Software supply chain side and full-period network security auxiliary defense system

Abstract

The invention relates to the technical field of network security, in particular to a software supply chain side and full-period network security auxiliary defense system, which comprises a data source module, a software supply chain side and full-period network security auxiliary defense module and a software supply chain side and full-period network security auxiliary defense module, the intelligent agent is configured with a workflow; the information connection subsystem comprises an information extraction module used for connecting the extracted information into the intelligent agent; and the vulnerability information analysis processing subsystem is used for executing a software protection algorithm. Vulnerability information is collected and managed through multiple ways, intelligent processing is carried out on security risks existing on the software supply chain side and even in the whole life cycle by means of an intelligent agent, security is shifted to the left before software is online, and the network security defense capacity of the software in the whole life cycle is further enhanced.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an agent-based software supply chain and full-cycle network security auxiliary defense system. Background Art

[0002] With the rapid development of Internet technology, the importance of software network security has become increasingly prominent. In today's digital age, software has become an important tool for enterprises and individuals to exchange information, store data, and process business. However, with the widespread popularity of software applications, network security threats have also increased, which has put forward higher requirements for software security.

[0003] like Figure 1 As shown in the figure, there are security risks in multiple links in the entire life cycle of software, including security vulnerabilities caused by coding in the source code side during the R&D stage, vulnerabilities in coding logic, data boundary vulnerabilities, etc., which will affect the security of the software; security risks from component dependency libraries, middleware, and integrated third-party software (or private) on the supply chain side; when the software is running, in order to ensure the smooth operation of the software, the security threats from the operating system where the software runs are usually ignored; security threats from the Internet side after the software is launched. Under the current circumstances, information security engineers and R&D and operation engineers cannot quickly implement risk classification and disposal, and locating problems and handling measures are time-consuming and labor-intensive.

[0004] The main means of network security defense for current software mainly include adding security protection tools on the Internet side after the software is launched, such as firewalls, intrusion detection systems (IDS), and WAF (Web Application Firewall); when the software is running, use vulnerability scanning tools to detect the security risks of the operating system and software entry where the software is running, such as the Green Alliance Vulnerability Scanning System (Green Alliance Vulnerability Scanning System is a network security vulnerability scanning software with the characteristics of high efficiency, accuracy, and security. It can conduct comprehensive security assessments on multiple targets such as operating systems, and promptly discover and report security vulnerabilities).

[0005] Therefore, the existing software network security defense technology has the following deficiencies:

[0006] 1. Defense technology fails to cover network security at all stages of the software life cycle, especially on the software coding side and the software supply chain side. The software supply chain includes network security defense for component dependency libraries, middleware, and third-party software (or private) on the source code side. The Chinese patent with publication number CN118316736A discloses a network threat active defense system and method based on a large model. It focuses on how to build a large network security model, and lacks security defense measures for security risks on the software coding side and the software supply chain side.

[0007] 2. Current network security risk analysis is often based on network traffic based on user behavior. The data source is relatively single and lacks multiple data sources. For example, a Chinese patent with publication number CN119011302A discloses a big data analysis and processing method and system for intelligent network security, which mentions the ability to improve network security analysis based on logs and user behavior. The data only comes from logs and user behavior, and lacks multiple data sources to provide intelligent solutions.

[0008] 3. Lack of the ability to quickly handle various risks in an intelligent and automated manner, and lack of the ability to provide intelligent solutions for R&D operation and maintenance engineers and network security engineers when network security risks are discovered. For example, the Chinese patent with publication number CN114189378A discloses a network security incident analysis method and proposes a method for locating the source of network security incidents by combining network security incident threat indicator information analysis. However, there is no ability to provide intelligent solutions. Summary of the invention

[0009] In order to overcome the problems that existing network security auxiliary defense methods cannot cover the defense on the software supply chain side, the data source is relatively single, and there is a lack of the ability to intelligently handle risks, the present invention provides a software supply chain side network security auxiliary defense method based on an intelligent agent.

[0010] The technical solution provided by the present invention is as follows: a network security auxiliary defense system on the software supply chain side, comprising:

[0011] The data source module stores basic software information and vulnerability information. The basic software information includes basic software attribute information and software supply chain information. The basic software attribute information includes the software responsible person. The software supply chain information includes the supply chain number and the supply chain type. The vulnerability information includes the software supply chain vulnerability information.

[0012] An agent, including a long-term memory based on a data source module and configured with a workflow;

[0013] An information connection subsystem, comprising an information extraction module for connecting the extracted information to the intelligent agent, wherein the extracted information includes basic software information of the software to be protected, software supply chain information, and software supply chain vulnerability information scanned by the security protection tool;

[0014] The vulnerability information analysis and processing subsystem includes at least one algorithm module for executing a number matching algorithm, wherein the number matching algorithm includes the following steps:

[0015] Use the intelligent agent to match the corresponding supply chain number and software owner from the information extracted by the information connection subsystem;

[0016] If the software to be protected has not yet been launched, the corresponding supply chain type and software supply chain vulnerability information are obtained from the software supply chain information according to the supply chain number and sent to the software manager. Otherwise, the workflow is called according to the supply chain type to execute different preset repair plans.

