Software open source security measurement system and method based on open source security, equipment and medium

Abstract

The invention belongs to the technical field of software analysis, and provides a software open source security measurement system, method, equipment and medium based on open source security, comprising a configuration module used for configuring parameters and weights of a measurement analysis module; the verification module is used for verifying whether the parameters and the weights conform to expectations or not, and if not, the parameters and the weights are adjusted; the measurement analysis module is used for carrying out measurement analysis on the software to be measured and analyzed based on the parameters and the weights and generating a measurement analysis result; wherein the measurement analysis result comprises a component measurement analysis result, a code engineering measurement analysis result and a project measurement analysis result; according to the method disclosed by the invention, the overall security of components, code engineering and projects of the software is measured by predefined parameters and weights, and the rationality of the parameters and weights is verified, so that the accuracy and reliability of an evaluation result can be ensured, the security evaluation efficiency is improved, and the resource allocation is more reasonable.

Description

Technical Field

[0001] The present invention belongs to the technical field of software analysis, and in particular relates to a software open source security measurement system, method, device and medium based on open source security. Background Art

[0002] Open source software is widely used in various industries due to its significant advantages. It can not only greatly reduce software development costs, but also speed up development iterations, helping companies respond to market demands more quickly. However, when using open source software in the early days, companies often paid too much attention to whether its functions could meet business needs and ignored potential security issues.

[0003] Over time, this neglect has led to the accumulation of a large number of open source components with vulnerabilities in many software systems. When enterprises realize the need to fix these vulnerabilities, they face huge challenges. In the process of open source software security governance and repair within the enterprise, it is found that a project may contain hundreds or thousands of vulnerable open source components, and each component may contain multiple vulnerabilities, forming a huge open source software asset ledger. However, due to the lack of unified open source software security metrics and specifications, a lot of valuable time is wasted on the lengthy vulnerability assessment process. Summary of the invention

[0004] In view of the problems in the background technology, the present invention proposes a software open source security measurement system, method, device and medium based on open source security.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions:

[0006] In a first aspect, the present disclosure proposes a software open source security measurement system based on open source security, including a configuration module, a verification module and a measurement analysis module;

[0007] Configuration module, used to configure the parameters and weights of the measurement analysis module;

[0008] A verification module, used to verify whether the parameters and weights meet expectations, and if not, adjust the parameters and weights;

[0009] The metric analysis module is used to perform metric analysis on the metric analysis software based on the parameters and weights, and generate metric analysis results; wherein the metric analysis results include component metric analysis results, code engineering metric analysis results and project metric analysis results.

[0010] Preferably, the metric analysis module includes a component metric analysis module, a code engineering metric analysis module and a project metric analysis module;

[0011] The component metric analysis module is used to perform metric analysis on the components of the metric analysis software based on the parameters and weights, and generate component metric analysis results;

[0012] The code engineering metric analysis module is used to perform metric analysis on the code engineering of the software to be metrically analyzed based on the parameters, weights and component metric analysis results, and generate code engineering metric analysis results;

[0013] The project metric analysis module is used to perform metric analysis on the project to be metrically analyzed software based on the parameters, weights and code engineering metric analysis results, and generate project metric analysis results.

[0014] Preferably, the configuration module includes a component configuration submodule, a code engineering configuration submodule and a project configuration submodule;

[0015] The component configuration submodule is used to configure the parameters and weights of the component measurement analysis module according to the properties of the component;

[0016] The code engineering configuration submodule is used to configure the parameters and weights of the code engineering measurement analysis module according to the properties of the code engineering;

[0017] The project configuration submodule is used to configure the parameters and weights of the project measurement analysis module according to the attributes of the project.

[0018] Preferably, the component configuration submodule is further used to calculate component scores according to the parameters and weights of the component metric analysis module, and determine component repair priorities based on the component scores;

[0019] The code engineering configuration submodule is further used to calculate the code engineering metric score according to the parameters and weights of the code engineering metric analysis module, and determine the code engineering repair priority based on the calculated code engineering metric score;

[0020] The project configuration submodule is also used to calculate the project metric score according to the parameters and weights of the project metric analysis module, and determine the project repair priority based on the calculated project metric score.

[0021] Preferably, the weight is a fixed weight or a dynamic weight.

[0022] Preferably, the system further comprises: a metric analysis result display module, configured to display the metric analysis result;

[0023] The measurement analysis result display module includes: a component measurement analysis result display module, a code engineering measurement analysis result display module and a project measurement analysis result display module;

[0024] The component metric analysis result display module is used to display the component metric analysis result;

[0025] The code engineering metric analysis result display module is used to display the code engineering metric analysis result;

[0026] The project measurement analysis result display module is used to display the project measurement analysis result.

