A software supply chain security analysis method

Abstract

The application relates to the field of software security, and particularly discloses a software supply chain security analysis method, which comprises the following steps: S1: collecting data of components of a software supply chain, and calculating historical security risk weights of each component in the supply chain; S2: collecting behavior data of the software in runtime, and performing correlation analysis in combination with supply chain data; and S3: pre-processing the collected behavior data and supply chain data, and extracting key features. The software supply chain security analysis method can discover runtime threats that cannot be detected by static analysis, such as zero-day vulnerabilities and hidden backdoor threats, through dynamic behavior analysis, significantly improves the coverage rate of threat detection, introduces historical security risk weights to quantify historical security problems of components of the supply chain, and realizes intelligent risk assessment and threat tracing in combination with knowledge graph and graph neural network technology.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of software security, and in particular to a software supply chain security analysis method. BACKGROUND

[0002] With the globalization and complexity of software supply chain, there are more and more third-party components, open source libraries, suppliers and other links involved in the process of software development and delivery, and the supply chain security problem is increasingly prominent. Attackers may implant malicious code, exploit unpatched vulnerabilities or introduce non-compliant components through some links in the supply chain, thereby causing serious threats to the entire system. Traditional supply chain security analysis methods mainly rely on static code analysis, vulnerability scanning and compliance checking.

[0003] However, although the existing method can find known security problems, the existing technology is often static analysis, which is difficult to find threats exposed at runtime, such as zero-day vulnerabilities and hidden backdoors. At the same time, it also ignores historical security risks, such as records of vulnerabilities and malicious code of supply chain components, which are not quantified or included in the analysis model, resulting in incomplete risk assessment.

[0004] In addition, the existing method usually relies on manual analysis or simple log correlation, which is difficult to accurately identify attack paths in the supply chain. Moreover, traditional defense strategies are usually static and cannot be dynamically adjusted according to real-time threats.

[0005] Therefore, it is necessary to propose a software supply chain security analysis method to solve the above problems. SUMMARY

[0006] The main purpose of the present application is to provide a software supply chain security analysis method which can effectively solve the problems in the background art.

[0007] To achieve the above purpose, the technical scheme adopted by the present application is as follows:

[0008] A software supply chain security analysis method, comprising the following steps:

[0009] S1: Collecting data of components of a software supply chain, and calculating historical security risk weight of each component in the supply chain. If a component of the supply chain has a security problem, the weight value is calculated according to the severity and frequency of the security problem;

[0010] S2: Collecting behavior data of the software at runtime, and performing correlation analysis combined with the supply chain data;

[0011] S3: Preprocessing the collected behavior data and supply chain data, and extracting key features;

[0012] S4: Use machine learning algorithms to detect abnormal behavior during software runtime, combined with historical security risk weights;

[0013] The specific implementation steps are as follows: S41: Train a machine learning model using historical normal behavior data;

[0014] S42: Input real-time collected behavior characteristics into the trained model for anomaly detection;

[0015] S43: Adjust the sensitivity of anomaly detection by combining the historical security risk weights of the supply chain components. For components with high historical security risk weights, increase the sensitivity of anomaly detection. For components with low historical security risk weights, reduce the sensitivity of anomaly detection;

[0016] S44: The model outputs the probability value of abnormal behavior. If it exceeds the set threshold, it is determined as abnormal behavior;

[0017] S5: Through knowledge graph technology, trace the detected abnormal behavior, and combine the historical security risk weights to identify potential supply chain attack paths;

[0018] S6: Based on the results of anomaly behavior detection and threat tracing, generate a security situation awareness report for the software supply chain and conduct real-time early warning;

[0019] S7: According to the results of security situation awareness, dynamically adjust the defense strategy and conduct emergency response.

