Open source component selection method and system based on community support

Abstract

The invention discloses an open source component selection method and system based on community support, and the method comprises the steps: obtaining the occurrence number of participation events of a target open source component from an open source community platform, and enabling the participation events to comprise multi-user participation behavior events related to the target open source component; the participation events comprise at least two or more of an initiation problem, a problem comment, an initiation pull request, a pull request comment and a merged pull request related to the target open source component, and each type of participation event comprises a plurality of event items respectively occurring at different time; creating a first evaluation parameter representing the activeness of the target open source component based on the occurrence number of the participating events; and selecting the target open source component based on the first evaluation parameter. According to the method, the activeness of the target open source component is evaluated based on the number of the participating events of the open source community platform, so that a developer is helped to better select the open source component with better safety performance.

Description

Technical Field

[0001] The present invention relates to the technical field of software development, and in particular to a method and system for selecting open source components based on community support. Background Art

[0002] In modern software development, the use of open source components is becoming increasingly popular because they can significantly improve development efficiency and reduce costs. However, the security issues of open source components have gradually attracted widespread attention. With the widespread use of open source software, various security vulnerabilities are constantly being discovered and disclosed, which brings potential risks to software development. Therefore, when developers select open source components, they need to comprehensively consider their security performance to avoid serious consequences such as system vulnerabilities and data leaks caused by security risks.

[0003] Currently, the evaluation of open source components usually relies on static analysis tools and vulnerability databases. However, these methods often have problems such as incomplete evaluation and lack of real-time performance, and cannot effectively reflect the security status of open source components in actual use. Summary of the invention

[0004] The purpose of the present invention is to provide a community-supported open source component selection method and system that can select open source components based on the performance of the open source components in the open source community.

[0005] In order to achieve the above object, the present invention provides a method for selecting open source components based on community support, which comprises:

[0006] Acquire the number of participation events of a target open source component from an open source community platform, where the participation events include behavior events involving multiple users related to the target open source component;

[0007] The participation events include at least two or more of the initiated issues, issue comments, initiated pull requests, pull request comments, and merged pull requests related to the target open source component, and each type of the participation events includes a number of event items that occur at different times;

[0008] Creating a first evaluation parameter representing the activity of the target open source component based on the number of occurrences of the participation event;

[0009] The target open source component is selected based on the first evaluation parameter.

[0010] Preferably, the method for generating the first evaluation parameter includes:

[0011] Assign a proportional weight to each type of engagement event, and the sum of the proportional weights of all engagement events of all types is 100%;

[0012] For a plurality of the event items in any type of the participating event, based on a time function, a time weight is configured for each of the event items according to the occurrence time of each of the event items;

[0013] The activity level AL of any of the above mentioned participation events is calculated based on the following formula i :

[0014] AL i =W i ×∑Q n

[0015] Among them, W i is the proportion weight of the participating event, Q n is the time weight of any event item in the participating event;

[0016] The first evaluation parameter SCA representing the community activity of the target open source component is calculated based on the following formula:

[0017]

[0018] Preferably, the time weight Q of any event item in the participating event is configured based on the following formula: n :

[0019]

[0020] Wherein, e is a natural constant, T is the statistical duration, t is a preset time constant, and Δt is the number of days after the behavioral event of the event item occurs.

[0021] Preferably, the community size of the target open source component is also obtained from the open source community platform, and a second evaluation parameter is generated based on the community size; proportional weights are configured for the second evaluation parameter and the first evaluation parameter, and the sum of the proportional weights of the second evaluation parameter and the first evaluation parameter is 100%; and the target open source component is selected based on the first evaluation parameter and the second evaluation parameter.

