graph neural network is obtained in combination with the correlation between the abnormal behaviors and the propagation mode of the abnormal behaviors in the network, including: Initialize the vector representation of each node in the behavior graph to obtain the initial vector representation of each node, enhance the features of the initial vector representation based on the occurrence time, resource dependency and operation type of the abnormal behavior, collect information of neighboring nodes directly connected to each node based on the connection relationship between nodes in the behavior graph, dynamically calculate the importance weight of each neighboring node to the current node by introducing an attention mechanism, and perform weighted aggregation on the neighboring node information according to the weight to obtain comprehensive information about the surrounding environment of the node; Based on the initial vector representation of the node, the aggregated comprehensive information of the association between the nodes is integrated from the comprehensive information by using an aggregation function, and the propagation intensity and influence range between the nodes are analyzed in combination with the propagation path of the abnormal behavior. According to the aggregated comprehensive information, the initial vector representation of the node is converted into a target vector representation that combines the node's own characteristics and the node's neighborhood information through a trainable conversion function, while retaining the temporal dependency and resource dependency between the nodes; Through the iterative message passing mechanism, the target representation of the node is repeatedly aggregated and transformed at different levels. In each layer iteration, the attention weight is dynamically updated to reflect the changes in the correlation between nodes, so as to obtain a global view of the complex correlation between the abnormal behaviors and capture the propagation mode of abnormal behaviors in the network. Based on the graph structure characteristics in the behavior graph combined with the global view, by analyzing the centrality and resource dependency strength of the nodes in the network, the main source or high-risk area of ​​the abnormal behavior is analyzed from the network structure characteristics in the abnormal behavior, and the key resource nodes and high-risk propagation paths are identified in combination with the dependency relationship of system resources, and an enhanced node representation of the network structure characteristics is generated; Using the enhanced node representation as input, a multi-dimensional risk assessment model is constructed, the influence range, propagation path and resource dependency of the node are comprehensively considered, the risk level of each node in the behavior graph is predicted, and the risk level of the node is calculated through a multi-dimensional scoring mechanism in combination with the characteristics of the node itself in the behavior graph and the position and role of the node in the behavior graph in the entire network, and a score representing the risk level of the abnormal behavior is output; The scores are aggregated, combined with the propagation path of the abnormal behavior and the dependency of system resources, to generate behavioral risk information including the risk source, propagation path, and impact range.

[0010] Optionally, dynamically adjusting a response strategy from a predefined security control measure library through an adaptive strategy selection algorithm according to the abnormal behavior list to formulate security control measures for the third-party component includes: Evaluate and process the third-party components involved in the abnormal behavior list, and determine the position and function of the third-party components in the software supply chain and the impact of the third-party components on the overall security and stability of the system by analyzing the upstream and downstream dependencies, call frequency, and permission scope of the components in the software supply chain. At the same time, evaluate the historical behavior patterns of the components and the degree of deviation of the current abnormal behavior to obtain a security status assessment report of the affected components. Acquire monitoring data of the current system from the behavior data stream, perform real-time cleaning and feature extraction on the monitoring data, analyze and process the security status of the current system based on the security status assessment report, evaluate the correlation between system load, network traffic pattern and the effectiveness of existing security measures through a dynamic weight allocation mechanism, and generate a real-time risk assessment portrait of the system environment in combination with the load of the current system, network traffic pattern and the effectiveness of existing security measures, and obtain potential risk and response capability assessment results in the environment where the current system is located; Based on historical attack data and known security events, the evolution of attack behaviors is extracted through time series analysis and pattern matching technology, and the types and scope of security threats that may appear in the future are predicted in combination with machine learning models. At the same time, potential attack paths and affected key resources are identified to identify new attack vectors against the affected components in advance. Based on the potential risks and response capability assessment results in the environment of the current system and the new attack vector, a multi-objective optimization algorithm is used to balance the implementation cost and expected benefits of security control measures. In combination with the security status of the current system, historical attack patterns and expected losses, a set of candidate response strategies is dynamically generated. According to real-time environmental changes and risk evolution trends, strategy priorities are adaptively adjusted, and optimal security control measures are dynamically adjusted and formulated.

[0011] Optionally, the monitoring data of the current system is obtained from the behavior data stream, and the monitoring data is cleaned and feature extracted in real time. Based on the security status assessment report, an adaptive strategy selection algorithm is applied to analyze and process the security status of the current system, and the correlation between the system load, network traffic pattern and the effectiveness of existing security measures is evaluated through a dynamic weight distribution mechanism. In combination with the load of the current system, the network traffic pattern and the effectiveness of existing security measures, a real-time risk assessment portrait of the system environment is generated, and the potential risk and response capability assessment results in the environment where the current system is located are obtained, including: Acquire monitoring data of the current system from the behavior data stream, clean the monitoring data in real time through data filtering and outlier processing, extract key features related to system load, network traffic and security measures, analyze the load of the current system using the location and function information of third-party components in the software supply chain provided in the security status assessment report, evaluate the correlation between load peak, resource utilization and task priority through a dynamic weight allocation mechanism, and obtain an assessment result on the load of the current system; Based on the security status assessment report, combined with the network traffic data collected by the network monitoring tool, the abnormal traffic pattern is analyzed from the network traffic pattern of the current system through traffic clustering and pattern recognition technology, and the sensitivity of abnormal traffic detection is dynamically adjusted in combination with historical traffic data and real-time traffic trends. Based on the abnormal traffic pattern, the communication security of the current system is assessed, and a network traffic security assessment report containing traffic anomaly scores and risk hotspots is generated; Based on the security status assessment report, review the security control measures deployed in the current system, evaluate the impact of different security measures on system load and network traffic through a dynamic weight allocation mechanism to determine whether the security control measures are effective in responding to threats in the environment of the current system, and verify the actual protection effect of the security control measures through simulated attack tests or vulnerability scans, record the effectiveness scores and coverage of the security measures, and obtain the effectiveness assessment results of the security measures; The assessment result, the security assessment report and the security measure effectiveness assessment result are input into an adaptive strategy selection algorithm, and the system load, network traffic and security measure effectiveness information are integrated through multi-dimensional data fusion technology to output multi-dimensional information. The weight distribution of each dimension is dynamically adjusted in combination with real-time environmental changes. The multi-dimensional information is analyzed through a machine learning model to construct a real-time risk assessment portrait of the system environment, including a risk distribution map, a threat evolution trend and a response capability score. In combination with the mutual influence between the factors in the multi-dimensional information, the potential risk and response capability assessment results in the environment where the current system is located are obtained.

[0012] Optionally, the monitoring of the behavior of the third-party component during runtime by using the differential execution sandbox technology according to the behavior pattern library, so as to obtain and record the behavior data flow of the third-party component during runtime by using a fine-grained resource access tracking mechanism, includes: Using the behavior pattern library, configuring and deploying a differential execution sandbox environment, creating an independent runtime environment through virtualization technology and resource isolation mechanism to isolate and monitor the runtime behavior of the third-party component, and configuring the behavior monitoring strategy of the sandbox environment to match the normal and abnormal behavior patterns in the behavior pattern library; The behavior of the third-party component at runtime is monitored using differential execution sandbox technology, by executing the third-party component in the sandbox environment and synchronously comparing the difference between the third-party component and the normal behavior pattern, so as to ensure that the monitoring mechanism identifies and matches the normal and abnormal behavior patterns in the behavior pattern library, and records the execution track and resource access behavior of the component in the sandbox environment; For the monitoring mechanism, a fine-grained resource access tracking mechanism is deployed to capture the access requests of third-party components to system resources through hook technology and system call interception mechanism, and track all access operations of the third-party components to system resources during runtime, including file reading and writing, network communication, memory access and process creation, so as to obtain and record the behavioral data flow of the third-party components during runtime, and at the same time, timestamp and context label each access operation to generate a complete behavior log.

[0013] In a second aspect, an embodiment of the present application provides a software supply chain risk detection and protection system, including: An acquisition module, used to acquire third-party components in the software supply chain and analyze multi-level dynamic behaviors from the third-party components; A prediction module, used to predict risk behavior patterns in the third-party component based on the multi-level dynamic behavior using a Bayesian network algorithm to generate a behavior pattern library; A monitoring module, used to monitor the behavior of the third-party component at runtime by using the differential execution sandbox technology according to the behavior pattern library, so as to obtain and record the behavior data flow of the third-party component at runtime by using a fine-grained resource access tracking mechanism; An identification module is used to identify abnormal behaviors that deviate from normal behavior patterns in the behavior pattern library based on the behavior data stream and apply a deep learning time series anomaly detection algorithm, and use a graph neural network algorithm to evaluate the risk level of the abnormal behaviors, and generate an abnormal behavior list by combining the correlation and propagation path between the abnormal behaviors; The adjustment module is used to dynamically adjust the response strategy from the pre-defined security control measure library through an adaptive strategy selection algorithm according to the abnormal behavior list, and formulate security control measures for the third-party component.

[0014] In a third aspect, an embodiment of the present application provides a computing device, including a processor and a memory, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute a software supply chain risk detection and protection method as described in any one of the first aspects.

[0015] In a fourth aspect, an embodiment of the present application provides a computer storage medium having computer program instructions stored thereon, wherein the computer program instructions, when executed by a processor, implement a software supply chain risk detection and protection method as described in any one of the first aspects.

[0016] In an embodiment of the present application, a third-party component in the software supply chain is obtained, and multi-level dynamic behaviors are analyzed from the third-party components; based on the multi-level dynamic behaviors, a Bayesian network algorithm is used to predict risk behavior patterns in the third-party components, and a behavior pattern library is generated; based on the behavior pattern library, the behavior of the third-party component at runtime is monitored using differential execution sandbox technology, so as to obtain and record the behavior data stream of the third-party component at runtime using a fine-grained resource access tracking mechanism; based on the behavior data stream, a deep learning time series anomaly detection algorithm is applied to identify abnormal behaviors that deviate from normal behavior patterns in the behavior pattern library, and a graph neural network algorithm is used to evaluate the risk level of the abnormal behavior, and a list of abnormal behaviors is generated in combination with the correlation and propagation path between the abnormal behaviors; based on the abnormal behavior list, a response strategy from a pre-defined security control measure library is dynamically adjusted through an adaptive strategy selection algorithm to formulate security control measures for the third-party components.

