Open source component security detection method and device, electronic equipment and storage medium

Abstract

The invention provides an open source component security detection method and device, electronic equipment and a storage medium, and relates to the technical field of computer security. The method comprises the following steps: acquiring open source component information and general platform enumeration entry information; constructing a first graph according to the open source component information; constructing a second graph according to the general platform enumeration entry information; processing the first graph and the second graph according to a graph matching algorithm, and determining sub-graph isomorphic mapping; and matching in a vulnerability database according to the target platform enumeration entry in the sub-graph isomorphic mapping, and determining vulnerability information of the open source component. According to the method, the graph is constructed by the open source component information and the general platform enumeration entry information respectively, analysis is performed in combination with the graph matching algorithm, the vulnerability information with the dependency relationship can be accurately determined, and the problem that the dependency relationship of vulnerabilities is difficult to identify in security monitoring is solved.

Description

Background Art

[0002] With the rapid development of Internet technology, the application of open source software in the field of software development has become increasingly widespread, greatly promoting the efficiency and quality of software development. However, this has also brought new challenges to Internet security, especially the security issues of the open source software supply chain have gradually become prominent, becoming one of the important factors threatening Internet security. Malicious penetration attacks are the biggest security risk facing the current Internet security field. Their types, propagation speed, number of infections, and scope of impact are constantly increasing. Such attacks often use vulnerabilities in the software to penetrate, thereby causing damage to the system or stealing sensitive information. Due to the widespread use of open source software in software development, security vulnerabilities in its supply chain have become an important target for malicious attackers.

[0003] In related technologies, automated scanning tools are used to regularly scan open source components in a project and compare them with known vulnerability databases to identify component information with security vulnerabilities. However, some vulnerabilities may involve dependencies between multiple components, and automated scanning tools cannot accurately identify these dependencies, resulting in false positives and false negatives.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The present disclosure provides a method, device, electronic device and storage medium for detecting security of open source components, which at least to some extent overcome the problem that it is difficult to identify dependencies when detecting vulnerabilities in open source components due to the limited scanning in related technologies.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to one aspect of the present disclosure, a method for security detection of open source components is provided, including: obtaining open source component information and general platform enumeration entry information; constructing a first graph according to the open source component information; constructing a second graph according to the general platform enumeration entry information; processing the first graph and the second graph according to a graph matching algorithm to determine a subgraph isomorphic mapping; matching in a vulnerability database according to target platform enumeration entries in the subgraph isomorphic mapping to determine vulnerability information of the open source component.

[0008] In some embodiments, constructing the first graph based on the open source component information includes: initializing an empty first graph structure; preprocessing the project name and attribute string in the open source component information to determine the target project name and target attribute string; using the target project name as a node of the first graph and adding the target attribute string as an attribute to construct the first graph.

[0009] In some embodiments, the preprocessing of the project name and attribute string in the open source component information to determine the target project name and target attribute string includes: replacing the alias in the project name in the open source component information with a standard form to determine the target project name; deleting all space characters in the attribute string and converting all letters to lowercase to determine the target attribute string.

[0010] In some embodiments, constructing the second graph according to the general platform enumeration entry information includes: initializing an empty second graph structure; creating a new node in the second graph structure for each general platform enumeration entry; setting general platform enumeration attributes for each node to construct the second graph.

[0011] In some embodiments, the processing of the first graph and the second graph according to a graph matching algorithm to determine a subgraph isomorphic mapping includes: preprocessing the first graph and the second graph; traversing from the first node of the first graph, and matching each node of the first graph with a node in the second graph; calculating node similarity based on node name and distance, and determining that a node mapping that successfully matches from the first graph to the second graph is a subgraph isomorphic mapping.

[0012] In some embodiments, the determining of the vulnerability information of the open source component by matching the target platform enumeration entries in the subgraph isomorphic mapping in the vulnerability database includes: extracting, according to the subgraph isomorphic mapping, the platform enumeration entry of the second graph node corresponding to the first graph node in the mapping as the target platform enumeration entry; matching the target platform enumeration entry with data in the vulnerability database, and for each matched target platform enumeration entry, extracting relevant vulnerability information from the vulnerability database and determining it as the vulnerability information of the open source component.

