Open source component selection method and system based on safety performance

Abstract

The invention provides an open source component selection method and system based on security performance, and the method comprises the steps: obtaining vulnerability information corresponding to a target open source component from an open source vulnerability database, the vulnerability information comprising vulnerability types, vulnerability publishing dates and vulnerability scores given by a vulnerability scoring system; obtaining an average daily downloading amount and an average daily release version amount of the target open source component in a specified time period from a public open source service platform; generating a first parameter by fitting based on the daily average downloading amount and the daily average release version amount; generating a second parameter based on the number of days from the vulnerability release date of each vulnerability to the current vulnerability and vulnerability score fitting; generating a first evaluation parameter representing the security element based on fitting of the first parameter and the second parameter; and selecting the target open source component based on the first evaluation parameter. According to the method, the screening safety and reliability of the open source components in the software development process are effectively improved by comprehensively analyzing the downloading amount, the publishing frequency and the vulnerability score of the open source components.

Description

Technical Field

[0001] The present invention relates to the technical field of software development, and in particular to a method and system for selecting open source components based on security performance. Background Art

[0002] In modern software development, the use of open source components is becoming increasingly popular because they can significantly improve development efficiency and reduce costs. However, the security issues of open source components have gradually attracted widespread attention. With the widespread use of open source software, various security vulnerabilities are constantly being discovered and disclosed, which brings potential risks to software development. Therefore, when developers select open source components, they need to comprehensively consider their security performance to avoid serious consequences such as system vulnerabilities and data leaks caused by security risks.

[0003] Currently, security assessments for open source components usually rely on static analysis tools and vulnerability databases. However, these methods often have problems such as incomplete assessments and lack of real-time performance, and cannot effectively reflect the security status of open source components in actual use. Summary of the invention

[0004] The purpose of the present invention is to provide a method and system for selecting open source components based on security performance, which can provide a more accurate security assessment of open source components based on comprehensive analysis of multi-dimensional data.

[0005] In order to achieve the above object, the present invention provides a method for selecting open source components based on security performance, which includes:

[0006] Acquire vulnerability information corresponding to the target open source component from an open source vulnerability database, wherein the vulnerability information includes vulnerability type, vulnerability release date, and vulnerability score given by a vulnerability scoring system;

[0007] Obtaining the average daily download volume and average daily release volume of the target open source component within a specified time period from a public open source service platform;

[0008] Generate a first parameter based on the average daily download volume and the average daily release volume;

[0009] Generate a second parameter based on the number of days from the vulnerability release date to the present and the vulnerability score of each vulnerability;

[0010] Generate a first evaluation parameter representing a safety factor based on the first parameter and the second parameter;

[0011] The target open source component is selected based on the first evaluation parameter.

[0012] Preferably, the first parameter S1 is fitted based on the following formula:

[0013]

[0014] Among them, USE_c represents the average daily download volume, and REL_c represents the average daily release volume.

[0015] Preferably, the second parameter S2 is fitted based on the following formula:

[0016]

[0017] Among them, e is a natural constant, CVSS i represents the vulnerability score of the i-th vulnerability in the target open source component, Time i It represents the number of days from the release date of the i-th vulnerability in the target open source component to the present, and T represents the statistical duration.

[0018] Preferably, the first evaluation parameter S is fitted based on the following formula: s :

[0019]

[0020] Wherein, a and b are preset adjustment constants, 1.5≤a≤2, 1<b<1.5.

[0021] Preferably, vulnerability repair status information of the vulnerability in the target open source component is obtained from the open source community platform, and a second evaluation parameter representing the vulnerability response situation is fitted according to the vulnerability repair status information and the corresponding vulnerability release date; and the target open source component is selected in combination with the first evaluation parameter and the second evaluation parameter.

