Open source component security detection method and device, electronic equipment and storage medium

Abstract

The present disclosure provides an open source component security detection method and device, electronic equipment and storage medium, relating to the technical field of computer security. The method comprises: obtaining open source component information and general platform enumeration item information; constructing a first graph according to the open source component information; constructing a second graph according to the general platform enumeration item information; processing the first graph and the second graph according to a graph matching algorithm to determine a subgraph isomorphism mapping; and matching the target platform enumeration item in the subgraph isomorphism mapping in a vulnerability database to determine vulnerability information of the open source component. The present application can accurately determine the vulnerability information with dependency relationship by constructing a graph in the manner of open source component information and general platform enumeration item information, and analyzing in combination with a graph matching algorithm, thereby solving the problem that it is difficult to identify the dependency relationship of the vulnerability in security monitoring.

Description

Technical Field

[0001] This disclosure relates to the field of computer security technology, and in particular to an open-source component security detection method, apparatus, electronic device, and storage medium. Background Technology

[0002] With the rapid development of internet technology, the application of open-source software in software development has become increasingly widespread, greatly improving the efficiency and quality of software development. However, this has also brought new challenges to internet security, particularly the security issues of the open-source software supply chain, which have become a significant threat to internet security. Malicious penetration attacks, as the biggest security threat currently facing the internet security field, are constantly escalating in terms of their types, spread speed, number of infections, and scope of impact. These attacks often exploit vulnerabilities in software to penetrate systems, thereby causing damage or stealing sensitive information. Due to the widespread use of open-source software in software development, security vulnerabilities in its supply chain have become important targets for malicious attackers.

[0003] In related technologies, automated scanning tools are used to periodically scan open-source components in a project and compare them with known vulnerability databases to identify components with security vulnerabilities. However, some vulnerabilities may involve dependencies between multiple components, and automated scanning tools may not be able to accurately identify these dependencies, leading to false positives and false negatives.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] This disclosure provides an open-source component security detection method, apparatus, electronic device, and storage medium, which at least to some extent overcomes the problem of difficulty in identifying dependencies when scanning open-source components to detect vulnerabilities due to limitations in related technologies.

[0006] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part by practice of this disclosure.

[0007] According to one aspect of this disclosure, a method for security detection of open-source components is provided, comprising: acquiring open-source component information and general platform enumeration entry information; constructing a first graph based on the open-source component information; constructing a second graph based on the general platform enumeration entry information; processing the first graph and the second graph according to a graph matching algorithm to determine a subgraph isomorphic mapping; and matching the target platform enumeration entries in the subgraph isomorphic mapping in a vulnerability database to determine the vulnerability information of the open-source component.

[0008] In some embodiments, constructing the first graph based on the open-source component information includes: initializing an empty first graph structure; preprocessing the project name and attribute string in the open-source component information to determine the target project name and target attribute string; using the target project name as a node in the first graph and adding the target attribute string as an attribute to construct the first graph.

[0009] In some embodiments, preprocessing the project name and attribute string in the open-source component information to determine the target project name and target attribute string includes: replacing the alias in the project name in the open-source component information with the standard form to determine the target project name; deleting all space characters and converting all letters in the attribute string to lowercase to determine the target attribute string.

[0010] In some embodiments, constructing the second graph based on the general platform enumeration entry information includes: initializing an empty second graph structure; creating a new node in the second graph structure for each general platform enumeration entry; setting general platform enumeration attributes for each node; and constructing the second graph.

[0011] In some embodiments, processing the first graph and the second graph according to the graph matching algorithm to determine the subgraph isomorphic mapping includes: preprocessing the first graph and the second graph; traversing from the first node of the first graph, matching each node of the first graph with a node in the second graph; calculating node similarity based on node name and distance, and determining the node mapping that is successfully matched from the first graph to the second graph as a subgraph isomorphic mapping.