[0013] According to another aspect of the present disclosure, there is also provided an open source component security detection device, including: an information acquisition module, used to acquire open source component information and general platform enumeration entry information; a first graph construction module, used to construct a first graph according to the open source component information; a second graph construction module, used to construct a second graph according to the general platform enumeration entry information; a graph matching module, used to process the first graph and the second graph according to a graph matching algorithm to determine a subgraph isomorphic mapping; a vulnerability information determination module, used to match the target platform enumeration entries in the subgraph isomorphic mapping in a vulnerability database to determine the vulnerability information of the open source component.

[0014] According to another aspect of the present disclosure, an electronic device is also provided, which includes: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned open source component security detection methods by executing the executable instructions.

[0015] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the open source component security detection method described in any one of the above is implemented.

[0016] According to another aspect of the present disclosure, a computer program product is also provided, including a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above open source component security detection methods.

[0017] The open source component security detection method provided in the embodiments of the present disclosure obtains open source component information and general platform enumeration entry information; constructs a first graph based on the open source component information; constructs a second graph based on the general platform enumeration entry information; processes the first graph and the second graph according to a graph matching algorithm to determine a subgraph isomorphic mapping; matches the target platform enumeration entry in the subgraph isomorphic mapping in a vulnerability database to determine the vulnerability information of the open source component. The present application constructs the open source component information and the general platform enumeration entry information into graphs respectively, and analyzes them in combination with a graph matching algorithm, so as to accurately determine vulnerability information with dependencies, thereby solving the problem that it is difficult to identify dependencies between vulnerabilities in security monitoring.

[0018] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0020] Figure 1 A schematic diagram showing the structure of an open source component security detection system in an embodiment of the present disclosure;

[0021] Figure 2 A flow chart of a method for detecting security of an open source component in an embodiment of the present disclosure is shown;

[0022] Figure 3 A flowchart of a specific example of an open source component security detection method according to an embodiment of the present disclosure is shown;

[0023] Figure 4 A flowchart of another specific example of an open source component security detection method in an embodiment of the present disclosure is shown;

[0024] Figure 5 A flowchart of another specific example of an open source component security detection method according to an embodiment of the present disclosure is shown;

[0025] Figure 6 Another specific example flow chart of an open source component security detection method according to an embodiment of the present disclosure is shown;

[0026] Figure 7 Another specific example flow chart of an open source component security detection method according to an embodiment of the present disclosure is shown;

[0027] Figure 8 A schematic diagram of an open source component security detection device in an embodiment of the present disclosure is shown;

[0028] Fig. 9 A structural block diagram of a computer device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0029] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0030] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0031] For ease of understanding, before introducing the embodiments of the present disclosure, several terms involved in the embodiments of the present disclosure are first explained as follows:

[0032] Evidence: A collection of information about a package, such as name, version, and manufacturer, in an object format that contains this information;

[0033] CPE: Common Platform Enumeration, common platform enumeration;

[0034] VF2: The basic idea of ​​the VF2 algorithm is to determine whether two graphs are isomorphic by recursively searching for node matches.

[0035] NVD: National Vulnerability Database, National Vulnerability Database.

[0036] The specific implementation of the embodiment of the present disclosure is described in detail below with reference to the accompanying drawings.

[0037] Figure 1 FIG. 1 shows an exemplary application system architecture diagram to which the open source component security detection method in the embodiment of the present disclosure can be applied. Figure 1 As shown, the system architecture may include a terminal device 101 , a network 102 and a server 103 .

[0038] The network 102 is a medium for providing a communication link between the terminal device 101 and the server 103, and can be a wired network or a wireless network.

[0039] Optionally, the wireless network or wired network described above uses standard communication technology and / or protocol. The network is usually the Internet, but it can also be any network, including but not limited to a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a mobile, wired or wireless network, a dedicated network or any combination of a virtual private network). In some embodiments, the data exchanged through the network is represented by technologies and / or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), etc. In addition, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPSec) can also be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technologies can also be used to replace or supplement the above data communication technologies.

[0040] The terminal device 101 can be various electronic devices, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, smart speakers, smart watches, wearable devices, augmented reality devices, virtual reality devices, etc.