[0017] Preferably, the basic attribute information of the software also includes the software number, the software supply chain information also includes the supply chain URL, and the workflow includes a restricted URL workflow that calls a firewall to automatically restrict URL access, a script upgrade workflow that executes an automated script tool to upgrade the middleware version, and a sending workflow that sends vulnerability information related to the software to be protected to the software person in charge;

[0018] The repair plan includes:

[0019] Repair solution 1: If the supply chain type is a component type, the software number is matched through the long-term memory of the intelligent agent, and the sending workflow is called to send the software number and vulnerability information to the software person in charge;

[0020] Repair solution 2: If the supply chain type is a middleware type, the script is called by the agent to upgrade the workflow;

[0021] Repair solution three, if the supply chain type is third-party software, call the restricted URL workflow through the intelligent agent.

[0022] Preferably, the basic software attribute information includes a supply chain number list 1 and a software number, the software supply chain information includes a software number list and a vulnerability number list, the software supply chain vulnerability information includes a supply chain vulnerability number and a supply chain number list 2, the supply chain number list 1 of the basic software attribute information is associated with the supply chain numbers of all software supply chains under the same software number, and the software number list item of the software supply chain information is associated with the software numbers of all software under the same supply chain number;

[0023] The vulnerability number list item of the software supply chain information is associated with the supply chain vulnerability numbers of all software supply chain vulnerabilities under the same supply chain number, and the supply chain number list 2 of the software supply chain vulnerability information is associated with the supply chain numbers of all software supply chains under the same supply chain vulnerability number.

[0024] Preferably, the basic attribute information of the software further includes a software number, and the number matching algorithm matches the corresponding supply chain number and the software person in charge in a way that: extracting the corresponding supply chain number and the software person in charge according to the software number;

[0025] Extract the corresponding supply chain number and software manager based on the supply chain vulnerability number of the risky vulnerability information discovered by the security protection tool;

[0026] The information extraction module is used to extract the supply chain number and software manager of the software to be protected.

[0027] Preferably, the software supply chain vulnerability information includes a supply chain vulnerability repair suggestion plan, and the workflow also includes a supply chain repair solution workflow for executing the supply chain vulnerability repair suggestion plan.

[0028] Preferably, the system further includes a data collection module, wherein the data collection module collects vulnerability information in any one or more of the following ways:

[0029] Use scripts to collect software supply chain vulnerability information on open source vulnerability management websites based on the software supply chain name and supply chain version;

[0030] Collect vulnerability information provided by subscribed security service providers;

[0031] Preferably, the data collection module further includes a timed task program for periodically collecting the latest vulnerability information, based on the vulnerability information related to the software supply chain detected by the penetration test and the use of the vulnerability information.

[0032] Preferably, the data collection module also includes a timed task program for periodically collecting the latest vulnerability information.

[0033] Preferably, in the number matching algorithm, if the risky vulnerability information discovered by the security protection tool has not been collected in the data source module, the vulnerability information is used as a prompt word to generate a vulnerability solution by using the short-term memory of the intelligent body.

[0034] In order to overcome the problems that existing network security auxiliary defense methods cannot cover the entire life cycle of software, especially the defense on the software supply chain side, and the data source is relatively single and lacks the ability to intelligently handle risks, the present invention also provides a full-cycle network security auxiliary defense method for software based on an intelligent agent.

[0035] The technical solution provided by the present invention is as follows:

[0036] A software full-cycle network security auxiliary defense system, including the software supply chain side network security auxiliary defense system, the vulnerability information also includes system vulnerability information, and the system vulnerability information includes a recommended solution for repairing the system vulnerability;

[0037] The workflow includes a system repair solution workflow for executing a system vulnerability repair suggestion solution;

[0038] The information connection subsystem also includes a coding tool module that connects the software coding tool with the agent, and the coding tool module is used to detect source code vulnerabilities in the coding process and generate repair solutions;

[0039] The extracted information also includes system vulnerability information scanned by a vulnerability scanning tool on the system running the protection software.

[0040] Preferably, the vulnerability information further includes an IP blacklist, the extracted information further includes risky IP addresses discovered by the security protection tool, the workflow further includes a blocking IP workflow for calling the security protection tool to execute a remote command tool to block IPs, and the vulnerability information analysis and processing subsystem further includes an algorithm module 2 for executing an IP analysis algorithm;

[0041] The IP analysis algorithm pushes the risky IPs found by the security protection tool to the intelligent agent, and uses the intelligent agent to determine whether the risky IP is included in the IP blacklist in the knowledge base. If so, the intelligent agent executes the IP ban workflow.

[0042] Otherwise, the risky IP will be pushed to the threat analysis platform to determine whether it is a high-risk IP. If it is, the intelligent agent will be used to execute the IP ban workflow.

[0043] Otherwise, determine whether the risky IP has an abnormal access frequency. If so, use the intelligent agent to execute the IP ban workflow.

[0044] Preferably, the software basic attribute information further includes a URL list, the software supply chain information further includes a supply chain URL, the extracted information further includes a URL with risks found by a security protection tool, and the vulnerability information analysis and processing subsystem further includes an algorithm module 3 for executing a URL judgment algorithm;

[0045] The URL judgment algorithm pushes the attacked URL discovered by the security protection tool to the intelligent agent, and uses the intelligent agent to analyze whether the attacked URL matches the URL list item or the supply chain URL item. If so, the intelligent agent executes a restricted URL workflow that calls the firewall to automatically restrict access to the supply chain URL.

[0046] Preferably, the coding tool module includes an IDE plug-in or IDE configuration file encapsulated by the API interface of the intelligent agent.

[0047] Preferably, the collected basic software information, software supply chain vulnerability information and vulnerability information are entered into the knowledge base and used as corpus for training and adjusting parameters of the intelligent agent.

