Open source component vulnerability detection method, device and electronic device

Abstract

The present invention provides a method, device, and electronic device for detecting open source component vulnerabilities. The implementation scheme comprises: parsing the dependency configuration file and vulnerability detection file of the open source component to be detected to obtain multiple corresponding triples; constructing at least one relationship subgraph with the open source component as the central node and / or a relationship subgraph with the vulnerability as the central node for each triple based on the entity relationships provided by the multiple triples; fusing the at least one relationship subgraph corresponding to each triple to obtain a fused relationship subgraph for each triple; determining whether each triple is included in the graph based on the similarity between the fused relationship subgraph of each triple and the fused relationship subgraph of each reference triple in the open source component vulnerability knowledge graph; and if included, searching the graph for the dependency chain of the open source component in the first triple and / or the impact range of the vulnerability. Thus, the open source component dependency chain and / or the impact range of the vulnerability can be analyzed.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an open source component vulnerability detection method, device and electronic device. Background Art

[0002] Currently, open source component-based development models are widely adopted in software development. Developers utilize a large number of open source components using relevant tools, forming a software supply chain. The introduction of open source components inevitably introduces vulnerabilities into the dependency chains of open source components, projects, and even the entire software supply chain, leading to the spread of vulnerabilities. Therefore, a comprehensive analysis of the entire software supply chain ecosystem is necessary to effectively understand the dependency chains of open source components and the scope of vulnerability propagation.

[0003] However, existing technologies have the problem of a large number of open source components, complex dependencies of open source components, and the inability to effectively present the propagation characteristics of vulnerabilities in the open source component dependency chain, resulting in the inability to comprehensively analyze and accurately quantify the open source component dependency chain and the impact scope of vulnerabilities in the software supply chain. Summary of the Invention

[0004] The present invention provides an open source component vulnerability detection method, device and electronic device, which can solve at least one of the above technical problems.

[0005] According to one aspect of the present invention, a method for detecting open source component vulnerabilities is provided, comprising:

[0006] Parsing the open source component dependency configuration file and the open source component vulnerability detection file to be detected to obtain corresponding multiple triples, wherein the triples include a head entity, a tail entity, and an entity relationship between the head entity and the tail entity, the head entity includes the open source component or vulnerability, and the tail entity includes the open source component, vulnerability, or vulnerability information;

[0007] Based on the entity relationships provided by the multiple triples, construct at least one relationship subgraph for each of the triples, wherein the at least one relationship subgraph includes a relationship subgraph with an open source component as a central node and / or a relationship subgraph with a vulnerability as a central node;

[0008] Performing subgraph fusion on at least one relationship subgraph corresponding to each of the triples to obtain a fused relationship subgraph of each of the triples;

[0009] Determining whether each of the triples is included in the open source component vulnerability knowledge graph based on the similarity between the fusion relationship subgraph of each of the triples and the fusion relationship subgraph of each reference triple in the open source component vulnerability knowledge graph;

[0010] When it is determined that a first triple among the multiple triples is included in the open source component vulnerability knowledge graph, the dependency chain and / or impact scope of the vulnerability of the open source component in the first triple is searched in the open source component vulnerability knowledge graph.

[0011] According to another aspect of the present invention, there is provided an open source component vulnerability detection device, comprising:

[0012] a configuration file parsing module, configured to parse the open source component dependency configuration file and the open source component vulnerability detection file to be detected to obtain a corresponding plurality of triples, wherein the triples include a head entity, a tail entity, and an entity relationship between the head entity and the tail entity, the head entity including the open source component or vulnerability, and the tail entity including the open source component, vulnerability, or vulnerability information;

[0013] a relationship subgraph construction module, configured to construct at least one relationship subgraph for each triple based on the entity relationships provided by the multiple triples, wherein the at least one relationship subgraph includes a relationship subgraph with an open source component as a central node and / or a relationship subgraph with a vulnerability as a central node;

[0014] a subgraph fusion module, configured to perform subgraph fusion on at least one relationship subgraph corresponding to each of the triples to obtain a fused relationship subgraph of each of the triples;

[0015] an inclusion relationship judgment module for determining whether each triple is included in the open source component vulnerability knowledge graph based on the similarity between the fusion relationship subgraph of each triple and the fusion relationship subgraph of each reference triple in the open source component vulnerability knowledge graph;

[0016] A graph search module is used to, upon determining that a first triple among the multiple triples is included in the open source component vulnerability knowledge graph, search for the dependency chain and / or impact scope of the vulnerability of the open source component in the first triple in the open source component vulnerability knowledge graph.

[0017] Using the technical solution of the present invention, the open source component dependency configuration file and the open source component vulnerability detection file to be detected are parsed to obtain corresponding multiple triples, wherein the triples include a head entity, a tail entity, and an entity relationship between the head entity and the tail entity, the head entity includes an open source component or a vulnerability, and the tail entity includes an open source component, a vulnerability, or vulnerability information. Based on the entity relationships provided by the above multiple triples, at least one relationship subgraph with the open source component as the center node and / or a relationship subgraph with the vulnerability as the center node is constructed for each triple. Then, subgraph fusion is performed on the at least one relationship subgraph corresponding to each triple to obtain a fused relationship subgraph for each triple. In this way, a relationship subgraph describing the relationship between the open source component and the vulnerability in the open source component dependency configuration file and the open source component vulnerability detection file can be accurately obtained. In this way, using the fused relationship subgraph, it is possible to accurately determine whether the triple to be detected is included in the open source component vulnerability knowledge graph. If so, the open source component vulnerability knowledge graph can be used to find the dependency chain of the open source component in the triple and / or the impact range of the vulnerability.

[0018] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings are provided for a better understanding of the present invention and do not constitute a limitation of the present invention.

[0020] Figure 1 is a flow chart of a method for detecting open source component vulnerabilities according to an embodiment of the present invention;

[0021] Figure 2 This is a structural framework of an open source component vulnerability detection device according to an embodiment of the present invention;

[0022] Figure 3 is a block diagram of an electronic device for implementing the method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0023] The following description of exemplary embodiments of the present invention is made in conjunction with the accompanying drawings, and various details of the embodiments of the present invention are included to facilitate understanding. These details should be considered as merely exemplary. Therefore, it should be appreciated by those skilled in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope of the present invention. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0024] Figure 1 The figure is a flowchart of a method for detecting open source component vulnerabilities according to an embodiment of the present invention.