[0022] Preferably, the method for generating the second evaluation parameter includes:

[0023] Obtaining indicator parameters related to the community size of the target open source component from an open source community platform, wherein the indicator parameters include the number of contributors, the number of followers, the number of event activities, and the number of discussions;

[0024] The number of contributors represents the number of people who participated in the development of the target open source component;

[0025] The number of followers represents the number of users who are interested in the target open source component;

[0026] The number of event activities represents the number of times the user interacts with the target open source component;

[0027] The number of discussions represents the number of posts issued by users to discuss the target open source component;

[0028] According to the importance relationship between the various indicator parameters, a proportional weight is configured for each of the indicator parameters, and the sum of the proportional weights of the various indicator parameters is 100%;

[0029] The second evaluation parameter SCZ is calculated based on the following formula:

[0030] SCZ=∑Y i ×N i

[0031] Among them, Y i Represents the proportional weight of any of the indicator parameters, N i Indicates the number of any of the index parameters.

[0032] Preferably, the importance relationship between the various indicator parameters is adjusted and confirmed based on a judgment matrix.

[0033] Preferably, vulnerability information corresponding to the target open source component is also obtained from an open source vulnerability database, the vulnerability information including vulnerability type, vulnerability release date, and vulnerability score given by a vulnerability scoring system; and the average daily download volume and average daily release volume of the target open source component within a specified time period are obtained from a public open source service platform;

[0034] Generate a first parameter based on the average daily download volume and the average daily release volume;

[0035] Generate a second parameter based on the number of days from the vulnerability release date to the present and the vulnerability score of each vulnerability;

[0036] Generate a third evaluation parameter representing a safety factor based on the first parameter and the second parameter;

[0037] The target open source component is selected based on the first evaluation parameter and the third evaluation parameter.

[0038] Preferably, the first parameter S1 is fitted based on the following formula:

[0039]

[0040] Among them, USE_c represents the average daily download volume, and REL_c represents the average daily release volume.

[0041] Preferably, the second parameter S2 is fitted based on the following formula:

[0042]

[0043] Among them, e is a natural constant, CVSS i represents the vulnerability score of the i-th vulnerability in the target open source component, Time i It represents the number of days from the release date of the i-th vulnerability in the target open source component to the present time, and T represents the statistical duration.

[0044] Preferably, the third evaluation parameter S is fitted based on the following formula: s :

[0045]

[0046]

[0047] Wherein, a and b are preset adjustment constants, 1.5≤a≤2, 1<b<1.5.

[0048] The present invention also provides an open source component selection system, which includes an evaluation parameter generator, wherein the evaluation parameter generator generates evaluation parameters for evaluating a target open source component based on the open source component selection method as described above.

[0049] The present invention also provides an open source component selection system, which includes:

[0050] one or more processors;

[0051] Memory;

[0052] and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the programs include instructions for executing the open source component selection method as described above.

[0053] The present invention also provides a computer-readable storage medium, which includes a computer program, and the computer program can be executed by a processor to complete the open source component selection method as described above.

[0054] Compared with the prior art, the open source component selection method provided by the above technical solution of the present invention evaluates the activity of the target open source component based on the number of participation events of the open source community platform, thereby helping developers to better select open source components with better security performance. Specifically, by analyzing the number of occurrences of various participation events such as question initiation, comments, and pull requests, the community activity of the open source component and the developer's attention to it can be objectively reflected. This evaluation method based on actual participation can more comprehensively and timely understand the security status of the open source component in actual use, and help developers avoid potential security risks. Therefore, this method can effectively improve the accuracy and security of developers' selection of open source components, and provide better preventive measures for security risks in the software development process. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 This is a flow chart of a method for selecting an open source component in one embodiment of the present invention.

[0056] Figure 2 This is a flow chart of a method for selecting an open source component in another embodiment of the present invention.

[0057] Figure 3 This is a flow chart of a method for selecting an open source component in one embodiment of the present invention.

[0058] Figure 4 This is a flow chart of a method for selecting an open source component in yet another embodiment of the present invention. DETAILED DESCRIPTION

[0059] In order to explain the technical content, structural features, achieved objectives and effects of the present invention in detail, the following is a detailed description in conjunction with the implementation methods and the accompanying drawings.

