Container mirror image dependency vulnerability propagation analysis method and device based on graph neural network

Abstract

The invention provides a container mirror image dependency vulnerability propagation analysis method and device based on a graph neural network, and the method comprises the steps: constructing a dependency relationship graph based on software packages in a container mirror image and a dependency relationship between the software packages through employing a target neural network; and the node features of each node are dynamically updated based on the target learning parameters, the node features of each node in the dependency relationship graph and the edge features, so that the node features comprise features from neighbor nodes. In this way, the target learning parameters in the target neural network can learn the dependency relationship between the nodes in a multi-level mode, the method can better adapt to dynamic changes of the dependency relationship, and then an accurate vulnerability propagation potential score result can be output along with updating of the node features and the edge features. Furthermore, a high-risk path is output and repaired based on the vulnerability propagation potential score, so that the network vulnerability propagation risk can be dealt with more accurately and timely, and the software security is improved.

Description

Technical Field

[0001] The present invention relates to the field of container security technology, and in particular to a method and device for analyzing the propagation of container image dependency vulnerabilities based on a graph neural network. Background Art

[0002] With the rapid development of information technology, the complexity and scale of software systems continue to expand, especially in containerized deployment environments. Containerization is a software deployment process that uses operating system-level virtualization technology to package applications and their dependencies (such as libraries, configuration files, environment variables, etc.) into standardized, lightweight, portable, independent units (i.e., containers). The dependencies between software components in containerized deployments are becoming increasingly complex. For example, in a typical containerized application, it may contain multiple open source and closed source components, which form direct or indirect dependency chains between these components.

[0003] Container images usually contain multiple layers, each of which may be created by different development teams and reference different external dependencies. These dependencies may come directly from the open source community and have the characteristics of dynamic changes and rapid version updates, which increases the difficulty of management. In addition, in a multi-cloud environment, the basic images used by different cloud service providers may also have inconsistent versions, further exacerbating the complexity of vulnerability propagation.

[0004] In order to address these challenges, many studies have begun to focus on dependency analysis methods based on graph models. However, common graph algorithms (such as shortest path or topological sorting) are insufficient in capturing the dynamic changes and nonlinear propagation of dependencies, resulting in inaccurate identification of dependencies between containers, which in turn leads to low accuracy in vulnerability propagation analysis, greatly affecting network security. Summary of the invention

[0005] In view of this, an embodiment of the present invention provides a method and device for analyzing the propagation of container image dependency vulnerabilities based on a graph neural network to improve the accuracy of vulnerability propagation analysis.

[0006] According to one aspect of the present invention, a method for analyzing the propagation of container image dependency vulnerabilities based on a graph neural network is provided, the method comprising: Obtain the software packages in the container image and the dependencies between the software packages, and input them into the pre-trained target graph neural network; So that the target graph neural network constructs a dependency graph based on the software packages and the dependency relationships between the software packages, wherein the dependency graph includes a plurality of nodes, each of the nodes corresponds to a software package, and the edges between the nodes are determined based on the dependency relationships between the software packages corresponding to the nodes; For each of the nodes in the dependency graph, iteratively update the node features of each of the nodes based on the target learning parameters and the neighbor nodes of the node and the edge features between the node and the neighbor nodes, wherein the neighbor nodes are nodes that are directly or indirectly dependent on the node; wherein the initial node features of each of the nodes are determined based on the identification, version number and vulnerability information of the node; wherein the edge features are determined based on the dependency type and dependency strength represented by the edge; When a preset iteration stop condition is reached, outputting a vulnerability propagation potential score of each node based on the target learning parameter, current features of each node, and features of each edge; A preset number of high-risk paths with the highest vulnerability propagation potential scores are determined based on the vulnerability propagation potential scores of each of the nodes and each of the edge features, so as to repair each of the nodes included in the high-risk paths.

[0007] According to another aspect of the present invention, a container image dependency vulnerability propagation analysis device based on a graph neural network is provided, the device comprising: An acquisition module is used to acquire the software packages in the container image and the dependencies between the software packages, and input them into a pre-trained target graph neural network; An output module, used for the target graph neural network to construct a dependency graph based on the software packages and the dependency relationships between the software packages, wherein the dependency graph includes a plurality of nodes, each of the nodes corresponds to a software package, and the edges between the nodes are determined based on the dependency relationships between the software packages corresponding to the nodes; For each of the nodes in the dependency graph, iteratively update the node features of each of the nodes based on the target learning parameters and the neighbor nodes of the node and the edge features between the node and the neighbor nodes, wherein the neighbor nodes are nodes that are directly or indirectly dependent on the node; wherein the initial node features of each of the nodes are determined based on the identification, version number and vulnerability information of the node; wherein the edge features are determined based on the dependency type and dependency strength represented by the edge; When a preset iteration stop condition is reached, outputting a vulnerability propagation potential score of each node based on the target learning parameter, current features of each node, and features of each edge; A determination module is used to determine a preset number of high-risk paths with the highest vulnerability propagation potential scores based on the vulnerability propagation potential scores of each of the nodes and each of the edge features, so as to repair each of the nodes included in the high-risk paths.

[0008] According to another aspect of the present invention, there is provided an electronic device, comprising: Processor; and Memory for storing programs, Among them, the program includes instructions, which, when executed by the processor, enable the processor to execute any of the above-mentioned container image dependency vulnerability propagation analysis methods of the graph neural network.

[0009] According to another aspect of the present invention, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable a computer to execute any of the above-mentioned methods for analyzing the propagation of container image dependency vulnerabilities of graph neural networks.