[0022] Preferably, the following four response states are set for evaluating vulnerability response status:

[0023] Waiting for response: the vulnerability is not fixed and Δt1<δ1;

[0024] No response: the vulnerability is not fixed and Δt1≥δ1;

[0025] Slow response: the vulnerability has been fixed and Δt2≥δ2;

[0026] Fast response: the vulnerability has been fixed and Δt2<δ2;

[0027] Wherein, Δt1 is the time interval between the release date of the vulnerability and the current statistical date;

[0028] Δt2 is the time interval between the release date of the vulnerability and the completion date of the vulnerability repair;

[0029] δ1 and δ2 are two preset time thresholds;

[0030] According to the vulnerability repair status information and the vulnerability release date, for each vulnerability, a corresponding response status is matched;

[0031] creating a third parameter related to a response speed of the vulnerabilities in the open source component based on the response status of all the vulnerabilities in the open source component;

[0032] Calculating the ratio of the number of vulnerabilities in the open source component that are in the slow response state and the fast response state to the total number of vulnerabilities to obtain a vulnerability response ratio;

[0033] The second evaluation parameter is obtained based on a product of the third parameter and the vulnerability response ratio.

[0034] Preferably, the third parameter CoV is created based on the following formula:

[0035] CoV=∑W i ×A i

[0036]

[0037] Among them, W i represents the weight assigned to each of the response states, A i Indicates the proportion of any of the response states in all the response states, B i Indicates the number of any of the response statuses.

[0038] The present invention also provides an open source component selection system, which includes an evaluation parameter generator, wherein the evaluation parameter generator generates evaluation parameters for evaluating a target open source component based on the open source component selection method as described above.

[0039] The present invention also provides an open source component selection system, which includes:

[0040] one or more processors;

[0041] Memory;

[0042] and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the programs include instructions for executing the open source component selection method as described above.

[0043] The present invention also provides a computer-readable storage medium, which includes a computer program, and the computer program can be executed by a processor to complete the open source component selection method as described above.

[0044] Compared with the prior art, the open source component selection method provided by the above technical solution of the present invention effectively improves the security and reliability of open source component screening during the software development process by comprehensively analyzing the download volume, release frequency and vulnerability scores of open source components.

[0045] First, by obtaining vulnerability information from the open source vulnerability database, the potential security risks of the target open source components are identified, and the severity and age of these risks are quantified. This ensures that developers have a comprehensive understanding of the security status of the components.

[0046] Secondly, the average daily downloads and releases obtained from the open source service platform reflect the activity and maintenance frequency of the target open source component. This not only helps to evaluate the maturity of the target open source component, but also indirectly measures the support of the development and user communities.

[0047] In general, this method provides a more accurate security assessment of open source components based on the comprehensive analysis of multi-dimensional data, which helps to improve the security performance and efficiency of software development. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 The figure is a flow chart of a method for selecting an open source component in an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to explain the technical content, structural features, achieved objectives and effects of the present invention in detail, the following is a detailed description in conjunction with the implementation methods and the accompanying drawings.

[0050] This embodiment discloses a method for selecting open source components based on security performance, which is used to select open source components from a third-party platform during software development and improve the security performance of the selected open source components.

[0051] like Figure 1 The open source component selection method in this embodiment includes the following steps:

[0052] S10: Obtain vulnerability information corresponding to the target open source component from the open source vulnerability database, where the vulnerability information includes vulnerability type, vulnerability release date, and vulnerability score given by the vulnerability scoring system.

[0053] S11: Obtain the average daily download volume and average daily release volume of the target open source component within a specified time period from a public open source service platform.

[0054] It should be noted that there is no requirement for the order of performing step S10 and step S11 , and either one may be performed first.

[0055] S12: Generate a first parameter based on the average daily download volume and the average daily released version volume.

[0056] S13: Generate a second parameter based on the number of days from the vulnerability release date of each vulnerability to the current time and the vulnerability score.

[0057] S14: Generate a first evaluation parameter representing a safety factor based on the first parameter and the second parameter.

[0058] S15: Select a target open source component based on the first evaluation parameter.

[0059] Specifically, the first parameter S1 is fitted based on the following formula:

[0060]

[0061] Among them, USE_c represents the average daily download volume, and REL_c represents the average daily release volume.

[0062] In addition, the second parameter S2 is fitted based on the following formula:

[0063]

[0064] Among them, e is a natural constant, an infinite non-repeating decimal, and its value is approximately 2.718281828459045, CVSS i represents the vulnerability score of the i-th vulnerability in the target open source component, Time i It indicates the number of days from the release date of the ith vulnerability in the target open source component to the current time, and T indicates the statistical duration.

[0065] Then, the first evaluation parameter S is fitted based on the following formula: s :

[0066]

[0067] Wherein, a and b are preset adjustment constants, 1.5≤a≤2, 1<b<1.5.