[0027] Preferably, the system further comprises: a measurement API interface module, which is used to integrate and connect with an external system through an API interface, and to perform measurement analysis based on the API interface and obtain measurement analysis results;

[0028] The measurement API interface module includes: a measurement trigger module, a measurement progress query module and a measurement result query module;

[0029] The metric trigger module is used to receive an external request and trigger metric analysis;

[0030] The measurement progress query module is used to query the progress of measurement analysis;

[0031] The measurement result query module is used to query the measurement analysis results.

[0032] In a second aspect, the present disclosure proposes a software open source security measurement method based on open source security, which is applied to the system described in the first aspect, and the method includes:

[0033] Verify whether the preset parameters and weights are reasonable;

[0034] Based on the parameters and weights, the software to be measured and analyzed is measured and analyzed, and a measurement analysis result is generated; wherein the measurement analysis result includes component measurement analysis results, code engineering measurement analysis results and project measurement analysis results.

[0035] In a third aspect, the present disclosure proposes a device comprising a memory and a processor, wherein the memory stores computer instructions that can be executed on the processor, and when the processor runs the computer instructions, it executes a software open source security measurement system based on open source security as described in the first aspect.

[0036] In a fourth aspect, the present disclosure proposes a computer-readable storage medium having computer instructions stored thereon. When the computer instructions are executed, a software open source security measurement system based on open source security as described in the first aspect can be implemented.

[0037] Beneficial effects of the present invention:

[0038] 1. The method of the present invention measures the security of software components, code engineering and the overall project through pre-defined parameters and weights, and verifies the rationality of these parameters and weights, which can ensure the accuracy and reliability of the evaluation results, not only improving the efficiency of security evaluation, but also making resource allocation more reasonable.

[0039] 2. The method of the present invention can quickly rectify the priorities and improve the subsequent repair efficiency by sorting all components, code projects and projects according to the calculated comprehensive scores and determining the repair priorities.

[0040] Other features and advantages of the present invention will be described in the following description, and partly become obvious from the description, or be understood by implementing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures pointed out in the description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 A framework diagram of a software open source security measurement system based on open source security of the present invention is shown;

[0043] Figure 2 The framework diagram of the metric analysis module of the present invention is shown;

[0044] Figure 3 A schematic diagram of the device structure of the present invention is shown. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] Reference Figure 1 As shown, a software open source security measurement system based on open source security specifically includes:

[0047] The configuration module is used to configure the parameters and weights of the measurement analysis module; the parameters and weights can be customized according to the actual business situation. Specifically, the configured parameters and weights come from the detection results of existing detection tools, and are combined with actual business attributes such as project type (sensitivity, importance, whether it is an Internet project, etc.), system level (level protection level, operation and maintenance level), etc., which can effectively combine the detection tools with the actual business to meet the usage requirements.

[0048] Furthermore, the configuration module specifically includes: a component configuration submodule, a code engineering configuration submodule and a project configuration submodule.

[0049] The component configuration submodule is mainly used to configure the parameters and weights of the component measurement analysis module according to the properties of the component. Furthermore, the component configuration submodule mainly configures deductions based on the vulnerability information and license agreement information related attributes of the component, such as vulnerability level, vulnerability exploitation difficulty, CVSS score, number of vulnerabilities, license agreement level, number of license agreements, component version, whether the component has stopped maintenance, whether the component is closed source, etc., and can set fixed weights or set dynamic weights based on the number of affected projects. It is understandable that the attributes and their corresponding weight impacts can also be customized.

[0050] The code engineering configuration submodule is mainly used to configure the parameters and weights of the code engineering measurement analysis module according to the properties of the code engineering. Furthermore, the code engineering configuration submodule mainly sets model parameters based on the number, level and measurement results of the components included in the code engineering, combined with the business attributes and weights of the project.

[0051] The project configuration submodule is mainly used to configure the parameters and weights of the project measurement analysis module according to the attributes of the project. Furthermore, the project configuration submodule mainly sets the model parameter weights based on the measurement results of the code projects included in the project, the number of code projects, and the business attributes of the project, such as project sensitivity, importance, and exposure.

[0052] The code engineering configuration submodule is also used to calculate the code engineering metric score according to the parameters and weights of the code engineering metric analysis module, and determine the code engineering repair priority based on the calculated code engineering metric score; the project configuration submodule is also used to calculate the project metric score according to the parameters and weights of the project metric analysis module, and determine the project repair priority based on the calculated project metric score.

[0053] As a preferred embodiment of the present disclosure, the component configuration submodule is also used to calculate the component score according to the parameters and weights of the component metric analysis module, and determine the component repair priority based on the component score; specifically, the score of each attribute of the component is calculated separately, where the component score = parameter * weight, and then sorted according to these scores to determine the priority of repair. The score can be set in different intervals, and each interval corresponds to a specific rectification strategy, such as guidance and suggestions such as rectification must be made, rectification is recommended, or rectification is not required. In addition, for different rectification strategies, the time limit for rectification can also be customized.