[0010] One or more technical solutions provided in the embodiments of the present invention use a target neural network to construct a dependency graph based on the software packages in the container image and the dependencies between the software packages, and dynamically update the node features of each node based on the target learning parameters, the node features of each node in the dependency graph, and the edge features, so that the node features include features from neighboring nodes. Since the model training and application methods are consistent, the target learning parameters in the target neural network can learn the dependencies between nodes at multiple levels, and can better adapt to the dynamic changes of the dependencies, and then can output a more accurate vulnerability propagation potential score result as the node features and edge features are updated. Furthermore, based on the vulnerability propagation potential score, high-risk paths are output and repaired, which can more accurately and timely respond to network vulnerability propagation risks and improve software security. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Further details, features and advantages of the invention are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which: Figure 1 A schematic diagram of a process of a container image dependency vulnerability propagation analysis method based on a graph neural network provided in an embodiment of the present invention; Figure 2 A schematic diagram of a process of graph neural network training in a method for analyzing the propagation of container image dependency vulnerabilities based on a graph neural network provided in an embodiment of the present invention; Figure 3 A schematic diagram of the logical structure of a container image dependency vulnerability propagation analysis device based on a graph neural network provided in an embodiment of the present invention; Figure 4 A block diagram of an exemplary electronic device that can be used to implement an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0012] Embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments of the present invention are only for exemplary purposes and are not intended to limit the scope of protection of the present invention.

[0013] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0014] The term "including" and its variations used in this document are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". Relevant definitions of other terms will be given in the following description. It should be noted that the concepts of "first", "second", etc. mentioned in the present invention are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0015] It should be noted that the modifications of "one" and "plurality" mentioned in the present invention are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0016] The names of the messages or information exchanged between multiple devices in the embodiments of the present invention are only used for illustrative purposes, and are not used to limit the scope of these messages or information.

[0017] In order to improve the accuracy of vulnerability analysis, an embodiment of the present invention provides a method and device for analyzing the propagation of container image dependency vulnerabilities based on a graph neural network. The method for analyzing the propagation of container image dependency vulnerabilities provided by an embodiment of the present invention can be applied to any electronic device with a vulnerability propagation analysis function, which may include a server, a computer, or a mobile terminal. The scheme of the present invention is described below with reference to the accompanying drawings: Figure 1 A flow chart of a method for analyzing the propagation of container image dependency vulnerabilities provided by an embodiment of the present invention is provided. The method may include the following steps: S101, obtaining each software package in the container image and the dependency relationship between the software packages, and inputting them into a pre-trained target graph neural network; S102, causing the target graph neural network to construct a dependency graph based on the software packages and the dependency relationships between the software packages, wherein the dependency graph includes a plurality of nodes, each of the nodes corresponds to a software package, and the edges between the nodes are determined based on the dependency relationships between the software packages corresponding to the nodes; For each of the nodes in the dependency graph, iteratively update the node features of each of the nodes based on the target learning parameters and the neighbor nodes of the node and the edge features between the node and the neighbor nodes, wherein the neighbor nodes are nodes that are directly or indirectly dependent on the node; wherein the initial node features of each of the nodes are determined based on the identification, version number and vulnerability information of the node; wherein the edge features are determined based on the dependency type and dependency strength represented by the edge; When a preset iteration stop condition is reached, outputting a vulnerability propagation potential score of each node based on the target learning parameter, current features of each node, and features of each edge; S103: determining a preset number of high-risk paths with the highest vulnerability propagation potential scores based on the vulnerability propagation potential scores of the nodes and the edge features, so as to repair the nodes included in the high-risk paths.

[0018] By applying the embodiment of the present invention, a dependency graph is constructed based on the software packages in the container image and the dependencies between the software packages by using the target neural network, and the node features of each node in the dependency graph are dynamically updated based on the target learning parameters, the node features of each node, and the edge features, so that the node features include features from neighboring nodes. Since the model training and application methods are consistent, the target learning parameters in the target neural network can learn the dependencies between nodes at multiple levels, and can better adapt to the dynamic changes of the dependencies, and then can output a more accurate vulnerability propagation potential score result as the node features and edge features are updated. Furthermore, based on the vulnerability propagation potential score, high-risk paths are output and repaired, which can more accurately and timely respond to network vulnerability propagation risks and improve software security.

[0019] The above S101-S103 are exemplarily described below: In a possible embodiment, each software package may register its software information in the system before being put into use online. The software information may include the software package identifier, version identifier, and software package dependencies, etc. The software package identifier may be the software package name, and the version identifier may be the version number. The software package dependencies may include the identifiers of other software packages that the software package needs to rely on. The dependency here may be that the software package needs to use data generated by other software packages, or needs to use functions provided by other software packages, etc. Exemplarily, when a software package is generated, it will determine the other software packages that it depends on, so the identifiers of other software packages that the software package depends on can be registered together with the software package as descriptive information.

[0020] The software information of the above software package may also include vulnerability information of the software package, which may include the CVE (Common Vulnerabilities & Exposures) number and vulnerability score of the software package, where the CVE number is an identifier for publicly disclosed known defects and security vulnerabilities in computer systems, which can be determined based on the code contained in the software package or the network environment in which it runs. The above vulnerability score can be determined based on the exploitability, impact scope and impact degree of the vulnerability. For example, the vulnerability score of the software package can be determined by the following formula: :

[0021] Among them, v represents the current software package or component. The CVSS (Common Vulnerability Scoring System) score of the software package vulnerability, usually between 0 and 10, indicates the severity of the vulnerability. The CVSS score is usually calculated by the CVSS scoring system, which is divided into three main parts: Base Score: reflects the basic characteristics of the vulnerability, including factors such as the attack complexity and impact of the vulnerability, and the score ranges from 0 to 10. Temporal Score: reflects the impact of the vulnerability over time, usually related to the exploitation of the vulnerability. Environmental Score: considers the impact of a specific environment, such as the degree of harm of the vulnerability in different application scenarios or configurations.