[0060] This embodiment discloses a method for selecting open source components based on community support, which is used for selecting open source components from a third-party platform during software development and improving the security performance of the selected open source components.

[0061] First of all, it should be noted that when an open source component is in an active large-scale community, the quality and security of the open source component can be better guaranteed. An active community means that more developers and users actively participate in the development, maintenance and problem solving of the component, which makes it more likely to respond to vulnerabilities and problems in a timely manner and develop more robust testing and verification processes. In addition, a large-scale community often means higher visibility and review, making it easier to identify and resolve potential security vulnerabilities.

[0062] In this regard, in the embodiment of the present invention, the security performance and reliability of the open source components are evaluated from the perspective of community support. Figure 1 , the open source component selection method also includes:

[0063] S10: Acquire the number of occurrences of participation events of the target open source component from the open source community platform, where the participation events include behavior events in which multiple users participate and are related to the target open source component;

[0064] The participation events include at least two or more of the initiated issues, issue comments, initiated pull requests, pull request comments, and merged pull requests related to the target open source component, and each type of the participation events includes a number of event items that occur at different times;

[0065] S11: Creating a first evaluation parameter representing the activity of the target open source component based on the number of occurrences of the participation event;

[0066] S12: Selecting the target open source component based on the first evaluation parameter.

[0067] Initiating a question means that a user has a question about a target open source component and asks it in the open source community to seek help.

[0068] For problem comments, it means that users discuss problems raised in the open source community and provide solutions.

[0069] Pull Requests means that developers submit code modification suggestions for target open source components in the open source community.

[0070] Pull request comments (PR Comments) mean that developers submit code modification suggestions for target open source components in the open source community for discussion and review.

[0071] For merged pull requests (Merged PRs), it means that developers merge code modification suggestions about the target open source components into the main branch in the open source community.

[0072] Based on this, Figure 2 , the method for generating the first evaluation parameter specifically includes:

[0073] S20: Assign a proportional weight to each type of participation event, and the sum of the proportional weights of all participation events of all types is 100%;

[0074] S21: for a plurality of the event items in any type of the participating event, based on a time function and according to the occurrence time of each of the event items, configure a time weight for each of the event items;

[0075] S22: Calculate the activity level AL of any of the participating events based on the following formula: i :

[0076] AL i =W i ×∑Q n

[0077] Among them, W i is the proportion weight of the participating event, Q n is the time weight of any event item in the participating event;

[0078] S23: Calculate a first evaluation parameter SCA representing the community activity of the target open source component based on the following formula:

[0079]

[0080] In addition, based on the following formula combined with the time weight Q of any of the event items in the participating event n :

[0081]

[0082] Wherein, e is a natural constant, T is the statistical duration, t is a preset time constant, and Δt is the number of days after the behavioral event of the event item occurs.

[0083] Specifically, for a certain target open source component, the community participation obtained in the past 365 days (i.e., the statistical duration T) is shown in Table 1 below, and a proportional weight is assigned to each participation event.

[0084] Table 1

[0085] Participate in events Number of event items Proportional Weight Ask a question 1000 0.2 Question Comments 5000 0.3 Open a pull request 2000 0.1 Pull request comments 3000 0.2 Merge pull request 1000 0.2

[0086] For example, for the participation event of raising a question, according to the occurrence time of 1000 event items, through the above Q n The time weight Q1 of the event item that initiates the problem is calculated by the calculation formula. Similarly, the time weights Q2, Q3, Q4, and Q5 of the other four event items participating in the time are calculated.

[0087] Then, ∑AL i =0.2×Q1+0.3×Q2+0.1×Q3+0.2×Q4+0.2×Q5

[0088] Finally, the value of the first evaluation parameter SCA is obtained through square root calculation. The SCA reflects the activity of the current target open source component in the open source community in the past 365 days. The larger the value, the higher the community activity.