[0025] like Figure 1 As shown, the open source component vulnerability detection method may include:

[0026] S110: Parse the open source component dependency configuration file and the open source component vulnerability detection file to be detected to obtain corresponding triples, where the triples include a head entity, a tail entity, and an entity relationship between the head entity and the tail entity, the head entity includes the open source component or vulnerability, and the tail entity includes the open source component, vulnerability, or vulnerability information;

[0027] S120: construct at least one relationship subgraph for each triple based on the entity relationships provided by the multiple triples, wherein the at least one relationship subgraph includes a relationship subgraph with an open source component as a central node and / or a relationship subgraph with a vulnerability as a central node;

[0028] S130, performing subgraph fusion on at least one relationship subgraph corresponding to each triple to obtain a fused relationship subgraph of each triple;

[0029] S140, determining whether each triple is included in the open source component vulnerability knowledge graph based on the similarity between the fusion relationship subgraph of each triple and the fusion relationship subgraph of each reference triple in the open source component vulnerability knowledge graph;

[0030] S150: When it is determined that a first triple among the multiple triples is included in the open source component vulnerability knowledge graph, search the open source component vulnerability knowledge graph for a dependency chain and / or an impact range of the vulnerability of the first triple.

[0031] It can be understood that in the embodiment of the present invention, triples, triple relationship subgraphs and fused relationship subgraphs can all be expressed using corresponding embedded representations. In the above-mentioned subgraph fusion and similarity calculation, embedded representations are also used to calculate the corresponding results.

[0032] Exemplarily, the open source component vulnerability detection file may be an open source component vulnerability scanning report.

[0033] For example, the open source component leak knowledge graph can be constructed by pre-collecting data. The specific construction process can be as follows:

[0034] Collect basic information about various open source components and vulnerabilities, as well as their dependency configuration files, from open source project hosting platforms such as GitHub and GitLab, vulnerability databases (such as the NVD-National Vulnerability Database and CVE Details), and the Maven Central component repository. Basic information about open source components can include component name, version, and dependencies. Basic vulnerability information can include vulnerability name, type, description, and affected components. Dependency configuration files for open source components can include component index files and the component dependency storage file (pom).

[0035] For the collected data, remove duplicate, irregular and incomplete data.

[0036] Through the basic information of open source components and vulnerabilities collected above, as well as the dependency configuration files of open source components, we can determine the dependency relationship between open source components, the inclusion relationship between open source components and vulnerabilities, the inclusion relationship between vulnerabilities and vulnerability information, and the impact relationship between vulnerabilities and open source components. Using these entity relationships, we can construct multiple triples, thereby constructing a knowledge graph of open source component vulnerabilities.

[0037] For example, by parsing the dependency configuration file of the open source component, it can be found that if open source component 1 directly uses open source component 2, then open source component 2 is defined as the parent component of open source component 1, and the dependency relationship is direct dependency; if open source component 1 indirectly introduces open source component 2, then open source component 2 is defined as the indirect parent component of open source component 1, and the dependency relationship is indirect dependency.

[0038] For example, after parsing the collected data to obtain multiple reference triples, the same steps as above, S120 and S130, can be used to obtain a relationship subgraph for each entity node in the multiple reference triples. This relationship subgraph can then be used to construct an open source component vulnerability knowledge graph. This open source component vulnerability knowledge graph integrates open source component and vulnerability information, enabling in-depth analysis of the open source components and vulnerabilities in the data to be tested.

[0039] For example, the knowledge graph of open source component vulnerabilities can be defined as .in, Represents an entity set, including the basic information of the collected open source components, including the component name, component version, and the basic information of the open source component's vulnerability: vulnerability name, vulnerability type, vulnerability description, and other information. Represents a set of relationships, used to describe the relationships between open source component entities, the relationships between open source component entities and vulnerability entities, and the relationships between vulnerability entities and vulnerability information. These relationships can include direct dependencies, indirect dependencies, impacts, and inclusions. Represents a set of triples, which constructs a reference triplet by combining the relationship between open source components, vulnerabilities, and vulnerability information. ,in, Represents the head entity, Represented as the tail entity, Represents the header entity With tail entity The relationship between . The triples to be detected can also be constructed in the same way.

[0040] For example, the composition of the triplet may be as shown in Table 1 below:

[0041] Table 1: Example of triple composition

[0042]

[0043] It is understandable that for the open source component dependency configuration files and open source component vulnerability detection files to be detected, they can be parsed according to the structural requirements similar to those in Table 1 to obtain the various triples to be detected, and based on the entity relationships provided by the various triples to be detected, at least one relationship subgraph can be constructed for each triple. The at least one relationship subgraph is one relationship subgraph or two relationship subgraphs, for example, a relationship subgraph with the open source component as the central node and a relationship subgraph with the vulnerability as the central node.

[0044] For example, if the entities in a triple include open source component A and open source component B, the triple's relationship subgraph includes a relationship subgraph with open source component A as the center node and a relationship subgraph with open source component B as the center node. For another example, if the entities in a triple include open source component A and vulnerability C, the triple's relationship subgraph includes a relationship subgraph with open source component A as the center node and a relationship subgraph with vulnerability C as the center node. For another example, if the entities in a triple include vulnerability C and vulnerability information, the triple's relationship subgraph only includes a relationship subgraph with vulnerability C as the center node.

[0045] For example, for a central node's relationship subgraph, we can first determine multiple entities that have entity relationships with the central node, then use the entity relationships between the central node and each entity to construct an adjacent subgraph, and then perform attention aggregation on the adjacent subgraph to obtain the central node's relationship subgraph. The central node can be the aforementioned open source component or vulnerability, and the entity can be the open source component or vulnerability.

[0046] It can be understood that if a triple is constructed with two relational subgraphs, the embedding representations of these two relational subgraphs are fused to obtain the embedding representation of the fused relational subgraph of the triple. If a triple has only one relational subgraph, the embedding representation of the relational subgraph is used as the embedding representation of the fused relational subgraph of the triple.

[0047] For example, the open source component vulnerability knowledge graph includes multiple reference triples, whose structure is the same as the triples in this example. Each reference triple has a fused relationship subgraph. When constructing the fused relationship subgraph of the reference triples, the embedded representation of the fused relationship subgraph of the reference triples can be stored in the open source component vulnerability relationship subgraph feature library. This can be used to subsequently match the relationship subgraph of the triple to be tested to determine whether the triple to be tested is included in the open source component vulnerability knowledge graph.