[0017] The technical solution of this application has the following beneficial effects: This application can fully capture the behavioral characteristics of these components under different operating environments and conditions by deeply analyzing the multi-level dynamic behavior of third-party components, ensuring more accurate identification of potential risk behaviors. The Bayesian network algorithm is used to predict the risk behavior patterns in third-party components, and a behavior pattern library containing normal behavior patterns, abnormal behavior patterns and risk behavior patterns is generated. This method not only improves the prediction accuracy of risky behaviors, but also provides data support for subsequent risk assessment. The differential execution sandbox technology is used to monitor the runtime behavior of third-party components, and the fine-grained resource access tracking mechanism is combined to obtain and record detailed runtime behavior data streams. This combination ensures real-time and accurate monitoring of the behavior of third-party components, reducing false positives and false negatives. The time series anomaly detection algorithm based on deep learning is used to identify abnormal behaviors that deviate from normal behavior patterns. The algorithm can automatically adapt to complex and changeable behavior patterns and improve the sensitivity and accuracy of anomaly detection. The graph neural network algorithm is used to evaluate the risk level of abnormal behaviors, and a list of abnormal behaviors is generated by combining the correlation and propagation path between abnormal behaviors. This method not only considers the impact of individual abnormal behaviors, but also evaluates their chain reactions in the network, providing a more comprehensive risk view. Based on the list of abnormal behaviors, the adaptive strategy selection algorithm dynamically adjusts the response strategy from the pre-defined security control measure library to formulate security control measures for third-party components. This enables the system to flexibly adjust defense measures according to actual threat situations, enhancing the system's adaptability and responsiveness.

[0018] Furthermore, by utilizing the deep learning model of long short-term memory network or gated recurrent unit, the behavioral data stream is modeled and processed, and time series features are extracted from it. This enables the system to capture the time dependency and long-term relational characteristics of the runtime behavior of third-party components. By aggregating node information at multiple layers and combining the correlation and propagation path between abnormal behaviors, comprehensive behavioral risk information is generated. This approach not only considers the impact of individual abnormal behaviors, but also evaluates their chain reactions in the network, providing a more comprehensive risk view and enhancing the accuracy and reliability of risk assessment.

[0019] Furthermore, by extracting key information from the behavior records, creating nodes for each abnormal behavior, and creating edges between nodes based on logical relationships, this refined construction method ensures that the behavior graph can accurately reflect the interactions between abnormal behaviors, laying a solid foundation for subsequent deep learning processing. Based on behavioral risk information, a comprehensive risk score is calculated for each abnormal behavior, and the corresponding risk level is assigned according to the predefined risk threshold or distribution. This method not only provides quantitative risk assessment, but also realizes hierarchical management of risks, allowing the security team to adopt appropriate response strategies according to different risk levels. The introduction of comprehensive risk scores makes risk assessment more intuitive and operational, and enhances the decision-making support capabilities of the system.

[0020] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0022] Figure 1 A flowchart of a software supply chain risk detection and protection method provided in an embodiment of the present application; Figure 2 A schematic diagram of the structure of a software supply chain risk detection and protection system provided in an embodiment of the present application; Figure 3 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0024] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

[0025] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0026] Figure 1 A flowchart of a software supply chain risk detection and protection method is provided for an embodiment of the present application, such as Figure 1 As shown, the method includes: Step 101: Obtain third-party components in the software supply chain, and analyze multi-level dynamic behaviors from the third-party components; In this step, third-party components include software libraries, frameworks, plug-ins, and tools introduced from external sources; multi-level dynamic behaviors refer to behavioral characteristics under different environments and conditions, including but not limited to behaviors at startup, resource access patterns at runtime, and interactions with other components. These behavioral characteristics are captured and analyzed through dynamic analysis tools.

[0027] In the embodiment of the present application, in an enterprise-level application development environment, the development team used multiple open source libraries and commercial plug-ins to accelerate the project progress. In order to ensure the security of these third-party components, the security team first collected a list of all introduced third-party components, and performed static analysis and dynamic analysis on each component through automated tools. Dynamic analysis includes executing components in an isolated environment and recording their behavior, thereby identifying initialization behavior at startup, API call patterns at runtime, file system access behavior, etc. These multi-level dynamic behavior data are used for subsequent risk assessment.

[0028] The embodiments of the present application ensure a comprehensive understanding of the behavior of third-party components, provide a detailed data basis for subsequent risk prediction, and improve the accuracy and reliability of risk assessment.

[0029] Step 102: Based on the multi-level dynamic behavior, using a Bayesian network algorithm to predict risk behavior patterns in the third-party component, and generating a behavior pattern library; In this step, the behavior pattern library contains normal behavior patterns, abnormal behavior patterns and risky behavior patterns; the Bayesian network algorithm refers to a probabilistic graphical model used to represent the dependency relationship between variables. By learning historical data, the Bayesian network can predict the possibility of future events.

[0030] In the embodiment of the present application, continuing with the above embodiment, the security team uses the Bayesian network algorithm to model the collected multi-level dynamic behavior data. By learning a large amount of historical data of known normal behavior and abnormal behavior, the algorithm generates a detailed behavior pattern library. This library not only contains common normal behavior patterns, such as normal API call sequences, but also covers known abnormal behavior patterns, such as unauthorized file access, and potential risk behavior patterns, such as unusual network connection attempts. This behavior pattern library becomes the basis for subsequent real-time monitoring and anomaly detection.

[0031] In the embodiment of the present application, through the Bayesian network algorithm, the system can more accurately predict the possible risk behavior patterns of third-party components, improve the foresight of risk identification, and reduce the security risks caused by unknown threats.

[0032] Step 103: According to the behavior pattern library, the behavior of the third-party component during runtime is monitored using the differential execution sandbox technology, so as to obtain and record the behavior data flow of the third-party component during runtime using a fine-grained resource access tracking mechanism; In this step, the differential execution sandbox technology refers to creating an execution environment that is similar to the actual production environment but isolated, so as to observe and analyze the actual running behavior of the third-party components; the fine-grained resource access tracking mechanism refers to recording all access operations of the third-party components to system resources during runtime and providing detailed log information.

[0033] In the embodiment of the present application, during the actual deployment phase, the security team puts the third-party components into a differential execution sandbox for operation. The sandbox environment simulates the real production environment, but limits direct access to external systems. At the same time, a fine-grained resource access tracking mechanism is enabled to record all resource access behaviors of each third-party component at runtime. For example, the specific path and content of a configuration file loaded by an open source library at each startup, as well as the requests it makes in network communications, are recorded. These behavioral data streams are transmitted to the central monitoring system in real time and compared with the patterns in the behavioral pattern library.

[0034] The differential execution sandbox technology of the embodiment of the present application is combined with a fine-grained resource access tracking mechanism to ensure real-time and accurate monitoring of the behavior of third-party components, reduce false alarm rates and missed alarm rates, and enhance the security of the system.

[0035] Step 104: Based on the behavior data stream, a deep learning time series anomaly detection algorithm is applied to identify abnormal behaviors that deviate from normal behavior patterns in the behavior pattern library, and a graph neural network algorithm is used to evaluate the risk level of the abnormal behaviors, and a list of abnormal behaviors is generated by combining the correlation and propagation path between the abnormal behaviors; In this step, the time series anomaly detection algorithm refers to the use of deep learning models such as long short-term memory networks (LSTM) or gated recurrent units to model and process behavioral data streams, extract time series features, and identify abnormal behaviors that deviate from normal behavior patterns; the graph neural network algorithm refers to the use of multi-layer aggregation of node information, combined with the correlation and propagation path between abnormal behaviors, to evaluate the risk level of abnormal behaviors.

[0036] In an embodiment of the present application, during the monitoring process, the central monitoring system receives a large amount of behavioral data streams. The system first applies the LSTM model to perform time series modeling on these data streams, extracts key time series features, and constructs a time series prediction model. By comparing with the normal behavior patterns in the behavior pattern library, the model identifies abnormal behaviors of certain third-party components, such as a plug-in that suddenly adds a large number of unauthorized file read operations. Subsequently, the system uses a graph neural network algorithm to further evaluate these abnormal behaviors, and combines their correlation and propagation paths to generate a detailed list of abnormal behaviors. For example, it is found that the abnormal behavior of a plug-in may be a chain reaction triggered by the update of another framework.

[0037] The application of the deep learning time series anomaly detection algorithm and graph neural network algorithm in the embodiment of the present application significantly improves the sensitivity and accuracy of abnormal behavior identification, enabling the system to timely discover and evaluate complex behavior patterns, and enhancing the comprehensiveness and accuracy of risk assessment.

[0038] Step 105: According to the abnormal behavior list, dynamically adjust the response strategy from the predefined security control measure library through an adaptive strategy selection algorithm to formulate security control measures for the third-party component; In this step, the adaptive strategy selection algorithm refers to dynamically selecting the most appropriate response strategy based on the currently detected abnormal behavior and its risk level to deal with different security threats; the security control measures library refers to a series of pre-defined security control measures, including but not limited to isolation, disabling, alarming, etc., which are used to deal with different types of abnormal behaviors.

[0039] In the embodiment of the present application, based on the abnormal behavior list, the security team dynamically adjusts the security control measures through an adaptive policy selection algorithm. For example, for high-risk abnormal behaviors, such as malicious code injection, isolation measures are immediately taken to prevent it from further affecting other system components; for medium-risk behaviors, such as unauthorized file access, an alarm is issued to notify the relevant responsible person and the relevant functions are temporarily disabled. This dynamic adjustment mechanism ensures that the system can quickly respond to various security threats and minimize potential losses.

[0040] The embodiment of the present application uses an adaptive strategy selection algorithm, and the system can flexibly adjust security control measures according to actual conditions, thereby realizing intelligent security protection and improving the system's adaptability and response efficiency.

[0041] Through the comprehensive application of the above five steps, not only can the behavior of third-party components be fully monitored and evaluated, but potential security threats can also be discovered and responded to in a timely manner, significantly improving the security and stability of the software supply chain.