[0068] In this embodiment, the values ​​of a and b are preferably: a=1.915, b=1.0386.

[0069] The following is a specific example to illustrate the execution process of the above open source component selection method in detail.

[0070] 1. Basic data acquisition

[0071] In this embodiment, the information in the past 5 years is counted, that is, the statistical time length T = 5*365.

[0072] Search for vulnerability information of the target open source component Numpy 1.26.0 through NVD API or web crawling.

[0073] Assume that Numpy 1.26.0 has 3 vulnerabilities discovered in the past 5 years, as follows:

[0074] Vulnerability 1: CVSS score is 7.5, release date is 2023-01-01;

[0075] Vulnerability 2: CVSS score is 5.0, and the release date is 2022-03-15;

[0076] Vulnerability 3: CVSS score is 3.0 and the release date is 2020-05-20.

[0077] Get the download and release data of Numpy 1.26.0 in the past five years through PyPI API or web crawling, and calculate the average daily downloads and releases.

[0078] For example, the average daily download volume USE_c = 5680131 times;

[0079] The average daily release volume REL_c = 150 times.

[0080] 2. Data processing

[0081]

[0082] For vulnerability 1, Time1 = 365 days, CVSS1 = 7.5;

[0083] For vulnerability 2, Time2 = 540 days, CVSS2 = 5.0;

[0084] For vulnerability 3, Time1 = 1095 days, CVSS3 = 3.0;

[0085] So,

[0086] Then, the final value of the first evaluation parameter is 1.43. According to the corresponding relationship between the preset value of the first evaluation parameter and the degree of danger, the security of Numpy 1.26.0 can be accurately evaluated.

[0087] In another preferred embodiment of the present invention, the open source components are evaluated from another dimension. To this end, the open source component selection method in this embodiment further includes the following steps:

[0088] The vulnerability repair status information of the vulnerability in the target open source component is obtained from the open source community platform, and a second evaluation parameter representing the vulnerability response situation is fitted according to the vulnerability repair status information and the corresponding vulnerability release date. The target open source component is selected in combination with the first evaluation parameter and the second evaluation parameter.

[0089] In this embodiment, a second evaluation parameter is fitted based on the vulnerability repair status information reflected in the open source community platform, so as to evaluate the target open source component from two aspects of the first evaluation parameter and the second evaluation parameter, so as to further improve the comprehensiveness and accuracy of the evaluation of the open source component.

[0090] Specifically, the following four response states are set to evaluate the vulnerability response status:

[0091] Waiting for response: the vulnerability is not fixed and Δt1<δ1;

[0092] No response: the vulnerability is not fixed and Δt1≥δ1;

[0093] Slow response: the vulnerability has been fixed and Δt2≥δ2;

[0094] Fast response: the vulnerability has been fixed and Δt2<δ2;

[0095] Among them, Δt1 is the time interval between the vulnerability release date and the current statistical date;

[0096] Δt2 is the time interval between the vulnerability release date and the vulnerability repair completion date;

[0097] δ1 and δ2 are two preset time thresholds.

[0098] In this regard, the open source component selection method in this embodiment is as follows:

[0099] According to the vulnerability repair status information and vulnerability release date, for each vulnerability, match the corresponding response status for it;

[0100] Creating a third parameter related to the response speed of the vulnerabilities in the open source components based on the response status of all the vulnerabilities in the open source components;

[0101] Calculate the ratio of the number of vulnerabilities in the open source components that are in the slow response and fast response states to the total number of vulnerabilities to obtain the vulnerability response ratio;

[0102] A second evaluation parameter is obtained based on a product of the third parameter and the vulnerability response ratio.

[0103] More specifically, the third parameter CoV is created based on the following formula:

[0104] CoV=∑W i ×A i

[0105]

[0106] Among them, W i represents the weight assigned to each response state, A iIndicates the proportion of any response status in all response statuses, B i Indicates the number of any one response status.

[0107] The process of generating the second evaluation parameter in the above embodiment is described in detail below.