[0041] Optionally, the client of the application installed in different terminal devices 101 is the same, or the client of the same type of application based on different operating systems. Based on the different terminal platforms, the specific form of the client of the application can also be different, for example, the application client can be a mobile client, a PC client, etc.

[0042] In a specific instance, the terminal device is used to obtain open source component information and general platform enumeration entry information; construct a first graph based on the open source component information; construct a second graph based on the general platform enumeration entry information; process the first graph and the second graph according to a graph matching algorithm to determine a subgraph isomorphic mapping; match the target platform enumeration entries in the subgraph isomorphic mapping in a vulnerability database to determine the vulnerability information of the open source component.

[0043] The server 103 may be a server that provides various services, such as a background management server that provides support for the device operated by the user using the terminal device 101. The background management server may analyze and process the received request and other data, and feed back the processing results to the terminal device.

[0044] Optionally, the server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0045] Those skilled in the art will know that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration, and any number of terminal devices, networks and servers may be provided according to actual needs, and the embodiments of the present disclosure do not limit this.

[0046] Figure 2 A flow chart of a method for detecting open source component security in an embodiment of the present disclosure is shown as follows: Figure 2 As shown, the open source component security detection method provided in the embodiment of the present disclosure includes the following steps:

[0047] S202, obtaining open source component information and general platform enumeration item information.

[0048] It should be noted that the above-mentioned open source components can be software components, libraries, frameworks and tools released under an open source license. Open source components are software building blocks with open source code that can be freely accessed, viewed, used, modified and distributed by users. For example, the above-mentioned open source component information may include name information, version information, and manufacturer information. For example, after the user uploads the application package, the detection engine scans the program package in the project through the analyzer to collect package information, such as name, version, manufacturer, etc. This information is called Evidence. The above-mentioned common platform enumeration entry can be a CPE entry, which is a standardized method for describing and identifying the application, operating system and hardware device categories present in enterprise computing assets. The common platform enumeration provides a standard machine-readable format that can be used to uniquely encode information technology products and platforms.

[0049] S204: construct a first graph according to the open source component information.

[0050] It should be noted that the above-mentioned first graph can be a dependency graph (G1), which includes nodes and edges. The nodes represent components in the system (for example, the names of open source components are used as nodes), and the edges represent the dependency relationships between components.

[0051] S206: Construct a second graph according to the general platform enumeration entry information.

[0052] It should be noted that the second graph may be a graphical representation of the general platform enumeration entries (G2). For example, in the second graph, each node should have a unique identifier, such as a general platform enumeration name.

[0053] S208: Process the first graph and the second graph according to a graph matching algorithm to determine a subgraph isomorphic mapping.

[0054] It should be noted that the above graph matching algorithm can use the similarity information of the graph structure to find the matching relationship between nodes in the graph structure. The above subgraph isomorphism mapping can represent whether there is a relationship between the two graphs, so that the vertex set and edge set of one graph can be mapped to the vertex set and edge set of the other graph in a corresponding manner, while keeping the original relationship between the edges and vertices unchanged.

[0055] S210, matching the target platform enumeration entries in the subgraph isomorphic mapping in the vulnerability database to determine vulnerability information of the open source component.

[0056] It should be noted that the vulnerability database may be a database that stores known vulnerability information. For example, the vulnerability database is used to store and manage known vulnerability information in software, hardware, network systems, etc. Users can query known vulnerabilities that may exist in the system through the vulnerability database. When new vulnerabilities are discovered, the vulnerability database can update the information in a timely manner. The vulnerability database can also be used to provide vulnerability repair suggestions or patches to help users quickly repair vulnerabilities in the system.

[0057] This application constructs open source component information and general platform enumeration entry information into graphs respectively, and combines them with graph matching algorithms for analysis, which can accurately determine vulnerability information with dependencies, solving the problem that it is difficult to identify dependencies between vulnerabilities in security monitoring.

[0058] In one embodiment of the present disclosure, Figure 3 As shown, the open source component security detection method provided in the embodiment of the present disclosure can determine the first graph through the following steps, and can associate data with each other in the form of nodes and edges in the graph structure, so as to provide support for vulnerability detection and identification of dependency relationships:

[0059] S302, initializing an empty first graph structure;

[0060] S304, pre-processing the project name and attribute string in the open source component information to determine the target project name and target attribute string;

[0061] S306 , taking the target project name as a node of the first graph and adding the target attribute string as an attribute, to construct the first graph.