[0042] In order to solve the problem of accurate monitoring and risk assessment of third-party component behaviors, in some embodiments, based on the behavior data stream, a deep learning time series anomaly detection algorithm is applied to identify abnormal behaviors that deviate from normal behavior patterns in the behavior pattern library, and a graph neural network algorithm is used to evaluate the risk level of the abnormal behaviors. Combined with the correlation and propagation path between the abnormal behaviors, an abnormal behavior list is generated, including: The behavior data stream is modeled using a long short-term memory network or a deep learning model of a gated recurrent unit, and local and global features in the behavior data stream are extracted through a multi-scale sliding window, and time series features are extracted from the behavior data stream. A time series prediction model is constructed based on the time series features; the time series prediction model is trained and verified according to the historical behavior data stream records of normal behavior patterns in the behavior pattern library to obtain an anomaly detection model; the data in the behavior data stream is input into the anomaly detection model, and the specific behavior of the third-party component during operation is judged by the probability distribution output by the anomaly detection model whether it deviates from the normal behavior pattern in the behavior pattern library; when the anomaly detection model identifies a behavior that deviates from the normal behavior pattern, the occurrence time of the behavior, the system resources involved and The specific operation type is captured, and the contextual environment information of the abnormal behavior is captured to obtain the behavior record identified as abnormal; using the behavior record, by analyzing the temporal relationship and resource dependency relationship between the abnormal behaviors, a behavior graph representing the correlation between the abnormal behaviors is constructed, and node weights and edge weights are introduced to quantify the impact scope and severity of the abnormal behaviors. The graph neural network algorithm is applied to evaluate the risk level of the abnormal behavior from the behavior graph, and the risk score is optimized through multiple rounds of iterations in combination with the correlation between the abnormal behaviors and the propagation path of the abnormal behaviors in the network to generate the risk level of each abnormal behavior; based on the risk level, cluster analysis is performed on the abnormal behaviors to identify potential attack patterns, and the specific information of the abnormal behaviors is summarized to generate an abnormal behavior list containing abnormal behavior classification, risk score and disposal suggestions.

[0043] In this embodiment, the long short-term memory network (LSTM) or the gated recurrent unit (GRU) are two deep learning models that are good at processing and predicting time series data. The multi-scale sliding window technology allows the capture of feature information at different time scales from the behavioral data stream, which is crucial for understanding complex behavioral patterns. The constructed behavioral graph is a graphical representation method in which nodes represent abnormal behaviors, edges represent the correlation between these behaviors, and weights reflect the scope and severity of the impact.

[0044] In an embodiment of the present application, first, the behavior data stream is preprocessed and feature extracted through a deep learning model to identify possible abnormal behaviors; secondly, a time series prediction model that can distinguish between normal and abnormal behaviors is trained based on historical data; thirdly, this model is used in actual operations to monitor the behavior of third-party components and record all behaviors marked as abnormal; finally, based on the recorded behavior data, a behavior map is constructed and the risk level of each abnormal behavior is evaluated through a graph neural network algorithm to generate a detailed abnormal behavior list.

[0045] Here is a specific example: The above solution is deployed in an enterprise-level software system. First, the LSTM model is used to model the operation logs of third-party components, and the key features of the log data in the past three months are captured through the multi-scale sliding window technology. Secondly, a time series prediction model is established based on these features, and the model is trained and verified using data without abnormal behavior in the past year. Thirdly, the operation data of the current system is collected in real time and input into the anomaly detection model. When an operation is found to deviate significantly from normal behavior, its occurrence time, involved resources and specific type are recorded, and contextual information is collected. Then, based on all the collected abnormal behavior records, a detailed behavior map is constructed, and the graph neural network algorithm is used to calculate the risk score of each abnormal behavior. Finally, all abnormal behaviors are clustered based on the risk score, potential security threats are identified, and a list of abnormal behaviors with classification, scoring and disposal suggestions is generated. Through the above steps, the enterprise not only improves its monitoring capabilities for the security of its software supply chain, but also can quickly respond to and mitigate potential security threats.

[0046] In order to further improve the accuracy of identifying abnormal behaviors and their risk assessment, in some embodiments, the behavior records are used to analyze the temporal relationship and resource dependency relationship between abnormal behaviors to construct a behavior graph representing the correlation between the abnormal behaviors, introduce node weights and edge weights to quantify the impact range and severity of abnormal behaviors, apply a graph neural network algorithm to evaluate the risk level of the abnormal behaviors from the behavior graph, combine the correlation between the abnormal behaviors and the propagation path of the abnormal behaviors in the network, optimize the risk score through multiple rounds of iterations, and generate the risk level of each abnormal behavior, including: Extract key information from the behavior record, wherein the key information includes the time of occurrence, the system resources involved, the type of operation performed, and the context information of the behavior, and extract the execution subject, target object, and operation result information of the abnormal behavior to construct a more comprehensive behavior feature representation; by analyzing the temporal relationship between abnormal behaviors, calculate the time interval and sequential dependency of the behavior, and determine the correlation of abnormal behaviors in the time dimension; by analyzing the resource dependency between abnormal behaviors, calculate the access overlap and dependency strength of the behavior on system resources, and determine the correlation of abnormal behaviors in the resource dimension; according to the key information and the correlation analysis results, create a node for each abnormal behavior, and assign a weight to each node, the weight value is dynamically calculated according to the impact range and severity of the abnormal behavior, and at the same time, create edges between nodes according to the logical relationship between abnormal behaviors, and assign a weight to each edge, the weight value is dynamically calculated according to the correlation strength between abnormal behaviors, and obtain a behavior map representing the interaction between the abnormal behaviors; using graph embedding technology, convert the behavior map into a representation in a low-dimensional vector space, and through multiple rounds of iteration The vector representations of nodes and edges are optimized, the structural information and semantic information in the graph are retained, and the optimized graph representation is obtained; the graph representation is deep-learned by using a graph neural network algorithm, the importance of neighbor node information is dynamically adjusted by introducing an attention mechanism, the representation of each node in the behavior graph is updated by multi-layer aggregation of neighbor node information of nodes in the behavior graph, a multi-dimensional risk assessment model is constructed in combination with the propagation path of abnormal behaviors and the dependency of system resources, and the behavior risk information evaluated by the graph neural network is obtained in combination with the correlation between the abnormal behaviors and the propagation mode of the abnormal behaviors in the network; based on the behavior risk information, a comprehensive risk score is calculated for each abnormal behavior by comprehensively considering the direct harm and potential propagation risk of the abnormal behavior, the risk score is optimized through multiple rounds of iterations, the scoring parameters are dynamically adjusted to reflect the real-time impact of the abnormal behavior, the score is mapped to a unified risk interval through normalization, and a dynamic grading strategy is used to assign a corresponding risk level to each abnormal behavior according to a predefined risk threshold or distribution, and an explanatory description of the risk level is generated, including the source of the risk and the scope of impact.

[0047] In this embodiment, the behavior graph is a graphical model in which nodes represent abnormal behaviors and edges represent the associations between these behaviors. The node weight reflects the scope and severity of the behavior, while the edge weight is calculated based on the strength of the association between the behaviors. Graph Neural Network (GNN) is a deep learning model specifically designed to process graph structured data. It can effectively capture complex dependencies between nodes and is suitable for scenarios such as risk assessment.

[0048] In an embodiment of the present application, first, key information including timestamps, involved resources and operation types, etc. is extracted from the behavior log of the third-party component for constructing a behavioral feature representation; secondly, the timing and resource correlation between behaviors are determined by analyzing the time intervals and sequential dependencies of abnormal behaviors as well as the resource access overlap and dependency strength; thirdly, a behavior graph is constructed based on the above analysis results, in which each abnormal behavior is regarded as a node, and the connections between nodes represent the logical relationship between them; finally, the behavior graph is converted into a low-dimensional vector representation using graph embedding technology, and these representations are optimized using a graph neural network algorithm to evaluate the risk level of each abnormal behavior.

[0049] Here is a specific example: This solution was deployed in a cloud computing environment. First, the key information of all abnormal behaviors in the past week was extracted from the cloud service operation log, including the time of occurrence, the server resources involved, the type of operation performed, and the context information. Second, by analyzing the time intervals and resource access patterns between these abnormal behaviors, their correlation in the time and resource dimensions was determined. Third, based on the above analysis results, a behavior graph containing 20 nodes was constructed. Each node represents an abnormal behavior, and different weight values ​​are assigned according to its impact range and severity. Each edge is assigned a corresponding weight according to the strength of the association between abnormal behaviors. Then, the graph embedding technology is used to transform the graph into a representation in a low-dimensional vector space, and multiple iterations are optimized through the graph neural network algorithm to obtain the final risk score of each abnormal behavior. Finally, all abnormal behaviors are classified according to the predefined risk threshold, and a detailed risk level explanation is provided for each behavior, including the source and impact range. Through the above steps, not only the detection capability of potential threats in the cloud environment is improved, but also the accurate risk assessment of abnormal behaviors is achieved, thereby enhancing the security of the system.

[0050] In order to further improve the understanding of the propagation pattern of abnormal behaviors in the network and the accuracy of their risk assessment, in certain embodiments, the graph representation is deep-learned using a graph neural network algorithm, the importance of neighbor node information is dynamically adjusted by introducing an attention mechanism, the representation of each node in the behavior graph is updated by multi-layer aggregation of neighbor node information of nodes in the behavior graph, a multi-dimensional risk assessment model is constructed in combination with the propagation path of abnormal behaviors and the dependency of system resources, and the behavior risk information evaluated by the graph neural network is obtained in combination with the correlation between the abnormal behaviors and the propagation pattern of the abnormal behaviors in the network, including: Initialize the vector representation of each node in the behavior graph to obtain the initial vector representation of each node. Based on the occurrence time, resource dependency and operation type of the abnormal behavior, perform feature enhancement on the initial vector representation. Based on the connection relationship between the nodes in the behavior graph, collect the information of the neighboring nodes directly connected to each node. By introducing the attention mechanism, dynamically calculate the importance weight of each neighboring node to the current node, and perform weighted aggregation on the neighboring node information according to the weight to obtain comprehensive information about the surrounding environment of the node. Based on the initial vector representation of the node, use the aggregation function to integrate the aggregated comprehensive information of the correlation between the nodes from the comprehensive information, combine the propagation path of the abnormal behavior, analyze the propagation intensity and influence range between the nodes, and according to the aggregated comprehensive information, use the trainable conversion function to convert the initial vector representation of the node into a target vector representation that combines the node's own characteristics and the node's neighborhood information, while retaining the temporal dependency and resource dependency between the nodes. Through the iterative message passing mechanism, repeatedly perform aggregation and conversion on the target representation of the node at different levels. In each layer iteration, dynamically Attention weights are updated to reflect changes in the correlation between nodes, a global view of the complex correlation between the abnormal behaviors is obtained, and the propagation pattern of abnormal behaviors in the network is captured; based on the graph structure characteristics in the behavior graph and the global view, by analyzing the centrality of the nodes in the network and the resource dependency strength, the main source or high-risk area of ​​the abnormal behavior is analyzed from the network structure characteristics in the abnormal behavior, and the key resource nodes and high-risk propagation paths are identified in combination with the dependency of system resources, and an enhanced node representation of the network structure characteristics is generated; using the enhanced node representation as input, a multi-dimensional risk assessment model is constructed, the influence range, propagation path and resource dependency of the node are comprehensively considered, the risk level of each node in the behavior graph is predicted, and the risk degree of the node is calculated through a multi-dimensional scoring mechanism in combination with the node's own characteristics in the behavior graph and the position and role of the node in the behavior graph in the entire network, and a score representing the risk degree of the abnormal behavior is output; the score is summarized, and the behavior risk information including the risk source, propagation path and influence range is generated in combination with the propagation path of the abnormal behavior and the dependency of system resources.