[0089] On the other hand, the size of the open source community reflects the popularity and widespread adoption of the open source components. Having a large community enables more thorough testing and review of open source components, thereby increasing the chances of discovering and resolving any potential vulnerabilities. A large community enables more thorough testing and review of open source components, thereby increasing the chances of discovering and resolving potential vulnerabilities, increasing the likelihood of discovering and resolving potential vulnerabilities.

[0090] In this regard, in another preferred embodiment of the present invention, the open source component selection method further includes:

[0091] The community size of the target open source component is obtained from an open source community platform, and a second evaluation parameter is generated based on the community size.

[0092] Since both the first evaluation parameter and the second evaluation parameter are community support elements that have an important impact on the selection of open source components. Therefore, proportional weights are configured for the first evaluation parameter and the second evaluation parameter, and the sum of the proportional weights of the first evaluation parameter and the second evaluation parameter is 100%. The actual values ​​of the first evaluation parameter and the second evaluation parameter are comprehensively calculated by the configured weights. Therefore, in this embodiment, the target open source component is selected based on the first evaluation parameter and the second evaluation parameter.

[0093] On the other hand, Figure 3 , the method for generating the second evaluation parameter includes:

[0094] S30: Obtaining indicator parameters related to the community size of the target open source component from an open source community platform, wherein the indicator parameters include the number of contributors, the number of followers, the number of event activities, and the number of discussions.

[0095] The number of contributors represents the number of people who participated in the development of the target open source component. The larger the number of contributors, the larger the development team of the open source component, which also implies that more people are involved in code review and maintenance, which is conducive to improving code quality and stability.

[0096] The number of followers represents the number of users who are interested in the target open source component. The more followers there are, the more popular the open source component is, which also implies that the user group is larger and more likely to discover and feedback problems, thereby promoting the improvement and perfection of the open source component. For example, on the GitHub platform, the star data of the target open source component, that is, the number of users who follow the target open source component, can be obtained through the GitHub API.

[0097] The number of event activities represents the number of times users interact with the target open source component, such as discussing the target open source component, reporting issues, contributing code, etc. On the GitHub platform, the number of issues, pull requests, and commits of the target open source component can be obtained through the GitHub API, and the number of interactions of related events (such as comments, likes, and reposts) can be used to measure the number of event activities.

[0098] The number of discussions represents the number of posts that users have made to discuss the target open source component. The more discussions there are, the higher the user's attention and participation in the target open source component, which is conducive to mutual exchange of experience and problem solving among users, and improves the efficiency and effectiveness of component use.

[0099] It should be noted that the number of events in the open source community focuses on the user participation and interaction level for specific events, while the number of discussions focuses on the activeness of users' discussions and exchanges on the open source components themselves.

[0100] S31: In this regard, according to the importance relationship between the various indicator parameters, a proportional weight is configured for each of the indicator parameters, and the sum of the proportional weights of the various indicator parameters is 100%.

[0101] S32: Calculate the second evaluation parameter SCZ based on the following formula:

[0102] SCZ=∑Y i ×N i

[0103] Among them, Y i Represents the proportional weight of any of the indicator parameters, N i Indicates the number of any of the index parameters.

[0104] Specifically, the importance relationship between the various indicator parameters is adjusted and confirmed based on the judgment matrix.

[0105] For example, the number of each indicator parameter obtained is as follows:

[0106] Number of contributors (NT): 100;

[0107] Number of followers (NF): 5000;

[0108] Number of events (NE): 1000 (e.g. comments and likes on issues and pull requests, etc.);

[0109] Number of Discussions (ND): 500 (for example, the number of discussion posts about MyLib).

[0110] Pre-configured:

[0111] The number of followers is 3 times more important than the number of contributors;

[0112] The number of contributors is 2x more important than the number of events;

[0113] The number of events is 1.5 times more important than the number of discussions.

[0114] Then we can construct a 4x4 judgment matrix X:

[0115]

[0116] Each element X[i][j] in the judgment matrix X represents the importance of the i-th indicator relative to the j-th indicator. For example, X[1][2] = 1 / 3, which means that NF is 3 times more important than NT.