[0048] Preferably, the vulnerability information analysis and processing subsystem also includes a backup module, which is used to input the system vulnerability information or supply chain vulnerability information as a prompt word into the intelligent agent when the newly discovered system vulnerability information or supply chain vulnerability information has not been collected or does not contain a vulnerability repair suggestion plan, and send the system vulnerability repair suggestion plan or supply chain vulnerability repair suggestion plan generated by the short-term memory of the intelligent agent to the software person in charge.

[0049] Compared with the prior art, the present invention has the following beneficial effects:

[0050] 1. Collect security risk intelligence vulnerability information through multiple channels, manage basic software information, software supply chain vulnerability information and system vulnerability information, and use intelligent agents to intelligently handle security risks on the software supply chain side and even in the entire life cycle, shift security left to before the software goes online, expose and repair security risks in advance, assist R&D engineers to discover and repair security risks earlier, and further strengthen the network security defense capabilities of the software throughout its life cycle; save network security engineers' time in dealing with problems and improve work efficiency.

[0051] 2. Provide a variety of vulnerability analysis and processing algorithms based on intelligent tool functions, including IP analysis algorithm, URL judgment algorithm, and number matching algorithm, to handle security risks efficiently and quickly.

[0052] 3. The method of further strictly judging IP through external open source websites reduces the possibility of IP being blocked by mistake.

[0053] 4. When a new vulnerability appears, all software containing the vulnerability can be counted, and the vulnerability details and vulnerability repair suggestions can be sent to the software manager via email, thereby improving the efficiency of enterprise software vulnerability repair and providing technical support for enterprise software network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1A schematic diagram for identifying security risks throughout the software life cycle;

[0055] Figure 2 This is a schematic diagram of the correlation between basic software information and vulnerability information;

[0056] Figure 3 Schematic diagram of the intelligent agent architecture of Embodiment 1 and Embodiment 2 of the present invention;

[0057] Figure 4 This is a schematic diagram of the number matching algorithm flow of the first embodiment of the present invention;

[0058] Figure 5 This is a schematic diagram of the IP analysis algorithm flow of the second embodiment of the present invention;

[0059] Figure 6 The figure is a flow chart of the URL determination algorithm of the second embodiment of the present invention. DETAILED DESCRIPTION

[0060] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. Based on the described embodiments of the present invention, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with ordinary skills in the field to which the present invention belongs.

[0061] In order to further understand the present invention, some terms mentioned in the present invention and the embodiments of the present invention are first explained:

[0062] Vulnerabilities: Vulnerabilities are security flaws in systems, applications, or network protocols that can be exploited by attackers to access, compromise, or bypass normal security controls.

[0063] CVE: CVE (Common Vulnerabilities and Exposures) is a database maintained by MITRE (a division of ManTech International Corporation) in the United States. The database contains information on known information security vulnerabilities in the world. CVE assigns a unique identifier, namely the CVE number (CVE ID), to each known vulnerability. This number is standardized and can uniquely identify a vulnerability worldwide.

[0064] Shift-Left Security: Shift-Left Security is a software development practice that aims to move security measures earlier in the software development lifecycle.

[0065] Large model training: Large model training refers to training a complex neural network model through big data. The values ​​of weights and biases in the network are determined through training with a large amount of data so that it can adapt to specific functions.

[0066] Large model parameter tuning: Parameter tuning refers to adjusting the parameters of a trained model to further improve its performance on a specific task. In large model training, parameter tuning usually refers to fine-tuning the pre-trained model.

[0067] Security protection tools: refers to network security systems used to protect software, systems and network installations, such as firewalls.

[0068] Software Supply Chain: Software supply chain refers to everything that goes into the software and where it comes from, including code, binaries, other components and their sources (such as repositories or package managers). It is the dependencies and properties of the dependencies that the software relies on, which can be commercial or open source. The software supply chain also includes other parts of the suite besides the individual applications, such as software that builds and packages scripts or the infrastructure that the application relies on to run. This invention mainly relates to software component dependency libraries, middleware, and third-party (or proprietary) software.

[0069] It should be pointed out in particular that middleware refers to open source third-party software; third-party (or private) software refers to open source commercial software, and its vulnerability risks and repair suggestions will be provided by the manufacturer in the future.

[0070] To better understand Figure 3 , explain the following nouns:

[0071] Short-term memory: Short-term memory means that all context learning is done using the short-term memory of the large model. The short-term memory described in the embodiment of the present invention uses prompt words (ie, Prompt) as input to generate results.

[0072] Long-term memory: Long-term memory refers to the ability to provide the agent with a long-term retention and recall of information, such as by retrieving it using external storage, etc. In the embodiment of the present invention, the knowledge base is used as external storage.

[0073] Tool function: Tool function refers to equipping a large model with external tools to expand model functions. The tool functions of this embodiment include automated script tools, API interface tools, remote execution script tools, etc.

[0074] Planning: Planning generally refers to the automatic planning and scheduling of tasks or actions performed by an agent, with the goal of optimizing resources. Planning can be represented as a combination of a prediction step and a search mechanism, which combines the prediction step with the search process in alternative actions to achieve the ideal state. In this embodiment, planning includes calling and executing corresponding tool functions based on different types of vulnerability information.

[0075] In order to facilitate those skilled in the art to better understand the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The following is only exemplary and does not limit the protection scope of the present invention.