[0012] In some embodiments, the step of matching the target platform enumeration entries in the subgraph isomorphic mapping with the vulnerability database to determine the vulnerability information of the open-source component includes: extracting the platform enumeration entries of the second graph node corresponding to the first graph node in the mapping as the target platform enumeration entries according to the subgraph isomorphic mapping; matching the target platform enumeration entries with the data in the vulnerability database; and for each matched target platform enumeration entry, extracting the relevant vulnerability information from the vulnerability database to determine the vulnerability information of the open-source component.

[0013] According to another aspect of this disclosure, an open-source component security detection device is also provided, comprising: an information acquisition module for acquiring open-source component information and general platform enumeration entry information; a first graph construction module for constructing a first graph based on the open-source component information; a second graph construction module for constructing a second graph based on the general platform enumeration entry information; a graph matching module for processing the first graph and the second graph according to a graph matching algorithm to determine a subgraph isomorphic mapping; and a vulnerability information determination module for matching the target platform enumeration entries in the subgraph isomorphic mapping in a vulnerability database to determine the vulnerability information of the open-source component.

[0014] According to another aspect of this disclosure, an electronic device is also provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the open-source component security detection method described in any one of the preceding claims by executing the executable instructions.

[0015] According to another aspect of this disclosure, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the open-source component security detection method described in any one of the preceding claims.

[0016] According to another aspect of this disclosure, a computer program product is also provided, including a computer program that, when executed by a processor, implements an open-source component security detection method for any of the above.

[0017] The open-source component security detection method provided in the embodiments of this disclosure obtains open-source component information and general platform enumeration entry information; constructs a first graph based on the open-source component information; constructs a second graph based on the general platform enumeration entry information; processes the first and second graphs using a graph matching algorithm to determine subgraph isomorphic mappings; and matches the target platform enumeration entries in the subgraph isomorphic mappings with a vulnerability database to determine the vulnerability information of the open-source component. This application, by constructing graphs from open-source component information and general platform enumeration entry information respectively, and combining this with graph matching algorithms for analysis, can accurately determine vulnerability information with dependency relationships, solving the problem of difficulty in identifying dependency relationships in security monitoring.

[0018] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0019] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0020] Figure 1 This diagram illustrates the structure of an open-source component security detection system according to an embodiment of the present disclosure.

[0021] Figure 2 This diagram illustrates a flowchart of an open-source component security detection method according to an embodiment of the present disclosure;

[0022] Figure 3 This diagram illustrates a specific example flowchart of an open-source component security detection method according to an embodiment of the present disclosure.

[0023] Figure 4 This diagram illustrates a flowchart of yet another specific example of a security detection method for open-source components according to embodiments of this disclosure.

[0024] Figure 5 This diagram illustrates a further specific example of a security detection method for open-source components according to an embodiment of the present disclosure.

[0025] Figure 6 This diagram illustrates another specific example of a security detection method for open-source components according to an embodiment of the present disclosure.

[0026] Figure 7 This diagram illustrates a flowchart of another specific example of an open-source component security detection method according to an embodiment of the present disclosure.

[0027] Figure 8 This diagram illustrates a security detection device for an open-source component according to an embodiment of the present disclosure.

[0028] Figure 9 A structural block diagram of a computer device according to an embodiment of the present disclosure is shown. Detailed Implementation

[0029] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0030] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0031] To facilitate understanding, before introducing the embodiments of this disclosure, the following explanations are provided for several terms involved in the embodiments of this disclosure:

[0032] Evidence: An object format that collects information about a package, such as its name, version, and manufacturer.

[0033] CPE: Common Platform Enumeration;

[0034] VF2: The basic idea of ​​the VF2 algorithm is to determine whether two graphs are isomorphic by recursively searching for node matching between them.

[0035] NVD: National Vulnerability Database.