[0022] Exploitability indicates the exploitability of a vulnerability, which is generally measured by known vulnerability exploits. It can be a floating value between 0 and 1. The closer it is to 1, the easier it is to exploit. ImpactFactor indicates the potential impact of a vulnerability on the system, such as data leakage, system crash, etc. It is usually a weight coefficient given according to the nature of the vulnerability. α, β, and γ are all weight coefficients used to adjust the impact of different factors on the final vulnerability score, which can be determined through experiments or field experience.

[0023] For example, the CVSS score of a software package is 8.5, the exploitability of the vulnerability is 0.9 (indicating that the vulnerability is easy to exploit), and the impact factor of the vulnerability is 0.8 (indicating that the potential impact of the vulnerability is large). The weight coefficients are set to: α=0.7, β=0.2, γ=0.1, then the vulnerability score of the node is calculated according to the following formula: VulnerabilityScore(v)=0.7×8.5+0.2×0.9+0.1×0.8=5.95+0.18+0.08=6.21 As a possible implementation, S101 can obtain the software information of each software package from the software package registration database, and extract the software package's identification, version number, dependency, vulnerability information, etc. from it. The above-mentioned dependency may include direct dependency and indirect dependency, wherein direct dependency refers to the software package directly using the data of other software packages or calling the functions of other software packages, and indirect dependency refers to the data of other software packages that the software package depends on depends on the data or functions generated by another software package. Exemplarily, for nodes A, B, and C, A uses data b produced by B, and in the process of B producing data b, it needs to use data c produced by C, then there is a direct dependency between A and B, and an indirect dependency between A and C.

[0024] In S102, a dependency graph may be constructed based on the above information of each software package, the dependency graph including a plurality of nodes, each of the nodes corresponding to a software package, and the edges between the nodes are determined based on the dependency relationship between the software packages corresponding to the nodes. Specifically, the edges between the nodes may be directed edges, and the directed edges may point from the dependent node to the dependent node.

[0025] The nodes and edges in the above dependency graph have corresponding node features and edge features, wherein the node features may include the identification, version number, dependency, and vulnerability information of the corresponding software package. The eigenvector of Contains the following: x i=[Package Name,Version,CVE IDs,Vulnerability Score] Among them, packagename is the software package name, version is the version number, CVE ID is the CVE number of the node, and Vulnerability Score is the vulnerability score of the node. As a possible implementation method, the above information can be embedded according to the preset correspondence relationship, so as to convert data of different dimensions into data of the same dimension to constitute the node characteristics of the node. The above preset correspondence relationship may include the correspondence between the software package name and the encoding, the correspondence between the version number and the encoding, the correspondence between the CVE ID and the encoding, and the correspondence between the vulnerability score.

[0026] The edge characteristics of the edge can be determined by the dependency type and risk level, wherein the dependency type includes direct dependency and indirect dependency, and the risk level can be determined based on the vulnerability information of the two nodes connected by the edge, the node weight, etc., and the node weight is pre-set according to the importance of the node in the application. Exemplarily, the risk level can be determined by the following formula:

[0027] in, Indicates the risk level between node vi and node vj. Direct / Indirect is the dependency type. The value corresponding to the dependency type can be preset. For example, direct dependency can be set to 1 and indirect dependency can be set to 0.5. CVSSScore is the CVSS score of the node. ChainLength is the depth of the dependency chain, which can be expressed as the number of nodes passed in the dependency path, which may affect the breadth of propagation. NodeImportance is the node weight, which is usually a constant. For example, the node weight of a general node can be set to 1, and the node weight of a core node can be set to 2. , , as well as All of them are preset weights, and each preset weight can be set according to the actual application scenario. For example, the above preset weights can be adjusted for different scenarios according to the following table to more accurately assess the vulnerability propagation risk in the system.

[0028] Table 1 Preset weights

[0029] The above edge features can be expressed by the following formula:

[0030] in, Indicates that the dependency type is direct dependency / indirect dependency, and Risk Level is the risk level of the edge.

[0031] As a possible implementation, after obtaining each node feature and edge feature, they can be input into a pre-trained target graph neural network, which can construct a dependency graph, and for each node in the dependency graph, iteratively update the node features of each node based on the node's neighbor nodes. As a possible implementation, for each node, the node features of its neighbor nodes and the edge features between the node and the neighbor nodes can be continuously fused to achieve iterative update of the node features of the node.

[0032] When a preset iteration stop condition is reached, the vulnerability propagation potential score of each node is output based on the node characteristics of each node and the edge characteristics of the edges between each node. The preset iteration stop condition may be that the number of iterations reaches a preset number.

[0033] The graph neural network can be GCN, GAT or GraphSAGE. The target graph neural network can include an input layer, a transfer layer and an output layer, wherein the input layer is used to receive the input of the software package information, the transfer layer is used to iteratively update the node features, and the output layer is used to output the final result. For example, Figure 2 As shown, the target graph neural network can be pre-trained by the following steps: S201. Input a training data set into an initial graph neural network, wherein the training data set includes training node features of training nodes and training edge features between the training nodes, and each training node corresponds to an actual vulnerability propagation potential score label.

[0034] The above training data set can be determined according to the historical software package information. The specific execution method of this step can refer to the description of S101-S102, which will not be repeated here.