[0062] In a specific example, the processed words are used to construct the dependency graph G1, each dependency is represented as a node in the graph, and related attributes are added. An empty graph structure is initialized, all dependencies are traversed, each dependency is added to the graph as a node, and attributes are set for each node, including the preprocessed string, which will be used for comparison in the subsequent matching process.

[0063] In one embodiment of the present disclosure, Figure 4 As shown, in the open source component security detection method provided in the embodiment of the present disclosure, the project name and attribute string in the open source component information are preprocessed, and determining the target project name and target attribute string includes the following steps:

[0064] S402, replacing the alias in the project name in the open source component information with a standard form to determine the target project name;

[0065] S404, deleting all space characters in the attribute string and converting all letters into lowercase, to determine the target attribute string.

[0066] In a specific example, all attribute strings in Evidence are preprocessed to standardize dependency names for better matching. All spaces in the input string are removed. All letters are converted to lowercase to avoid mismatches caused by uppercase and lowercase letters. An alias mapping table is created to replace common software name aliases with standard forms. For example, "my-sql" is replaced with "mysql", "postgresql" is replaced with "postgres", and so on. Tokenization is performed to decompose the standardized string into a list of words so that each word can be processed separately. Stop words are filtered to remove stop words (such as articles, conjunctions, etc.) and other irrelevant words. Stemming technology is used to restore words to their basic form to reduce formal differences. The preprocessed word list is reassembled into a string as the final preprocessing result.

[0067] This application replaces the project names in the open source component information with aliases to ensure that each project name is in a unique and easily recognizable standard form, avoiding information confusion caused by different aliases and improving the accuracy of information retrieval and matching. At the same time, after deleting space characters and unifying letter case, the unified format of attribute strings makes string matching more efficient because there is no need to consider the interference caused by spaces and case differences. By preprocessing project names and attribute strings, the accuracy and consistency of information are improved, matching efficiency is improved, and data redundancy is reduced.

[0068] In one embodiment of the present disclosure, Figure 5 As shown, the open source component security detection method provided in the embodiment of the present disclosure can determine the second graph through the following steps, and can associate data with each other in the form of nodes and edges in the graph structure, so as to provide support for vulnerability detection and identification of dependency relationships:

[0069] S502, initializing an empty second graph structure;

[0070] S504, for each general platform enumeration entry, create a new node in the second graph structure;

[0071] S506: Set a general platform enumeration attribute for each node to construct a second graph.

[0072] In a specific example, a general platform enumeration entry graph G2 is constructed, each general platform enumeration entry is represented as a node in the graph, and related attributes are added. An empty graph structure is initialized, all general platform enumeration entries are traversed, each general platform enumeration entry is added to the graph as a node, and attributes are set for each node, including the name of the general platform enumeration entry, which will be used for comparison in the subsequent matching process.

[0073] This application uses a graph structure to store and manage general platform enumeration information, which can mine and analyze dependency relationships, allowing users to quickly query vulnerability information during retrieval.

[0074] In one embodiment of the present disclosure, Figure 6 As shown, in the open source component security detection method provided in the embodiment of the present disclosure, the first graph and the second graph are processed according to the graph matching algorithm, and determining the subgraph isomorphic mapping includes the following steps:

[0075] S602, pre-processing the first image and the second image.

[0076] It should be noted that the above preprocessing may include standardizing data, optimizing graph structure, reducing unnecessary calculations, and improving the accuracy of subsequent matching. At the same time, preprocessing can also ensure that the data format and representation of the two graphs are consistent before matching, thereby reducing matching errors caused by data differences.

[0077] S604, traversing from the first node of the first graph, and matching each node of the first graph with a node in the second graph.

[0078] It should be noted that traversing from the first node of the first graph ensures that each node has a chance to match with a node in the second graph, thereby improving the comprehensiveness of the matching.

[0079] S606, calculating node similarity according to the node name and the distance, and determining that the node mapping successfully matched from the first graph to the second graph is a subgraph isomorphic mapping.