[0036] The specific implementation methods of the embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0037] Figure 1 A schematic diagram of an exemplary application system architecture is shown, illustrating an application of the open-source component security detection method described in this disclosure. For example... Figure 1 As shown, the system architecture may include terminal device 101, network 102 and server 103.

[0038] Network 102 is a medium used to provide a communication link between terminal device 101 and server 103, and can be a wired network or a wireless network.

[0039] Optionally, the aforementioned wireless or wired networks use standard communication technologies and / or protocols. The network is typically the Internet, but can also be any network, including but not limited to Local Area Networks (LANs), Metropolitan Area Networks (MANs), Wide Area Networks (WANs), mobile, wired or wireless networks, private networks, or any combination of virtual private networks. In some embodiments, technologies and / or formats including Hyper Text Markup Language (HTML), Extensible Markup Language (XML), etc., are used to represent data exchanged over the network. Furthermore, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Networks (VPNs), and Internet Protocol Security (IPSec) can be used to encrypt all or some links. In other embodiments, custom and / or dedicated data communication technologies can be used to replace or supplement the aforementioned data communication technologies.

[0040] Terminal device 101 can be various electronic devices, including but not limited to smartphones, tablets, laptops, desktop computers, smart speakers, smartwatches, wearable devices, augmented reality devices, virtual reality devices, etc.

[0041] Optionally, the client of the application installed on different terminal devices 101 may be the same, or the client of the same type of application based on different operating systems. Depending on the terminal platform, the specific form of the application client may also be different; for example, the application client may be a mobile client, a PC client, etc.

[0042] In a specific example, the aforementioned terminal device is used to obtain open-source component information and general platform enumeration entry information; construct a first graph based on the open-source component information; construct a second graph based on the general platform enumeration entry information; process the first and second graphs according to the graph matching algorithm to determine the subgraph isomorphic mapping; and match the target platform enumeration entries in the subgraph isomorphic mapping in the vulnerability database to determine the vulnerability information of the open-source component.

[0043] Server 103 can be a server that provides various services, such as a backend management server that supports the device operated by the user using terminal device 101. The backend management server can analyze and process received requests and other data, and feed the processing results back to the terminal device.

[0044] Optionally, the server can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0045] Those skilled in the art will know that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative; any number of terminal devices, networks, and servers can be included depending on actual needs. This disclosure does not limit the scope of the embodiments.

[0046] Figure 2 This diagram illustrates a flowchart of an open-source component security detection method according to an embodiment of the present disclosure, such as... Figure 2 As shown, the open-source component security detection method provided in this embodiment includes the following steps:

[0047] S202, obtain information on open-source components and general platform enumeration entries.

[0048] It should be noted that the aforementioned open-source components can be software components, libraries, frameworks, and tools released under open-source licenses. Open-source components are software building blocks with publicly available source code, which can be freely accessed, viewed, used, modified, and distributed by users. For example, the information about these open-source components may include name information, version information, and vendor information. For instance, after a user uploads an application package, the detection engine scans the packages in the project using an analyzer, collecting package information such as name, version, and vendor; this information is called Evidence. The aforementioned General Platform Enumeration entries can be CPE entries, a standardized method for describing and identifying the categories of applications, operating systems, and hardware devices present in an enterprise's computing assets. General Platform Enumeration provides a standard, machine-readable format that allows for the unique encoding of information technology products and platforms.

[0049] S204, construct the first graph based on open-source component information.

[0050] It should be noted that the first graph mentioned above can be a dependency graph (G1). The first graph includes nodes and edges. Nodes represent components in the system (e.g., the names of open-source components are used as nodes), and edges represent the dependencies between components.

[0051] S206, construct the second graph based on the enumerated entry information of the general platform.

[0052] It should be noted that the second diagram above can be a graphical representation of the general platform enumeration entries (G2). For example, in the second diagram, each node should have a unique identifier, such as the general platform enumeration name.

[0053] S208, Process the first and second graphs according to the graph matching algorithm to determine the subgraph isomorphic mapping.