[0020] Preferably, in step S1, the components of the software supply chain include third-party suppliers, dependency relationships, intellectual property structures, and vulnerability information, and the specific data collected for each component is:

[0021] Third-party supplier information: supplier's name, historical security record, compliance;

[0022] Dependency relationship: dependency relationship between software components, including open source components and third-party libraries;

[0023] Intellectual property structure: software intellectual property information, including licenses and copyrights;

[0024] Vulnerability information: known vulnerability information, including CVE number and vulnerability severity;

[0025] The weight value calculation formula is: , where is the historical security risk weight of the i-th supply chain component, is the severity of the historical security event of the i-th supply chain component, is the historical security risk weight of the i-th supply chain component, is the severity of the historical security event of the i-th supply chain component, is the historical security risk weight of the i-th supply chain component. The frequency of historical security incidents occurring in each component of the supply chain and These are weighting coefficients used to adjust for the effects of severity and frequency. .

[0026] Preferably, in step S2, the specific implementation steps for collecting the software's behavioral data during runtime and combining it with supply chain data for correlation analysis are as follows:

[0027] S21: Deploy a lightweight monitoring agent in the target system to capture the runtime behavior of the software in real time;

[0028] S22: The monitoring agent uses system hook technology to capture the software's system calls, network communications, and file operation behaviors;

[0029] S23: Correlate the captured behavioral data with supply chain data to analyze the relationship between software runtime behavior and supply chain components;

[0030] The formula for collecting behavioral data is:

[0031] D runtime ={d1,d2,…,d i},in For runtime behavior datasets, For the first Each behavioral data point contains a timestamp, behavior type, and behavior parameter information.

[0032] Preferably, in step S3, the specific steps for preprocessing the collected behavioral data and supply chain data and extracting key features are as follows:

[0033] S31: Clean the raw behavioral data and supply chain data to remove noise and redundant information;

[0034] S32: Use feature engineering methods to extract features from behavioral data;

[0035] S33: Combine supply chain data to extract features related to the components of the supply chain;

[0036] S34: Vectorize the extracted features to form a feature matrix;

[0037] The feature extraction formula is: F = {f1, f2, ..., f...} i},in The characteristic matrix, For the first Each feature vector contains behavioral and supply chain features.

[0038] Preferably, the features of the behavior data extracted include system call frequency, network communication pattern, file operation sequence;

[0039] The features related to the supply chain components include the usage frequency of dependent components, the historical security record of the supplier.

[0040] Preferably, in step S4, the anomaly detection formula is:

[0041] wherein is the behavior data and the historical security risk weight is the probability of abnormal behavior, and is the model parameter, is the influence coefficient of the historical security risk weight.

[0042] Preferably, the implementation steps of step S5 include:

[0043] S51: Constructing a software supply chain knowledge graph;

[0044] S52: Associating the detected abnormal behavior with the nodes in the knowledge graph, and analyzing the possible attack path;

[0045] S53: Reasoning the knowledge graph through a graph neural network, combining the historical security risk weight, and identifying the potential supply chain attack source;

[0046] S54: For the supply chain components with high historical security risk weight, conducting more in-depth analysis and detection;

[0047] The knowledge graph reasoning formula is: wherein is the node feature matrix of the layer, is the adjacency matrix, is the degree matrix, is the weight matrix, is the activation function.

[0048] Preferably, the implementation steps of step S6 include:

[0049] S61: Comprehensive analysis of the abnormal behavior detection results and the threat tracing results, and generating a security situation awareness report;

[0050] S62: According to the severity of the threat and the historical security risk weight, triggering different levels of early warning mechanism;

[0051] S63: Real-time pushing of the early warning information to the relevant security management personnel, and providing response suggestions;

[0052] The security posture score formula is: wherein is the security posture score, is the weight of the th threat, is the severity score of the th threat, is the historical security risk weight of the th supply chain component, is the historical security problem score of the th supply chain component.

[0053] Preferably, the implementation step of step S7 comprises:

[0054] S71: dynamically adjusting the security policy of the system according to the security posture score;

[0055] S72: triggering an emergency response mechanism for detected serious threats, especially for supply chain components with high historical security risk weights, isolating the affected software components, and repairing them;

[0056] S73: recording the handling process of the entire security event to form a security event report for subsequent analysis;

[0057] The dynamic defense strategy adjustment formula is: wherein is the adjustment strength of the defense strategy, is the security posture score, is the urgency of the threat, is the historical security risk weight, is the weight coefficient.