[0080] This application provides support for open source component security detection by determining subgraph isomorphic mapping and analyzing the similarities and differences between the first graph and the second graph.

[0081] In a specific example, when performing graph matching, a node matching rule (Node_match) is defined to define how to determine whether two nodes match.

[0082] An exact match is attempted first, that is, checking whether the preprocessed dependency name is exactly the same as the name of the platform enumeration entry.

[0083] If the exact match fails, a fuzzy match is performed to calculate the edit distance Edit_distance between the two strings (str1 and str2), and the similarity Similarity is calculated using the following formula:

[0084] Similarity=(len(str1)+len(str2)-Edit_distance) / (len(str1)+len(str2));

[0085] Among them, the len() function is used to obtain the length of the string (that is, the number of characters in the string).

[0086] In one example, a threshold of 0.8 is set, and if the similarity is greater than or equal to the threshold, the match is considered successful.

[0087] This application combines exact matching and fuzzy matching by combining matching rule functions. This combination method not only considers surface consistency, but also potential semantic consistency, thereby improving the comprehensiveness and accuracy of matching and improving the interpretability and comparability of component security detection.

[0088] In one embodiment of the present disclosure, Figure 7 As shown, in the open source component security detection method provided in the embodiment of the present disclosure, matching is performed in the vulnerability database according to the target platform enumeration entries in the subgraph isomorphic mapping to determine the vulnerability information of the open source component, including the following steps:

[0089] S702, extracting, according to the subgraph isomorphism mapping, the platform enumeration entry of the second graph node corresponding to the first graph node in the mapping as the target platform enumeration entry;

[0090] S704, matching the target platform enumeration entry with the data in the vulnerability database, and for each matched target platform enumeration entry, extracting relevant vulnerability information from the vulnerability database to determine it as vulnerability information of the open source component.

[0091] In a specific example, graph matching is performed and all matches are found. The graph matching algorithm is used to find the matching relationship between the dependency graph and the platform enumeration entry graph. The VF2 algorithm is used for subgraph isomorphism detection. The rule uses the matching rule (Node_match) in the previous step, inputs the G1 and G2 graph parameters, and returns all found subgraph isomorphism mappings. Each mapping is a dictionary that represents the node mapping from G1 to G2. The platform enumeration entries corresponding to all found subgraph isomorphism mappings are returned. The platform enumeration entry matching is combined with the NVD database matching to return vulnerability information.

[0092] This application can accurately map the nodes in the first graph to the corresponding nodes in the second graph through subgraph isomorphic mapping, thereby extracting the platform enumeration entry corresponding to the target node. This attribute matching method avoids matching errors caused by inconsistent information such as name and version, and improves the accuracy of vulnerability information. In addition, the extracted vulnerability information can be used to conduct risk assessment on open source components, allowing users to take timely measures to reduce security risks.

[0093] Based on the same inventive concept, the embodiments of the present disclosure also provide an open source component security detection device, as described in the following embodiments. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0094] Figure 8 A schematic diagram of an open source component security detection device in an embodiment of the present disclosure is shown. Figure 8 As shown, the device includes: an information acquisition module 81, a first graph construction module 82, a second graph construction module 83, a graph matching module 84 and a vulnerability information determination module 85.

[0095] The information acquisition module 81 is used to acquire open source component information and general platform enumeration item information.

[0096] The first graph building module 82 is used to build a first graph according to the open source component information.

[0097] The second graph construction module 83 is used to construct a second graph according to the general platform enumeration entry information.

[0098] The graph matching module 84 is used to process the first graph and the second graph according to a graph matching algorithm to determine a subgraph isomorphic mapping.

[0099] The vulnerability information determination module 85 is used to match the target platform enumeration entries in the subgraph isomorphic mapping in the vulnerability database to determine the vulnerability information of the open source component.

[0100] In one example of the present disclosure, the first graph construction module 82 is also used to initialize an empty first graph structure; pre-process the project name and attribute string in the open source component information to determine the target project name and target attribute string; use the target project name as a node of the first graph and add the target attribute string as an attribute to construct the first graph.

[0101] In one example of the present disclosure, the first construction graph module 82 is also used to replace the alias in the project name in the open source component information with a standard form to determine the target project name; delete all space characters in the attribute string and convert all letters to lowercase to determine the target attribute string.