[0051] In this embodiment, a graph neural network (GNN) is a deep learning model that can process graph-structured data and is particularly suitable for capturing complex dependencies between nodes. The attention mechanism allows the model to dynamically adjust the importance weights of neighbor nodes based on their relevance, thereby more accurately reflecting the actual impact. The aggregation function is used to integrate the information of neighbor nodes, while the transformation function helps update the vector representation of the node to better reflect its role and influence in the network.

[0052] In an embodiment of the present application, first, a vector representation is initialized for each node in the behavior graph, and its features are enhanced based on the specific attributes of the abnormal behavior; secondly, the importance weights of the neighbor nodes are calculated through the attention mechanism, and the information of the neighbor nodes is aggregated accordingly; thirdly, the target vector representation of the node is updated using the aggregated information, while considering the timing and resource dependencies between nodes; finally, the node representation is optimized through multiple iterations, the key nodes and propagation paths in the network are identified, and a multi-dimensional risk assessment model is constructed, which ultimately generates behavioral risk information including risk sources, propagation paths, and impact ranges.

[0053] Here is a specific example: This solution was deployed in an enterprise's internal network security monitoring system. First, an initial vector representation was created for all abnormal behaviors recorded in the past month, and features were enhanced based on their occurrence time, involved resources, and operation types. Second, for each node, information about all neighboring nodes directly connected to it was collected, and the importance weights of neighboring nodes were calculated using the attention mechanism, thereby obtaining comprehensive information about the surrounding environment of each node. Third, based on this comprehensive information, the target vector representation of each node was updated through a trainable transformation function, while retaining the temporal dependencies and resource dependencies between nodes. Then, through multiple iterations of the message passing mechanism, the aggregation and transformation processes were repeatedly performed at different levels, the entire network structure was analyzed, and several major sources of abnormal behaviors and high-risk propagation paths were identified. Based on the above analysis results, a multi-dimensional risk assessment model was constructed to assign a risk score to each abnormal behavior. After summarizing all the scores, a detailed behavior risk report was generated, which included the risk source, propagation path, and impact range of each abnormal behavior. Through the above steps, not only the ability to identify internal enterprise network security threats is improved, but also effective management and control of potential risks are achieved.

[0054] In order to further improve the dynamic assessment and response capabilities of the security of third-party components, in some embodiments, dynamically adjusting the response strategy from the pre-defined security control measure library through an adaptive strategy selection algorithm according to the abnormal behavior list to formulate security control measures for the third-party components includes: Evaluate and process the third-party components involved in the abnormal behavior list, and determine the position, function and impact of the third-party components on the overall security and stability of the system in the software supply chain by analyzing the upstream and downstream dependencies, call frequency and authority scope of the components in the software supply chain. At the same time, evaluate the historical behavior patterns of the components and the degree of deviation from the current abnormal behavior to obtain a security status assessment report of the affected components; obtain the monitoring data of the current system from the behavior data stream, perform real-time cleaning and feature extraction on the monitoring data, and analyze and process the security status of the current system based on the security status assessment report by applying an adaptive strategy selection algorithm, and evaluate the correlation between the system load, network traffic pattern and the effectiveness of existing security measures through a dynamic weight allocation mechanism, and generate a security status assessment report based on the load of the current system, network traffic pattern and the effectiveness of existing security measures. A real-time risk assessment portrait of the system environment is obtained to obtain the potential risk and response capability assessment results in the environment where the current system is located; based on historical attack data and known security events, the evolution law of attack behavior is extracted through time series analysis and pattern matching technology, and the machine learning model is combined to predict the types of security threats and the scope of impact that may appear in the future, and at the same time identify potential attack paths and affected key resources to identify new attack vectors against the affected components in advance; based on the potential risk and response capability assessment results in the environment where the current system is located and the new attack vector, a multi-objective optimization algorithm is used to balance the implementation cost and expected benefits of security control measures, and in combination with the security status of the current system, historical attack patterns and expected losses, a set of candidate response strategies is dynamically generated, and according to real-time environmental changes and risk evolution trends, the strategy priority is adaptively adjusted, and the optimal security control measures are dynamically adjusted and formulated.

[0055] In this embodiment, the adaptive policy selection algorithm is a method that can dynamically adjust the security policy based on the real-time status of the current system and historical data. It determines the most appropriate response strategy by comprehensively evaluating the system load, network traffic patterns, and the effectiveness of existing security measures. In addition, the multi-objective optimization algorithm aims to balance the implementation cost of security measures with their expected benefits, ensuring that the measures taken are both effective and economical.

[0056] In an embodiment of the present application, first, a comprehensive assessment is conducted on the third-party components involved in the abnormal behavior list to determine their roles in the software supply chain and their impact on the security and stability of the system; secondly, the real-time monitoring data of the system is collected and processed, and an adaptive strategy selection algorithm is used to generate a risk assessment portrait that reflects the current security status of the system; thirdly, historical attack data and machine learning models are used to predict future security threats, and potential attack paths and key resources are identified; finally, the best response strategy for these threats is generated through a multi-objective optimization algorithm, and the strategy is continuously adjusted according to real-time environmental changes to maintain the optimal protection state.

[0057] Here is a specific example: Some abnormal behaviors were found in an application deployed within an enterprise. First, a comprehensive security assessment was conducted on the third-party components used by the application, and their upstream and downstream dependencies, call frequencies and permission scopes in the software supply chain were analyzed, and a security status report for each component was obtained; secondly, the operation data of the application was collected in real time. After cleaning and feature extraction, the adaptive strategy selection algorithm was used to analyze the security status of the current system, taking into account the system load, network traffic patterns, and the effectiveness of existing security measures, to form a real-time risk assessment portrait of the system; thirdly, based on past security events and known attack patterns, the possible security threats in the future were predicted through timing analysis and pattern matching technology, and potential attack paths and affected key resources were identified; then, the costs and benefits of various security control measures were evaluated through a multi-objective optimization algorithm, and a set of candidate response strategies were dynamically generated in combination with the real-time status of the system and historical attack patterns, and the priorities of these strategies were continuously adjusted according to changes in the real-time environment; through the above steps, not only the enterprise is effectively protected from unknown security threats, but also the security measures taken are ensured to be the most cost-effective.

[0058] In order to further improve the accuracy of the assessment of potential risks and response capabilities in the current system environment, in some embodiments, the monitoring data of the current system is obtained from the behavior data stream, and the monitoring data is cleaned and feature extracted in real time. Based on the security status assessment report, an adaptive strategy selection algorithm is applied to analyze and process the security status of the current system, and the correlation between the system load, network traffic pattern and the effectiveness of existing security measures is evaluated through a dynamic weight allocation mechanism. In combination with the load of the current system, the network traffic pattern and the effectiveness of existing security measures, a real-time risk assessment portrait of the system environment is generated, and the potential risk and response capability assessment results in the environment where the current system is located are obtained, including: Acquire the monitoring data of the current system from the behavioral data stream, clean the monitoring data in real time through data filtering and outlier processing, extract key features related to system load, network traffic and security measures, use the location and function information of third-party components in the software supply chain provided in the security status assessment report to analyze the load of the current system, evaluate the correlation between load peak, resource utilization and task priority through a dynamic weight allocation mechanism, and obtain an assessment result about the load of the current system; based on the security status assessment report, combined with the network traffic data collected by the network monitoring tool, analyze the abnormal traffic pattern from the network traffic pattern of the current system through traffic clustering and pattern recognition technology, combine historical traffic data and real-time traffic trends, dynamically adjust the sensitivity of abnormal traffic detection, evaluate the communication security of the current system based on the abnormal traffic pattern, and generate a network traffic security assessment report containing traffic anomaly scores and risk hotspots; based on the security status assessment report, review the current system The method comprises the following steps: first, determining the security control measures deployed, evaluating the impact of different security measures on system load and network traffic through a dynamic weight allocation mechanism, so as to determine whether the security control measures are effective in dealing with the threats in the environment of the current system, and verifying the actual protection effect of the security control measures through simulated attack tests or vulnerability scans, recording the effectiveness scores and coverage of the security measures, and obtaining the effectiveness evaluation results of the security measures; inputting the evaluation results, the security assessment report, and the effectiveness evaluation results of the security measures into an adaptive strategy selection algorithm, integrating the effectiveness information of the system load, network traffic, and security measures through multi-dimensional data fusion technology, so as to output multi-dimensional information, dynamically adjusting the weight allocation of each dimension in combination with real-time environmental changes, analyzing the multi-dimensional information through a machine learning model, and constructing a real-time risk assessment portrait of the system environment, including a risk distribution map, a threat evolution trend, and a response capability score, and combining the mutual influence between the factors in the multi-dimensional information to obtain the potential risk and response capability evaluation results in the environment of the current system.

[0059] In this embodiment, real-time cleaning refers to filtering and processing the original monitoring data to remove outliers to ensure the quality of the data. The dynamic weight allocation mechanism is a method of adjusting the weights of different indicators according to the system operation status to more accurately reflect the true status of the system. Traffic clustering and pattern recognition technology are used to identify abnormal patterns in network traffic and help quickly locate potential threats. The adaptive strategy selection algorithm comprehensively considers the system load, network traffic and the effectiveness of existing security measures to provide the system with the best security protection strategy.

[0060] In an embodiment of the present application, key monitoring data is first extracted from the behavioral data stream, and high-quality input data is obtained after real-time cleaning; secondly, these data are combined with the location and function information of third-party components to evaluate the load status of the current system through a dynamic weight allocation mechanism; thirdly, based on network monitoring data, traffic clustering and pattern recognition techniques are used to analyze the current network traffic pattern, identify any abnormal traffic, and evaluate the communication security of the system accordingly; then, the effectiveness of existing security measures is reviewed, and their scores and coverage are recorded; finally, all evaluation results are input into an adaptive strategy selection algorithm, and multi-dimensional information is integrated through a machine learning model to build a real-time risk assessment portrait of the system to evaluate the potential risks and response capabilities of the system.