[0054] It should be noted that the graph matching algorithm described above can utilize the similarity information of graph structures to find matching relationships between nodes in different graph structures. The subgraph isomorphism mapping described above can characterize whether there is a relationship between two graphs such that the vertex set and edge set of one graph can be mapped to the vertex set and edge set of the other graph in a corresponding manner, while maintaining the original relationship between edges and vertices.

[0055] S210: Match the target platform enumeration entries in the subgraph isomorphic mapping with the vulnerability database to determine the vulnerability information of the open source component.

[0056] It should be noted that the aforementioned vulnerability database can be a database that stores information on known vulnerabilities. For example, a vulnerability database is used to store and manage known vulnerability information in software, hardware, network systems, etc. Users can use the vulnerability database to query known vulnerabilities that may exist in the system. When new vulnerabilities are discovered, the vulnerability database can update the information in a timely manner. The vulnerability database can also be used to provide vulnerability remediation suggestions or patches to help users quickly fix vulnerabilities in the system.

[0057] This application constructs graphs from open-source component information and general platform enumeration entries, and then analyzes them using graph matching algorithms. This approach can accurately identify vulnerability information with dependencies, thus solving the problem of difficulty in identifying dependencies in security monitoring.

[0058] In one embodiment of this disclosure, such as Figure 3 As shown, the open-source component security detection method provided in this embodiment can determine the first graph through the following steps, which can associate data in the form of nodes and edges in the graph structure, providing support for vulnerability detection and identification of dependencies:

[0059] S302, initialize an empty first graph structure;

[0060] S304 preprocesses the project name and attribute string in the open-source component information to determine the target project name and target attribute string;

[0061] S306, construct the first graph by using the target project name as a node in the first graph and adding the target attribute string as an attribute.

[0062] In a specific example, the processed words are used to construct a dependency graph G1, where each dependency is represented as a node in the graph, and relevant attributes are added. An empty graph structure is initialized, all dependencies are traversed, and each dependency is added to the graph as a node. Attributes are set for each node, including the preprocessed string; these attributes will be used for comparison in subsequent matching processes.

[0063] In one embodiment of this disclosure, such as Figure 4 As shown, the open-source component security detection method provided in this embodiment preprocesses the project name and attribute string in the open-source component information to determine the target project name and target attribute string, including the following steps:

[0064] S402, replace the alias in the project name in the open source component information with the standard form to determine the target project name;

[0065] S404: Remove all whitespace characters and convert all letters to lowercase in the attribute string to determine the target attribute string.

[0066] In a specific example, all attribute strings in the Evidence are preprocessed, and dependency names are standardized for better matching. All whitespace is removed from the input string. All letters are converted to lowercase to avoid case-sensitivity mismatches. An alias mapping table is created, replacing common software name aliases with their standard forms. For example, "my-sql" is replaced with "mysql", and "postgresql" with "postgres". Tokenization is performed, breaking the standardized string down into a list of words for individual word processing. Stop words are filtered out, removing stop words (such as articles, conjunctions, etc.) and other irrelevant words. Stemming techniques are used to restore words to their basic forms, reducing formal differences. The preprocessed word list is then reassembled into a single string as the final preprocessed result.

[0067] This application ensures that each project name is unique and easily identifiable by replacing aliases in the open-source component information, avoiding information confusion caused by different aliases and improving the accuracy of information retrieval and matching. Simultaneously, by removing whitespace characters and standardizing letter case, the uniform format of the attribute strings makes string matching more efficient, as it eliminates the need to consider interference from spaces and case differences. Preprocessing of project names and attribute strings improves the accuracy and consistency of information, increases matching efficiency, and reduces data redundancy.

