Comprehensive detection method and device for software supply chain security

Abstract

The invention discloses a software supply chain security-oriented comprehensive detection method and device. The method comprises the following steps of: obtaining a to-be-implanted software set and a software supply chain; performing layer-by-layer analysis and implantation operation on the software supply chain to obtain an implanted software supply chain; and performing code comprehensive judgment processing on the implanted software supply chain and the software supply chain to obtain a comprehensive detection result value of the security of the software supply chain. According to the invention, the efficiency, accuracy and comprehensiveness of software supply chain security detection are improved.

Description

Technical Field

[0001] The present invention relates to the fields of software security and industrial Internet of Things, and in particular to a comprehensive detection method and device for software supply chain security. Background Art

[0002] With the increasing complexity and scale of software supply chains and the rapid development of Internet technology, software supply chain security has become an indispensable infrastructure in the Industrial Internet of Things. The issue of software supply chain security is becoming increasingly prominent. How to ensure software supply chain security has become a hot topic in current research. Therefore, the detection and evaluation of software supply chain security is an issue that needs to be urgently addressed.

[0003] There are already some supply chain security testing solutions on the market for industrial software supply chain security testing, but there are still the following limitations and testing defects:

[0004] 1. Current software supply chain security testing requires the help of a large number of security engineers and multiple security tools. The testing process is complex, time-consuming and labor-intensive.

[0005] 2. Currently, there is a common situation in security testing where the false positive rate of source code detection tools is high. This is mainly due to reasons such as untimely updates of the policy library or incompatibility or mismatch of the source code language, which leads to high false positive and missed negative rates of the source code.

[0006] 3. Current security testing is mainly conducted at one level of the software supply chain, and code implantation tools are also mainly targeted at one layer, lacking overall implantation and comprehensive evaluation of the entire software supply chain.

[0007] Therefore, how to improve the efficiency, accuracy and comprehensiveness of software supply chain security testing has become an urgent problem to be solved. Summary of the invention

[0008] The present invention mainly solves the problem of how to improve the efficiency, accuracy and comprehensiveness of software supply chain security detection, and discloses a comprehensive detection method and device for software supply chain security.

[0009] In a first aspect, an embodiment of the present invention discloses a comprehensive detection method for software supply chain security, including:

[0010] S1, obtain the software set to be implanted and the software supply chain;

[0011] S2, performing layer-by-layer analysis and implantation operations on the software supply chain to obtain a software supply chain after implantation;

[0012] S3, performing comprehensive code identification processing on the post-implantation software supply chain and the software supply chain to obtain a comprehensive detection result value of the software supply chain security.

[0013] The software supply chain includes a source code layer, a software layer, a database layer, a configuration file layer and a compiler layer;

[0014] The software set to be implanted includes a source code implantation sub-set, a software implantation sub-set, a database implantation sub-set, a configuration file implantation sub-set and a compiler implantation sub-set;

[0015] The implant subset includes implant software corresponding to all software types at each software supply chain level.

[0016] The step of analyzing the software supply chain layer by layer and implanting the software supply chain to obtain the software supply chain after implantation includes:

[0017] S21, obtaining software type information at each software supply chain level;

[0018] S22, based on all implant subsets and according to the software type information, determining the implant software corresponding to each software supply chain level;

[0019] S23, implanting corresponding implantation software into each software supply chain level.

[0020] The comprehensive code identification processing of the post-implantation software supply chain and the software supply chain to obtain a comprehensive detection result value of software supply chain security includes:

[0021] S31, using a first code identification processing model, performing calculation processing on the source code layer and the software layer to obtain a first detection result value;

[0022] S32, using a second code discrimination processing model, performing calculation processing on the database layer and the configuration file layer to obtain a second detection result value;

[0023] S33, using a third code discrimination processing model, performing calculation processing on the compiler layer to obtain a third detection result value;

[0024] S34, performing weighted sum processing on the first test result value, the second test result value and the third test result value to obtain a comprehensive test result value of software supply chain security.

[0025] The using of the first code discrimination processing model to perform calculation processing on the source code layer and the software layer to obtain a first detection result value includes:

[0026] S311, performing text vector conversion processing on the source code layer and the source code layer after implantation, respectively, to obtain a source code vector and a source code vector after implantation;

[0027] S312, performing text vector conversion processing on the software layer and the post-implantation software layer respectively to obtain a software vector and a post-implantation software vector respectively;

[0028] S313, performing subtraction processing on the source code vector and the implanted source code vector to obtain a first difference sequence;

[0029] S314, performing subtraction processing on the software vector and the implanted software vector to obtain a second difference sequence;

[0030] S315, performing high-order cumulative amount calculation processing on the first difference sequence and the second difference sequence to obtain a high-order cumulative amount sequence;

[0031] S316, performing detection calculation processing on the high-order cumulant sequence to obtain a first detection result value.