[0048] Exemplarily, the embedded representation of the fusion relationship subgraph of the triple to be detected is matched with the embedded representation of the fusion relationship subgraph of each reference triple in the open source component vulnerability knowledge graph, for example, the Euclidean distance or cosine similarity between them is calculated, and their similarity can be obtained. If the similarity is greater than a preset similarity threshold, it is determined that the triple is included in the open source component vulnerability knowledge graph, and the graph can be used to analyze the dependency chain of the open source component and the impact range of the vulnerability for the triple. If the similarity is less than the preset threshold, it is determined that the triple is not included in the open source component vulnerability knowledge graph, and the triple can be considered to be invalid information, and it is impossible to analyze the dependency chain of the open source component and the impact range of the vulnerability for the triple.

[0049] For example, if the triples corresponding to the open source component dependency configuration file and the open source component vulnerability detection file to be detected are not included in the open source component vulnerability knowledge graph, it means that the open source component dependency configuration file and the open source component vulnerability detection file are invalid files.

[0050] For example, when the triple to be detected is identified as being included in the open source component vulnerability knowledge graph If the entity in the triple includes an open source component, a node analysis is performed on the knowledge graph to obtain the dependency chain of the open source component. If the entity in the triple includes a vulnerability, a node analysis is performed on the knowledge graph to calculate the impact range of the vulnerability.

[0051] According to the above implementation method, the open source component dependency configuration file and the open source component vulnerability detection file to be tested are parsed to obtain multiple triples to be tested, wherein the triples include a head entity, a tail entity, and an entity relationship between the head entity and the tail entity, the head entity including the open source component or vulnerability, and the tail entity including the open source component, vulnerability, or vulnerability information. Based on the entity relationships provided by the above multiple triples, at least one relationship subgraph with the open source component as the center node and / or a relationship subgraph with the vulnerability as the center node is constructed for each triple. Then, subgraph fusion is performed on the at least one relationship subgraph corresponding to each triple to obtain a fused relationship subgraph for each triple. In this way, a relationship subgraph describing the relationship between the open source component and the vulnerability in the open source component dependency configuration file and the open source component vulnerability detection file can be accurately obtained. In this way, using the fused relationship subgraph of the triple to be tested, it is possible to accurately determine whether the triple to be tested is included in the open source component vulnerability knowledge graph. If so, the open source component vulnerability knowledge graph can be used to find the dependency chain of the open source component in the triple and / or the impact range of the vulnerability, thereby achieving analysis of the dependency chain of the open source component and / or the impact range of the vulnerability.

[0052] In one embodiment, based on the entity relationships provided by multiple triples, at least one relationship subgraph is constructed for each triple, including: in a case where the triple includes a head entity whose entity type is vulnerability or open source component and a tail entity whose entity type is vulnerability or open source component, based on the entity relationships provided by multiple triples, a relationship subgraph with the head entity as the central node and a relationship subgraph with the tail entity as the central node are constructed for the triple; in a case where the triple includes a head entity whose entity type is vulnerability and a tail entity whose entity type is vulnerability information, based on the entity relationships provided by multiple triples, only a relationship subgraph with the head entity as the central node is constructed for the triple.

[0053] Exemplarily, if the head entity and the tail entity of a triple are both open source components, a relationship subgraph is constructed with the two open source components as a central node respectively, and the triple has two relationship subgraphs with the open source components as central nodes.

[0054] For example, if the head entity of a triple is an open source component and the tail entity is a vulnerability, then the triple has a relationship subgraph with the open source component as the center node and a relationship subgraph with the vulnerability as the center node. Alternatively, if the head entity of a triple is a vulnerability and the tail entity is an open source component, then the triple has a relationship subgraph with the open source component as the center node and a relationship subgraph with the vulnerability as the center node.

[0055] For example, if the head entity of a triple is a vulnerability and the tail entity is vulnerability information, then the triple has only one relationship subgraph with the open source component as the central node.

[0056] For example, when constructing a relationship subgraph of a central node, the entity relationships provided by multiple tuples to be detected can be used to determine the neighbor nodes of the central node among the entities involved in multiple triples, and the relationship subgraph of the central node can be constructed based on the entity relationships between the central node and these neighbor nodes.

[0057] According to the above implementation, for a triple, based on the entity types of the head entity and the tail entity of the triple, that is, whether they are open source components or vulnerabilities, it is determined whether to construct a relationship subgraph with the head entity as the central node and a relationship subgraph with the tail entity as the central node. In this way, each triple element can obtain at least one relationship subgraph with the open source component as the central node or a relationship subgraph with the vulnerability as the central node.

[0058] In one embodiment, a relationship subgraph with a head entity as a central node is constructed, including: based on the entity relationships provided by multiple triples, determining multiple one-hop neighbors that have entity relationships with the head entity among all entities involved in each triple; based on the entity relationship type between the head entity and each one-hop neighbor of the head entity, constructing an adjacency subgraph with the head entity as the central node under each entity relationship type; using a graph attention network, performing attention aggregation on the adjacency subgraph with the head entity as the central node under each entity relationship type, and obtaining a relationship subgraph with the head entity as the central node.

[0059] In one embodiment, a relationship subgraph with a tail entity as a central node is constructed, including: based on the entity relationships provided by multiple triples, determining multiple one-hop neighbors that have entity relationships with the tail entity among all entities involved in each triple; based on the entity relationship type between the tail entity and each one-hop neighbor of the tail entity, constructing an adjacency subgraph with the tail entity as the central node under each entity relationship type; using a graph attention network, performing attention aggregation on the adjacency subgraph with the tail entity as the central node under each entity relationship type, to obtain a relationship subgraph with the tail entity as the central node.

[0060] Exemplarily, a graph attention network is used to perform attention aggregation on the adjacent subgraphs under each entity relationship type to obtain a relationship subgraph of the central node. Specifically, the following may be included: for the adjacent subgraphs under each entity relationship type, based on the splicing results between the central node and each adjacent node in the adjacent subgraph under the entity relationship type, the correlation weight coefficient between the central node and each adjacent node is determined; using the correlation weight coefficient between the central node and each adjacent node, each adjacent node is aggregated to obtain the aggregated information of the adjacent subgraph under the entity relationship type; using a multi-head attention mechanism, attention calculation is performed on the aggregated information of the adjacent subgraph under the entity relationship type to obtain the attention score of the adjacent subgraph under the entity relationship type; and based on the attention score of the adjacent subgraph under each entity relationship type, the adjacent subgraph under each entity relationship type is aggregated to obtain the relationship subgraph of the central node. Wherein, the central node can be the head entity or the tail entity mentioned above.

[0061] Exemplarily, since the head entity may include two entity types, open source components and vulnerabilities, the relationship subgraph with the head entity as the central node may include a relationship subgraph with the open source component as the central node and a relationship subgraph with the vulnerability as the central node.