[0117] Next, calculate the maximum eigenvalue (λ max ) and the corresponding eigenvector (P):

[0118] Maximum eigenvalue λ max =4.2;

[0119] Corresponding eigenvector P: [0.13, 0.31, 0.41, 0.15];

[0120] Then, perform a consistency check:

[0121] Check whether the judgment matrix X is consistent, that is, whether the importance relationship between the indicators in the judgment matrix X is self-consistent. Calculate the consistency index (CI) and consistency ratio (CR):

[0122] Consistency index CI = (λ max -n) / (n-1)=(4.2-4) / (4-1)=0.067;

[0123] The consistency ratio CR = CI / RI = 0.067 / 0.90 = 0.074;

[0124] Where n is the number of indicators (i.e. 4), and RI is the average consistency index corresponding to the n-order matrix, which can be obtained by looking up the table and will not be repeated here. Generally speaking, when CR<0.1, the consistency of the judgment matrix is ​​considered acceptable. In this example, CR=0.074, which is less than 0.1, so the consistency of the judgment matrix X is acceptable.

[0125] Then, according to the calculated proportional weight P, each indicator parameter can be weighted to obtain the final community size score, which is the second evaluation parameter SCZ:

[0126] SCZ=P[1]*NT+P[2]*NF+P[3]*NE+P[4]*ND;

[0127] SCZ=0.13*100+0.31*5000+0.41*1000+0.15*500;

[0128] SCZ=2265.

[0129] In another preferred embodiment of the present invention, the target open source component is evaluated from the perspective of the exploited vulnerabilities of the target open source component and the usage of the developers, so as to further improve the security performance and reliability of the selected target open source component. Fewer exploited vulnerabilities means higher security, but it may also mean that the component is not widely used or updated infrequently.

[0130] Specifically, Figure 4 In this embodiment, the open source component selection method includes the following steps:

[0131] S10: Obtain vulnerability information corresponding to the target open source component from the open source vulnerability database, where the vulnerability information includes vulnerability type, vulnerability release date, and vulnerability score given by the vulnerability scoring system.

[0132] S11: Obtain the average daily download volume and average daily release volume of the target open source component within a specified time period from a public open source service platform.

[0133] It should be noted that there is no requirement for the order of performing step S10 and step S11 , and either one may be performed first.

[0134] S12: Generate a first parameter based on the average daily download volume and the average daily released version volume.

[0135] S13: Generate a second parameter based on the number of days from the vulnerability release date of each vulnerability to the current time and the vulnerability score.

[0136] S14: Generate a third evaluation parameter representing a safety factor based on the first parameter and the second parameter.

[0137] S15: Selecting the target open source component based on the first evaluation parameter and the third evaluation parameter. Of course, the target open source component may also be selected in combination with the first evaluation parameter, the second evaluation parameter and the third evaluation parameter.

[0138] Specifically, the first parameter S1 is fitted based on the following formula:

[0139]

[0140] Among them, USE_c represents the average daily download volume, and REL_c represents the average daily release volume.

[0141] In addition, the second parameter S2 is fitted based on the following formula:

[0142]

[0143] Among them, e is a natural constant, an infinite non-repeating decimal, and its value is approximately 2.718281828459045, CVSS i represents the vulnerability score of the i-th vulnerability in the target open source component, Time i It indicates the number of days from the release date of the ith vulnerability in the target open source component to the current time, and T indicates the statistical duration.

[0144] Then, the third evaluation parameter S is fitted based on the following formula: s :

[0145]

[0146]

[0147] Wherein, a and b are preset adjustment constants, 1.5≤a≤2, 1<b<1.5.

[0148] In this embodiment, the values ​​of a and b are preferably: a=1.915, b=1.0386.

[0149] The following is a specific example to illustrate the execution process of the above open source component selection method in detail.

[0150] 1. Basic data acquisition

[0151] In this embodiment, the information in the past 5 years is counted, that is, the statistical time length T = 5*365.