[0076] Embodiment 1

[0077] This embodiment discloses a software supply chain network security auxiliary defense system, including:

[0078] The data source module, in this embodiment, is a knowledge base (a knowledge base refers to a database that uses artificial intelligence technology to systematically organize, classify and manage a large amount of knowledge and information. It not only stores a large amount of knowledge and information, but also realizes functions such as rapid retrieval of knowledge, intelligent recommendation and data analysis through intelligent algorithms and technologies. The knowledge base mentioned in this embodiment takes a database as an example, and of course it can also include a vector knowledge base converted from a text file list), stores basic software information and software supply chain vulnerability information. The basic software information includes basic software attribute information and software supply chain information. The basic software attribute information includes software number, software name, static IP address of the server on which it runs, URL list, supply chain number list one and software person in charge. Fields can also be added as needed. The software supply chain information includes supply chain number, software number list, supply chain type, vulnerability number list and supply chain URL. The software supply chain vulnerability information includes supply chain vulnerability number, supply chain vulnerability name, supply chain vulnerability details, supply chain affected version, supply chain vulnerability repair suggestion plan, supply chain number list two, etc.; it should be noted that the basic software attribute information and software supply chain information are not limited to the above information, and can be added or reduced according to the usage scenario;

[0079] The data collection module is used to collect but not limited to basic software information and software supply chain vulnerability information, including a scheduled task program for regularly collecting the latest system vulnerability information and software supply chain vulnerability information, and a supply chain information program for extracting and collecting software supply chain information from software source code.

[0080] The agent includes a long-term memory based on a data source module and is configured with a workflow. The workflow is a preset rule chain executed by the agent calling an API interface or an automated script. It means that when the agent encounters a complex problem, it does not directly deal with it, but first plans and decomposes the task, selects the tool functions required for each task, and executes it according to the prompt word content. The agent is a computer program based on a large language model that has the ability to plan and think, the ability to remember, the ability to use tool functions, and can independently complete a given task. The agent described in the embodiment of the present invention is a large language model with the ability to generate code and text, such as Figure 3 As shown, the tool functions mainly include remote script execution, remote command execution, and API interface.

[0081] The workflows involved in this embodiment include a URL restriction workflow that calls a firewall to automatically restrict access to supply chain URLs by calling a remote command execution tool function; a script upgrade workflow that upgrades the middleware version by calling a remote script execution tool function; a sending workflow that sends vulnerability information related to the software to be protected to the software manager; a supply chain repair solution workflow that executes the supply chain vulnerability repair suggestion solution according to the prompt word content; and a system repair solution workflow for executing the system vulnerability repair suggestion solution.

[0082] An information connection subsystem, comprising an information extraction module for connecting the extracted information to the intelligent agent, wherein the extracted information includes basic software information of the software to be protected, software supply chain information, and software supply chain vulnerability information scanned by the security protection tool;

[0083] The vulnerability information analysis and processing subsystem includes an algorithm module 1 and a backup module for executing the number matching algorithm. The backup module is used to input the supply chain vulnerability information as a prompt word into the intelligent agent when the newly discovered supply chain vulnerability information has not been collected or does not contain a vulnerability repair suggestion plan, and send the supply chain vulnerability repair suggestion plan generated by the intelligent agent's short-term memory to the software person in charge. The number matching algorithm includes the following steps:

[0084] Extract the corresponding supply chain number and software person in charge according to the software number, or extract the corresponding supply chain number and software person in charge according to the supply chain vulnerability number of the risky vulnerability information discovered by the security protection tool, or extract the supply chain number and software person in charge of the software to be protected through the information extraction module; if the risky vulnerability information discovered by the security protection tool is not collected in the data source module, call the backup module to send the vulnerability information and supply chain vulnerability repair suggestions to the software person in charge.

[0085] If the software to be protected has not been launched, the corresponding supply chain type and software supply chain vulnerability information are obtained from the software supply chain information according to the supply chain number and sent to the software manager. If the software to be protected has been launched, the agent's planning is used to obtain the corresponding supply chain type from the software supply chain information according to the supply chain number, and different repair plans are executed according to the supply chain type:

[0086] Repair solution 1: If the supply chain type is a component type, the agent matches the software number from the knowledge base based on the supply chain number, calls the sending workflow to feed back the software number and software supply chain vulnerability information to the software person in charge;

[0087] Repair solution 2: If the supply chain type is a middleware type, the script is called by the agent to upgrade the workflow;

[0088] Repair plan three, if the supply chain type is third-party (or private) software, the workflow is called through the intelligent agent, and the software number, software supply chain vulnerability information and other related information are matched from the knowledge base according to the supply chain number and fed back to the software person in charge.

[0089] Among them, the software basic attribute information, software supply chain information, and software supply chain vulnerability information are respectively made into lists in the data source module, i.e., the knowledge base, and are associated through association logic, such as Figure 2 As shown, the association logic includes:

[0090] Association logic 1: The supply chain number list item of the software basic attribute information is associated with the supply chain numbers of all software supply chains under the same software number, and the software number list item of the software supply chain information is associated with the software numbers of all software under the same supply chain number;

[0091] Association logic 2: The vulnerability number list item in the software supply chain information is associated with the supply chain vulnerability numbers of all supply chain vulnerabilities under the same supply chain number, and the supply chain number list item 2 of the software supply chain vulnerability information is associated with the supply chain numbers of all software supply chains under the same supply chain vulnerability number.

[0092] The collected basic software information and software supply chain vulnerability information are entered into the knowledge base and used as corpus for training and adjusting parameters of the intelligent agent.

[0093] The steps for collecting data in the data collection module are as follows:

[0094] S101, collecting basic software information, including collecting basic software attribute information and collecting software supply chain information.

[0095] Basic software attribute information is collected through CMDB (Configuration Management Database, which is a database used to store and manage detailed information of various components in IT infrastructure in IT service management and IT operation and maintenance management. Components include hardware devices, software applications, network connections, virtual machines, and storage devices).