[0058] Preferably, in step S51, the software supply chain knowledge graph comprises software components, dependency relationships, supplier information, and historical security risk weights.

[0059] Compared with the prior art, the present application provides a software supply chain security analysis method, which has the following beneficial effects:

[0060] This software supply chain security analysis method, through dynamic behavioral analysis, can discover runtime threats that static analysis cannot detect, such as zero-day vulnerabilities and hidden backdoors, significantly improving threat detection coverage. It also introduces historical security risk weights to quantify historical security issues in supply chain components. Combining knowledge graph and graph neural network technologies, it achieves intelligent risk assessment and threat attribution. Based on security posture scores and historical security risk weights, it dynamically adjusts defense strategies, enhancing the system's adaptability. Furthermore, by adjusting the sensitivity of the anomaly detection model using historical security risk weights, it effectively reduces false positives and false negatives, improving detection accuracy. From data collection, anomaly detection, threat attribution to dynamic defense, it covers all aspects of supply chain security, forming a complete solution that comprehensively protects the security of the software supply chain. Attached Figure Description

[0061] Figure 1 This is a flowchart of the steps of the present invention. Detailed Implementation

[0062] To make the technical means, creative features, objectives and effects of this invention easier to understand, the invention will be further described below in conjunction with specific embodiments.

[0063] like Figure 1 As shown, a software supply chain security analysis method includes the following steps:

[0064] Step 1: Collect data from the components of the software supply chain. These components include third-party vendors, dependencies, intellectual property structure, vulnerability information, etc. Specific data collected from the software supply chain includes the following:

[0065] Third-party supplier information: supplier's name, historical security record, and compliance;

[0066] Dependency relationships: The dependencies between software components, including open-source components and third-party libraries;

[0067] Intellectual property structure: The intellectual property information of the software, including licenses, copyrights, etc.;

[0068] Vulnerability Information: Information on known vulnerabilities, including CVE numbers, vulnerability severity, etc.

[0069] The data acquisition formula is: D supply ={d1,d2,…,d i},in For supply chain datasets, For the first Data for each component of the supply chain, including supplier information, dependencies, intellectual property structure, and vulnerability information;

[0070] Then calculate the historical security risk weight of each component If a component of a supply chain has had security issues (vulnerabilities, malicious code implants, etc.), calculate its weight value based on the severity and frequency of the security issues;

[0071] The calculation formula is: Where is the historical security risk weight of the th component of the supply chain, is the severity of the th historical security event of the supply chain component, is the frequency of the th historical security event of the supply chain component, and is the weight coefficient, used to adjust the influence of severity and frequency, ;

[0072] Specifically, for vulnerability severity: for known vulnerabilities (CVE vulnerabilities), directly use the CVSS score as the measure of severity, the CVSS score ranges from 0 to 10, the higher the score, the higher the severity of the vulnerability;

[0073] For malicious code event severity: for malicious code implant events, you can score them based on their impact range, damage degree and repair difficulty.

[0074] Specifically:

[0075] Impact range: whether it affects multiple systems or users.

[0076] Damage degree: whether it leads to data leakage, system crash, etc.

[0077] Repair difficulty: whether it requires a large amount of resources or time to repair.

[0078] For compliance issue severity: for compliance issues (license conflicts, intellectual property disputes), you can score them based on their legal risk and economic loss.

[0079] Specifically:

[0080] Legal risk: whether it can lead to litigation or fines.

[0081] Economic loss: whether it can lead to significant financial loss.

[0082] Finally, if a component involves multiple types of security events (vulnerabilities, malicious code, compliance issues), you can weight and sum their severity to get a comprehensive score.