[0032] The high-order cumulative amount calculation process includes:

[0033]

[0034] Wherein, x(n) is the nth item of the first difference sequence, y(n) is the nth item of the second difference sequence, RX4, RX6, RX9 are the fourth-order cumulants, sixth-order cumulants and ninth-order cumulants of the first difference sequence respectively, RY3, RY5, RY6 are the third-order cumulants, fifth-order cumulants and sixth-order cumulants of the second difference sequence respectively, RXY 34 RXY 56 RXY 78 They are the third and fourth order joint cumulants, the fifth and sixth order joint cumulants, and the seventh and eighth order joint cumulants, respectively. FFT represents fast Fourier transform processing, and N is the length of the first difference sequence;

[0035] The detection calculation process includes:

[0036]

[0037] Wherein, H1 represents the first detection result value.

[0038] The using of the second code discrimination processing model to perform calculation processing on the database layer and the configuration file layer to obtain a second detection result value includes:

[0039] S321, performing text vector conversion processing on the post-implantation database and the post-implantation configuration file, respectively, to obtain a corresponding post-implantation database vector set and a post-implantation configuration file vector set; the post-implantation database vector set includes a plurality of post-implantation database vectors; the post-implantation configuration file vector set includes a plurality of post-implantation configuration file vectors;

[0040] The post-implantation database vector set and the post-implantation configuration file vector set are represented as a database matrix and a configuration file matrix respectively; a row vector of the database matrix is ​​a post-implantation database vector; a row vector of the configuration file matrix is ​​a post-implantation configuration file vector;

[0041] S322, performing geometric mean vector calculation processing on the database matrix and the configuration file matrix respectively to obtain a data geometric vector and a configuration geometric vector;

[0042] S323, performing logarithmic sum processing on the data geometric vector and the configuration geometric vector to obtain a second detection result value.

[0043] According to a second aspect of the present invention, a comprehensive detection device for software supply chain security is disclosed, the device comprising:

[0044] A memory storing executable program code;

[0045] a processor coupled to the memory;

[0046] The processor calls the executable program code stored in the memory to execute the comprehensive detection method for software supply chain security.

[0047] According to a third aspect of the present invention, a computer-storable medium is disclosed, wherein the computer-storable medium stores computer instructions, and when the computer instructions are called by a computer, they are used to execute the comprehensive detection method for software supply chain security.

[0048] According to a fourth aspect of the present invention, an information data processing terminal is disclosed. The information data processing terminal is used to implement the comprehensive detection method for software supply chain security.

[0049] The beneficial effects of the present invention are:

[0050] The present invention discloses a comprehensive detection method and device for software supply chain security, which mainly solves the problem of how to improve the efficiency, accuracy and comprehensiveness of software supply chain security detection.

[0051] When the present invention performs comprehensive detection on the security of the software supply chain, it first simulates an attack on the software supply chain, implants corresponding codes at each level, performs comprehensive code identification processing on the implanted software supply chain and the software supply chain, and obtains a comprehensive detection result value of the software supply chain security, thereby ensuring the accuracy and comprehensiveness of the detection result.

[0052] The present invention performs comprehensive code discrimination processing, and constructs different code discrimination processing models for different levels and software types. The first code discrimination processing model is used to calculate the source code layer and the software layer to obtain a first detection result value; the second code discrimination processing model is used to calculate the database layer and the configuration file layer to obtain a second detection result value; the third code discrimination processing model is used to calculate the compiler layer to obtain a third detection result value; the first detection result value, the second detection result value and the third detection result value are weighted and summed to obtain a comprehensive detection result value of software supply chain security. Through the above operations, the accuracy and comprehensiveness of the code discrimination processing are ensured, and a rapid and accurate assessment of software supply chain security is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 1 is a flow chart for implementing the method of the present invention;

[0054] Figure 2 Schematic diagram of the composition of the software supply chain attack system. DETAILED DESCRIPTION

[0055] In order to better understand the content of the present invention, an embodiment is given here.

[0056] Figure 1 It is a flow chart for implementing the method of the present invention. Figure 2 Schematic diagram of the composition of the software supply chain attack system.