[0062] Exemplarily, since the tail entity may include two entity types, namely, open source components and vulnerabilities, the relationship subgraph with the tail entity as the central node may include a relationship subgraph with the open source component as the central node and a relationship subgraph with the vulnerability as the central node.

[0063] Specifically, the following describes the calculation process of embedding representations for the relationship subgraphs centered on open source components and the relationship subgraphs centered on vulnerabilities:

[0064] For example, given a triple The embedding representation of the triple can be obtained by TransE to obtain the initial embedding of the entity and relationship of the triple. Head entity The initial embedding of For the relationship The initial embedding of For the tail entity The initial embedding of is the embedding representation function. Then the initial embedding of entities and relations is projected into the same feature space to obtain the vector representations of entities and relations, respectively:

[0065] ;

[0066] ;

[0067] .

[0068] in, represents the vector representation of the head entity, A vector representation of entity relationships, represents the vector representation of the tail entity, represents the entity transformation matrix, Represents the entity relationship transformation matrix.

[0069] Exemplarily, the above-mentioned entity transformation matrix and entity relationship transformation matrix can be obtained by learning the embedded representation of triples in the knowledge graph using a neural network.

[0070] For example, if the entity type of the central node is open source component, the entity relationship type is ,in, Indicates that the entity relationship between open source components is an indirect dependency relationship type. Indicates that the entity relationship between open source components is an indirect dependency relationship type. The entity relationship between the open source component and the vulnerability is of the included relationship type. All one-hop neighbors of the central node are divided into subgraphs. Based on the entity relationship type between the one-hop neighbors and the open source component central node, the one-hop neighbors are assigned to the adjacency subgraph under the corresponding entity relationship type. This generates an adjacency subgraph with the open source component as the central node under each entity relationship type.

[0071] For example, if the entity type of the central node is vulnerability, the entity relationship type is ,in, Indicates another vulnerability contained in the vulnerability center node, as well as the vulnerability name, vulnerability type, vulnerability description, vulnerability level, vulnerability damage level and vulnerability exploitation method of the vulnerability center node, This open-source component represents the impact of a vulnerability's central node. It partitions all one-hop neighbors of the central node into subgraphs. Based on the entity relationship type between the one-hop neighbors and the vulnerability's central node, these neighbors are assigned to adjacency subgraphs of the corresponding entity relationship type. This generates adjacency subgraphs for each entity relationship type, with the vulnerability as the central node.

[0072] For example, the node As the central node, in the entity relationship type Determine the central node in the adjacency subgraph below Neighbor nodes , will connect the central node The vector represents its neighbor nodes The vector representation of is spliced ​​to obtain the splicing result, which is as follows:

[0073] ;

[0074] in, Central node The vector represents its neighbor nodes The vector represents the splicing result, is the linear transformation matrix, is the splicing function, Represents neighbor nodes The vector representation of Indicates that open source components are the central nodes The vector representation of .

[0075] For example, based on the central node The vector representation of the concatenation result with the vector representation of each neighbor node is calculated in the entity relationship type The central node in the adjacency subgraph With neighboring nodes The correlation weight coefficient between them is:

[0076] ;

[0077] in, For entity relationship types The central node in the adjacency subgraph With neighboring nodes The correlation weight coefficient between is an exponential function, is the activation function, Central node With neighboring nodes The linear transformation matrix in the adjacent subgraph, To connect the central node The set of all neighbor nodes of Central node With the The linear transformation matrix of neighbor nodes in the adjacent subgraph.

[0078] After obtaining the correlation weight coefficients between the central node and each neighbor node in the adjacency subgraph under each entity relationship type, the adjacent subgraph under each entity relationship type is aggregated based on the graph attention network, and the aggregated information of the aggregated adjacent subgraph under each entity relationship type is calculated by attention. The aggregated information of the adjacent subgraph under each entity relationship type is further aggregated using the attention results to obtain the relationship subgraph of the central node.

[0079] For example, set the entity relationship type The central node of the lower adjacent subgraph is , connecting the central node The set of all neighbor nodes of .

[0080] Using a multi-head attention mechanism, the entity relationship type is The central node in the lower adjacent subgraph The information of all connected neighbor nodes is aggregated, and the embedding representation of the aggregation result is:

[0081] ;

[0082] in, The entity relationship type is The adjacent subgraph with the central node The aggregate information of all connected neighbor nodes can also be called entity relationship type Next node is the embedded representation of the adjacent subgraph of the central node, is the aggregation operation of multi-head attention, is the number of multi-head attention, is the activation function under the multi-head attention mechanism.

[0083] Since there are three types of entity relationships with open source components as the central node, namely Similarly, combining the above example, we can get the other two relationship types: The aggregate information of all neighbor nodes connected to the central node in the adjacency subgraph below. Thus, the above three entity relationship types Next node The embedded representation of the adjacent subgraph with 3 central nodes can be: .

[0084] By calculating the attention score of the embedded representation of the adjacent subgraph, we can get the attention score of the embedded representation of the adjacent subgraph relative to the central node:

[0085] .

[0086] in, Entity relationship type The attention score of the adjacent subgraph under is the central node in the adjacent subgraph The embedding representation of Entity relationship type The diagonal matrix corresponding to the adjacent subgraph under , is the conversion function, The entity relationship type is Next node is the embedded representation of the adjacent subgraph of the central node.

[0087] In some examples, the attention scores are normalized to obtain the normalized attention scores of the adjacent subgraphs of each entity relationship type relative to the central node, as follows:

[0088] ;

[0089] in, Entity relationship type The adjacent subgraph relative to the central node The normalized attention score of .

[0090] After obtaining the normalized attention score of the adjacent subgraph of each entity relationship type relative to the central node, a multi-head attention mechanism is used to calculate the attention score of the open source component entity node. is the embedded representation of the relationship subgraph of the central node, as follows:

[0091] .

[0092] in, Represents a node is the relationship subgraph of the central node, where the node It is an open source component.

[0093] For example, the embedding representation calculation process of the relationship subgraph with the vulnerability as the central node can be similar to the embedding representation calculation process of the relationship subgraph with the open source component as the central node, except that the entity relationship type related to the vulnerability central node is .

[0094] Therefore, a multi-head attention mechanism is used to calculate the embedding representation of the relationship subgraph with the vulnerability as the central node , as follows:

[0095] ;

[0096] in, is the number of multi-head attention, 2 is the number of entity relationship types, is the conversion function, For vulnerability-centric nodes The vector representation of For the entity relationship type with vulnerability as the center node Embedded representation of the adjacent subgraph under .