[0054] As a preferred embodiment of the present disclosure, the code engineering configuration submodule is also used to calculate the code engineering metric score according to the parameters and weights of the code engineering metric analysis module, and determine the code engineering repair priority based on the calculated code engineering metric score.

[0055] As a preferred embodiment of the present disclosure, the project configuration submodule is also used to calculate the project metric score according to the parameters and weights of the project metric analysis module, and determine the project repair priority based on the calculated project metric score. The method of the present disclosure can quickly rectify the priority and improve the subsequent repair efficiency by sorting all components, code projects and projects according to the calculated comprehensive scores and determining the repair priority.

[0056] The verification module is used to verify whether the parameters and weights meet expectations. If not, the parameters and weights are adjusted. Specifically, when setting measurement parameters and weights, the measurement verification function can be used to test components, code projects, and projects to actually verify whether the set measurement parameters meet expectations. Parameter settings that do not meet expectations can be adjusted in a timely manner.

[0057] Reference Figure 2 As shown, the measurement analysis module is used to perform measurement analysis on the software to be measured and analyzed based on parameters and weights, and generate measurement analysis results. Specifically, the measurement analysis module includes a component measurement analysis module, a code engineering measurement analysis module and a project measurement analysis module; wherein the component measurement analysis module is used to perform measurement analysis on the components of the software to be measured and analyzed based on parameters and weights, and generate component measurement analysis results; the code engineering measurement analysis module is used to perform measurement analysis on the code engineering of the software to be measured and analyzed based on parameters, weights and component measurement analysis results, and generate code engineering measurement analysis results; the project measurement analysis module is used to perform measurement analysis on the project of the software to be measured and analyzed based on parameters, weights and code engineering measurement analysis results, and generate project measurement analysis results.

[0058] When conducting measurement analysis, the measurement results of the open source component security measurement model are the data source for the code engineering security measurement model, and the measurement results of the code engineering security measurement model are the data source for the project security measurement model.

[0059] After completing the configuration of parameters and weights, the measurement analysis module will perform measurement analysis on components, code projects, and projects based on the configuration information. Measurement analysis supports manual initiation, scheduled initiation, and triggering measurement after task detection is completed. Measurement analysis can measure all projects, code projects, and components in a short period of time, greatly saving the time of manual evaluation and effectively saving the resources invested by development and security teams in evaluation.

[0060] By measuring the software components, code engineering and overall project security through pre-defined parameters and weights and verifying the rationality of these parameters and weights, the accuracy and reliability of the evaluation results can be ensured, which not only improves the efficiency of security assessment but also makes resource allocation more reasonable.

[0061] As a preferred embodiment of the present disclosure, the system further includes: a measurement analysis result display module for displaying measurement analysis results. Further, the measurement analysis result display module includes: a component measurement analysis result display module, a code engineering measurement analysis result display module and a project measurement analysis result display module; wherein the component measurement analysis result display module is used to display component measurement analysis results; the code engineering measurement analysis result display module is used to display code engineering measurement analysis results; and the project measurement analysis result display module is used to display project measurement analysis results. After each measurement model is run, the measurement results are persistently stored and displayed. For the open source component measurement results, its measurement basic parameters, measurement time, existing code engineering and projects, measurement scores and measurement results are displayed. The code engineering measurement results display its measurement basic parameters, measurement time, measurement scores and measurement results, and the details of the open source component measurement results contained in the code engineering can be queried. The project measurement results display its measurement basic parameters, measurement time, measurement scores and measurement results, and the measurement details of the code engineering contained in it can be queried.

[0062] As a preferred embodiment of the present disclosure, the system further includes: a measurement API interface module, which is used to integrate and connect with an external system through an API interface, and to perform measurement analysis based on the API interface, and obtain measurement analysis results. Further, the measurement API interface module includes: a measurement trigger module, a measurement progress query module, and a measurement result query module; wherein the measurement trigger module is used to receive an external request and trigger measurement analysis; the measurement progress query module is used to query the progress of measurement analysis; and the measurement result query module is used to query the measurement analysis results.

[0063] The software open source security measurement system based on open source security has achieved automatic measurement of software open source security. After the measurement is completed, relevant security personnel and developers can quickly determine the open source security status and rectification priority in the software, which greatly improves the efficiency of measurement and evaluation and reduces the cost of measurement and evaluation.

[0064] Based on the same inventive concept, the present disclosure also proposes a software open source security measurement method based on open source security, which is applied to the above-mentioned software open source security measurement system based on open source security. The method specifically includes:

[0065] Verify whether the preset parameters and weights are reasonable;

[0066] Based on the parameters and weights, the software to be measured and analyzed is measured and analyzed, and measurement analysis results are generated; wherein the measurement analysis results include component measurement analysis results, code engineering measurement analysis results and project measurement analysis results.