[0035] S202. For each of the training nodes in the initial graph neural network, the training node features of the training nodes are updated based on the training node features of the training nodes, the training node features of the neighboring nodes of the training nodes, the training edge features of the edges connecting the training nodes, and a preset weight matrix and a preset bias item, wherein the preset weight matrix and the preset bias item are trainable parameters.

[0036] This step can be performed through a propagation layer, which can have multiple propagation layers. The number of propagation layers determines the above-mentioned preset number of iterations. The number of propagation layers is mainly determined by the depth of the dependency chain between nodes in the dependency graph. If the dependency chain is long, more layers are required to fully capture the characteristics of each node and the propagated information. At the same time, adjustments must be made considering the limitations of computing resources and performance requirements to balance accuracy and computational complexity. In practical applications, the number of propagation layers is usually adjusted through experiments to ensure that the network remains efficient when converging. For example, the number of propagation layers can be set for different scenarios according to the following table: Table 2 Schematic diagram of propagation layer settings

[0037] The core mechanism of the propagation layer is message passing. Each layer iteratively aggregates the features of the node with the features of the neighboring nodes to update the features of the node. The above-mentioned neighboring nodes refer to the nodes that have edges with the node. Through the above-mentioned technical means, the node contains not only its own information, but also the information of its neighboring nodes. For example, for a dependency chain: A → B → C, the features of C will gradually include the dependency information propagated from A and B. This mechanism helps to identify dependency propagation paths across multiple layers and can help the model identify vulnerability propagation paths in different dependency chains.

[0038] As a possible implementation, for each node in the graph , the updated node features It can be calculated by the following formula:

[0039] in, Representation Node The feature vector at layer t, Representation Node The set of neighbor nodes of Is a node With Node The edge feature of the edge between , which can represent the strength of the dependency relationship, W is a learnable weight matrix, and the parameters in the weight matrix can be continuously adjusted in the subsequent training process, σ(·) is an activation function, such as ReLU. b is a bias term, which represents the offset when calculating node features, and this term is also a trainable parameter.

[0040] S203: outputting a predicted vulnerability propagation potential score of each of the nodes based on the current node feature of each of the training nodes and the training edge feature of each of the edges.

[0041] After each propagation layer updates the node features, the output layer can output a predicted vulnerability propagation potential score (VPS, Vulnerability Propagation Score) based on the updated node features and edge features. The predicted vulnerability propagation potential score is used to indicate the probability that the node may cause communication propagation. For example, the vulnerability propagation potential score can be calculated by the following formula:

[0042] in, Is a node The feature vector of the last layer in the graph neural network propagation process, v', is a learnable parameter vector obtained through training, which represents the weight of the vulnerability propagation potential.

[0043] S204. Adjust the parameters of the graph neural network based on the target difference between the predicted vulnerability propagation potential score of each training node and the actual vulnerability propagation potential score of the training node until the target difference converges to obtain a target graph neural network.

[0044] The actual vulnerability propagation probability of each node can be predetermined based on the corresponding code of each node and the network environment in which it runs, and the above target difference can be obtained through a preset loss function, which can be a cross entropy loss function, a variance loss function, etc. Specifically, the target difference between the predicted vulnerability propagation potential score and the actual vulnerability propagation probability of the node can be calculated through the loss function, and the parameters of the graph neural network can be adjusted based on the target difference, and the parameters can include the above weight matrix W, the vector v', and the bias term b, etc.

[0045] As a possible implementation method, the above parameters can be updated through the back-propagation algorithm, and the above bias term b can also be automatically adjusted according to the gradient descent method to minimize the loss function, thereby improving the prediction accuracy of the graph neural network.

[0046] The target difference convergence may mean that the difference between the target differences obtained twice is less than a preset difference threshold or the target difference is less than a preset difference threshold.

[0047] Traditional graph algorithms (such as the shortest path) assume that information propagation is linear and the propagation path is predefined. However, graph neural networks use deep learning technology to make the update of node features at each layer not only rely on direct neighbor nodes, but also process node features through recursion and nonlinear activation functions (such as ReLU). This method can simulate more complex propagation behaviors and better cope with multi-level dependencies and complex path propagation situations.

[0048] In a possible embodiment, in order to improve the training efficiency of graph neural networks, the above-mentioned dependency graph can be converted into queue data. The time complexity of graph structure data usually increases quadratically with the increase of nodes, while the time complexity of queue structure processing is usually a constant. It can be seen that the time complexity of queue structure data is significantly lower than that of graph structure data.

[0049] In a possible embodiment, the above dependency graph may be converted by the following steps: S301, scanning the dependency graph, obtaining leaf nodes that are not depended on by other nodes and connecting them to a preset processing queue.

[0050] In a possible embodiment, the in-degree of each node in the dependency graph can be calculated. Specifically, for each node , its indegree(v i ):

[0051] Where A is the adjacency matrix, Represents a slave node To Node It can be seen that if a node is not dependent on other nodes, the in-degree of the node is 0.

[0052] In this step, a node with an in-degree of 0 can be defined as a leaf node, and the leaf node is added to a preset processing queue, the length of which is greater than the number of nodes included in the dependency graph. After adding the node to the preset processing queue, the node can be marked as processed.

[0053] S302, reducing the in-degree of the adjacent nodes of the leaf node, and determining whether there is a node with an in-degree of 0; wherein the node with an in-degree of 0 refers to a node that is not dependent on other nodes; The adjacent nodes of a leaf node refer to nodes in a directed graph that are directly connected to the node with an in-degree of 0 and point to the node from the node with an in-degree of 0. Exemplarily, the in-degree of the adjacent nodes of the leaf node can be reduced by 1, and it is determined whether there is a node with an in-degree of 0.