[0097] According to the above implementation, for each central node, the attention mechanism is used to aggregate the adjacent subgraphs under each entity relationship type under the central node, and a relationship subgraph with the open source component as the central node and a relationship subgraph with the vulnerability as the central node can be obtained.

[0098] In one embodiment, subgraph fusion is performed on at least one relationship subgraph corresponding to each triple to obtain a fused relationship subgraph of each triple, including: when the triple constructs a relationship subgraph with the head entity as the center node and a relationship subgraph with the tail entity as the center node, vector concatenation is performed on the relationship subgraph with the head entity as the center node and the relationship subgraph with the tail entity as the center node of the triple to obtain a fused relationship subgraph of the triple; when the triple only constructs a relationship subgraph with the head entity as the center node, the fused relationship subgraph of the triple is determined based on the relationship subgraph with the head entity as the center node of the triple.

[0099] It can be understood that for any triple, its fusion relationship subgraph can be calculated using the above method.

[0100] For example, if the head entity of the triple is an open source component and the tail entity is a vulnerability, or if the head entity is a vulnerability and the tail entity is an open source component, then the relationship subgraph of the triple includes a relationship subgraph with the open source component as the central node and a relationship subgraph with the vulnerability as the central node. By fusing these two subgraphs, the relationship subgraph of the triple can be obtained.

[0101] For example, by fusing the embedding representation of the relation subgraph with the open source component as the central node and the embedding representation of the relation subgraph with the vulnerability as the central node, we can obtain the embedding representation of the fused relation subgraph of the triple , calculated as:

[0102] ;

[0103] in, is the embedding representation of the relationship subgraph with the open source component as the central node, is the embedding representation of the relation subgraph with the vulnerability as the central node, The symbol for concatenation.

[0104] For example, if the head entities of a triple are all open source components, then the triple's relationship subgraph includes two relationship subgraphs with the open source component as the center node. These two relationship subgraphs are also fused to obtain the fused relationship subgraph of the triple. If the head entities of a triple are all vulnerabilities, then the triple's relationship subgraph includes two relationship subgraphs with the vulnerability as the center node. These two relationship subgraphs are also fused to obtain the fused relationship subgraph of the triple.

[0105] Understandably, the knowledge graph of open source component vulnerabilities The fusion relationship subgraph of the reference triples in the [ ] can also be calculated similarly to the above process, and then the calculated fusion relationship subgraph of the reference triples is stored in the open source component vulnerability relationship subgraph feature library. Thus, in the process of analyzing the open source components and their vulnerabilities for each triple to be tested, the target fusion relationship subgraph that meets the similarity requirements can be searched in the open source component vulnerability relationship subgraph feature library based on the fusion relationship subgraph of the triple to be tested. If found, it means that the triple to be tested is included in the open source component vulnerability knowledge graph. Furthermore, the dependency chain of the open source components in the triple and / or the impact range of the vulnerability can be searched in the graph.

[0106] According to the above implementation, the fusion relationship subgraph of each triple to be detected can be calculated to facilitate the subsequent search for a reference triple in the open source component vulnerability knowledge graph whose fusion relationship subgraph matches the fusion relationship subgraph of the triple to be detected.

[0107] In one embodiment, in an open source component vulnerability knowledge graph, searching for the dependency chain and / or impact range of the open source component in the first triple includes: when the first open source component is included in the first triple, with the first open source component as the initial central node, performing the following search operation until none of the found open source component neighbor nodes meet the preset requirements, stopping the search operation, and connecting the found central nodes in sequence to obtain the dependency chain of the first open source component in the first triple; when the first vulnerability is included in the first triple, with the first vulnerability as the initial central node, performing the search operation until none of the found open source component neighbor nodes meet the preset requirements, stopping the search operation, and connecting the found central nodes in sequence to obtain the impact range of the first vulnerability in the first triple; wherein the search operation includes: in the open source component vulnerability knowledge graph, searching for an open source component neighbor node that has an entity relationship with the central node and meets the preset requirements, and based on the degree of correlation between the central node and each open source component neighbor node, determining the central node for the next search operation in each open source component neighbor node.

[0108] In one embodiment, the search operation also includes: determining a first similarity between the central node and the open source component neighbor node based on the number of neighbor nodes of each node in the intersection between the neighbor node set of the central node and the neighbor node set of the open source component neighbor node; determining a second similarity between the central node and the open source component neighbor node based on the ratio between the number of nodes in the intersection between the neighbor node set of the central node and the neighbor node set of the open source component neighbor node and the number of nodes in the union between the neighbor node set of the central node and the neighbor node set of the open source component neighbor node; determining the degree of correlation between the central node and the open source component neighbor node based on the first similarity and the second similarity.

[0109] For example, in the open source component vulnerability knowledge graph In the , select the node that matches the first open source component or the first vulnerability similarity in the triple to be detected As the central node for the next search operation, node For nodes The open source component neighbor node, where The total number of neighbor nodes of all open source components of the central node.

[0110] Exemplarily, the intersection between the neighbor node set of the central node and the neighbor node set of its open source component neighbor node is determined, and the sum of the reciprocals of the logarithms of the total number of neighbor nodes of each node in the intersection is used as the first similarity between the central node and the open source component neighbor node.

[0111] For example, the Adamic Adar algorithm is used to calculate and The correlation between them is calculated as follows:

[0112] ;

[0113] in, For nodes and nodes The degree of similarity between Central node The set of neighbor nodes of For nodes The set of neighbor nodes of belong and Nodes in the intersection node set of their neighbor node sets, For nodes The number of neighbor nodes.

[0114] Exemplarily, the second similarity between the central node and the open source component neighbor node is taken as the ratio of the number of nodes in the intersection between the neighbor node set of the central node and the neighbor node set of the open source component neighbor node to the number of nodes in the union between the neighbor node set of the central node and the neighbor node set of the open source component neighbor node.

[0115] For example, Jaccard similarity is used to calculate and The trend factor between is calculated as follows:

[0116] ;

[0117] in, Central node The set of neighbor nodes of For nodes The set of neighbor nodes of The symbol for the intersection of sets, The symbol for the union of sets, The value of The closer to 1, the node and nodes The more similar.

[0118] For example, the reciprocal of the first similarity and the second similarity are averaged to obtain the correlation between the central node and the open source component neighbor nodes.

[0119] For example, the computing center node Neighbor nodes with open source components The degree of correlation is:

[0120] ;

[0121] in, The value of The closer to 1, the higher the correlation between nodes. You can set the threshold ,For example ,if , then discard the corresponding neighbor nodes.