[0083] Step 2: Collect runtime behavior data of the software and conduct correlation analysis with supply chain data;

[0084] The specific implementation steps are as follows: Step 21: Deploy a lightweight monitoring agent in the target system to capture software runtime behavior in real time;

[0085] Step 22: The monitoring agent captures system calls, network communication, and file operation behavior of the software through system hook technology;

[0086] Step 23: Correlate the captured behavior data with supply chain data to analyze the relationship between software runtime behavior and supply chain components;

[0087] The behavior data collection formula is: D runtime = {d1, d2, …, d i}, where D is the runtime behavior data set, d is the th behavior data point, containing timestamp, behavior type, and behavior parameter information.

[0088] Step 3: Preprocess the collected behavior data and supply chain data and extract key features;

[0089] The specific implementation steps are as follows:

[0090] Step 31: Cleanse the original behavior data and supply chain data to remove noise and redundant information;

[0091] Step 32: Use feature engineering methods to extract behavior data features, including system call frequency, network communication pattern, and file operation sequence;

[0092] Step 33: Combine supply chain data to extract features related to supply chain components, including dependent component usage frequency and supplier historical security records;

[0093] Step 34: Vectorize the extracted features to form a feature matrix;

[0094] The feature extraction formula is: F = {f1, f2, …, f i}, where F is the feature matrix, f is the

[0095] th feature vector containing behavior features and supply chain features.

[0096] The specific implementation steps are as follows:

[0097] Step 41: Train a machine learning model, preferably Isolation Forest, Support Vector Machine, or Deep Learning Model, using historical normal behavior data;

[0098] Step 42: Input real-time collected behavior features into the trained model for anomaly detection;

[0099] Step 43: Adjust the sensitivity of anomaly detection by combining the historical security risk weight of the supply chain components. For components with a higher historical security risk weight, increase the sensitivity of anomaly detection (i.e., lower the detection threshold); for components with a lower historical security risk weight, decrease the sensitivity of anomaly detection (i.e., raise the detection threshold);

[0100] Step 44: The model outputs the probability value of abnormal behavior, and if it exceeds the set threshold, it is determined as abnormal behavior;

[0101] The anomaly detection formula is: where is the behavior data and the historical security risk weight is the probability of abnormal behavior, and is the model parameter, is the influence coefficient of the historical security risk weight.

[0102] Step 5: Through knowledge graph technology, conduct traceability analysis on the detected abnormal behavior, and combine with the historical security risk weight to identify potential supply chain attack paths;

[0103] The implementation steps include:

[0104] Step 51: Build a software supply chain knowledge graph, including software components, dependency relationships, supplier information, and historical security risk weights;

[0105] Step 52: Associate the detected abnormal behavior with the nodes in the knowledge graph to analyze possible attack paths;

[0106] Step 53: Use graph neural networks to reason about the knowledge graph, combining with the historical security risk weight to identify potential supply chain attack sources;

[0107] Step 54: For supply chain components with a higher historical security risk weight, conduct more in-depth analysis and detection;

[0108] The knowledge graph reasoning formula is: where is the node feature matrix of the layer, is the adjacency matrix, is a degree matrix, is a weight matrix, is an activation function.

[0109] Step 6: Based on the results of anomaly behavior detection and threat tracing, generate a security situation awareness report of the software supply chain and conduct real-time early warning;

[0110] The implementation steps include:

[0111] Step 61: Comprehensive analysis of anomaly behavior detection results and threat tracing results to generate a security situation awareness report;

[0112] Step 62: Trigger different levels of early warning mechanisms (low, medium, high) according to the severity of the threat and the historical security risk weight;

[0113] Step 63: Real-time push warning information to relevant security management personnel and provide response suggestions;

[0114] The security situation score formula is: , where is the security situation score, is the weight of the th threat, is the severity score of the th threat, is the historical security risk weight of the th supply chain component, is the historical security problem score of the th supply chain component.