[0068] In one embodiment of this disclosure, such as Figure 5 As shown, the open-source component security detection method provided in this embodiment can determine the second graph through the following steps, which can associate data in the form of nodes and edges in the graph structure, providing support for vulnerability detection and identification of dependencies:

[0069] S502, initialize an empty second graph structure;

[0070] S504, for each general platform enumeration entry, a new node is created in the second graph structure;

[0071] S506 sets a general platform enumeration attribute for each node to construct the second graph.

[0072] In a specific example, a general platform enumeration entry graph G2 is constructed, representing each general platform enumeration entry as a node in the graph and adding relevant attributes. An empty graph structure is initialized, and all general platform enumeration entries are traversed, adding each general platform enumeration entry as a node to the graph. Attributes are set for each node, including the name of the general platform enumeration entry; these attributes will be used for comparison in subsequent matching processes.

[0073] This application uses a graph structure to store and manage general platform enumeration information, which enables dependency mining and analysis, allowing users to quickly find vulnerability information during retrieval.

[0074] In one embodiment of this disclosure, such as Figure 6 As shown, the open-source component security detection method provided in this embodiment of the present disclosure processes the first and second graphs according to a graph matching algorithm to determine the subgraph isomorphic mapping, including the following steps:

[0075] S602, preprocess the first and second figures.

[0076] It should be noted that the above preprocessing can include standardizing data, optimizing graph structure, reducing unnecessary computation, and improving the accuracy of subsequent matching. At the same time, preprocessing can also ensure that the data format and representation of the two graphs are consistent before matching, reducing matching errors caused by data differences.

[0077] S604: Starting from the first node of the first graph, traverse the graph and match each node in the first graph with a node in the second graph.

[0078] It should be noted that traversing from the first node in the first graph ensures that each node has a chance to match with a node in the second graph, thereby improving the comprehensiveness of the matching.

[0079] S606: Calculate node similarity based on node name and distance, and determine the node mapping that successfully matches from the first graph to the second graph as a subgraph isomorphic mapping.

[0080] This application provides support for the security detection of open-source components by determining the isomorphic mapping of subgraphs and analyzing the similarities and differences between the first and second graphs.

[0081] In a specific instance, when performing graph matching, a node matching rule (Node_match) is defined to determine whether two nodes match.

[0082] First, attempt an exact match, that is, check whether the preprocessed dependency name is exactly the same as the name of the platform enumeration entry.

[0083] If an exact match fails, a fuzzy match is performed. The edit distance (Edit_distance) between the two strings (str1 and str2) is calculated, and the similarity is calculated using the following formula:

[0084] Similarity=(len(str1)+len(str2)-Edit_distance) / (len(str1)+len(str2));

[0085] The len() function is used to get the length of a string (i.e., the number of characters in the string).

[0086] In one instance, a threshold of 0.8 is set, and if the similarity is greater than or equal to this threshold, the match is considered successful.

[0087] This application combines exact matching and fuzzy matching by combining matching rule functions. This combination method considers not only surface consistency but also underlying semantic consistency, thereby improving the comprehensiveness and accuracy of matching and enhancing the interpretability and comparability of component security detection.

[0088] In one embodiment of this disclosure, such as Figure 7 As shown, the open-source component security detection method provided in this embodiment of the present disclosure involves matching the target platform enumeration entries in the subgraph isomorphic mapping with the vulnerability database to determine the vulnerability information of the open-source component, including the following steps:

[0089] S702, Based on the subgraph isomorphic mapping, extract the platform enumeration entries of the second graph nodes corresponding to the first graph nodes in the mapping as the target platform enumeration entries;

[0090] S704 matches the target platform enumeration entries with the data in the vulnerability database. For each matching target platform enumeration entry, it extracts relevant vulnerability information from the vulnerability database to identify the vulnerability information of the open-source component.