[0122] It can be understood that by calculating the correlation between the central node and all its neighboring nodes, arranging them in descending order of the correlation values, selecting the node with the highest correlation value as the central node for the next search operation, and repeating the above search operation in sequence until all nodes of the entire knowledge graph are executed or until the correlation between the central node and all its neighboring nodes is lower than the preset threshold, the above search operation is stopped.

[0123] For example, starting from the initial central node, following the search order of the central nodes, the central nodes found are sequentially connected to obtain the dependency chain of the open source component and the impact range of the vulnerability.

[0124] It is understandable that through the above method, the dependency chain of the open source component and the unique meta-path of the vulnerability’s impact range can be determined. With the final neighbor node There is a finite path between them, which is represented as a meta-path ,in, is the number of relations in the meta-path. If the node to be detected is an open source component, then the existence of the open source component is determined. If the node to be detected is a vulnerability, it is determined that the vulnerability affects the existence of open source components. Layer vulnerability propagation.

[0125] According to the above embodiment, a unique meta-path of the dependency chain of the open source component and the impact scope of the vulnerability can be determined.

[0126] Figure 2 This is a structural block diagram of an open source component vulnerability detection device according to an embodiment of the present invention.

[0127] like Figure 2 As shown, the open source component vulnerability detection device includes:

[0128] Configuration file parsing module 210, configured to parse the open source component dependency configuration file and the open source component vulnerability detection file to be detected to obtain corresponding multiple triples, wherein the triples include a head entity, a tail entity, and an entity relationship between the head entity and the tail entity, the head entity includes the open source component or vulnerability, and the tail entity includes the open source component, vulnerability, or vulnerability information;

[0129] a relationship subgraph construction module 220, configured to construct at least one relationship subgraph for each triple based on the entity relationships provided by the multiple triples, wherein the at least one relationship subgraph includes a relationship subgraph with an open source component as a central node and / or a relationship subgraph with a vulnerability as a central node;

[0130] A subgraph fusion module 230 is configured to perform subgraph fusion on at least one relationship subgraph corresponding to each of the triples to obtain a fused relationship subgraph of each of the triples;

[0131] An inclusion relationship judgment module 240 is configured to determine whether each triple is included in the open source component vulnerability knowledge graph based on the similarity between the fusion relationship subgraph of each triple and the fusion relationship subgraph of each reference triple in the open source component vulnerability knowledge graph;

[0132] The graph search module 250 is used to search the dependency chain and / or impact scope of the open source component in the open source component vulnerability knowledge graph when it is determined that the first triple of the multiple triples is included in the open source component vulnerability knowledge graph.

[0133] In one embodiment, the relationship subgraph construction module 220 includes:

[0134] A first subgraph construction unit is configured to, when the triple includes a head entity whose entity type is vulnerability or open source component and a tail entity whose entity type is vulnerability or open source component, construct, for the triple based on the entity relationships provided by the multiple triples, a relationship subgraph with the head entity as a central node and a relationship subgraph with the tail entity as a central node;

[0135] The second subgraph construction unit is used to construct a relationship subgraph with only the head entity as the central node for the triple based on the entity relationships provided by the multiple triples, when the triple includes a head entity whose entity type is vulnerability and a tail entity whose entity type is vulnerability information.

[0136] In one embodiment, constructing a relationship subgraph with the head entity as a central node includes:

[0137] Based on the entity relationships provided by the multiple triples, determining, among all entities involved in each of the triples, multiple one-hop neighbors that have an entity relationship with the head entity;

[0138] Based on the entity relationship types between the head entity and each one-hop neighbor of the head entity, construct an adjacency subgraph under each entity relationship type with the head entity as the central node;

[0139] A graph attention network is used to perform attention aggregation on the adjacent subgraphs with the head entity as the central node under each entity relationship type, so as to obtain a relationship subgraph with the head entity as the central node.

[0140] In one embodiment, constructing a relationship subgraph with the tail entity as a central node includes:

[0141] Based on the entity relationships provided by the multiple triples, determining, among all entities involved in each of the triples, multiple one-hop neighbors that have an entity relationship with the tail entity;

[0142] Based on the entity relationship types between the tail entity and each one-hop neighbor of the tail entity, constructing an adjacency subgraph with the tail entity as a central node under each entity relationship type;

[0143] A graph attention network is used to perform attention aggregation on the adjacent subgraphs with the tail entity as the central node under each entity relationship type, so as to obtain a relationship subgraph with the tail entity as the central node.

[0144] In one embodiment, the subgraph fusion module 230 includes:

[0145] a first fusion unit, configured to, when the triple is constructed with a relationship subgraph having the head entity as a central node and a relationship subgraph having the tail entity as a central node, perform vector concatenation on the relationship subgraph having the head entity as a central node and the relationship subgraph having the tail entity as a central node of the triple, to obtain a fused relationship subgraph of the triple;

[0146] The second fusion unit is configured to determine a fused relationship subgraph of the triple based on the relationship subgraph of the triple with the head entity as the center node, when the triple only constructs a relationship subgraph with the head entity as the center node.

[0147] In one embodiment, the graph search module 250 includes:

[0148] a dependency chain determining unit, configured to, when the first triple includes a first open source component, perform the following search operation with the first open source component as an initial central node, until none of the found neighbor nodes of the open source component meet preset requirements, stop performing the search operation, and sequentially connect the found central nodes to obtain a dependency chain of the first open source component in the first triple;

[0149] an impact range determining unit, configured to, when the first triple includes a first vulnerability, and if the first vulnerability is an initial central node, perform the search operation until none of the found open source component neighbor nodes meet the preset requirements, stop the search operation, and sequentially connect to the found central nodes to obtain an impact range of the first vulnerability in the first triple;

[0150] Among them, the search operation includes: searching for open source component neighbor nodes that have an entity relationship with the central node and meet the preset requirements in the open source component vulnerability knowledge graph, and based on the degree of correlation between the central node and each of the open source component neighbor nodes, determining the central node for performing the search operation next time among each of the open source component neighbor nodes.

[0151] In one embodiment, the search operation further includes:

[0152] Determining a first similarity between the central node and the open source component neighbor node based on the number of neighbor nodes of each node in the intersection between the neighbor node set of the central node and the neighbor node set of the open source component neighbor node;

[0153] Determining a second similarity between the central node and the open source component neighbor node based on a ratio between the number of nodes in an intersection between the neighbor node set of the central node and the neighbor node set of the open source component neighbor node, and the number of nodes in a union between the neighbor node set of the central node and the neighbor node set of the open source component neighbor node;

[0154] Based on the first similarity and the second similarity, a correlation degree between the central node and the open source component neighbor node is determined.