[0057] In a first aspect of an embodiment of the present invention, a comprehensive detection method and device for software supply chain security are disclosed, including:

[0058] S1, obtain the software set to be implanted and the software supply chain;

[0059] S2, performing layer-by-layer analysis and implantation operations on the software supply chain to obtain a software supply chain after implantation;

[0060] S3, performing comprehensive code identification processing on the post-implantation software supply chain and the software supply chain to obtain a comprehensive detection result value of software supply chain security;

[0061] The software supply chain includes a source code layer, a software layer, a database layer, a configuration file layer and a compiler layer.

[0062] The software set to be implanted includes a source code implantation sub-set, a software implantation sub-set, a database implantation sub-set, a configuration file implantation sub-set and a compiler implantation sub-set.

[0063] The implant subset includes implant software corresponding to all software types at each software supply chain level;

[0064] The step of analyzing the software supply chain layer by layer and implanting the software supply chain to obtain the software supply chain after implantation includes:

[0065] S21, obtaining software type information at each software supply chain level;

[0066] S22, based on the implant subset and according to the software type information, determining the implant software corresponding to each software supply chain level;

[0067] S23, implanting corresponding implant software into each software supply chain level.

[0068] The comprehensive code identification processing of the post-implantation software supply chain and the software supply chain to obtain a comprehensive detection result value of software supply chain security includes:

[0069] S31, using a first code identification processing model, performing calculation processing on the source code layer and the software layer to obtain a first detection result value;

[0070] S32, using a second code discrimination processing model, performing calculation processing on the database layer and the configuration file layer to obtain a second detection result value;

[0071] S33, using a third code discrimination processing model, performing calculation processing on the compiler layer to obtain a third detection result value;

[0072] S34, performing weighted sum processing on the first test result value, the second test result value and the third test result value to obtain a comprehensive test result value of software supply chain security.

[0073] The using of the first code discrimination processing model to perform calculation processing on the source code layer and the software layer to obtain a first detection result value includes:

[0074] Performing text vector conversion processing on the source code layer and the source code layer after implantation, respectively, to obtain a source code vector and a source code vector after implantation;

[0075] Performing text vector conversion processing on the software layer and the post-implantation software layer respectively to obtain a software vector and a post-implantation software vector respectively;

[0076] Subtracting the source code vector from the implanted source code vector to obtain a first difference sequence;

[0077] Subtracting the software vector from the implanted software vector to obtain a second difference sequence;

[0078] Performing high-order cumulant calculation processing on the first difference sequence and the second difference sequence to obtain a high-order cumulant sequence;

[0079] Perform detection calculation processing on the high-order cumulant sequence to obtain a first detection result value.

[0080] The text-to-vector conversion process is performed on the source code layer and the source code layer after implantation respectively, and the text-to-vector conversion process is performed on the code of each layer.

[0081] The text vector conversion process can be implemented by using the function command str2num or word2vec or a text-to-vector conversion model.

[0082] The high-order cumulative amount calculation process includes:

[0083]

[0084]

[0085] Wherein, x(n) is the nth item of the first difference sequence, y(n) is the nth item of the second difference sequence, RX4, RX6, RX9 are the fourth-order cumulants, sixth-order cumulants and ninth-order cumulants of the first difference sequence respectively, RY3, RY5, RY6 are the third-order cumulants, fifth-order cumulants and sixth-order cumulants of the second difference sequence respectively, RXY 34 RXY 56 RXY 78 They are the third and fourth order joint cumulants, the fifth and sixth order joint cumulants, and the seventh and eighth order joint cumulants, respectively. FFT represents fast Fourier transform processing, and N is the length of the first difference sequence;

[0086] The detection calculation process includes:

[0087]

[0088] Wherein, H1 represents the first detection result value.

[0089] The using of the second code discrimination processing model to perform calculation processing on the database layer and the configuration file layer to obtain a second detection result value includes:

[0090] S321, performing text vector conversion processing on the post-implantation database and the post-implantation configuration file, respectively, to obtain a corresponding post-implantation database vector set and a post-implantation configuration file vector set; the post-implantation database vector set includes a plurality of post-implantation database vectors; the post-implantation configuration file vector set includes a plurality of post-implantation configuration file vectors;

[0091] The post-implantation database vector set and the post-implantation configuration file vector set are represented as a database matrix and a configuration file matrix respectively; a row vector of the database matrix is ​​a post-implantation database vector; a row vector of the configuration file matrix is ​​a post-implantation configuration file vector;

[0092] S322, performing geometric mean vector calculation processing on the database matrix and the configuration file matrix respectively to obtain a data geometric vector and a configuration geometric vector;

[0093] S323, performing logarithmic sum processing on the data geometric vector and the configuration geometric vector to obtain a second detection result value.