[0054] S303, if it exists, storing the node with in-degree 0 into the preset processing queue, and returning to the step of reducing the in-degree of the adjacent node of the leaf node to determine whether there is a node with in-degree 0; S304, if not, returning to the step of reducing the in-degree of the adjacent nodes of the leaf node to determine whether there is a node with an in-degree of 0, until all nodes in the dependency graph are stored in the preset processing queue; Correspondingly, each node can be output to the graph neural network in the order in which each node is added to the preset processing queue, so that the graph neural network iteratively updates the node features of each node in the dependency graph based on the neighbor nodes of the node in the order in which each node is added to the preset processing queue.

[0055] Through the above technical solution, the dependency graph is topologically sorted and the nodes are arranged in descending order of in-degree, that is, the nodes in the graph are arranged in the order of dependency. This process ensures that each node will only update its own features after the features of all its dependent nodes are updated, avoiding computational bottlenecks in the training process caused by dependency cycles or complex multi-layer dependencies.

[0056] Furthermore, the above input order ensures that the node feature update of each layer of the graph neural network can proceed smoothly during the training process, avoiding calculation conflicts or inefficiencies caused by deep dependencies. In the subsequent graph neural network training process, the node features will be propagated in topological order through the queue structure, ensuring the correctness of the calculation order and dependency relationship of each layer, thereby reducing the time complexity of training.

[0057] In a possible embodiment, after obtaining the vulnerability propagation potential score of each node, the vulnerability propagation potential score of each propagation path can be calculated based on the vulnerability propagation potential score of the node, and a preset number of candidate paths with the highest scores can be screened out. A high vulnerability propagation potential score means a high probability of vulnerability propagation and a high risk, so these paths can be further analyzed.

[0058] As a possible implementation method, the vulnerability propagation potential score of each path can be calculated by the following formula: It is a slave node To Node If there is a path, the propagation risk score R(p) of the path can be calculated by the following formula:

[0059] in, Is a node The vulnerability propagation potential score of It is the edge feature between each pair of adjacent nodes on the path, indicating the strength of the dependency relationship.

[0060] Accordingly, according to the risk score R(p), a path with a higher transmission risk can be selected. :

[0061] That is, the path with the highest propagation risk score can be selected as the potential vulnerability propagation path for repair or optimization.

[0062] In a possible embodiment, for each of the candidate paths, the influence range score of each risk node can be calculated based on the vulnerability propagation potential scores of each risk node and the neighboring nodes of each risk node contained in the candidate path, and the edge characteristics of the edges between each risk node and the neighboring nodes of each risk node.

[0063] The potential impact range is the potential of each node to spread vulnerabilities to other nodes. Specifically, for each node in the candidate path, first, the depth (number of levels of dependency) and breadth (number of connections with other nodes) of the node's dependency chain need to be analyzed. For example, a node A may depend on multiple nodes B, C, and D. If A's vulnerability is attacked, B, C, and D may also be affected. The depth and breadth of each node's dependency will affect its potential impact on other nodes. Secondly, the weight of the edge (dependency strength) needs to be analyzed: the weight of each edge represents the strength or importance of the dependency between nodes. For example, some nodes may have strong dependencies (high weight), which means that if one of the nodes has a vulnerability, the impact of the spread may be more extensive. When calculating the potential impact range, the weight of each dependency edge must be considered, which will determine the speed of information propagation and the breadth of the impact. VPS (Vulnerability Propagation Potential Score): The VPS score of each node represents its vulnerability propagation potential in the entire dependency chain. If a node has a higher VPS score, its impact on the entire path will also be greater. Therefore, when calculating the potential impact range, the VPS score plays a weighted role. Nodes with high VPS scores mean that the impact of their vulnerability spread is greater, and these nodes may need to be repaired as high priority.

[0064] Exemplarily, the potential influence score of a node may be calculated in the following manner:

[0065] in, is the current node, representing a software package or component. Representation and Node The set of directly adjacent nodes, i.e., nodes All other nodes that it depends on, Representation Node The vulnerability propagation potential score indicates the potential risk of the node propagating the vulnerability. Is a node With Node The dependency weight between them, i.e., the edge feature, indicates the strength of the dependency. This value can be calculated based on the closeness of the dependency chain, version relationship, or other factors.

[0066] For each node , the potential impact range is all the nodes it depends on The weighted sum of the VPS score and the dependency strength. Nodes with higher VPS scores have a greater impact on vulnerability propagation, so they are given higher weights when calculating the impact range. Weight indicates the dependency strength between nodes. If the dependency is stronger, the value is larger, which means that the vulnerability propagation of the node is more likely to affect other nodes directly related to it.

[0067] For example, the node Depends on two nodes and , whose dependency weights are 0.8 and 0.5 respectively, and and The VPS of nodes are 0.7 and 0.9 respectively. The potential impact range can be calculated as follows: ImpactRange(v1)=(0.7×0.8)+(0.9×0.5)=0.56+0.45=1.01 Afterwards, the influence range scores of each risk node contained in each candidate path can be fused to obtain the influence range scores of each candidate path; and based on the influence range scores of each candidate path, a priority order can be set for each candidate path to repair each node contained in each high-risk path according to the priority order.

[0068] According to the potential impact range of the nodes in each path, the paths can be sorted and the paths with the greatest impact can be selected as the focus. The larger the impact range of a path, the greater the potential impact of the vulnerability in the path on other nodes in the dependency chain, and these paths should be repaired first.