[0108] Still taking Numpy 1.26.0, the target open source component in the first evaluation parameter generation process, as an example, assume that Numpy1.26.0 has found three vulnerabilities in the past five years, as follows:

[0109] Vulnerability 1: CVSS score is 7.5, release date is 2023-01-01;

[0110] Vulnerability 2: CVSS score is 5.0, and the release date is 2022-03-15;

[0111] Vulnerability 3: CVSS score is 3.0 and the release date is 2020-05-20.

[0112] The vulnerability repair status information obtained from the open source community platform is as follows:

[0113] Vulnerability 1 has been fixed on 2023-06-10;

[0114] Vulnerability 2 has been fixed on 2022-03-20;

[0115] Vulnerability 3 has been fixed on 2020-05-25.

[0116] Taking δ1 and δ2 as 30 days as an example, each vulnerability is divided into one of the following four states: pending response, no response, slow response, and fast response according to the repair time and response status:

[0117] Vulnerability 1: Since it has been repaired, the repair time Δt2>δ2, so vulnerability 1 is a slow response;

[0118] Vulnerability 2: Since it has been repaired, the repair time Δt2<δ2, so vulnerability 2 is a fast response;

[0119] Vulnerability 3: Since it has been repaired, the repair time Δt2<δ2, so vulnerability 2 is a fast response;

[0120] Then, the number of each response state is:

[0121] Waiting for response: 0;

[0122] No response: 0;

[0123] Slow response: 1 (vulnerability 1);

[0124] Fast response: 2 (vulnerabilities 2 and 3).

[0125] The proportion of any response status in all response statuses A i as follows:

[0126] Waiting for response: A1=0 / 3=0;

[0127] No response: A2=0 / 3=0;

[0128] Slow response: A3 = 1 / 3 = 0.33;

[0129] Fast response: A4=2 / 3=0.67.

[0130] The preset weights of pending response, no response, slow response, and fast response are 0, 0.5, 1, and 2 respectively.

[0131] Then, the third parameter CoV = (0*0) + (0.5*0) + (1*0.33) + (2*0.67) = 1.67.

[0132] Vulnerability response ratio Rv = (number of responded vulnerabilities) / (total number of vulnerabilities) = 2 / 3 = 0.67.

[0133] Then, the second evaluation parameter representing the vulnerability response situation is Sv=Rv*CoV=0.67*1.67=1.072.

[0134] In summary, the present invention discloses a method for selecting open source components, which effectively improves the security and reliability of open source component screening during the software development process by comprehensively analyzing the download volume, release frequency, vulnerability scores and vulnerability repair status information of the open source community platform.

[0135] First, by obtaining vulnerability information from the open source vulnerability database, the potential security risks of the target open source components are identified, and the severity and age of these risks are quantified. This ensures that developers have a comprehensive understanding of the security status of the components.

[0136] Secondly, the average daily downloads and releases obtained from the open source service platform reflect the activity and maintenance frequency of the target open source component, and are combined with vulnerability information to generate the first evaluation parameter. This not only helps to evaluate the maturity of the target open source component, but also indirectly measures the support of the development and user communities.

[0137] Furthermore, the vulnerability repair status information of the vulnerabilities in the target open source components is obtained from the open source community platform, and the second evaluation parameter is generated accordingly. The introduction of the vulnerability repair factor can not only effectively improve the security and reliability of open source components, but also enhance users' trust in open source components and promote the healthy development of the open source ecosystem. At the same time, it also provides users with a scientific decision-making basis for selecting safe and reliable open source components, and promotes the healthy development of the open source software industry.

[0138] In general, this method provides a more accurate security assessment of open source components based on the comprehensive analysis of multi-dimensional data, which helps to improve the security performance and efficiency of software development.

[0139] In another preferred embodiment of the present invention, a system for selecting an open source component is disclosed, including an evaluation parameter generator, which generates evaluation parameters for evaluating a target open source component based on the open source component selection method in the above embodiment.

[0140] The present invention also discloses another open source component selection system, which includes one or more processors, a memory and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the program includes instructions for executing the open source component selection method as described above. The processor can adopt a general central processing unit (CPU), a microprocessor, an application specific integrated circuit (ASIC), or one or more integrated circuits to execute related programs to implement the functions required to be executed by the modules in the open source component selection system of the embodiment of the present application, or to execute the open source component selection method of the method embodiment of the present application.