[0091] In a specific example, graph matching is performed to find all matches. A graph matching algorithm is used to find the matching relationships between the dependency graph and the platform enumeration entry graph. The VF2 algorithm is used for subgraph isomorphism detection, using the matching rules (Node_match) from the previous step. Inputting graph parameters G1 and G2, it returns all found subgraph isomorphic mappings. Each mapping is a dictionary representing the node mapping from G1 to G2. The platform enumeration entries corresponding to all found subgraph isomorphic mappings are returned. Platform enumeration entry matching, combined with NVD database matching, returns vulnerability information.

[0092] This application utilizes subgraph isomorphic mapping to accurately map nodes in the first graph to corresponding nodes in the second graph, thereby extracting platform enumeration entries corresponding to the target node. This attribute-based matching method avoids matching errors caused by inconsistencies in information such as name and version, improving the accuracy of vulnerability information. Furthermore, the extracted vulnerability information can be used to conduct risk assessments of open-source components, enabling users to take timely measures to mitigate security risks.

[0093] Based on the same inventive concept, this disclosure also provides an open-source component security detection device, as described in the following embodiments. Since the principle by which this device solves the problem is similar to that of the above-described method embodiments, the implementation of this device embodiment can refer to the implementation of the above-described method embodiments, and repeated details will not be elaborated further.

[0094] Figure 8 This diagram illustrates a security detection device for an open-source component according to an embodiment of the present disclosure. Figure 8 As shown, the device includes: an information acquisition module 81, a first graph construction module 82, a second graph construction module 83, a graph matching module 84, and a vulnerability information determination module 85.

[0095] Among them, the information acquisition module 81 is used to acquire information about open source components and enumeration entries of general platforms.

[0096] The first graph construction module 82 is used to construct the first graph based on the open-source component information.

[0097] The second graph construction module 83 is used to construct the second graph based on the enumerated entry information of the general platform.

[0098] Graph matching module 84 is used to process the first graph and the second graph according to the graph matching algorithm to determine the subgraph isomorphic mapping.

[0099] The vulnerability information determination module 85 is used to match the target platform enumeration entries in the subgraph isomorphic mapping with the vulnerability database to determine the vulnerability information of the open source component.

[0100] In one example of this disclosure, the first graph construction module 82 is further configured to: initialize an empty first graph structure; preprocess the project name and attribute string in the open-source component information to determine the target project name and target attribute string; use the target project name as a node of the first graph and add the target attribute string as an attribute to construct the first graph.

[0101] In one instance of this disclosure, the first construction graph module 82 is further configured to: replace the alias in the project name in the open-source component information with the standard form to determine the target project name; and delete all whitespace characters and convert all letters to lowercase in the attribute string to determine the target attribute string.

[0102] In one instance of this disclosure, the second graph construction module 83 is further configured to: initialize an empty second graph structure; create a new node in the second graph structure for each general platform enumeration entry; set the general platform enumeration attribute for each node; and construct the second graph.

[0103] In one example of this disclosure, the graph matching module 84 is further configured to: preprocess the first graph and the second graph; traverse from the first node of the first graph, and match each node of the first graph with a node in the second graph; calculate the node similarity based on the node name and distance, and determine the node mapping that is successfully matched from the first graph to the second graph as a subgraph isomorphic mapping.

[0104] In one example of this disclosure, the vulnerability information determination module 85 is further configured to: extract platform enumeration entries of second graph nodes corresponding to first graph nodes in the subgraph isomorphic mapping as target platform enumeration entries; match the target platform enumeration entries with data in the vulnerability database; and for each matched target platform enumeration entry, extract relevant vulnerability information from the vulnerability database to determine it as vulnerability information of the open-source component.

[0105] It should be noted that the information acquisition module 81, the first graph construction module 82, the second graph construction module 83, the graph matching module 84, and the vulnerability information determination module 85 correspond to S202 to S210 in the method embodiment. The examples and application scenarios implemented by these modules and their corresponding steps are the same, but they are not limited to the content disclosed in the above method embodiment. It should also be noted that these modules, as part of the apparatus, can be executed in a computer system such as a set of computer-executable instructions.