[0155] For the description of specific functions and examples of each module and submodule of the system in the embodiment of the present invention, please refer to the relevant description of the corresponding steps in the above method embodiment, which will not be repeated here.

[0156] In the technical solution of the present invention, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0157] According to an embodiment of the present invention, the present invention further provides a system and a readable storage medium.

[0158] Figure 3 A schematic block diagram of an example electronic device 800 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0159] like Figure 3 As shown, electronic device 800 includes a computing unit 801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 802 or a computer program loaded from a storage unit 808 into a random access memory (RAM) 803. RAM 803 may also store various programs and data required for the operation of electronic device 800. Computing unit 801, ROM 802, and RAM 803 are interconnected via a bus 804. An input / output (I / O) interface 805 is also connected to bus 804.

[0160] Multiple components in the electronic device 800 are connected to the I / O interface 805, including an input unit 806, such as a keyboard, a mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a magnetic disk, an optical disk, etc.; and a communication unit 809, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 809 allows the electronic device 800 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0161] The computing unit 801 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the computing unit 801 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 801 performs the various methods and processes described above, such as the power system production simulation method that considers the peak-shaving characteristics of coal-fired units. For example, in some embodiments, the power system production simulation method that considers the peak-shaving characteristics of coal-fired units can be implemented as a computer software program tangibly embodied in a machine-readable medium, such as the storage unit 808. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 800 via the ROM 802 and / or the communication unit 809. When the computer program is loaded into the RAM 803 and executed by the computing unit 801, one or more steps of the power system production simulation method that considers the peak-shaving characteristics of coal-fired units described above can be performed. Alternatively, in other embodiments, the computing unit 801 may be configured in any other appropriate manner (eg, by means of firmware) to execute a power system production simulation method that takes into account the peak-shaving characteristics of coal-fired units.

[0162] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system comprising at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0163] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. Such program code can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0164] In the context of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or apparatus. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of machine-readable storage media may include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fibers, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0165] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0166] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0167] A computer system may include a client and a server. The client and server are generally remote from each other and typically interact through a communication network. The client-server relationship arises through computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, a server in a distributed system, or a server integrated with a blockchain.

[0168] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in the present invention can be achieved. This is not limited herein.

[0169] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A method for detecting open source component vulnerabilities, characterized in that: include: Parsing the open source component dependency configuration file and the open source component vulnerability detection file to be detected to obtain corresponding multiple triples, wherein the triples include a head entity, a tail entity, and an entity relationship between the head entity and the tail entity, the head entity includes the open source component or vulnerability, and the tail entity includes the open source component, vulnerability, or vulnerability information; Based on the entity relationships provided by the multiple triples, at least one relationship subgraph is constructed for each of the triples, wherein the at least one relationship subgraph includes a relationship subgraph with an open source component as a central node and / or a relationship subgraph with a vulnerability as a central node, and the construction process of at least one relationship subgraph for each of the triples includes: in a case where the triple includes a head entity whose entity type is vulnerability or open source component and a tail entity whose entity type is vulnerability or open source component, based on the entity relationships provided by the multiple triples, a relationship subgraph with the head entity as a central node and a relationship subgraph with the tail entity as a central node are constructed for the triple; in a case where the triple includes a head entity whose entity type is vulnerability and a tail entity whose entity type is vulnerability information, based on the multiple For the entity relationships provided by the triples, only a relationship subgraph with the head entity as the central node is constructed for the triples; wherein the relationship subgraph with the head entity as the central node is a relationship subgraph with the open source component as the central node or a relationship subgraph with the vulnerability as the central node, and the relationship subgraph with the tail entity as the central node is a relationship subgraph with the open source component as the central node or a relationship subgraph with the vulnerability as the central node; the entity relationship types in the relationship subgraph with the open source component as the central node include indirect dependency relationships between open source components, direct dependency relationships between open source components, and inclusion relationships between open source components and vulnerabilities; the entity relationship types in the relationship subgraph with the vulnerability as the central node include inclusion relationships between vulnerabilities, relationships between vulnerabilities and vulnerability information, and impact relationships between vulnerabilities and open source components; Performing subgraph fusion on at least one relationship subgraph corresponding to each of the triples to obtain a fused relationship subgraph of each triple, wherein the process of determining the fused relationship subgraph of each triple includes: when the triple constructs a relationship subgraph with the head entity as the center node and a relationship subgraph with the tail entity as the center node, performing vector concatenation on the relationship subgraph with the head entity as the center node and the relationship subgraph with the tail entity as the center node of the triple to obtain the fused relationship subgraph of the triple; when the triple only constructs a relationship subgraph with the head entity as the center node, determining the fused relationship subgraph of the triple based on the relationship subgraph with the head entity as the center node of the triple; Determining whether each of the triples is included in the open source component vulnerability knowledge graph based on the similarity between the fusion relationship subgraph of each of the triples and the fusion relationship subgraph of each reference triple in the open source component vulnerability knowledge graph; When it is determined that a first triple among the multiple triples is included in the open source component vulnerability knowledge graph, searching the open source component vulnerability knowledge graph for a dependency chain and / or an impact range of the vulnerability in the first triple; Among them, constructing a relationship subgraph with the head entity as the central node and constructing a relationship subgraph with the tail entity as the central node both include: using a graph attention network to perform attention aggregation on the adjacent subgraphs of the central node under each entity relationship type to obtain the relationship subgraph of the central node, specifically including: for the adjacent subgraphs of the central node under each entity relationship type, determining the relevant weight coefficients between the central node and each adjacent node based on the splicing results between the central node and each adjacent node in the adjacent subgraph under the entity relationship type, using the relevant weight coefficients between the central node and each adjacent node to aggregate each adjacent node to obtain the aggregation information of the adjacent subgraph under the entity relationship type, using a multi-head attention mechanism to perform attention calculation on the aggregation information of the adjacent subgraph under the entity relationship type to obtain the attention score of the adjacent subgraph under the entity relationship type, and based on the attention scores of the adjacent subgraphs under each entity relationship type, aggregating the adjacent subgraphs under each entity relationship type to obtain the relationship subgraph of the central node.

2. The method according to claim 1, characterized in that The constructing of a relationship subgraph with the head entity as a central node includes: Based on the entity relationships provided by the multiple triples, determining, among all entities involved in each of the triples, multiple one-hop neighbors that have an entity relationship with the head entity; Based on the entity relationship types between the head entity and each one-hop neighbor of the head entity, an adjacency subgraph with the head entity as a central node under each entity relationship type is constructed.