[0061] Here is a specific example: In an enterprise-level data center environment, we first extracted monitoring data from the server logs and network monitoring tools for the past 24 hours, and cleaned it in real time through data filtering and outlier processing, extracting key features related to system load, network traffic, and security measures; secondly, based on the function and location information of each third-party component in the data center, we analyzed the system load, calculated the relationship between load peak, resource utilization, and task priority through a dynamic weight allocation mechanism, and obtained a preliminary assessment of the system load; thirdly, combined with network traffic data, we used traffic clustering and pattern recognition technology to discover several abnormal traffic patterns, and dynamically adjusted the detection sensitivity based on historical data. The system then analyzes the sensitivity of network traffic and forms a network traffic security assessment report containing anomaly scores and risk hotspots. Then, it reviews the existing security measures such as firewalls and intrusion detection systems, verifies their actual effects through simulated attack tests, and records the effectiveness scores and coverage of various measures. Finally, it inputs all assessment results into the adaptive strategy selection algorithm, integrates these multi-dimensional information using machine learning models, and constructs a detailed real-time risk assessment portrait of the system environment, including risk distribution maps, threat evolution trends, and response capability scores. Through the above steps, not only the security monitoring capabilities of the enterprise data center environment are improved, but also accurate assessment and rapid response to potential threats are achieved.

[0062] In order to further improve the monitoring and risk identification capabilities of the runtime behavior of third-party components, in some embodiments, the behavior of the third-party components at runtime is monitored using differential execution sandbox technology based on the behavior pattern library, so as to obtain and record the behavior data flow of the third-party components at runtime using a fine-grained resource access tracking mechanism, including: The behavior pattern library is used to configure and deploy a differential execution sandbox environment, and an independent runtime environment is created through virtualization technology and resource isolation mechanism to isolate and monitor the runtime behavior of the third-party component. At the same time, the behavior monitoring strategy of the sandbox environment is configured to match it with the normal and abnormal behavior patterns in the behavior pattern library; the behavior of the third-party component at runtime is monitored using differential execution sandbox technology, and the third-party component is executed in the sandbox environment and the difference between it and the normal behavior pattern is synchronously compared to ensure that the monitoring mechanism identifies and matches the normal and abnormal behavior patterns in the behavior pattern library, and records the execution trajectory and resource access behavior of the component in the sandbox environment; for the monitoring mechanism, a fine-grained resource access tracking mechanism is deployed to capture the access request of the third-party component to the system resources through hook technology and system call interception mechanism, and track all access operations of the third-party component to the system resources at runtime, including file reading and writing, network communication, memory access and process creation, so as to obtain and record the behavior data flow of the third-party component at runtime, and add a timestamp and context tag to each access operation to generate a complete behavior log.

[0063] In this embodiment, the differential execution sandbox is a technology that uses virtualization technology and resource isolation mechanism to create a secure and independent operating environment, which can effectively isolate and monitor the behavior of third-party components. The fine-grained resource access tracking mechanism involves using hook technology and system call interception technology to capture all access operations of components to system resources, including file reading and writing, network communication, etc., and timestamps and context tags each operation to ensure that the behavior trajectory of the component can be fully recorded.

[0064] In an embodiment of the present application, first, a differential execution sandbox environment is configured according to a behavior pattern library to ensure that it can accurately match normal and abnormal behavior patterns; second, third-party components are executed in the sandbox environment, and deviations from normal patterns are monitored in real time; third, a fine-grained resource access tracking mechanism is used to accurately capture third-party components' access requests to various system resources, and record the timestamps and context information of these requests in detail, thereby constructing a detailed behavior log for subsequent analysis and review.

[0065] Here is a specific example: In an enterprise-level application system, a differential execution sandbox environment was first configured based on a known library of security behavior patterns, and an independent operating environment was created using virtualization technology, specifically for monitoring the newly integrated third-party payment component. Secondly, the payment component was started in this sandbox environment, and its behavior was monitored in real time, and its actual behavior was compared with the predefined normal behavior pattern to ensure that any deviation was captured in a timely manner. At the same time, a fine-grained resource access tracking mechanism was deployed. Through hook technology and system call interception mechanism, the component's access requests to all resources in the system were tracked and recorded, including but not limited to file system read and write operations, network communication activities, and memory access, etc. Each operation is accompanied by a timestamp and context label. Then, all the collected behavior data was integrated into a complete behavior log. Through the above steps, not only the monitoring accuracy of the third-party component behavior was improved, but also the protection of the security of the enterprise's internal system was enhanced, so that even in the face of potential risks, a quick response and processing can be achieved.

[0066] Graph Neural Networks (GNN) is a deep learning model specifically designed to process graph-structured data and is widely used in social network analysis, recommendation systems, anomaly detection and other fields. In the field of software supply chain security, GNN can effectively capture the complex relationships between third-party components and assess their risk levels. This solution uses GNN to perform multi-layer aggregation and transformation on nodes in the behavior graph to generate enhanced node representations and then predict the risk score of each node.

[0067] Optionally, the graph representation is deep-learned using a graph neural network algorithm, and the representation of each node in the behavior graph is updated by multi-layer aggregation of neighbor node information of the nodes in the behavior graph, and the behavior risk information evaluated by the graph neural network is obtained by combining the correlation between the abnormal behaviors and the propagation mode of the abnormal behaviors in the network, including: Initializing the vector representation of each node in the graph representation to obtain the initial vector representation of each node, collecting information of neighboring nodes directly connected to each node based on the connection relationship between the nodes in the graph representation, and obtaining comprehensive information about the surrounding environment of the node, including: Generate each node in the behavior graph according to the initialization strategy The initial vector representation of , at each layer In the collection and node Directly connected neighbor nodes The information of neighbor nodes is integrated through the aggregation function information to form comprehensive information ; Among them, the calculation formula of comprehensive information is: ; in, Representation Node In the graph neural network The comprehensive information after aggregation in the layer; Representation Node The set of neighbor nodes of Representation Node The size of the neighbor node set, that is, the number of neighbor nodes, is used as the denominator when calculating the average; Representation Node In the graph neural network Vector representation in layers; Indicates that all Neighbor nodes Perform the sum operation, It is a traversal The indices of all neighbor nodes; In comprehensive information The purpose of the formula is to integrate the information of neighbor nodes through the aggregation function, so that each node can reflect the characteristics of its surrounding environment and enhance the ability of node representation.

[0068] The following is a brief introduction to the design reasons of each sub-item of the formula: The design reason is to gradually accumulate the information of nodes and their neighbors, so as to better capture the contextual characteristics of nodes. The reason for the design is to ensure that the contribution of each neighbor node is equally weighted and to avoid the scale difference problem caused by different nodes having different numbers of neighbors. The reason for the design is to aggregate the information of all neighbor nodes, so that each node not only considers its own characteristics, but also combines the information of surrounding nodes. The reason for the design is to recursively accumulate information so that each layer can be updated based on the learning results of the previous layer. This can gradually accumulate multiple levels of information, from low-level features to high-level abstract features, helping the model to better understand complex graph structure data.

[0069] The following is a brief introduction to how to obtain the parameters of the formula: It is directly obtained from the adjacency matrix or edge list of the behavior graph. For each node It is the set of all nodes directly connected to it. During the training process, these representations are gradually updated through a multi-layer aggregation mechanism. It can be the original feature vector of the node, and the representation of the subsequent layers is obtained by the formula and other update mechanisms are iteratively calculated. is calculated directly from the set of neighbor nodes size.

[0070] The step of converting the initial vector representation of the node into a target vector representation combining the node's own features and the node's neighborhood information through a trainable conversion function according to the comprehensive information includes: Based on comprehensive information and nodes In the graph neural network Vector representation in layers , update the node through the transformation function Graph Neural Network Target vector representation in layer , calculated by the following formula: ; in, Representation Node In the graph neural network The target vector representation after layer update; Activation function, used to introduce nonlinear characteristics; No. The weight matrix of the layer, which is used to map the input features to the output feature space; Indicates the splicing operation, that is, the node In the The representation vector of the layer And aggregated neighbor information Concatenate them into a new vector and use the new vector as the input of the transformation function; Indicates The bias vector of the layer, used to adjust the threshold of the activation function; In the target vector representation The purpose of this formula is to update the node representation through the transformation function, introduce nonlinear characteristics, and enable the model to capture more complex feature relationships.

[0071] The following is a brief introduction to the design reasons of each sub-item of the formula: Introducing nonlinear activation function Refers to the activation function The introduction of is to break the limitation of linear transformation and enable the model to capture the complex nonlinear relationship between input features. Refers to the weight matrix This allows the model to better capture the complex relationships between nodes and their neighbors by learning to adjust the importance of different input features. It is represented by the previous layer of the node itself and aggregated neighbor information By splicing, the model not only considers the characteristics of the node itself, but also combines the influence of its surrounding environment. It ensures that the representation of each node not only reflects its own attributes, but also contains important information from neighboring nodes, thus providing a more comprehensive contextual understanding. is the bias term The introduction of is to ensure that non-zero output can be generated even when the input is zero, which increases the flexibility of the model. This helps the model better fit the data under different input conditions and avoids the problem of constant output caused by all zero inputs.

[0072] The following is a brief introduction to how to obtain the parameters of the formula: Activation Function The appropriate activation function is selected according to the specific task requirements. The weight matrix is the weight matrix It is learned from a large amount of labeled data through the training process. It is a slave node In the The representation of the layer is calculated step by step by recursively applying the formula. Initial representation It can be the original feature vector of the node, such as features extracted from behavior records. is obtained by aggregating neighbor nodes Representation Calculated. Bias is from the bias term It is also learned from the labeled data through the training process, and the weight matrix The initial bias term can be initialized randomly or set to zero.

[0073] The method uses the enhanced node representation as input to predict the risk level of each node in the behavior graph, and outputs a score representing the risk level of the abnormal behavior in combination with the characteristics of the node in the behavior graph and the position and function of the node in the behavior graph in the entire network, including: Using enhanced node representation As input, the risk score of each node is predicted by the prediction model , the formula is: ; in, Representation Node risk score; Represents the weight matrix of the first prediction layer, defining the input enhancement node representation Output risk score The linear relationship between : The weight matrix of the second prediction layer is used for linear transformation after further nonlinear transformation; It represents the enhanced node representation generated after the graph structure characteristics are introduced; Represents the bias vector of the first prediction layer; Represents the bias vector of the second prediction layer; Represents a node after high-order feature interaction processing The feature representation of Represents a node with residual connection and adaptive normalization The hidden representation of . ReLU represents the activation function, which is used to introduce nonlinearity.

[0074] The prediction model predicts the risk score of each node The formula is designed to use enhanced node representation to predict the risk score of each node, combining node characteristics and network location to comprehensively assess the risk.