[0106] Those skilled in the art will understand that various aspects of this disclosure can be implemented as a system, method, or program product. Therefore, various aspects of this disclosure can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "system."

[0107] The following reference Figure 9 To describe an electronic device 900 according to such an embodiment of the present disclosure. Figure 9 The electronic device 900 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0108] like Figure 9 As shown, the electronic device 900 is manifested in the form of a general-purpose computing device. The components of the electronic device 900 may include, but are not limited to: at least one processing unit 910, at least one storage unit 920, and a bus 930 connecting different system components (including the storage unit 920 and the processing unit 910).

[0109] The storage unit stores program code that can be executed by the processing unit 910, causing the processing unit 910 to perform the steps described in the "Exemplary Methods" section above according to various exemplary embodiments of this disclosure.

[0110] For example, the processing unit 910 can perform the following steps in the above method embodiment: obtaining open source component information and general platform enumeration entry information; constructing a first graph based on the open source component information; constructing a second graph based on the general platform enumeration entry information; processing the first graph and the second graph according to the graph matching algorithm to determine the subgraph isomorphic mapping; matching the target platform enumeration entries in the subgraph isomorphic mapping in the vulnerability database to determine the vulnerability information of the open source component.

[0111] For example, the processing unit 910 can perform the following steps in the above method embodiment: initialize an empty first graph structure; preprocess the project name and attribute string in the open source component information to determine the target project name and target attribute string; add the target project name as a node of the first graph and the target attribute string as an attribute to construct the first graph.

[0112] For example, the processing unit 910 can perform the following steps in the above method embodiment: replace the alias in the project name in the open source component information with the standard form to determine the target project name; delete all space characters and convert all letters to lowercase in the attribute string to determine the target attribute string.

[0113] For example, the processing unit 910 may execute the following steps of the above method embodiment: initialize an empty second graph structure; create a new node in the second graph structure for each general platform enumeration entry; set the general platform enumeration attribute for each node, and construct the second graph.

[0114] For example, the processing unit 910 may perform the following steps in the above method embodiment: preprocessing the first graph and the second graph; traversing from the first node of the first graph, matching each node of the first graph with a node in the second graph; calculating the node similarity based on the node name and distance, and determining the node mapping that successfully matches from the first graph to the second graph as a subgraph isomorphic mapping.

[0115] For example, the processing unit 910 can perform the following steps in the above method embodiment: extract the platform enumeration entries of the second graph nodes corresponding to the first graph nodes in the mapping as target platform enumeration entries according to the subgraph isomorphic mapping; match the target platform enumeration entries with the data in the vulnerability database; and for each matched target platform enumeration entry, extract the relevant vulnerability information from the vulnerability database to determine the vulnerability information of the open source component.

[0116] Storage unit 920 may include readable media in the form of volatile storage units, such as random access memory (RAM) 9201 and / or cache memory 9202, and may further include read-only memory (ROM) 9203.

[0117] Storage unit 920 may also include a program / utility 9204 having a set (at least one) program module 9205, such program module 9205 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0118] Bus 930 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0119] Electronic device 900 can also communicate with one or more external devices 940 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 900, and / or with any device that enables electronic device 900 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 950. Furthermore, electronic device 900 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 960. As shown, network adapter 960 communicates with other modules of electronic device 900 via bus 930. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 900, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0120] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0121] In particular, according to embodiments of this disclosure, the process described above with reference to the flowchart can be implemented as a computer program product, which includes a computer program that, when executed by a processor, implements the above-described open-source component security detection method.

[0122] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. A program product capable of implementing the methods described above is stored thereon. In some possible implementations, various aspects of this disclosure may also be implemented as a program product including program code, which, when run on a terminal device, causes the terminal device to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure.

[0123] More specific examples of computer-readable storage media in this disclosure may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0124] In this disclosure, a computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting a program for use by or in connection with an instruction execution system, apparatus, or device.