[0069] Calculating the potential impact range can help security teams manage risks with limited resources. By identifying the propagation paths of vulnerabilities with high impact ranges, security teams can allocate resources more efficiently and focus on fixing critical vulnerabilities, thereby maximizing security protection effects.

[0070] By applying the embodiments of the present invention, dependency modeling based on graph neural networks can capture more complex dependency patterns and potential vulnerability propagation paths. Compared with traditional vulnerability detection methods, this technology uses deep learning to mine hidden patterns in dependency graphs, making the prediction of vulnerability propagation paths more accurate. For security analysts, this method can effectively identify potential risks instead of relying solely on known vulnerability information, reducing the risk of missed detection.

[0071] Furthermore, in a containerized environment, the security of container images is critical. By comprehensively analyzing all software packages and dependencies in the image, the system can identify and address potential security risks in advance. Timely patching of vulnerabilities can significantly reduce security risks in container images, reduce subsequent security incidents, and protect the data and system security of the enterprise.

[0072] And because of the visualization of the dependency graph and efficient analysis capabilities, developers can quickly locate high-risk vulnerability propagation paths and prioritize fixing vulnerabilities in these paths. This method can effectively save developers' time and energy, avoid the problem of traditional static analysis methods that require a lot of time to manually analyze complex dependencies, and improve vulnerability repair efficiency.

[0073] In actual applications, software components in the supply chain are constantly updated and changed, and vulnerabilities may be introduced during the update process. By automatically analyzing the vulnerability propagation paths of various components in the supply chain, enterprises can better assess security risks in supply chain management, provide early warnings, and reduce the possibility of supply chain disruptions or attacks. Especially in a multi-cloud environment, the complexity of dependencies is higher. This method can ensure that cross-platform and cross-system dependencies are analyzed in a timely and comprehensive manner.

[0074] It can be seen that the method provided by the embodiment of the present invention improves the automation level of vulnerability detection and repair through graph neural networks and automated dependency analysis. Most of the work can be completed automatically without manual intervention or excessive manual analysis, thereby reducing the possibility of human error and making security management more efficient. Through efficient vulnerability propagation path analysis, enterprises can accurately identify which dependency paths pose a threat to security and prioritize resources to repair the most critical vulnerabilities. This not only helps to reduce resource waste, but also maximizes the impact of repair work, ensuring that enterprises achieve the best security protection effect with limited resources.

[0075] Based on the same inventive concept, the embodiment of the present invention also provides a container image dependency vulnerability propagation analysis device based on graph neural network, such as Figure 3 As shown, the device 300 may include: An acquisition module 301 is used to acquire each software package in the container image and the dependency relationship between the software packages, and input them into a pre-trained target graph neural network; Output module 302, used for the target graph neural network to construct a dependency graph based on the software packages and the dependency relationships between the software packages, wherein the dependency graph includes a plurality of nodes, each of the nodes corresponds to a software package, and the edges between the nodes are determined based on the dependency relationships between the software packages corresponding to the nodes; For each of the nodes in the dependency graph, iteratively update the node features of each of the nodes based on the target learning parameters and the neighbor nodes of the node and the edge features between the node and the neighbor nodes, wherein the neighbor nodes are nodes that are directly or indirectly dependent on the node; wherein the initial node features of each of the nodes are determined based on the identification, version number and vulnerability information of the node; wherein the edge features are determined based on the dependency type and dependency strength represented by the edge; When a preset iteration stop condition is reached, outputting a vulnerability propagation potential score of each node based on the target learning parameter, current features of each node, and features of each edge; The determination module 303 is used to determine a preset number of high-risk paths with the highest vulnerability propagation potential scores based on the vulnerability propagation potential scores of each of the nodes and each of the edge features, so as to repair each of the nodes included in the high-risk paths.

[0076] In a possible embodiment, the target graph neural network is obtained in advance through the following steps: Inputting a training data set into an initial graph neural network, the training data set including training node features of training nodes and training edge features between the training nodes, each training node corresponding to an actual vulnerability propagation potential score label; For each of the training nodes in the initial graph neural network, the training node features of the training nodes are updated based on the training node features of the training nodes, the training node features of the neighboring nodes of the training nodes, the training edge features of the edges connecting the training nodes, and a preset weight matrix and a preset bias item, wherein the preset weight matrix and the preset bias item are trainable parameters; Outputting a predicted vulnerability propagation potential score of each of the nodes based on the current node features of each of the training nodes and the training edge features of each of the edges; Based on the target difference between the predicted vulnerability propagation potential score of each training node and the actual vulnerability propagation potential score of the training node, the parameters of the graph neural network are adjusted until the target difference converges to obtain a target graph neural network.

[0077] In a possible embodiment, the device further includes: a storage module, The storage module is used Scan the dependency graph to obtain leaf nodes that are not depended on by other nodes and connect them to a preset processing queue; Lowering the in-degree of the adjacent nodes of the leaf node to determine whether there is a node with an in-degree of 0; wherein the node with an in-degree of 0 refers to a node that is not dependent on other nodes; If so, the node with in-degree 0 is stored in the preset processing queue, and the step of reducing the in-degree of the adjacent node of the leaf node to determine whether there is a node with in-degree 0 is returned; If not, returning to the step of reducing the in-degree of the adjacent nodes of the leaf node to determine whether there is a node with an in-degree of 0, until all nodes in the dependency graph are stored in the preset processing queue; For each of the nodes in the dependency graph, iteratively updating the node features of each of the nodes based on the target learning parameters and the neighbor nodes of the node and the edge features between the node and the neighbor nodes, includes: In the order in which each of the nodes is added to the preset processing queue, for each of the nodes in the dependency graph, the node features of each of the nodes are iteratively updated based on the target learning parameters and the neighboring nodes of the node and the edge features between the node and the neighboring nodes.