3. The method according to claim 1, characterized in that The constructing of a relationship subgraph with the tail entity as a central node includes: Based on the entity relationships provided by the multiple triples, determining, among all entities involved in each of the triples, multiple one-hop neighbors that have an entity relationship with the tail entity; Based on the entity relationship types between the tail entity and each one-hop neighbor of the tail entity, an adjacency subgraph with the tail entity as a central node under each entity relationship type is constructed.

4. The method according to claim 1, wherein Searching the dependency chain and / or vulnerability impact scope of the open source component in the first triple in the open source component vulnerability knowledge graph includes: When the first triple includes a first open source component, performing the following search operation with the first open source component as the initial central node until none of the found neighbor nodes of the open source component meet preset requirements, stopping the search operation, and sequentially connecting the found central nodes to obtain a dependency chain of the first open source component in the first triple; When the first triplet includes a first vulnerability, if the first vulnerability is an initial central node, the search operation is performed until none of the found open source component neighbor nodes meet the preset requirements, then the search operation is stopped, and the found central nodes are connected in sequence to obtain an impact range of the first vulnerability in the first triplet. Among them, the search operation includes: searching for open source component neighbor nodes that have an entity relationship with the central node and meet the preset requirements in the open source component vulnerability knowledge graph, and based on the degree of correlation between the central node and each of the open source component neighbor nodes, determining the central node for performing the search operation next time among each of the open source component neighbor nodes.

5. The method according to claim 4, characterized in that The search operation further includes: Determining a first similarity between the central node and the open source component neighbor node based on the number of neighbor nodes of each node in the intersection between the neighbor node set of the central node and the neighbor node set of the open source component neighbor node; Determining a second similarity between the central node and the open source component neighbor node based on a ratio between the number of nodes in an intersection between the neighbor node set of the central node and the neighbor node set of the open source component neighbor node, and the number of nodes in a union between the neighbor node set of the central node and the neighbor node set of the open source component neighbor node; Based on the first similarity and the second similarity, a correlation degree between the central node and the open source component neighbor node is determined.

6. An open source component vulnerability detection device, characterized in that: include: a configuration file parsing module, configured to parse the open source component dependency configuration file and the open source component vulnerability detection file to be detected to obtain a corresponding plurality of triples, wherein the triples include a head entity, a tail entity, and an entity relationship between the head entity and the tail entity, the head entity including the open source component or vulnerability, and the tail entity including the open source component, vulnerability, or vulnerability information; a relationship subgraph construction module, configured to construct at least one relationship subgraph for each triple based on the entity relationships provided by the multiple triples, wherein the at least one relationship subgraph includes a relationship subgraph with an open source component as a central node and / or a relationship subgraph with a vulnerability as a central node; a subgraph fusion module, configured to perform subgraph fusion on at least one relationship subgraph corresponding to each of the triples to obtain a fused relationship subgraph of each of the triples; an inclusion relationship judgment module for determining whether each triple is included in the open source component vulnerability knowledge graph based on the similarity between the fusion relationship subgraph of each triple and the fusion relationship subgraph of each reference triple in the open source component vulnerability knowledge graph; A graph search module is configured to, upon determining that a first triple among the multiple triples is included in the open source component vulnerability knowledge graph, search the open source component vulnerability knowledge graph for a dependency chain and / or an impact range of the vulnerability in the first triple; Wherein, the relationship subgraph construction module includes: A first subgraph construction unit is configured to, when the triple includes a head entity whose entity type is vulnerability or open source component and a tail entity whose entity type is vulnerability or open source component, construct, for the triple based on the entity relationships provided by the multiple triples, a relationship subgraph with the head entity as a central node and a relationship subgraph with the tail entity as a central node; A second subgraph construction unit is configured to construct, for a case where the triple includes a head entity whose entity type is vulnerability and a tail entity whose entity type is vulnerability information, only a relationship subgraph with the head entity as a central node for the triple based on the entity relationships provided by the multiple triples; wherein the relationship subgraph with the head entity as the central node is a relationship subgraph with the open source component as the central node or a relationship subgraph with the vulnerability as the central node, and the relationship subgraph with the tail entity as the central node is a relationship subgraph with the open source component as the central node or a relationship subgraph with the vulnerability as the central node; the entity relationship types in the relationship subgraph with the open source component as the central node include indirect dependency relationships between open source components, direct dependency relationships between open source components, and inclusion relationships between open source components and vulnerabilities; the entity relationship types in the relationship subgraph with the vulnerability as the central node include inclusion relationships between vulnerabilities, relationships between vulnerabilities and vulnerability information, and impact relationships between vulnerabilities and open source components; Wherein, the subgraph fusion module includes: a first fusion unit, configured to, when the triple is constructed with a relationship subgraph having the head entity as a central node and a relationship subgraph having the tail entity as a central node, perform vector concatenation on the relationship subgraph having the head entity as a central node and the relationship subgraph having the tail entity as a central node of the triple, to obtain a fused relationship subgraph of the triple; a second fusion unit, configured to determine, when only a relationship subgraph with the head entity as a central node is constructed for the triple, a fused relationship subgraph of the triple based on the relationship subgraph with the head entity as a central node of the triple; Among them, constructing a relationship subgraph with the head entity as the central node and constructing a relationship subgraph with the tail entity as the central node both include: using a graph attention network to perform attention aggregation on the adjacent subgraphs of the central node under each entity relationship type to obtain the relationship subgraph of the central node, specifically including: for the adjacent subgraphs of the central node under each entity relationship type, determining the relevant weight coefficients between the central node and each adjacent node based on the splicing results between the central node and each adjacent node in the adjacent subgraph under the entity relationship type, using the relevant weight coefficients between the central node and each adjacent node to aggregate each adjacent node to obtain the aggregation information of the adjacent subgraph under the entity relationship type, using a multi-head attention mechanism to perform attention calculation on the aggregation information of the adjacent subgraph under the entity relationship type to obtain the attention score of the adjacent subgraph under the entity relationship type, and based on the attention scores of the adjacent subgraphs under each entity relationship type, aggregating the adjacent subgraphs under each entity relationship type to obtain the relationship subgraph of the central node.

7. An electronic device, characterized in that: include: at least one processor, and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the processor, and the processor is used to obtain the instructions from the memory and execute the instructions, so that the processor can execute the open source component vulnerability detection method described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to be provided to a computer to instruct the computer to execute the open source component vulnerability detection method according to any one of claims 1 to 5.

Images