[0102] In an example of the present disclosure, the second graph construction module 83 is further used to initialize an empty second graph structure; for each general platform enumeration entry, create a new node in the second graph structure; set the general platform enumeration attribute for each node to construct the second graph.

[0103] In one example of the present disclosure, the graph matching module 84 is also used to pre-process the first graph and the second graph; traverse from the first node of the first graph, and match each node of the first graph with a node in the second graph; calculate the node similarity based on the node name and distance, and determine that the node mapping that successfully matches from the first graph to the second graph is a subgraph isomorphic mapping.

[0104] In one example of the present disclosure, the vulnerability information determination module 85 is also used to extract, based on the subgraph isomorphic mapping, the platform enumeration entry of the second graph node corresponding to the first graph node in the mapping as the target platform enumeration entry; match the target platform enumeration entry with the data in the vulnerability database, and for each matching target platform enumeration entry, extract relevant vulnerability information from the vulnerability database and determine it as the vulnerability information of the open source component.

[0105] It should be noted that the above information acquisition module 81, the first graph construction module 82, the second graph construction module 83, the graph matching module 84 and the vulnerability information determination module 85 correspond to S202 to S210 in the method embodiment, and the examples and application scenarios implemented by the above modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above method embodiment. It should be noted that the above modules as part of the device can be executed in a computer system such as a set of computer executable instructions.

[0106] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0107] Refer to the following Fig. 9 The electronic device 900 according to this embodiment of the present disclosure is described. Fig. 9 The electronic device 900 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0108] like Fig. 9 As shown, the electronic device 900 is in the form of a general computing device. The components of the electronic device 900 may include but are not limited to: at least one processing unit 910, at least one storage unit 920, and a bus 930 connecting different system components (including the storage unit 920 and the processing unit 910).

[0109] The storage unit stores program codes, which can be executed by the processing unit 910, so that the processing unit 910 executes the steps described in the above “exemplary method” section of this specification according to various exemplary embodiments of the present disclosure.

[0110] For example, the processing unit 910 can execute the following steps of the above-mentioned method embodiment: obtain open source component information and general platform enumeration entry information; construct a first graph according to the open source component information; construct a second graph according to the general platform enumeration entry information; process the first graph and the second graph according to the graph matching algorithm to determine the subgraph isomorphic mapping; match the target platform enumeration entries in the subgraph isomorphic mapping in the vulnerability database to determine the vulnerability information of the open source component.

[0111] For example, the processing unit 910 can execute the following steps of the above method embodiment: initialize an empty first graph structure; pre-process the project name and attribute string in the open source component information to determine the target project name and target attribute string; use the target project name as a node of the first graph and add the target attribute string as an attribute to construct the first graph.

[0112] For example, the processing unit 910 can execute the following steps of the above method embodiment: replace the alias in the project name in the open source component information with the standard form to determine the target project name; delete all space characters in the attribute string and convert all letters to lowercase to determine the target attribute string.

[0113] For example, the processing unit 910 may execute the following steps of the above method embodiment: initialize an empty second graph structure; create a new node in the second graph structure for each general platform enumeration entry; set the general platform enumeration attribute for each node to construct the second graph.

[0114] For example, the processing unit 910 can execute the following steps of the above-mentioned method embodiment: preprocessing the first graph and the second graph; traversing from the first node of the first graph, and matching each node of the first graph with a node in the second graph; calculating the node similarity based on the node name and distance, and determining that the node mapping that successfully matches from the first graph to the second graph is a subgraph isomorphic mapping.

[0115] For example, the processing unit 910 can execute the following steps of the above-mentioned method embodiment: according to the subgraph isomorphism mapping, extract the platform enumeration entry of the second graph node corresponding to the first graph node in the mapping as the target platform enumeration entry; match the target platform enumeration entry with the data in the vulnerability database, and for each matching target platform enumeration entry, extract relevant vulnerability information from the vulnerability database and determine it as the vulnerability information of the open source component.

[0116] The storage unit 920 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 9201 and / or a cache storage unit 9202 , and may further include a read-only storage unit (ROM) 9203 .