[0067] Reference Figure 3 As shown, based on the same inventive concept, the present disclosure also proposes a device, including a memory and a processor, wherein the memory stores computer instructions that can be run on the processor, and the processor executes the above-mentioned software open source security measurement system based on open source security when running the computer instructions.

[0068] Based on the same inventive concept, the present disclosure also proposes a computer-readable storage medium on which computer instructions are stored. When the computer instructions are executed, the above-mentioned software open source security measurement system based on open source security can be implemented.

[0069] Among them, any reference to memory, storage, database or other media used in the embodiments provided by the present invention may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory.

[0070] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0071] Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent substitutions for some of the technical features therein; and these modifications or substitutions do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A software open source security measurement system based on open source security, characterized in that: Includes configuration module, verification module and measurement analysis module; Configuration module, used to configure the parameters and weights of the measurement analysis module; A verification module, used to verify whether the parameters and weights meet expectations, and if not, adjust the parameters and weights; The metric analysis module is used to perform metric analysis on the metric analysis software based on the parameters and weights, and generate metric analysis results; wherein the metric analysis results include component metric analysis results, code engineering metric analysis results and project metric analysis results.

2. The software open source security measurement system based on open source security according to claim 1, characterized in that: The measurement and analysis module includes a component measurement and analysis module, a code engineering measurement and analysis module and a project measurement and analysis module; The component metric analysis module is used to perform metric analysis on the components of the metric analysis software based on the parameters and weights, and generate component metric analysis results; The code engineering metric analysis module is used to perform metric analysis on the code engineering of the software to be metrically analyzed based on the parameters, weights and component metric analysis results, and generate code engineering metric analysis results; The project metric analysis module is used to perform metric analysis on the project to be metrically analyzed software based on the parameters, weights and code engineering metric analysis results, and generate project metric analysis results.

3. The software open source security measurement system based on open source security according to claim 2, characterized in that: The configuration module includes a component configuration submodule, a code engineering configuration submodule and a project configuration submodule; The component configuration submodule is used to configure the parameters and weights of the component measurement analysis module according to the properties of the component; The code engineering configuration submodule is used to configure the parameters and weights of the code engineering measurement analysis module according to the properties of the code engineering; The project configuration submodule is used to configure the parameters and weights of the project measurement analysis module according to the attributes of the project.

4. The software open source security measurement system based on open source security according to claim 3 is characterized in that: The component configuration submodule is further used to calculate component scores according to the parameters and weights of the component metric analysis module, and determine component repair priorities based on the component scores; The code engineering configuration submodule is further used to calculate the code engineering metric score according to the parameters and weights of the code engineering metric analysis module, and determine the code engineering repair priority based on the calculated code engineering metric score; The project configuration submodule is also used to calculate the project metric score according to the parameters and weights of the project metric analysis module, and determine the project repair priority based on the calculated project metric score.

5. The software open source security measurement system based on open source security according to claim 4 is characterized in that: The weight is a fixed weight or a dynamic weight.

6. The software open source security measurement system based on open source security according to claim 1, characterized in that: The system further comprises: a metric analysis result display module, configured to display the metric analysis result; The measurement analysis result display module includes: a component measurement analysis result display module, a code engineering measurement analysis result display module and a project measurement analysis result display module; The component metric analysis result display module is used to display the component metric analysis result; The code engineering metric analysis result display module is used to display the code engineering metric analysis result; The project measurement analysis result display module is used to display the project measurement analysis result.

7. The software open source security measurement system based on open source security according to claim 1 is characterized in that: The system further comprises: a measurement API interface module, which is used to integrate and connect with an external system through an API interface, and to perform measurement analysis based on the API interface, and to obtain measurement analysis results; The measurement API interface module includes: a measurement trigger module, a measurement progress query module and a measurement result query module; The metric trigger module is used to receive an external request and trigger metric analysis; The measurement progress query module is used to query the progress of measurement analysis; The measurement result query module is used to query the measurement analysis results.

8. A software open source security measurement method based on open source security, applied to the system according to any one of claims 1 to 7, characterized in that: The method comprises: Verify whether the preset parameters and weights are reasonable; Based on the parameters and weights, the software to be measured and analyzed is measured and analyzed, and a measurement analysis result is generated; wherein the measurement analysis result includes component measurement analysis results, code engineering measurement analysis results and project measurement analysis results.

9. A device comprising a memory and a processor, wherein the memory stores computer instructions that can be executed on the processor, characterized in that: When the processor runs the computer instructions, it executes a software open source security measurement system based on open source security as described in any one of claims 1 to 7.

10. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instructions are executed, a software open source security measurement system based on open source security as described in any one of claims 1 to 7 can be implemented.

Images