[0096] Use command lines or scripts to collect software supply chain information from software source code, including supply chain number, supply chain name, supply chain version number, software number list, supply chain type, vulnerability number list, supply chain URL, etc.

[0097] S102, collecting vulnerability information.

[0098] Collection method 1: Based on the software supply chain name and supply chain version, use scripts to obtain software supply chain vulnerability information and vulnerability repair suggestions on open source vulnerability management websites such as Full Disclosure Mailing List (FDML, Full Disclosure Mailing List, is an information sharing platform dedicated to the field of information security. It aims to provide an open, transparent and timely information sharing environment to help information security professionals keep abreast of the latest security threats and defense methods) and Exploit DB (full name Exploit-DB, an online vulnerability database and platform that focuses on collecting and publishing various computer vulnerabilities and their exploit codes. It aims to provide users with detailed information about computer vulnerabilities, including vulnerability descriptions, impact ranges, and exploitation methods. Through Exploit-DB, users can quickly understand the weaknesses of the system and take corresponding defensive measures. The following is an example of a script that collects supply chain vulnerability information and vulnerability repair suggestions through a script:

[0099] {

[0100] Vulnerability ID: "CVE-2013-4547",

[0101] Vulnerability name: "Nginx file name logic vulnerability",

[0102] Vulnerability details: "This vulnerability can lead to directory crossing and code execution. The main reason is that nginx incorrectly parses the requested URI due to 00 truncation, and parses the file name requested by the user into the corresponding script program, resulting in permission bypass, code execution and other collateral effects, thereby realizing the getshell process."

[0103] Affected versions: "Nginx 0.8.41 ~ 1.4.3 1.5.0 ~ 1.5.7",

[0104] Suggested solution for fixing the vulnerability: "Upgrade Nginx to 1.5.7"

[0105] ……:……

[0106] }

[0107] Collection method 2:

[0108] Collect IP blacklists and software supply chain vulnerability information and vulnerability repair suggestions provided by security service providers (such as NSFOCUS) through subscription.

[0109] Collection method three: Software supply chain vulnerability information detected through penetration testing, and vulnerability repair suggestions generated by the agent's short-term memory based on the software supply chain vulnerability information.

[0110] In addition, in order to further improve the accuracy of vulnerability repair suggestions, the scheduled task program obtains the latest risk information, software supply chain vulnerability information and supply chain vulnerability repair suggestions from the above collection methods, and updates the supply chain vulnerability repair suggestion field in a timely manner. At the same time, the updated data is also used for knowledge base updates and intelligent agent training and fine-tuning.

[0111] Using the method of this embodiment to perform software security auxiliary defense on the supply chain side of the protected software, a serial number matching algorithm is executed, such as Figure 4 As shown, the following steps are included:

[0112] S201: Extract software supply chain information and software responsible person. Use the intelligent agent to match the corresponding supply chain number and software responsible person from the information extracted by the information connection subsystem.

[0113] When the software is compiled and integrated, that is, the software has not yet been launched, the information extraction module (such as a script) is used to automatically extract the software supply chain information in the source code of the software to be protected as a prompt word and input it into the intelligent agent, including component dependency library information, middleware information, and third-party (or private) software information. For example, software written in Python can obtain component dependency library information {certifi==2023.7.22, chardet==4.0.0, idna==2.10, requests==2.24.0, urllib3==1.25.10 (the format is component dependency library name==version number)} through the pip freeze > requirements.txt command; or extract the corresponding software supply chain information and software responsible person according to the software number;

[0114] After the software is launched, the intelligent agent extracts the corresponding supply chain number based on the supply chain vulnerability number and software manager of the risky vulnerability information discovered by the security protection tool. If the vulnerability information is not collected in the data source module, the backup module is called to use the short-term memory of the intelligent agent to use the vulnerability information as a prompt to generate the corresponding vulnerability solution, and call the sending workflow to send the vulnerability information and supply chain vulnerability repair suggestions to the software manager.

[0115] S202: using the intelligent agent to search for the corresponding supply chain type from the knowledge base according to the supply chain number and the association logic;

[0116] S203: If the software to be protected has not yet been launched, search for software supply chain vulnerability information based on the supply chain number and association logic 2, organize the supply chain vulnerability name, supply chain number, supply chain vulnerability details, supply chain affected version, and supply chain vulnerability repair suggestion plan in the software supply chain vulnerability letter, and send it to the software person in charge via email and end, otherwise proceed to the next step.

[0117] S204: Implement different repair solutions based on supply chain type:

[0118] S2041: Repair solution 1: If the supply chain type is a component type, the agent's long-term memory matches the software number from the data source module based on the supply chain number, and the software supply chain vulnerability information is fed back to the software manager;

[0119] S2042: Repair solution 2, if the supply chain type is a middleware type, the script upgrade workflow is called by the agent. For example, for the Nginx file name logic vulnerability with the vulnerability number CVE-2013-4547, the recommended solution for repairing the vulnerability is to upgrade Nginx to 1.5.7. Then the automated script tool will smoothly upgrade Nginx to a version later than 1.5.7 to complete the repair of the vulnerability.

[0120] S2043: Repair solution three, if the supply chain type is third-party (or private) software, the restricted URL workflow is called through the intelligent agent.

[0121] If the risky vulnerability information discovered by the security protection tool contains a supply chain vulnerability repair suggestion plan, the supply chain repair plan workflow of the supply chain vulnerability repair suggestion plan can also be directly executed.