[0078] In a possible embodiment, the device further includes: An impact range determination module is used to calculate the impact range score of each risk node for each high-risk path based on the vulnerability propagation potential score of each risk node and the neighboring nodes of each risk node contained in the high-risk path, and the edge features of the edges between each risk node and the neighboring nodes of each risk node; The influence range scores of the risk nodes included in the high-risk paths are merged to obtain the influence range scores of the high-risk paths; A priority order is set for each of the high-risk paths based on the impact range score of each of the high-risk paths, so that each of the nodes included in each of the high-risk paths is repaired according to the priority order.

[0079] Among them, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in the present invention are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0080] The exemplary embodiment of the present invention further provides an electronic device, comprising: at least one processor; and a memory connected to the at least one processor in communication. The memory stores a computer program that can be executed by the at least one processor, and the computer program is used to enable the electronic device to perform a method according to an embodiment of the present invention when executed by the at least one processor.

[0081] Exemplary embodiments of the present invention also provide a non-transitory computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor of a computer, is used to cause the computer to perform a method according to an embodiment of the present invention.

[0082] An exemplary embodiment of the present invention further provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor of a computer, the computer is used to enable the computer to perform a method according to an embodiment of the present invention.

[0083] refer to Figure 4 , a block diagram of an electronic device 400 that can be used as a server or client of the present invention will now be described, which is an example of a hardware device that can be applied to various aspects of the present invention. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0084] like Figure 4 As shown, the electronic device 400 includes a computing unit 401, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 402 or a computer program loaded from a storage unit 408 into a random access memory (RAM) 403. In the RAM 403, various programs and data required for the operation of the electronic device 400 can also be stored. The computing unit 401, the ROM 402, and the RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0085] A plurality of components in the electronic device 400 are connected to the I / O interface 405, including: an input unit 406, an output unit 407, a storage unit 408, and a communication unit 409. The input unit 406 may be any type of device capable of inputting information to the electronic device 400, and the input unit 406 may receive input digital or character information, and generate key signal inputs related to user settings and / or function control of the electronic device. The output unit 407 may be any type of device capable of presenting information, and may include, but is not limited to, a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 408 may include, but is not limited to, a disk, an optical disk. The communication unit 409 allows the electronic device 400 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks, and may include, but is not limited to, a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth™ device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0086] The computing unit 401 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 401 performs the various methods and processes described above. For example, in some embodiments, any of the above-described container image dependency vulnerability propagation analysis methods based on graph neural networks may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 408. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 400 via the ROM 402 and / or the communication unit 409. In some embodiments, the computing unit 401 may be configured to execute any of the above-described container image dependency vulnerability propagation analysis methods based on graph neural networks in any other appropriate manner (e.g., by means of firmware).

[0087] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0088] In the context of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0089] As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, apparatus, and / or device (e.g., disk, optical disk, memory, programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0090] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0091] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0092] A computer system may include clients and servers. Clients and servers are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship to each other.

Claims

1. A container image dependency vulnerability propagation analysis method based on graph neural network, characterized in that: The method comprises: Obtain the software packages in the container image and the dependencies between the software packages, and input them into the pre-trained target graph neural network; So that the target graph neural network constructs a dependency graph based on the software packages and the dependency relationships between the software packages, wherein the dependency graph includes a plurality of nodes, each of the nodes corresponds to a software package, and the edges between the nodes are determined based on the dependency relationships between the software packages corresponding to the nodes; For each of the nodes in the dependency graph, iteratively update the node features of each of the nodes based on the target learning parameters and the neighbor nodes of the node and the edge features between the node and the neighbor nodes, wherein the neighbor nodes are nodes that are directly or indirectly dependent on the node; wherein the initial node features of each of the nodes are determined based on the identification, version number and vulnerability information of the node; wherein the edge features are determined based on the dependency type and dependency strength represented by the edge; When a preset iteration stop condition is reached, outputting a vulnerability propagation potential score of each node based on the target learning parameter, current features of each node, and features of each edge; A preset number of high-risk paths with the highest vulnerability propagation potential scores are determined based on the vulnerability propagation potential scores of each of the nodes and each of the edge features, so as to repair each of the nodes included in the high-risk paths.

2. The method according to claim 1, characterized in that The target graph neural network is obtained in advance through the following steps: Inputting a training data set into an initial graph neural network, the training data set including training node features of training nodes and training edge features between the training nodes, each training node corresponding to an actual vulnerability propagation potential score label; For each of the training nodes in the initial graph neural network, the training node features of the training nodes are updated based on the training node features of the training nodes, the training node features of the neighboring nodes of the training nodes, the training edge features of the edges connecting the training nodes, and a preset weight matrix and a preset bias item, wherein the preset weight matrix and the preset bias item are trainable parameters; Outputting a predicted vulnerability propagation potential score of each of the nodes based on the current node features of each of the training nodes and the training edge features of each of the edges; Based on the target difference between the predicted vulnerability propagation potential score of each training node and the actual vulnerability propagation potential score of the training node, the parameters of the graph neural network are adjusted until the target difference converges to obtain a target graph neural network.