[0094] The text-to-vector conversion processing is performed on the post-implantation database and the post-implantation configuration file, respectively. A data set in the post-implantation database is converted into a corresponding vector, and a configuration file is converted into a corresponding vector. The post-implantation configuration file includes a plurality of configuration files.

[0095] The expression for calculating the geometric mean vector is:

[0096]

[0097] Among them, p i is the i-th item of the data geometry vector or configuration geometry vector, a ij is the i-th row and j-th column element in the database matrix or the profile matrix, and n is the number of columns of the judgment matrix A;

[0098] The expression of the logarithmic summation process is:

[0099]

[0100] Where R is the second detection result value, M1 is the length of the data geometry vector, is the mean of the ith item in the data geometry vector and the ith item in the configuration geometry vector.

[0101] The using the third code discrimination processing model to perform calculation processing on the compiler layer to obtain a third detection result value includes:

[0102] Performing text vector conversion processing on the compiler layer and the compiler layer after implantation respectively to obtain a pre-implantation compiler vector and a post-implantation compiler vector;

[0103] Performing correlation calculation processing on the pre-implantation compiler vector and the post-implantation compiler vector to obtain a correlation vector;

[0104] Performing inverse normalization processing on the association vector to obtain a third detection result value;

[0105] The calculation expression of the association calculation is:

[0106]

[0107] Among them, A1 j is the jth element of the compiler vector before implantation, A2 j is the jth element of the compiler vector after implantation, p j is the jth element of the associated vector, and M2 is the length of the compiler vector before implantation.

[0108] The calculation expression of the reverse normalization process is:

[0109]

[0110] Among them, H3 is the third detection result value.

[0111] The weighted summation of the first test result value, the second test result value and the third test result value to obtain a comprehensive test result value for software supply chain security is performed by multiplying the first test result value, the second test result value and the third test result value by a weighted vector and then adding them up to obtain a comprehensive test result value for software supply chain security.

[0112] The weighted vector may be 0.5, 0.4, or 0.1.

[0113] In the present invention, when conducting comprehensive detection, the software supply chain must first be simulated and attacked. The software supply chain attack is a system that implants backdoors into the software. Its system architecture is as follows: Figure 2 As shown, five implantation forms can be realized, namely, source code implantation, software implantation, database implantation, configuration file implantation, and compiler implantation.

[0114] Source code implantation refers to the operator placing the acquired software source code into the software supply chain attack. The system's source code analysis module can automatically analyze the software, determine a series of information such as the language used for software development, the tools used for development, the tools used for code updates, the system platform on which the project is running, etc., and then implant the backdoor into the software according to the specified implantation strategy based on the acquired information. It supports platform automated deployment and automatically verifies whether the vulnerability has been successfully implanted.

[0115] Software implantation means that after the operator places the obtained software executable file into the software supply chain attack, the system's software decompilation module can decompile the software, determine the data structure and execution process of the executable file, and implant the backdoor in the appropriate data block.

[0116] Database implantation refers to inserting a "one-sentence" backdoor statement into the software database, adding new backdoor users, and modifying system security settings to allow it to be exploited by attackers.

[0117] Configuration file implantation tampers with configuration files that contain sensitive information such as account information, access address control information, etc., in order to achieve the purpose of the attack.

[0118] Compiler implantation refers to tampering with a general software compilation platform and adding malicious modules, so that a large number of developers can obtain the compilation platform and establish a development environment. The software compiled by the tampered software compilation platform will be implanted with a backdoor.

[0119] According to a second aspect of the present invention, a comprehensive detection device for software supply chain security is disclosed, the device comprising:

[0120] A memory storing executable program code;

[0121] a processor coupled to the memory;

[0122] The processor calls the executable program code stored in the memory to execute the comprehensive detection method for software supply chain security.

[0123] According to a third aspect of the present invention, a computer-storable medium is disclosed, wherein the computer-storable medium stores computer instructions, and when the computer instructions are called by a computer, they are used to execute the comprehensive detection method for software supply chain security.

[0124] According to a fourth aspect of the present invention, an information data processing terminal is disclosed. The information data processing terminal is used to implement the comprehensive detection method for software supply chain security.

[0125] The above description is only an embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A comprehensive detection method for software supply chain security, characterized in that: include: S1, obtain the software set to be implanted and the software supply chain; S2, performing layer-by-layer analysis and implantation operations on the software supply chain to obtain a software supply chain after implantation; S3, performing comprehensive code identification processing on the post-implantation software supply chain and the software supply chain to obtain a comprehensive detection result value of the software supply chain security.