[0075] The following is a brief introduction to the design reasons of each sub-item of the formula: The introduction of the nonlinear activation function ReLU is to enhance the expressiveness of the model. The non-saturation property of ReLU helps to accelerate training and prevent the gradient vanishing problem, making the training of deep networks more stable and efficient. and is the weight matrix and The introduction of is to achieve linear combination of features, so that the model can learn the complex relationship between input features. By applying different weight matrices layer by layer, the model can extract different feature abstractions at different levels and gradually enhance the understanding of graph structure data. This not only increases the learning depth of the model, but also improves its generalization ability and adaptability. The introduction of residual connections allows information to be directly transferred from shallow layers to deeper layers, ensuring that the model can still effectively learn useful features at deeper levels. This approach can significantly improve the performance of the model, especially when processing complex graph structure data. Node feature representation is the node feature representation Contains the original feature information of the node itself, such as the time in the behavior record, resource access mode, etc. These features provide the model with basic information about the node and are the basis for risk assessment. By combining with the representation after multi-layer aggregation, the model can more comprehensively understand the behavior pattern of the node and make more accurate risk predictions. and is the bias term and The introduction of is to ensure that non-zero output can be generated even when the input is zero, which increases the flexibility of the model. The bias term allows the model to have reasonable output even when there is no input, improving the adaptability and robustness of the model.

[0076] The following is a brief introduction to how to obtain the parameters of the formula: The activation function ReLU is selected according to the specific task requirements. ReLU is one of the most commonly used activation functions in deep learning and is usually provided directly in the deep learning framework. and is the weight matrix and Learned from a large amount of labeled data through the training process. These parameters are usually optimized by minimizing a predefined loss function using the back propagation algorithm. The initial weights can be randomly initialized or loaded from a pre-trained model. Residual connection is from Aggregate the information of neighboring nodes and update the node representation through the transformation function. Residual connections can be extracted from specific hidden layers to ensure effective transmission of information. Node feature representation It is represented by the node feature It can be extracted from the behavior record, including but not limited to the time of occurrence, the system resources involved, the type of operation performed, and context information. These features can be generated through data preprocessing steps and used as input to the model. and is from the bias term and It is also learned from the labeled data through the training process, and the weight matrix and The initial bias term can be initialized randomly or set to zero.

[0077] The scores are aggregated to generate behavioral risk information.

[0078] Suppose we have a behavior graph with 5 nodes, the nodes are numbered arrive , and the initial vector representation of each node is known and their neighbor nodes : ; Neighbor node set: ; Weight matrix and bias vector: ; Activation function: ; Calculation process: Step 1: Initialize the node vector representation according to the given initial vector representation , directly use these values ​​as the initial vector representation of layer 0.

[0079] Step 2: Aggregate neighbor node information, for each layer , calculate comprehensive information :by For example: ; Similarly, calculate the comprehensive information of other nodes: ; Step 3: Update the node vector representation and use the conversion function to update the node vector representation :by For example: ; Similarly, calculate the updated vector representation of other nodes .

[0080] Step 4: Predict risk scores using enhanced node representation As input, predict the risk score of each node :by For example: ; Assumptions and : ; Similarly, the risk scores of other nodes are calculated .

[0081] By scoring the risk of each node By calculating , we get the risk level score of each abnormal behavior. For example, the node The risk score of the abnormal behavior is 0.832, indicating that the abnormal behavior has a high risk level. The security team can take corresponding measures based on these scores, such as isolating high-risk plug-ins, strengthening monitoring, or updating security policies. This approach not only improves the ability to identify potential threats, but also enhances the system's adaptability and response efficiency, ensuring the security of the software supply chain.

[0082] Optionally, in step 105, according to the abnormal behavior list, dynamically adjusting the response strategy from the predefined security control measures library through an adaptive strategy selection algorithm to formulate security control measures for the third-party components includes: evaluating and processing the third-party components involved in the abnormal behavior list to determine the position and function of the third-party components in the software supply chain and the impact of the third-party components on the overall security and stability of the system, and obtaining a security status assessment report of the affected components; acquiring the monitoring data of the current system from the behavior data stream, and analyzing and processing the security status of the current system based on the security status assessment report by applying an adaptive strategy selection algorithm, and combining the load of the current system, the network traffic pattern and the effectiveness of the existing security measures to obtain the potential risk and response capability assessment results in the environment where the current system is located; predicting the types and impact range of security threats that may occur in the future based on historical attack data and known security events, combined with a machine learning model, so as to identify new attack vectors against the affected components in advance; dynamically adjusting and formulating the optimal security control measures based on the potential risk and response capability assessment results in the environment where the current system is located and the new attack vector, and combining the security status of the current system, historical attack patterns and expected losses.Optionally, the monitoring data of the current system is obtained from the behavior data stream, and based on the security status assessment report, an adaptive strategy selection algorithm is applied to analyze and process the security status of the current system, and combined with the load of the current system, network traffic pattern and the effectiveness of existing security measures, the potential risk and response capability assessment results of the environment in which the current system is located are obtained, including: obtaining the monitoring data of the current system from the behavior data stream, using the location and function information of the third-party components in the software supply chain provided in the security status assessment report, analyzing the load of the current system to obtain an assessment result about the load of the current system; based on the security status assessment report, combined with the network traffic data collected by the network monitoring tool, analyzing the abnormal traffic pattern from the network traffic pattern of the current system , based on the abnormal traffic pattern, evaluate the communication security of the current system and generate a security assessment report of the network traffic pattern; based on the security status assessment report, review the security control measures deployed in the current system to determine whether the security control measures are effective in dealing with the threats in the environment of the current system, and verify the actual protection effect of the security control measures through simulated attack tests or vulnerability scans to obtain security measure effectiveness assessment results; input the assessment results, the security assessment report and the security measure effectiveness assessment results into an adaptive strategy selection algorithm to output multi-dimensional information, analyze the multi-dimensional information through a machine learning model, and combine the mutual influence between the factors in the multi-dimensional information to obtain the potential risk and response capability assessment results in the environment of the current system.

[0083] In this step, the security status assessment report includes a detailed assessment of the location and function of third-party components in the software supply chain and their impact on the overall security and stability of the system. This information is used to determine the security status of the affected components and provide a basis for subsequent security policy adjustments. The monitoring data comes from the behavioral data stream, covering multi-dimensional information such as the current system load, network traffic patterns, and the effectiveness of existing security measures. The potential risk and response capability assessment results are obtained by analyzing and processing the above monitoring data through the adaptive strategy selection algorithm. Combined with the current system load, network traffic patterns, and the actual protection effect of existing security measures, the potential risks and response capabilities of the system environment are assessed. The new attack vector is based on historical attack data and known security events, combined with machine learning models to predict the types and scope of security threats that may occur in the future, and identify new attack paths against affected components in advance. The optimal security control measures are the most effective security policies that are dynamically adjusted and formulated based on the current system's potential risks, response capability assessment results, historical attack patterns, and expected losses.

[0084] In the embodiment of the present application, the optional scheme first conducts a comprehensive evaluation of the third-party components involved in the abnormal behavior list to determine its position, function and its impact on the overall security and stability of the system in the software supply chain, and generates a security status assessment report. Then, the monitoring data of the current system is obtained from the behavior data stream, and the position and function information provided by the security status assessment report is used to analyze the load of the current system to obtain the evaluation results of the system load. At the same time, combined with the network traffic data collected by the network monitoring tool, the abnormal traffic pattern is analyzed, the communication security of the current system is evaluated, and a security assessment report of the network traffic pattern is generated. In addition, the security control measures deployed in the current system are reviewed, their actual protection effects are verified, and the effectiveness evaluation results of the security measures are obtained. Finally, these evaluation results are input into the adaptive strategy selection algorithm, and the multi-dimensional information is analyzed through the machine learning model, combined with the mutual influence between the various factors, to obtain the potential risk and response capability evaluation results in the current system environment. Based on these evaluation results and new attack vectors, combined with the security status of the current system, historical attack patterns and expected losses, the optimal security control measures are dynamically adjusted and formulated to ensure the security and stability of the system.

[0085] In an enterprise-level software supply chain environment, the security team is committed to dynamically adjusting security control measures to respond to potential threats. They first conducted a comprehensive assessment of the third-party components involved in the abnormal behavior list, focusing not only on the location and function of these components in the supply chain, but also deeply analyzing their impact on the overall security and stability of the system, thereby generating a detailed security status assessment report. For example, in response to the discovery that a plug-in frequently accessed unauthorized files and may affect the integrity of system files, the team recorded and assessed the risk level of the behavior in detail. Then, the monitoring data of the current system was obtained from the real-time behavior data stream, and the information provided by the previous security status assessment report was used to analyze the current system load, especially the phenomenon of significant increase in system load observed in a specific time period. At the same time, combined with the network traffic data collected by the network monitoring tool, the team identified abnormal traffic patterns, assessed that there were loopholes in the current system communication security, and generated a security assessment report on the network traffic pattern based on this. In addition, the team also reviewed the effectiveness of the security control measures deployed in the current system, verified the actual protection effect of these measures through simulated attack tests and vulnerability scanning, and obtained specific security measures effectiveness assessment results. Finally, all the above evaluation results are input into the adaptive strategy selection algorithm, and the machine learning model is used to comprehensively analyze multi-dimensional information, consider the interaction between various factors, and obtain the evaluation results of potential risks and response capabilities in the current environment. Based on this, combined with the predicted new attack vectors, the security status of the current system, historical attack patterns, and expected losses, the security team dynamically adjusts and formulates the optimal security control measures, such as isolating high-risk plug-ins, enhancing network traffic monitoring, and updating firewall rules. Throughout the process, the application of the adaptive strategy selection algorithm greatly improves the security and response efficiency of the system, ensures that threats can be responded to in a timely and effective manner, and significantly enhances the overall security protection level of the enterprise. For example, after detecting abnormal behavior of a specific plug-in, it is immediately isolated to prevent it from further endangering system security; or the firewall rules are quickly adjusted according to the changes in the network traffic pattern to prevent potential malicious traffic from entering the enterprise's internal network. This series of targeted and responsive measures effectively ensures the safe and stable operation of the enterprise software supply chain.Optionally, in step 103, according to the behavior pattern library, the behavior of the third-party component at runtime is monitored using differential execution sandbox technology, so as to obtain and record the behavior data flow of the third-party component at runtime using a fine-grained resource access tracking mechanism, including: using the behavior pattern library, configuring and deploying a differential execution sandbox environment for isolating and monitoring the behavior of the third-party component at runtime; using differential execution sandbox technology to monitor the behavior of the third-party component at runtime to ensure that the monitoring mechanism identifies and matches normal and abnormal behavior patterns in the behavior pattern library; for the monitoring mechanism, deploying a fine-grained resource access tracking mechanism to track all access operations of the third-party component to system resources at runtime to obtain and record the behavior data flow of the third-party component at runtime.