3. The method according to claim 1, characterized in that The method further comprises: Scan the dependency graph to obtain leaf nodes that are not depended on by other nodes and connect them to a preset processing queue; Lowering the in-degree of the adjacent nodes of the leaf node to determine whether there is a node with an in-degree of 0; wherein the node with an in-degree of 0 refers to a node that is not dependent on other nodes; If so, the node with in-degree 0 is stored in the preset processing queue, and the step of reducing the in-degree of the adjacent node of the leaf node to determine whether there is a node with in-degree 0 is returned; If not, returning to the step of reducing the in-degree of the adjacent nodes of the leaf node to determine whether there is a node with an in-degree of 0, until all nodes in the dependency graph are stored in the preset processing queue; For each of the nodes in the dependency graph, iteratively updating the node features of each of the nodes based on the target learning parameters and the neighbor nodes of the node and the edge features between the node and the neighbor nodes, includes: In the order in which each of the nodes is added to the preset processing queue, for each of the nodes in the dependency graph, the node features of each of the nodes are iteratively updated based on the target learning parameters and the neighboring nodes of the node and the edge features between the node and the neighboring nodes.

4. The method according to claim 1, characterized in that The method further comprises: For each of the high-risk paths, based on the vulnerability propagation potential scores of each risk node and the neighboring nodes of each risk node included in the high-risk path, and the edge features of the edges between each risk node and the neighboring nodes of each risk node, the influence range score of each risk node is calculated; The influence range scores of the risk nodes included in the high-risk paths are merged to obtain the influence range scores of the high-risk paths; A priority order is set for each of the high-risk paths based on the impact range score of each of the high-risk paths, so that each of the nodes included in each of the high-risk paths is repaired according to the priority order.

5. A container image dependency vulnerability propagation analysis device based on graph neural network, characterized in that: The device comprises: An acquisition module is used to acquire the software packages in the container image and the dependencies between the software packages, and input them into a pre-trained target graph neural network; An output module, used for the target graph neural network to construct a dependency graph based on the software packages and the dependency relationships between the software packages, wherein the dependency graph includes a plurality of nodes, each of the nodes corresponds to a software package, and the edges between the nodes are determined based on the dependency relationships between the software packages corresponding to the nodes; For each of the nodes in the dependency graph, iteratively update the node features of each of the nodes based on the target learning parameters and the neighbor nodes of the node and the edge features between the node and the neighbor nodes, wherein the neighbor nodes are nodes that are directly or indirectly dependent on the node; wherein the initial node features of each of the nodes are determined based on the identification, version number and vulnerability information of the node; wherein the edge features are determined based on the dependency type and dependency strength represented by the edge; When a preset iteration stop condition is reached, outputting a vulnerability propagation potential score of each node based on the target learning parameter, current features of each node, and features of each edge; A determination module is used to determine a preset number of high-risk paths with the highest vulnerability propagation potential scores based on the vulnerability propagation potential scores of each of the nodes and each of the edge features, so as to repair each of the nodes included in the high-risk paths.

6. The device according to claim 5, characterized in that The target graph neural network is obtained in advance through the following steps: Inputting a training data set into an initial graph neural network, the training data set including training node features of training nodes and training edge features between the training nodes, each training node corresponding to an actual vulnerability propagation potential score label; For each of the training nodes in the initial graph neural network, the training node features of the training nodes are updated based on the training node features of the training nodes, the training node features of the neighboring nodes of the training nodes, the training edge features of the edges connecting the training nodes, and a preset weight matrix and a preset bias item, wherein the preset weight matrix and the preset bias item are trainable parameters; Outputting a predicted vulnerability propagation potential score of each of the nodes based on the current node features of each of the training nodes and the training edge features of each of the edges; Based on the target difference between the predicted vulnerability propagation potential score of each training node and the actual vulnerability propagation potential score of the training node, the parameters of the graph neural network are adjusted until the target difference converges to obtain a target graph neural network.

7. The device according to claim 6, characterized in that The device further comprises: a storage module, The storage module is used Scan the dependency graph to obtain leaf nodes that are not depended on by other nodes and connect them to a preset processing queue; Lowering the in-degree of the adjacent nodes of the leaf node to determine whether there is a node with an in-degree of 0; wherein the node with an in-degree of 0 refers to a node that is not dependent on other nodes; If so, the node with in-degree 0 is stored in the preset processing queue, and the step of reducing the in-degree of the adjacent node of the leaf node to determine whether there is a node with in-degree 0 is returned; If not, returning to the step of reducing the in-degree of the adjacent nodes of the leaf node to determine whether there is a node with an in-degree of 0, until all nodes in the dependency graph are stored in the preset processing queue; For each of the nodes in the dependency graph, iteratively updating the node features of each of the nodes based on the target learning parameters and the neighbor nodes of the node and the edge features between the node and the neighbor nodes, includes: In the order in which each of the nodes is added to the preset processing queue, for each of the nodes in the dependency graph, the node features of each of the nodes are iteratively updated based on the target learning parameters and the neighboring nodes of the node and the edge features between the node and the neighboring nodes.

8. The device according to claim 5, characterized in that The device also includes: Impact Scope Determination Module for For each of the high-risk paths, based on the vulnerability propagation potential scores of each risk node and the neighboring nodes of each risk node included in the high-risk path, and the edge features of the edges between each risk node and the neighboring nodes of each risk node, the influence range score of each risk node is calculated; The influence range scores of the risk nodes included in the high-risk paths are merged to obtain the influence range scores of the high-risk paths; A priority order is set for each of the high-risk paths based on the impact range score of each of the high-risk paths, so that each of the nodes included in each of the high-risk paths is repaired according to the priority order.

9. An electronic device, comprising: processor; as well as Memory for storing programs, The program includes instructions, which, when executed by the processor, cause the processor to perform the method according to any one of claims 1 to 4.

10. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to make a computer execute the method according to any one of claims 1-4.

Images