2. The comprehensive detection method for software supply chain security according to claim 1, characterized in that: The software supply chain includes a source code layer, a software layer, a database layer, a configuration file layer and a compiler layer; The software set to be implanted includes a source code implantation sub-set, a software implantation sub-set, a database implantation sub-set, a configuration file implantation sub-set and a compiler implantation sub-set; The implant subset includes implant software corresponding to all software types at each software supply chain level.

3. The comprehensive detection method for software supply chain security as claimed in claim 2, characterized in that: The step of analyzing the software supply chain layer by layer and implanting the software supply chain to obtain the software supply chain after implantation includes: S21, obtaining software type information at each software supply chain level; S22, based on all implant subsets and according to the software type information, determining the implant software corresponding to each software supply chain level; S23, implanting corresponding implantation software into each software supply chain level.

4. The comprehensive detection method for software supply chain security as claimed in claim 2, characterized in that: The comprehensive code identification processing of the post-implantation software supply chain and the software supply chain to obtain a comprehensive detection result value of software supply chain security includes: S31, using a first code identification processing model, performing calculation processing on the source code layer and the software layer to obtain a first detection result value; S32, using a second code discrimination processing model, performing calculation processing on the database layer and the configuration file layer to obtain a second detection result value; S33, using a third code discrimination processing model, performing calculation processing on the compiler layer to obtain a third detection result value; S34, performing weighted sum processing on the first test result value, the second test result value and the third test result value to obtain a comprehensive test result value of software supply chain security.

5. The comprehensive detection method for software supply chain security as claimed in claim 4, characterized in that: The using of the first code discrimination processing model to perform calculation processing on the source code layer and the software layer to obtain a first detection result value includes: S311, performing text vector conversion processing on the source code layer and the source code layer after implantation, respectively, to obtain a source code vector and a source code vector after implantation; S312, performing text vector conversion processing on the software layer and the post-implantation software layer respectively to obtain a software vector and a post-implantation software vector respectively; S313, performing subtraction processing on the source code vector and the implanted source code vector to obtain a first difference sequence; S314, performing subtraction processing on the software vector and the implanted software vector to obtain a second difference sequence; S315, performing high-order cumulative amount calculation processing on the first difference sequence and the second difference sequence to obtain a high-order cumulative amount sequence; S316, performing detection calculation processing on the high-order cumulant sequence to obtain a first detection result value.

6. The comprehensive detection method for software supply chain security as claimed in claim 5, characterized in that: The high-order cumulative amount calculation process includes: Wherein, x(n) is the nth item of the first difference sequence, y(n) is the nth item of the second difference sequence, RX4, RX6, RX9 are the fourth-order cumulants, sixth-order cumulants and ninth-order cumulants of the first difference sequence respectively, RY3, RY5, RY6 are the third-order cumulants, fifth-order cumulants and sixth-order cumulants of the second difference sequence respectively, RXY 34 RXY 56 RXY 78 They are the third and fourth order joint cumulants, the fifth and sixth order joint cumulants, and the seventh and eighth order joint cumulants, respectively. FFT represents fast Fourier transform processing, and N is the length of the first difference sequence; The detection calculation process includes: Wherein, H1 represents the first detection result value.

7. The comprehensive detection method for software supply chain security as claimed in claim 6, characterized in that: The using of the second code discrimination processing model to perform calculation processing on the database layer and the configuration file layer to obtain a second detection result value includes: S321, performing text vector conversion processing on the post-implantation database and the post-implantation configuration file, respectively, to obtain a corresponding post-implantation database vector set and a post-implantation configuration file vector set; the post-implantation database vector set includes a plurality of post-implantation database vectors; the post-implantation configuration file vector set includes a plurality of post-implantation configuration file vectors; The post-implantation database vector set and the post-implantation configuration file vector set are represented as a database matrix and a configuration file matrix respectively; a row vector of the database matrix is ​​a post-implantation database vector; a row vector of the configuration file matrix is ​​a post-implantation configuration file vector; S322, performing geometric mean vector calculation processing on the database matrix and the configuration file matrix respectively to obtain a data geometric vector and a configuration geometric vector; S323, performing logarithmic sum processing on the data geometric vector and the configuration geometric vector to obtain a second detection result value.

8. A comprehensive detection device for software supply chain security, characterized in that: The device comprises: A memory storing executable program code; a processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the comprehensive detection method for software supply chain security as described in any one of claims 1 to 7.

9. A computer storable medium, characterized in that: The computer storable medium stores computer instructions, and when the computer instructions are called by a computer, they are used to execute the comprehensive detection method for software supply chain security as described in any one of claims 1 to 7.

10. An information data processing terminal, characterized in that: The information data processing terminal is used to implement the comprehensive detection method for software supply chain security as described in any one of claims 1 to 7.

Images