[0117] The storage unit 920 may also include a program / utility 9204 having a set (at least one) of program modules 9205, such program modules 9205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0118] Bus 930 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0119] The electronic device 900 may also communicate with one or more external devices 940 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 900, and / or may communicate with any device that enables the electronic device 900 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 950. Furthermore, the electronic device 900 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 960. As shown, the network adapter 960 communicates with other modules of the electronic device 900 via a bus 930. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 900, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0120] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0121] In particular, according to an embodiment of the present disclosure, the process described in the above reference flowchart may be implemented as a computer program product, which includes: a computer program, which implements the above open source component security detection method when executed by a processor.

[0122] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. A program product capable of implementing the above method of the present disclosure is stored thereon. In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to cause the terminal device to execute the steps according to various exemplary implementations of the present disclosure described in the above “Exemplary Method” section of this specification.

[0123] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0124] In the present disclosure, a computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0125] Alternatively, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0126] In a specific implementation, the program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0127] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0128] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0129] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0130] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A method for detecting the security of an open source component, characterized in that: include: Get open source component information and general platform enumeration entry information; Constructing a first graph according to the open source component information; Constructing a second graph according to the general platform enumeration entry information; Processing the first graph and the second graph according to a graph matching algorithm to determine a subgraph isomorphic mapping; Vulnerability information of the open source component is determined by matching target platform enumeration entries in the subgraph isomorphic mapping in a vulnerability database.

2. The open source component security detection method according to claim 1, characterized in that: The constructing a first graph according to the open source component information includes: Initialize an empty first graph structure; Preprocessing the project name and attribute string in the open source component information to determine the target project name and target attribute string; The target project name is used as a node of a first graph and the target attribute string is added as an attribute to construct the first graph.

3. The open source component security detection method according to claim 2, characterized in that: The preprocessing of the project name and the attribute string in the open source component information to determine the target project name and the target attribute string includes: Replace the alias in the project name in the open source component information with a standard form to determine the target project name; All space characters in the attribute string are deleted, and all letters are converted to lowercase to determine the target attribute string.

4. The open source component security detection method according to claim 1, characterized in that: The constructing the second graph according to the general platform enumeration entry information comprises: Initialize an empty second graph structure; For each general platform enumeration entry, a new node is created in the second graph structure; The general platform enumeration attribute is set for each node to construct the second graph.

5. The open source component security detection method according to any one of claims 1 to 3, characterized in that: The processing of the first graph and the second graph according to the graph matching algorithm to determine the subgraph isomorphic mapping includes: Preprocessing the first image and the second image; Traverse from the first node of the first graph, and match each node of the first graph with a node in the second graph; Node similarity is calculated according to the node name and the distance, and a node mapping successfully matched from the first graph to the second graph is determined to be a subgraph isomorphic mapping.

6. The open source component security detection method according to claim 1, characterized in that: The step of matching the target platform enumeration entries in the subgraph isomorphic mapping in a vulnerability database to determine the vulnerability information of the open source component includes: Extracting, according to the subgraph isomorphism mapping, a platform enumeration entry of the second graph node corresponding to the first graph node in the mapping as the target platform enumeration entry; The target platform enumeration entry is matched with data in a vulnerability database, and for each matched target platform enumeration entry, relevant vulnerability information is extracted from the vulnerability database and determined as vulnerability information of the open source component.

7. An open source component security detection device, characterized in that: include: Information acquisition module, used to obtain open source component information and general platform enumeration item information; A first graph construction module, configured to construct a first graph according to the open source component information; A second graph construction module, configured to construct a second graph according to the general platform enumeration entry information; A graph matching module, used to process the first graph and the second graph according to a graph matching algorithm to determine a subgraph isomorphic mapping; A vulnerability information determination module is used to match the target platform enumeration entries in the subgraph isomorphic mapping in a vulnerability database to determine the vulnerability information of the open source component.

8. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the open source component security detection method described in any one of claims 1 to 6 by executing the executable instructions.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the open source component security detection method described in any one of claims 1 to 6 is implemented.

10. A computer program product comprising: A computer program or instruction, characterized in that when the computer program or instruction is executed by a processor, it implements the open source component security detection method described in any one of claims 1 to 6.

Images