[0141] The present invention also discloses a computer-readable storage medium, which includes a computer program, and the computer program can be executed by a processor to complete the open source component selection method as described above. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium can be a read-only memory (ROM), or a random access memory (RAM), or a magnetic medium, such as a floppy disk, a hard disk, a tape, a magnetic disk, or an optical medium, such as a digital versatile disc (DVD), or a semiconductor medium, such as a solid state disk (SSD), etc.

[0142] The embodiment of the present application also discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of an electronic device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the electronic device executes the above-mentioned open source component selection method.

[0143] The above disclosure is only the preferred embodiment of the present invention, which certainly cannot be used to limit the scope of rights of the present invention. Therefore, equivalent changes made according to the scope of the patent application of the present invention are still within the scope covered by the present invention.

Claims

1. A method for selecting open source components based on security performance, characterized in that: include: Acquire vulnerability information corresponding to the target open source component from an open source vulnerability database, wherein the vulnerability information includes vulnerability type, vulnerability release date, and vulnerability score given by a vulnerability scoring system; Obtaining the average daily download volume and average daily release volume of the target open source component within a specified time period from a public open source service platform; Generate a first parameter based on the average daily download volume and the average daily release volume; Generate a second parameter based on the number of days from the vulnerability release date to the present and the vulnerability score of each vulnerability; Generate a first evaluation parameter representing a safety factor based on the first parameter and the second parameter; The target open source component is selected based on the first evaluation parameter.

2. The method for selecting open source components based on security performance according to claim 1, characterized in that: The first parameter S1 is fitted based on the following formula: Among them, USE_c represents the average daily download volume, and REL_c represents the average daily release volume.

3. The method for selecting open source components based on security performance according to claim 2, characterized in that: The second parameter S2 is fitted based on the following formula: Among them, e is a natural constant, CVSS i represents the vulnerability score of the i-th vulnerability in the target open source component, Time i It represents the number of days from the release date of the i-th vulnerability in the target open source component to the present time, and T represents the statistical duration.

4. The method for selecting open source components based on security performance according to claim 3 is characterized in that: The first evaluation parameter S is fitted based on the following formula s : Wherein, a and b are preset adjustment constants, 1.5≤a≤2, 1<b<1.

5.

5. The method for selecting open source components based on security performance according to claim 1, characterized in that: Obtain vulnerability repair status information of the vulnerability in the target open source component from the open source community platform, fit a second evaluation parameter representing the vulnerability response situation according to the vulnerability repair status information and the corresponding vulnerability release date; and select the target open source component in combination with the first evaluation parameter and the second evaluation parameter.

6. The method for selecting open source components based on security performance according to claim 5, characterized in that: Set the following four response statuses to evaluate vulnerability response status: Waiting for response: the vulnerability is not fixed and Δt1<δ1; No response: the vulnerability is not fixed and Δt1≥δ1; Slow response: the vulnerability has been fixed and Δt2≥δ2; Fast response: the vulnerability has been fixed and Δt2<δ2; Wherein, Δt1 is the time interval between the release date of the vulnerability and the current statistical date; Δt2 is the time interval between the release date of the vulnerability and the completion date of the vulnerability repair; δ1 and δ2 are two preset time thresholds; According to the vulnerability repair status information and the vulnerability release date, for each vulnerability, a corresponding response status is matched; creating a third parameter related to a response speed of the vulnerabilities in the open source component based on the response status of all the vulnerabilities in the open source component; Calculating the ratio of the number of vulnerabilities in the open source component that are in the slow response state and the fast response state to the total number of vulnerabilities to obtain a vulnerability response ratio; The second evaluation parameter is obtained based on a product of the third parameter and the vulnerability response ratio.

7. The method for selecting open source components based on security performance according to claim 6, characterized in that: The third parameter CoV is created based on the following formula: CoV=∑W i ×A i Among them, W i represents the weight assigned to each of the response states, A i Indicates the proportion of any of the response states in all the response states, B i Indicates the number of any of the response statuses.

8. An open source component selection system, characterized in that: It comprises an evaluation parameter generator, which generates evaluation parameters for evaluating a target open source component based on the open source component selection method according to any one of claims 1 to 7.

9. An open source component selection system, characterized in that: include: one or more processors; Memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs comprising instructions for executing the open source component selection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: It includes a computer program, which can be executed by a processor to complete the open source component selection method as described in any one of claims 1 to 7.

Images