[0086] In this step, the differential execution sandbox environment is an execution environment that is similar to the actual production environment but isolated, which can observe and analyze the actual operation behavior of third-party components without affecting the production system. The fine-grained resource access tracking mechanism is used to record all access operations of third-party components to system resources during runtime, providing detailed log information to ensure that each resource access is accurately captured and recorded, providing detailed data support for subsequent behavior analysis.

[0087] In an embodiment of the present application, the optional solution first uses a behavior pattern library to configure and deploy a differential execution sandbox environment to achieve isolation and monitoring of the runtime behavior of third-party components. Differential execution sandbox technology ensures that the monitoring mechanism can identify and match normal and abnormal behavior patterns in the behavior pattern library, thereby improving the accuracy of behavior identification. Next, a fine-grained resource access tracking mechanism is deployed in the sandbox environment to track all access operations of third-party components to system resources at runtime, and obtain and record detailed runtime behavior data streams. In this way, not only can the behavior of third-party components be monitored in real time, but it can also ensure that all resource access operations are recorded in detail, providing a solid data foundation for subsequent risk assessment and anomaly detection.

[0088] In an enterprise-level software development environment, in order to ensure that the third-party components introduced do not introduce potential security threats, the security team first configured and deployed a differential execution sandbox environment based on the pre-built behavior pattern library. This environment not only simulates the real production environment to ensure that the third-party components can show their true behavior, but also is completely isolated from the actual business environment, thereby avoiding any potential risks from affecting the existing system. For example, when a plug-in is started in the sandbox environment, the built-in monitoring mechanism immediately starts working, and by identifying and matching the normal and abnormal behavior patterns in the behavior pattern library, any deviation from the standard behavior is promptly discovered, such as attempts to access unauthorized resources or perform abnormal operations. At the same time, in order to further enhance the monitoring capability, the team also deployed a fine-grained resource access tracking mechanism to record in detail all system resource access operations of the plug-in, including the specific path and content of each configuration file read, and the packet details of each request issued in the network communication. These detailed runtime behavior data streams are then transmitted in real time to the central monitoring system, where they are deeply analyzed to facilitate the identification of potential security threats and take corresponding countermeasures. Throughout the entire process, the combined application of differential execution sandbox technology and fine-grained resource access tracking mechanism significantly enhances the transparency and controllability of third-party component behavior, ensuring that even in a complex enterprise-level software development environment, the overall security of the system can be effectively improved, protecting the enterprise from potential security risks caused by external components. In this way, the security team can not only respond and handle abnormal behavior quickly, but also continuously optimize the behavior pattern library based on the collected data to improve long-term security protection capabilities. Figure 2 A schematic diagram of a software supply chain risk detection and protection system is provided for an embodiment of the present application. Figure 2 As shown, the system includes: An acquisition module 21 is used to acquire third-party components in the software supply chain and analyze multi-level dynamic behaviors from the third-party components; A prediction module 22, configured to predict risk behavior patterns in the third-party component based on the multi-level dynamic behavior using a Bayesian network algorithm to generate a behavior pattern library; A monitoring module 23, configured to monitor the behavior of the third-party component at runtime by using a differential execution sandbox technology according to the behavior pattern library, so as to obtain and record the behavior data flow of the third-party component at runtime by using a fine-grained resource access tracking mechanism; The identification module 24 is used to identify abnormal behaviors that deviate from normal behavior patterns in the behavior pattern library based on the behavior data stream and apply a deep learning time series anomaly detection algorithm, and use a graph neural network algorithm to evaluate the risk level of the abnormal behaviors, and generate an abnormal behavior list by combining the correlation and propagation path between the abnormal behaviors; The adjustment module 25 is used to dynamically adjust the response strategy from the pre-defined security control measure library through an adaptive strategy selection algorithm according to the abnormal behavior list, and formulate security control measures for the third-party component.

[0089] Figure 2 The software supply chain risk detection and protection system can be executed Figure 1 The implementation principle and technical effect of the software supply chain risk detection and protection method described in the embodiment are not described in detail. The specific way in which each module and unit performs operations in the software supply chain risk detection and protection system in the above embodiment has been described in detail in the embodiment of the method, and will not be elaborated here.

[0090] In one possible design, Figure 2 A software supply chain risk detection and protection system of the illustrated embodiment can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32; The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0091] The processing component 32 is used to: obtain third-party components in the software supply chain, and analyze multi-level dynamic behaviors from the third-party components; based on the multi-level dynamic behaviors, use the Bayesian network algorithm to predict the risk behavior patterns in the third-party components and generate a behavior pattern library; according to the behavior pattern library, use the differential execution sandbox technology to monitor the behavior of the third-party components during runtime, so as to use the fine-grained resource access tracking mechanism to obtain and record the behavior data stream of the third-party components during runtime; based on the behavior data stream, use the deep learning time series anomaly detection algorithm to identify abnormal behaviors that deviate from normal behavior patterns in the behavior pattern library, and use the graph neural network algorithm to evaluate the risk level of the abnormal behaviors, and combine the correlation and propagation path between the abnormal behaviors to generate an abnormal behavior list; according to the abnormal behavior list, dynamically adjust the response strategy from the pre-defined security control measures library through the adaptive strategy selection algorithm to formulate security control measures for the third-party components.

[0092] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component may also be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the above method.

[0093] The storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0094] Of course, the computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0095] The input / output interface provides an interface between the processing component and the peripheral interface module, which may be an output device, an input device, etc.

[0096] The communication component is configured to facilitate, among other things, wired or wireless communications between the computing device and other devices.

[0097] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. In this case, the computing device can refer to a cloud server, and the above-mentioned processing components, storage components, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0098] The present application also provides a computer storage medium storing a computer program, wherein the computer program can achieve the above-mentioned Figure 1 A software supply chain risk detection and protection method according to the illustrated embodiment.

[0099] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0100] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0101] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0102] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A software supply chain risk detection and protection method, characterized in that: include: Obtain third-party components in the software supply chain and analyze multi-level dynamic behaviors from the third-party components; Based on the multi-level dynamic behavior, using a Bayesian network algorithm to predict risk behavior patterns in the third-party components and generate a behavior pattern library; According to the behavior pattern library, the behavior of the third-party component during runtime is monitored using differential execution sandbox technology, so as to obtain and record the behavior data flow of the third-party component during runtime using a fine-grained resource access tracking mechanism; Based on the behavior data stream, a deep learning time series anomaly detection algorithm is applied to identify abnormal behaviors that deviate from normal behavior patterns in the behavior pattern library, and a graph neural network algorithm is used to evaluate the risk level of the abnormal behaviors, and a list of abnormal behaviors is generated by combining the correlation and propagation path between the abnormal behaviors; According to the abnormal behavior list, a response strategy from a predefined security control measure library is dynamically adjusted through an adaptive strategy selection algorithm to formulate security control measures for the third-party component.

2. The method according to claim 1, characterized in that: Based on the behavior data stream, the deep learning time series anomaly detection algorithm is applied to identify abnormal behaviors that deviate from normal behavior patterns in the behavior pattern library, and the graph neural network algorithm is used to evaluate the risk level of the abnormal behaviors, and the abnormal behavior list is generated by combining the correlation and propagation path between the abnormal behaviors, including: The behavior data stream is modeled using a long short-term memory network or a deep learning model of a gated recurrent unit, and local and global features in the behavior data stream are extracted through a multi-scale sliding window, time series features are extracted from the behavior data stream, and a time series prediction model is constructed based on the time series features; According to the historical behavior data stream records of normal behavior patterns in the behavior pattern library, the time series prediction model is trained and verified to obtain an anomaly detection model; Inputting the data in the behavior data stream into the anomaly detection model, judging whether the specific behavior of the third-party component during operation deviates from the normal behavior pattern in the behavior pattern library through the probability distribution output by the anomaly detection model, and when the anomaly detection model identifies a behavior that deviates from the normal behavior pattern, recording the occurrence time of the behavior, the system resources involved and the specific operation type, and capturing the contextual environment information of the abnormal behavior, to obtain a record of the behavior identified as abnormal; By using the behavior records, by analyzing the temporal relationship and resource dependency relationship between the abnormal behaviors, a behavior graph representing the correlation between the abnormal behaviors is constructed, and node weights and edge weights are introduced to quantify the impact scope and severity of the abnormal behaviors. A graph neural network algorithm is applied to evaluate the risk level of the abnormal behaviors from the behavior graph. In combination with the correlation between the abnormal behaviors and the propagation path of the abnormal behaviors in the network, the risk score is optimized through multiple rounds of iterations to generate the risk level of each abnormal behavior. Based on the risk level, cluster analysis is performed on the abnormal behaviors to identify potential attack patterns, and specific information of the abnormal behaviors is summarized to generate an abnormal behavior list including abnormal behavior classification, risk score and disposal suggestions.

3. The method according to claim 2, characterized in that The behavior records are used to analyze the temporal relationship and resource dependency relationship between abnormal behaviors, to construct a behavior graph representing the correlation between the abnormal behaviors, to introduce node weights and edge weights to quantify the impact scope and severity of abnormal behaviors, to apply a graph neural network algorithm to evaluate the risk level of the abnormal behaviors from the behavior graph, and to optimize the risk score through multiple rounds of iterations to generate the risk level of each abnormal behavior, including: Extract key information from the behavior record, wherein the key information includes the time of occurrence, the system resources involved, the type of operation performed, and the context information of the behavior, and extract the execution subject, target object, and operation result information of the abnormal behavior to construct a more comprehensive behavior feature representation; By analyzing the temporal relationship between abnormal behaviors, the time interval and sequential dependency of the behaviors are calculated to determine the relevance of abnormal behaviors in the time dimension; by analyzing the resource dependency between abnormal behaviors, the access overlap and dependency intensity of the behaviors on system resources are calculated to determine the relevance of abnormal behaviors in the resource dimension; According to the key information and the correlation analysis results, a node is created for each abnormal behavior, and a weight is assigned to each node. The weight value is dynamically calculated according to the impact scope and severity of the abnormal behavior. At the same time, according to the logical relationship between the abnormal behaviors, edges between the nodes are created, and a weight is assigned to each edge. The weight value is dynamically calculated according to the correlation strength between the abnormal behaviors, so as to obtain a behavior map representing the interaction between the abnormal behaviors; Using graph embedding technology, the behavior graph is converted into a representation in a low-dimensional vector space, and the vector representations of nodes and edges are optimized through multiple rounds of iterations to retain the structural information and semantic information in the graph, thereby obtaining an optimized graph representation; The graph representation is deep-learned using a graph neural network algorithm. The importance of neighbor node information is dynamically adjusted by introducing an attention mechanism. The representation of each node in the behavior graph is updated by multi-layer aggregation of neighbor node information of nodes in the behavior graph. A multi-dimensional risk assessment model is constructed by combining the propagation path of abnormal behaviors and the dependency of system resources. The behavioral risk information evaluated by the graph neural network is obtained by combining the correlation between the abnormal behaviors and the propagation mode of the abnormal behaviors in the network. Based on the behavioral risk information, a comprehensive risk score is calculated for each abnormal behavior taking into account the direct harm and potential transmission risk of the abnormal behavior. The risk score is optimized through multiple rounds of iterations, and the scoring parameters are dynamically adjusted to reflect the real-time impact of the abnormal behavior. The score is mapped to a unified risk interval through normalization processing. According to the predefined risk threshold or distribution, a dynamic grading strategy is used to assign a corresponding risk level to each abnormal behavior, and an explanatory description of the risk level is generated at the same time, including the source of the risk and the scope of impact.