[0152] Search for vulnerability information of the target open source component Numpy 1.26.0 through NVD API or web crawling.

[0153] Assume that Numpy 1.26.0 has 3 vulnerabilities discovered in the past 5 years, as follows:

[0154] Vulnerability 1: CVSS score is 7.5, release date is 2023-01-01;

[0155] Vulnerability 2: CVSS score is 5.0, and the release date is 2022-03-15;

[0156] Vulnerability 3: CVSS score is 3.0 and the release date is 2020-05-20.

[0157] Get the download and release data of Numpy 1.26.0 in the past five years through PyPI API or web crawling, and calculate the average daily downloads and releases.

[0158] For example, the average daily download volume USE_c = 5680131 times;

[0159] The average daily release volume REL_c = 150 times.

[0160] 2. Data processing

[0161]

[0162] For vulnerability 1, Time1 = 365 days, CVSS1 = 7.5;

[0163] For vulnerability 2, Time2 = 540 days, CVSS2 = 5.0;

[0164] For vulnerability 3, Time1 = 1095 days, CVSS3 = 3.0;

[0165] So,

[0166]

[0167] Then, the final value of the third evaluation parameter is 1.43.

[0168] In this embodiment, by comprehensively analyzing the download volume, release frequency, and vulnerability scores of open source components, the security and reliability of screening open source components during the software development process are effectively improved.

[0169] In another preferred embodiment of the present invention, a system for selecting an open source component is disclosed, which includes an evaluation parameter generator. The evaluation parameter generator generates evaluation parameters for evaluating a target open source component based on the open source component selection method in the above embodiment.

[0170] The present invention also discloses another open source component selection system, which includes one or more processors, a memory and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the program includes instructions for executing the open source component selection method as described above. The processor can adopt a general central processing unit (CPU), a microprocessor, an application specific integrated circuit (ASIC), or one or more integrated circuits to execute related programs to implement the functions required to be executed by the modules in the open source component selection system of the embodiment of the present application, or to execute the open source component selection method of the method embodiment of the present application.

[0171] The present invention also discloses a computer-readable storage medium, which includes a computer program, and the computer program can be executed by a processor to complete the open source component selection method as described above. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium can be a read-only memory (ROM), or a random access memory (RAM), or a magnetic medium, such as a floppy disk, a hard disk, a tape, a magnetic disk, or an optical medium, such as a digital versatile disc (DVD), or a semiconductor medium, such as a solid state disk (SSD), etc.

[0172] The embodiment of the present application also discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of an electronic device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the electronic device executes the above-mentioned open source component selection method.

[0173] The above disclosure is only the preferred embodiment of the present invention, which certainly cannot be used to limit the scope of rights of the present invention. Therefore, equivalent changes made according to the scope of the patent application of the present invention are still within the scope covered by the present invention.

Claims

1. A method for selecting open source components based on community support, characterized in that: include: Acquire the number of participation events of a target open source component from an open source community platform, where the participation events include behavior events involving multiple users related to the target open source component; The participation events include at least two or more of the initiated issues, issue comments, initiated pull requests, pull request comments, and merged pull requests related to the target open source component, and each type of the participation events includes a number of event items that occur at different times; Creating a first evaluation parameter representing the activity of the target open source component based on the number of occurrences of the participation event; The target open source component is selected based on the first evaluation parameter.