[0122] Embodiment 2

[0123] This embodiment discloses a software full-cycle network security auxiliary defense system, including the software supply chain side network security auxiliary defense system of embodiment one.

[0124] In addition, the vulnerability information stored in the data source module of this embodiment also includes IP blacklist and system vulnerability information. The system vulnerability information includes system vulnerability number, system vulnerability name, system vulnerability details, system affected version, and system vulnerability repair suggestion. The knowledge base mentioned in this embodiment is formed by importing basic software information, software supply chain vulnerability information, and system vulnerability information into the database according to the association relationship, which is used to quickly retrieve relevant information about software supply chain vulnerabilities;

[0125] The workflow also includes a workflow that calls the firewall to automatically block IP by calling a remote command execution tool function, and a system repair solution workflow that executes a recommended system vulnerability repair solution based on prompt words.

[0126] The information connection subsystem also includes a coding tool module that connects the software coding tool with the intelligent agent. The coding tool module is used to detect source code vulnerabilities in the coding process and generate repair solutions. The coding tool module includes an IDE plug-in or IDE configuration file encapsulated by the API interface of the intelligent agent.

[0127] The information extracted by the information extraction module also includes system vulnerability information scanned by the vulnerability scanning tool on the system running the protection software, and risky IP addresses and URLs discovered by the security protection tool.

[0128] The data collection module collects system vulnerability information by scanning vulnerability information and vulnerability repair suggestions through vulnerability scanning tools, such as the NSFOCUS vulnerability scanning system. The collected basic software information, software supply chain vulnerability information, and system vulnerability information are entered into the knowledge base and used as corpus for training and parameter adjustment of the intelligent agent.

[0129] The vulnerability information analysis and processing subsystem also includes a backup module, which is used to input the system vulnerability information or supply chain vulnerability information as a prompt word into the intelligent agent when the newly discovered system vulnerability information or supply chain vulnerability information has not been collected or does not contain a vulnerability repair suggestion plan, and send the system vulnerability repair suggestion plan or supply chain vulnerability repair suggestion plan generated by the intelligent agent's short-term memory to the software person in charge.

[0130] This embodiment adopts different software-assisted defense methods according to different life cycle stages of the software, including the following steps:

[0131] S3: On the software coding side, the agent’s API interface is encapsulated into an IDE (Integrated Development Environment) plug-in or configuration file, i.e., a coding tool module, which enables the IDE to automatically detect source code vulnerabilities during the coding process and detect security vulnerabilities in real time during the coding process. When a security vulnerability is detected, the agent generates a reference code for the security vulnerability repair solution in real time based on the context information of the coding. The configuration file is as follows:

[0132] {

[0133] "models": [

[0134] {

[0135] "title": "Big Model of Vertical Field of Network Security",

[0136] "provider": "ollama",

[0137] "model": "network-safe-model-v2:130b",

[0138] "apiBase": "https: / / xxx.xxx.xxx:port"

[0139] }

[0140] ],

[0141] "customCommands": [

[0142] {

[0143] "name": "checkbugs",

[0144] "prompt": "{{{ input}}} Check for security risks in thiscode section",

[0145] "description": "Checking Bugs for highlighted code"

[0146] }

[0147] ],

[0148] "tabAutocompleteModel": {

[0149] "title": "network-safe-model-v2:130b",

[0150] "provider": "ollama",

[0151] "model": "network-safe-model-v2:130b",

[0152] "apiBase": "https: / / xxx.xxx.xxx:port"

[0153] },

[0154] "allowAnonymousTelemetry": false,

[0155] "embeddingsProvider": {

[0156] "provider": "ollama",

[0157] "model": "nomic-embed-text:latest",

[0158] "apiBase": "https: / / xxx.xxx.xxx:port"

[0159] }

[0160] }

[0161] On the software supply chain side, the specific method is as follows: Step S201 to Step S204 in Embodiment 1:

[0162] When the software is running, in order to deal with security threats from the system where the software is running, the software-assisted defense method includes the following steps:

[0163] S401: Call a vulnerability scanning tool (such as NSFOCUS vulnerability scanning system) to scan the operating system where the software is running and output a vulnerability scanning report.

[0164] S402: extracting the system vulnerability number and the corresponding system vulnerability repair suggestion plan from the vulnerability scanning report, and using the intelligent agent to execute the system repair plan workflow;

[0165] If there is no recommended solution for the system vulnerability repair, the intelligent agent will call the backup module, use the short-term memory to generate the corresponding recommended solution for the system vulnerability repair based on the system vulnerability details as the prompt word of the intelligent agent, and send the system vulnerability information and the recommended solution for the system vulnerability repair to the software person in charge via email.

[0166] After the software is launched, it will be exposed to the Internet and will be attacked by a large number of network attacks. The software-assisted defense method includes the following steps:

[0167] S501: Analyze the type of vulnerability information and call the corresponding algorithm module;

[0168] S5021: When the vulnerability information is a risky IP, the algorithm module 2 is called to execute the IP analysis algorithm, such as Figure 5 As shown, that is,

[0169] Push the risky IPs found by the security protection tool to the intelligent agent, and use the intelligent agent to determine whether the risky IP is included in the IP blacklist in the knowledge base. If so, use the intelligent agent to execute the IP ban workflow.

[0170] Otherwise, the risky IP will be pushed to the threat analysis platform (such as the Weibu Online X Intelligence Community, which is a well-known pilot demonstration comprehensive threat analysis platform and intelligence sharing community in China. It is based on threat data query, analysis and intelligence data sharing, and provides a convenient one-stop analysis tool for global security practitioners and enterprises. The website address is https: / / www.threatbook.cn / prod / api. Other threat analysis platforms can also be used for analysis) to determine whether it is a high-risk IP. If it is, the intelligent agent will be used to execute the IP ban workflow.