4. The method according to claim 3, characterized in that The graph representation is deep-learned using a graph neural network algorithm, the importance of neighbor node information is dynamically adjusted by introducing an attention mechanism, the representation of each node in the behavior graph is updated by multi-layer aggregation of neighbor node information of nodes in the behavior graph, a multi-dimensional risk assessment model is constructed in combination with the propagation path of abnormal behaviors and the dependency of system resources, and the behavior risk information evaluated by the graph neural network is obtained in combination with the correlation between the abnormal behaviors and the propagation mode of the abnormal behaviors in the network, including: Initialize the vector representation of each node in the behavior graph to obtain the initial vector representation of each node, enhance the features of the initial vector representation based on the occurrence time, resource dependency and operation type of the abnormal behavior, collect information of neighboring nodes directly connected to each node based on the connection relationship between nodes in the behavior graph, dynamically calculate the importance weight of each neighboring node to the current node by introducing an attention mechanism, and perform weighted aggregation on the neighboring node information according to the weight to obtain comprehensive information about the surrounding environment of the node; Based on the initial vector representation of the node, the aggregated comprehensive information of the association between the nodes is integrated from the comprehensive information by using an aggregation function, and the propagation intensity and influence range between the nodes are analyzed in combination with the propagation path of the abnormal behavior. According to the aggregated comprehensive information, the initial vector representation of the node is converted into a target vector representation that combines the node's own characteristics and the node's neighborhood information through a trainable conversion function, while retaining the temporal dependency and resource dependency between the nodes; Through the iterative message passing mechanism, the target representation of the node is repeatedly aggregated and transformed at different levels. In each layer iteration, the attention weight is dynamically updated to reflect the changes in the correlation between nodes, so as to obtain a global view of the complex correlation between the abnormal behaviors and capture the propagation mode of abnormal behaviors in the network. Based on the graph structure characteristics in the behavior graph combined with the global view, by analyzing the centrality and resource dependency strength of the nodes in the network, the main source or high-risk area of ​​the abnormal behavior is analyzed from the network structure characteristics in the abnormal behavior, and the key resource nodes and high-risk propagation paths are identified in combination with the dependency relationship of system resources, and an enhanced node representation of the network structure characteristics is generated; Using the enhanced node representation as input, a multi-dimensional risk assessment model is constructed, the influence range, propagation path and resource dependency of the node are comprehensively considered, the risk level of each node in the behavior graph is predicted, and the risk level of the node is calculated through a multi-dimensional scoring mechanism in combination with the characteristics of the node itself in the behavior graph and the position and role of the node in the behavior graph in the entire network, and a score representing the risk level of the abnormal behavior is output; The scores are aggregated, combined with the propagation path of the abnormal behavior and the dependency of system resources, to generate behavioral risk information including the risk source, propagation path, and impact range.

5. The method according to claim 1, characterized in that The step of dynamically adjusting the response strategy from the predefined security control measures library through an adaptive strategy selection algorithm according to the abnormal behavior list to formulate security control measures for the third-party component includes: Evaluate and process the third-party components involved in the abnormal behavior list, and determine the position and function of the third-party components in the software supply chain and the impact of the third-party components on the overall security and stability of the system by analyzing the upstream and downstream dependencies, call frequency, and permission scope of the components in the software supply chain. At the same time, evaluate the historical behavior patterns of the components and the degree of deviation of the current abnormal behavior to obtain a security status assessment report of the affected components. Acquire monitoring data of the current system from the behavior data stream, perform real-time cleaning and feature extraction on the monitoring data, analyze and process the security status of the current system based on the security status assessment report, evaluate the correlation between system load, network traffic pattern and the effectiveness of existing security measures through a dynamic weight allocation mechanism, and generate a real-time risk assessment portrait of the system environment in combination with the load of the current system, network traffic pattern and the effectiveness of existing security measures, and obtain potential risk and response capability assessment results in the environment where the current system is located; Based on historical attack data and known security events, the evolution of attack behaviors is extracted through time series analysis and pattern matching technology, and the types and scope of security threats that may appear in the future are predicted in combination with machine learning models. At the same time, potential attack paths and affected key resources are identified to identify new attack vectors against the affected components in advance. Based on the potential risks and response capability assessment results in the environment of the current system and the new attack vector, a multi-objective optimization algorithm is used to balance the implementation cost and expected benefits of security control measures. In combination with the security status of the current system, historical attack patterns and expected losses, a set of candidate response strategies is dynamically generated. According to real-time environmental changes and risk evolution trends, strategy priorities are adaptively adjusted, and optimal security control measures are dynamically adjusted and formulated.

6. The method according to claim 5, characterized in that The monitoring data of the current system is obtained from the behavior data stream, and the monitoring data is cleaned and feature extracted in real time. Based on the security status assessment report, the security status of the current system is analyzed and processed by applying an adaptive strategy selection algorithm. The correlation between the system load, network traffic pattern and the effectiveness of existing security measures is evaluated through a dynamic weight allocation mechanism. In combination with the load of the current system, the network traffic pattern and the effectiveness of existing security measures, a real-time risk assessment portrait of the system environment is generated, and the potential risk and response capability assessment results in the environment where the current system is located are obtained, including: Acquire monitoring data of the current system from the behavior data stream, clean the monitoring data in real time through data filtering and outlier processing, extract key features related to system load, network traffic and security measures, analyze the load of the current system using the location and function information of third-party components in the software supply chain provided in the security status assessment report, evaluate the correlation between load peak, resource utilization and task priority through a dynamic weight allocation mechanism, and obtain an assessment result on the load of the current system; Based on the security status assessment report, combined with the network traffic data collected by the network monitoring tool, the abnormal traffic pattern is analyzed from the network traffic pattern of the current system through traffic clustering and pattern recognition technology, and the sensitivity of abnormal traffic detection is dynamically adjusted in combination with historical traffic data and real-time traffic trends. Based on the abnormal traffic pattern, the communication security of the current system is assessed, and a network traffic security assessment report containing traffic anomaly scores and risk hotspots is generated; Based on the security status assessment report, review the security control measures deployed in the current system, evaluate the impact of different security measures on system load and network traffic through a dynamic weight allocation mechanism to determine whether the security control measures are effective in responding to threats in the environment of the current system, and verify the actual protection effect of the security control measures through simulated attack tests or vulnerability scans, record the effectiveness scores and coverage of the security measures, and obtain the effectiveness assessment results of the security measures; The assessment result, the security assessment report and the security measure effectiveness assessment result are input into an adaptive strategy selection algorithm, and the system load, network traffic and security measure effectiveness information are integrated through multi-dimensional data fusion technology to output multi-dimensional information. The weight distribution of each dimension is dynamically adjusted in combination with real-time environmental changes. The multi-dimensional information is analyzed through a machine learning model to construct a real-time risk assessment portrait of the system environment, including a risk distribution map, a threat evolution trend and a response capability score. In combination with the mutual influence between the factors in the multi-dimensional information, the potential risk and response capability assessment results in the environment where the current system is located are obtained.

7. The method according to claim 1, characterized in that The method of monitoring the behavior of the third-party component at runtime by using the differential execution sandbox technology according to the behavior pattern library, and obtaining and recording the behavior data flow of the third-party component at runtime by using a fine-grained resource access tracking mechanism, includes: Using the behavior pattern library, configuring and deploying a differential execution sandbox environment, creating an independent runtime environment through virtualization technology and resource isolation mechanism to isolate and monitor the runtime behavior of the third-party component, and configuring the behavior monitoring strategy of the sandbox environment to match the normal and abnormal behavior patterns in the behavior pattern library; The behavior of the third-party component at runtime is monitored using differential execution sandbox technology, by executing the third-party component in the sandbox environment and synchronously comparing the difference between the third-party component and the normal behavior pattern, so as to ensure that the monitoring mechanism identifies and matches the normal and abnormal behavior patterns in the behavior pattern library, and records the execution track and resource access behavior of the component in the sandbox environment; For the monitoring mechanism, a fine-grained resource access tracking mechanism is deployed to capture the access requests of third-party components to system resources through hook technology and system call interception mechanism, and track all access operations of the third-party components to system resources during runtime, including file reading and writing, network communication, memory access and process creation, so as to obtain and record the behavioral data flow of the third-party components during runtime, and at the same time, timestamp and context label each access operation to generate a complete behavior log.

8. A software supply chain risk detection and protection system, characterized in that: include: An acquisition module, used to acquire third-party components in the software supply chain and analyze multi-level dynamic behaviors from the third-party components; A prediction module, used to predict risk behavior patterns in the third-party component based on the multi-level dynamic behavior using a Bayesian network algorithm to generate a behavior pattern library; A monitoring module, used to monitor the behavior of the third-party component at runtime by using the differential execution sandbox technology according to the behavior pattern library, so as to obtain and record the behavior data flow of the third-party component at runtime by using a fine-grained resource access tracking mechanism; An identification module is used to identify abnormal behaviors that deviate from normal behavior patterns in the behavior pattern library based on the behavior data stream and apply a deep learning time series anomaly detection algorithm, and use a graph neural network algorithm to evaluate the risk level of the abnormal behaviors, and generate an abnormal behavior list by combining the correlation and propagation path between the abnormal behaviors; The adjustment module is used to dynamically adjust the response strategy from the pre-defined security control measure library through an adaptive strategy selection algorithm according to the abnormal behavior list, and formulate security control measures for the third-party component.

9. A computing device, characterized in that It comprises a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a software supply chain risk detection and protection method as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that: A computer program is stored, and when the computer program is executed by a computer, a software supply chain risk detection and protection method as described in any one of claims 1 to 7 is implemented.

Images