2. The open source component selection method according to claim 1, characterized in that: The method for generating the first evaluation parameter includes: Assign a proportional weight to each type of engagement event, and the sum of the proportional weights of all engagement events of all types is 100%; For a plurality of the event items in any type of the participating event, based on a time function, a time weight is configured for each of the event items according to the occurrence time of each of the event items; The activity level AL of any of the above mentioned participation events is calculated based on the following formula i : <h2 style=";text-align:left;direction:ltr">AL<h2 style=";text-align:left;direction:ltr"> i <h2 style=";text-align:left;direction:ltr"> =W<h2 style=";text-align:left;direction:ltr"> i <h2 style=";text-align:left;direction:ltr"> ×∑Q<h2 style=";text-align:left;direction:ltr"> n Among them, W i is the proportion weight of the participating event, Q n is the time weight of any event item in the participating event; The first evaluation parameter SCA representing the community activity of the target open source component is calculated based on the following formula:

3. The open source component selection method according to claim 2, characterized in that: The time weight Q of any event item in the participating event is configured based on the following formula n : Wherein, e is a natural constant, T is the statistical duration, t is a preset time constant, and Δt is the number of days after the behavioral event of the event item occurs.

4. The open source component selection method according to claim 1, characterized in that: The community size of the target open source component is also obtained from the open source community platform, and a second evaluation parameter is generated based on the community size; a proportional weight is configured for the second evaluation parameter and the first evaluation parameter, and the sum of the proportional weights of the second evaluation parameter and the first evaluation parameter is 100%; the target open source component is selected based on the first evaluation parameter and the second evaluation parameter.

5. The open source component selection method according to claim 4, characterized in that: The method for generating the second evaluation parameter includes: Obtaining indicator parameters related to the community size of the target open source component from an open source community platform, wherein the indicator parameters include the number of contributors, the number of followers, the number of event activities, and the number of discussions; The number of contributors represents the number of people who participated in the development of the target open source component; The number of followers represents the number of users who are interested in the target open source component; The number of event activities represents the number of times the user interacts with the target open source component; The number of discussions represents the number of posts issued by users to discuss the target open source component; According to the importance relationship between the various indicator parameters, a proportional weight is configured for each of the indicator parameters, and the sum of the proportional weights of the various indicator parameters is 100%; The second evaluation parameter SCZ is calculated based on the following formula: SCZ=∑Y i ×N i Among them, Y i Represents the proportional weight of any of the indicator parameters, N i Indicates the number of any of the index parameters.

6. The open source component selection method according to claim 5, characterized in that: The importance relationship between the various indicator parameters is adjusted and confirmed based on the judgment matrix.

7. The open source component selection method according to claim 1, characterized in that: Also obtain vulnerability information corresponding to the target open source component from an open source vulnerability database, the vulnerability information including vulnerability type, vulnerability release date, and vulnerability score given by a vulnerability scoring system; and obtain the average daily download volume and average daily release volume of the target open source component within a specified time period from a public open source service platform; Generate a first parameter based on the average daily download volume and the average daily release volume; Generate a second parameter based on the number of days from the vulnerability release date to the present and the vulnerability score of each vulnerability; Generate a third evaluation parameter representing a safety factor based on the first parameter and the second parameter; The target open source component is selected based on the first evaluation parameter and the third evaluation parameter.

8. The open source component selection method according to claim 7, characterized in that: The first parameter S1 is fitted based on the following formula: Among them, USE_c represents the average daily download volume, and REL_c represents the average daily release volume.

9. The open source component selection method according to claim 8, characterized in that: The second parameter S2 is fitted based on the following formula: Among them, e is a natural constant, CVSS i represents the vulnerability score of the i-th vulnerability in the target open source component, Time i It represents the number of days from the release date of the i-th vulnerability in the target open source component to the present time, and T represents the statistical duration.

10. The open source component selection method according to claim 9, characterized in that: The third evaluation parameter S is fitted based on the following formula s : Wherein, a and b are preset adjustment constants, 1.5≤a≤2, 1<b<1.

5.

11. An open source component selection system, characterized in that: It comprises an evaluation parameter generator, which generates evaluation parameters for evaluating a target open source component based on the open source component selection method according to any one of claims 1 to 10.

12. An open source component selection system, characterized in that: include: one or more processors; Memory; and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, the programs comprising instructions for executing the open source component selection method as described in any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that: It comprises a computer program, which can be executed by a processor to complete the open source component selection method as described in any one of claims 1 to 10.

Images