[0171] Otherwise, determine whether the risky IP has an abnormal access frequency (such as more than 1,000 times). If so, use the intelligent agent to execute the IP ban workflow.

[0172] S5022: When the vulnerability information is an attacked URL (Uniform Resource Locator, which is a concise representation of the location and access method of resources available on the Internet. It is the address of a standard resource on the Internet. Each file on the Internet has a unique URL, which contains information indicating the location of the file and how the browser should handle it), algorithm module 3 is called to execute the URL judgment algorithm, such as Figure 6 As shown, that is,

[0173] After the security protection tool finds the attacked URL, the intelligent agent is used to analyze whether the attacked URL matches the URL list item or the supply chain URL item. If so, the intelligent agent is used to execute the URL restriction workflow.

[0174] S5023: If the vulnerability information is software supply chain vulnerability information, the algorithm module 1 is called to execute the number matching algorithm after the software is launched, that is,

[0175] The intelligent agent extracts the corresponding supply chain number and software manager based on the supply chain vulnerability number of the risky vulnerability information discovered by the security protection tool.

[0176] Using intelligent agents to search for supply chain types from the knowledge base based on supply chain numbers and association logic;

[0177] Different remediation options are implemented based on the supply chain type:

[0178] Repair solution 1: If the supply chain type is a component type, the agent matches the software number from the knowledge base based on the supply chain number and feeds back the software supply chain vulnerability information to the software manager;

[0179] Repair solution 2: If the supply chain type is a middleware type, the script is called by the agent to upgrade the workflow;

[0180] Repair plan three, if the supply chain type is third-party (i.e. private) software, the restricted URL workflow is called through the intelligent agent, and the software number is matched from the knowledge base according to the supply chain number, and the software supply chain vulnerability information is fed back to the software person in charge.

[0181] If the risky vulnerability information discovered by the security protection tool contains a supply chain vulnerability repair suggestion plan, the supply chain repair plan workflow of the supply chain vulnerability repair suggestion plan can also be directly executed.

[0182] S5024: After the software is launched, in order to further ensure the security of the software, network security engineers usually conduct periodic penetration tests on the software (penetrators use various means to test a specific network at different locations in order to discover and exploit vulnerabilities in the system, and then output a penetration test report and submit it to the network owner. Based on the penetration test report provided by the penetration personnel, the network owner can clearly understand the security risks and problems in the system) and form a penetration test report.

[0183] The vulnerability details in the penetration test report are input as prompts into the intelligent agent, which uses short-term memory to generate vulnerability repair suggestions, includes them in the data source module, and sends the vulnerability details and vulnerability repair suggestions to the software manager via email.

[0184] In this embodiment, when a vulnerability occurs, the intelligent agent analyzes and identifies the vulnerability information, and uses the short-term memory and long-term memory of the intelligent agent to assist in the analysis. For different types of vulnerability risks, different workflows are used to call different tool functions to complete vulnerability processing, thereby completing the intelligent processing of security risks existing in the software supply chain and even the entire life cycle.

[0185] The preferred embodiments of the present invention are described in detail above in conjunction with the accompanying drawings. However, the present invention is not limited to the specific details in the above embodiments. Within the technical concept of the present invention, a variety of simple modifications can be made to the technical solution of the present invention, and these simple modifications all belong to the protection scope of the present invention.

Claims

1. A network security auxiliary defense system for software supply chain, characterized in that: include: The data source module stores basic software information and vulnerability information. The basic software information includes basic software attribute information and software supply chain information. The basic software attribute information includes the software person in charge. The software supply chain information includes the supply chain number and the supply chain type. The vulnerability information includes the software supply chain vulnerability information. An agent, including a long-term memory based on a data source module and configured with a workflow; An information connection subsystem, comprising an information extraction module for connecting the extracted information to the intelligent agent, wherein the extracted information includes basic software information of the software to be protected and software supply chain vulnerability information scanned by the security protection tool; The vulnerability information analysis and processing subsystem includes at least one algorithm module for executing a number matching algorithm, wherein the number matching algorithm includes the following steps: Use the intelligent agent to match the corresponding supply chain number and software owner from the information extracted by the information connection subsystem; If the software to be protected has not yet been launched, the corresponding supply chain type and software supply chain vulnerability information are obtained from the software supply chain information according to the supply chain number and sent to the software manager. Otherwise, the workflow is called according to the supply chain type to execute different preset repair plans.

2. The software supply chain network security auxiliary defense system according to claim 1 is characterized in that: The basic attribute information of the software also includes the software number, the software supply chain information also includes the supply chain URL, and the workflow includes a restricted URL workflow that calls a firewall to automatically restrict access to the supply chain URL, a script upgrade workflow that executes an automated script tool to upgrade the middleware version, and a sending workflow that sends vulnerability information related to the software to be protected to the software owner; The repair plan includes: Repair solution 1: If the supply chain type is a component type, the software number is matched through the long-term memory of the intelligent agent, and the sending workflow is called to send the software number and vulnerability information to the software person in charge; Repair solution 2: If the supply chain type is a middleware type, the script is called by the agent to upgrade the workflow; Repair solution three, if the supply chain type is third-party software, call the restricted URL workflow through the intelligent agent.