[0125] Optionally, the program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0126] In practical implementation, program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0127] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0128] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0129] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0130] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the appended claims.

Claims

1. A security detection method for open-source components, characterized in that, include: Retrieve information on open-source components and general platform enumeration entries; Based on the information of the open-source components, construct the first graph; Based on the enumerated entry information of the general platform, a second graph is constructed; The first and second graphs are processed using a graph matching algorithm to determine the subgraph isomorphic mapping; The vulnerability information of the open-source component is determined by matching the target platform enumeration entries in the subgraph isomorphic mapping with the vulnerability database. The step of processing the first graph and the second graph according to the graph matching algorithm to determine the subgraph isomorphic mapping includes: preprocessing the first graph and the second graph; traversing from the first node of the first graph, matching each node of the first graph with a node in the second graph; calculating the node similarity based on the node name and distance, and determining the node mapping that successfully matches from the first graph to the second graph as the subgraph isomorphic mapping; wherein the first graph is a dependency graph, including nodes and edges, where nodes represent components and edges represent the dependencies between components.

2. The open-source component security detection method according to claim 1, characterized in that, The step of constructing the first graph based on the open-source component information includes: Initialize an empty first graph structure; The project name and attribute string in the open source component information are preprocessed to determine the target project name and target attribute string; The first graph is constructed by using the target project name as a node in the first graph and adding the target attribute string as an attribute.

3. The open-source component security detection method according to claim 2, characterized in that, The step of preprocessing the project name and attribute string in the open-source component information to determine the target project name and target attribute string includes: Replace the aliases in the project names of the open-source component information with standard forms to determine the target project name; Remove all whitespace characters and convert all letters to lowercase in the attribute string to determine the target attribute string.

4. The open-source component security detection method according to claim 1, characterized in that, The step of constructing the second graph based on the enumerated entry information of the general platform includes: Initialize an empty second graph structure; For each general platform enumeration entry, a new node is created in the second graph structure; Set a common platform enumeration attribute for each node to construct the second graph.

5. The open-source component security detection method according to claim 1, characterized in that, The step of matching the target platform enumeration entries in the subgraph isomorphic mapping with the vulnerability database to determine the vulnerability information of the open-source component includes: Based on the subgraph isomorphic mapping, the platform enumeration entries of the second graph nodes corresponding to the first graph nodes in the mapping are extracted as the target platform enumeration entries; The target platform enumeration entries are matched with data in the vulnerability database. For each matched target platform enumeration entry, relevant vulnerability information is extracted from the vulnerability database and identified as vulnerability information of the open-source component.

6. An open-source component security detection device, characterized in that, include: The information acquisition module is used to acquire information about open-source components and enumeration entries for general platforms; The first graph construction module is used to construct a first graph based on the open-source component information; The second graph construction module is used to construct the second graph based on the enumerated entry information of the general platform. The graph matching module is used to process the first graph and the second graph according to the graph matching algorithm to determine the subgraph isomorphic mapping; The vulnerability information determination module is used to match the target platform enumeration entries in the subgraph isomorphic mapping with the vulnerability database to determine the vulnerability information of the open source component; The graph matching module is further configured to: preprocess the first graph and the second graph; traverse from the first node of the first graph, and match each node of the first graph with a node in the second graph; calculate node similarity based on node name and distance, and determine the node mapping from the first graph to the second graph that is successfully matched as a subgraph isomorphic mapping; wherein the first graph is a dependency graph, including nodes and edges, where nodes represent components and edges represent dependencies between components.

7. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the open-source component security detection method according to any one of claims 1 to 5 by executing the executable instructions.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the open-source component security detection method according to any one of claims 1 to 5.

9. A computer program product, comprising: A computer program or instruction, characterized in that, when executed by a processor, the computer program or instruction implements the open-source component security detection method according to any one of claims 1 to 5.

Images