3. The software supply chain network security auxiliary defense system according to claim 1 or 2, characterized in that: The software basic attribute information includes a supply chain number list 1 and a software number, the software supply chain information includes a software number list and a vulnerability number list, the software supply chain vulnerability information includes a supply chain vulnerability number and a supply chain number list 2, the supply chain number list 1 of the software basic attribute information is associated with the supply chain numbers of all software supply chains under the same software number, and the software number list item of the software supply chain information is associated with the software numbers of all software under the same supply chain number; The vulnerability number list item of the software supply chain information is associated with the supply chain vulnerability numbers of all software supply chain vulnerabilities under the same supply chain number, and the supply chain number list 2 of the software supply chain vulnerability information is associated with the supply chain numbers of all software supply chains under the same supply chain vulnerability number.

4. The software supply chain network security auxiliary defense system according to claim 3 is characterized in that: The basic attribute information of the software also includes a software number, and the number matching algorithm matches the corresponding supply chain number and the software person in charge in a way that: extracting the corresponding supply chain number and the software person in charge according to the software number; Extract the corresponding supply chain number and software manager based on the supply chain vulnerability number of the risky vulnerability information discovered by the security protection tool; The information extraction module is used to extract the supply chain number and software manager of the software to be protected.

5. The software supply chain network security auxiliary defense system according to claim 1 or 2, characterized in that: The software supply chain vulnerability information includes a supply chain vulnerability repair suggestion plan, and the workflow also includes a supply chain repair solution workflow for executing the supply chain vulnerability repair suggestion plan.

6. The software supply chain network security auxiliary defense system according to claim 1 or 2, characterized in that: It also includes a data collection module, and the data collection module collects vulnerability information in any one or more of the following ways: Use scripts to collect software supply chain vulnerability information on open source vulnerability management websites based on the software supply chain name and supply chain version; Collect vulnerability information provided by subscribed security service providers; The vulnerability information related to the software supply chain tested by penetration testing and the supply chain vulnerability repair suggestions generated based on the vulnerability information using the short-term memory of the intelligent agent are collected.

7. The software supply chain network security auxiliary defense system according to claim 6 is characterized in that: It also includes a data collection module, which also includes a timed task program for regularly collecting the latest vulnerability information.

8. The software supply chain network security auxiliary defense system according to claim 1 or 2, characterized in that: In the number matching algorithm, if the risky vulnerability information discovered by the security protection tool is not collected in the data source module, the vulnerability information is used as a prompt word by using the short-term memory of the intelligent body to generate a corresponding vulnerability solution.

9. A software full-cycle network security auxiliary defense system, comprising the software supply chain side network security auxiliary defense system according to any one of claims 1 to 8, characterized in that: The vulnerability information also includes system vulnerability information, and the system vulnerability information includes a suggested solution for repairing the system vulnerability; The workflow includes a system repair solution workflow for executing a system vulnerability repair suggestion solution; The information connection subsystem also includes a coding tool module that connects the software coding tool with the agent, and the coding tool module is used to detect source code vulnerabilities in the coding process and generate repair solutions; The extracted information also includes system vulnerability information scanned by a vulnerability scanning tool on the system running the protection software.

10. The software full-cycle network security auxiliary defense system according to claim 9 is characterized in that: The vulnerability information also includes an IP blacklist, the extracted information also includes risky IP addresses discovered by the security protection tool, the workflow also includes a blocking IP workflow for calling the security protection tool to execute a remote command tool to block the IP, and the vulnerability information analysis and processing subsystem also includes an algorithm module 2 for executing an IP analysis algorithm; The IP analysis algorithm pushes the risky IPs found by the security protection tool to the intelligent agent, and uses the intelligent agent to determine whether the risky IP is included in the IP blacklist in the knowledge base. If so, the intelligent agent executes the IP ban workflow. Otherwise, the risky IP will be pushed to the threat analysis platform to determine whether it is a high-risk IP. If it is, the intelligent agent will be used to execute the IP ban workflow. Otherwise, determine whether the risky IP has an abnormal access frequency. If so, use the intelligent agent to execute the IP ban workflow.

11. The software full-cycle network security auxiliary defense system according to claim 9 or 10, characterized in that: The software basic attribute information also includes a URL list, the software supply chain information also includes a supply chain URL, the extracted information also includes a URL with risks found by the security protection tool, and the vulnerability information analysis and processing subsystem also includes an algorithm module 3 for executing a URL judgment algorithm; The URL judgment algorithm pushes the attacked URL discovered by the security protection tool to the intelligent agent, and uses the intelligent agent to analyze whether the attacked URL matches the URL list item or the supply chain URL item. If so, the intelligent agent executes a restricted URL workflow that calls the firewall to automatically restrict access to the supply chain URL.

12. The software full-cycle network security auxiliary defense system according to claim 9 or 10, characterized in that: The coding tool module includes an IDE plug-in or IDE configuration file encapsulated by the API interface of the intelligent agent.

13. The software full-cycle network security auxiliary defense system according to claim 9 or 10, characterized in that: The collected basic software information, software supply chain vulnerability information and vulnerability information are entered into the knowledge base and used as corpus for training and parameter adjustment of the intelligent agent.

14. The software full-cycle network security auxiliary defense system according to claim 9 or 10, characterized in that: The vulnerability information analysis and processing subsystem also includes a backup module, which is used to input the system vulnerability information or supply chain vulnerability information as a prompt word into the intelligent agent when the newly discovered system vulnerability information or supply chain vulnerability information has not been collected or does not contain a vulnerability repair suggestion plan, and send the system vulnerability repair suggestion plan or supply chain vulnerability repair suggestion plan generated by the short-term memory of the intelligent agent to the software person in charge.

Images