[0115] Step 7: According to the results of security situation awareness, dynamically adjust the defense strategy and conduct emergency response;

[0116] The implementation steps include:

[0117] Step 71: Dynamically adjust the security policy of the system (firewall rules, access control policy) according to the security situation score;

[0118] Step 72: Trigger emergency response mechanisms for detected serious threats, especially supply chain components with high historical security risk weight, isolate affected software components, and conduct repairs;

[0119] Step 73: Record the entire security incident handling process to form a security incident report for subsequent analysis;

[0120] The dynamic defense strategy adjustment formula is: , where is the adjustment strength of the defense strategy, is the security situation score, an emergency level of the threat, a historical security risk weight, a weight coefficient.

[0121] The present scheme realizes real-time security situation awareness of the software supply chain by introducing a historical security risk weight, combining dynamic behavior analysis, knowledge graph, and graph neural network technologies.

[0122] Introduction of the historical security risk weight: can more intelligently analyze and detect potential threats in the supply chain, especially those components that have had security problems in the past.

[0123] Dynamic behavior analysis and intelligent threat tracing: can detect dynamic threats that static analysis cannot detect, and intelligently trace threats through a knowledge graph.

[0124] Dynamic defense and adaptive capability: based on security situation score and historical security risk weight, can dynamically adjust defense strategies and improve the adaptive capability of the system.

[0125] The above shows and describes the basic principles and main features of the present application and the advantages of the present application. Those skilled in the art should understand that the present application is not limited by the above examples, and the above examples and descriptions in the specification are only to illustrate the principles of the present application. Without departing from the spirit and scope of the present application, various changes and improvements can be made to the present application, and these changes and improvements all fall within the scope of the claimed present application.

Claims

1. A software supply chain security analysis method, characterized in that, Includes the following steps: S1: Collect data on the components of the software supply chain and calculate the historical security risk weight for each component in the supply chain. If a component of the supply chain has experienced a security problem, calculate its weight value based on the severity and frequency of the security problem. S2: Collect behavioral data of the software during operation and perform correlation analysis in conjunction with supply chain data; S3: Preprocess the collected behavioral and supply chain data and extract key features; S4: Utilize machine learning algorithms, combined with historical security risk weights, to detect abnormal behavior during software operation; The specific implementation steps are as follows: S41: Train the machine learning model using historical normal behavior data; S42: Input the real-time collected behavioral features into the trained model to perform anomaly detection; S43: Adjust the sensitivity of anomaly detection based on the historical security risk weights of the supply chain components. Increase the sensitivity of anomaly detection for components with high historical security risk weights and decrease the sensitivity of anomaly detection for components with low historical security risk weights. S44: The model outputs the probability value of abnormal behavior; if it exceeds the set threshold, it is judged as abnormal behavior. S5: Through knowledge graph technology, the detected abnormal behavior is traced and analyzed, and combined with historical security risk weights, potential supply chain attack paths are identified. S6: Based on the results of abnormal behavior detection and threat tracing, generate a security situation awareness report for the software supply chain and provide real-time early warnings; S7: Based on the results of security situation awareness, dynamically adjust defense strategies and conduct emergency response.

2. The software supply chain security analysis method according to claim 1, characterized in that: In step S1, the components of the software supply chain include third-party suppliers, dependencies, intellectual property structure, and vulnerability information, and the specific data collected for each component are as follows: Third-party supplier information: supplier's name, historical security record, and compliance; Dependency relationships: The dependencies between software components, including open-source components and third-party libraries; Intellectual property structure: The intellectual property information of the software, including licenses and copyrights; Vulnerability information: Known vulnerability information, including CVE number and vulnerability severity; The formula for calculating the weight value is: H i =α·S i +β·F i H i S represents the historical security risk weight for the i-th supply chain component. i F represents the severity of historical security incidents for the i-th supply chain component. i Let α be the frequency of historical security events occurring in the i-th supply chain component, and β be weighting coefficients used to adjust the impact of severity and frequency, where α + β = 1.

3. The software supply chain security analysis method according to claim 2, characterized in that: In step S2, the specific steps for collecting the software's behavioral data during runtime and performing correlation analysis in conjunction with supply chain data are as follows: S21: Deploy a lightweight monitoring agent in the target system to capture the runtime behavior of the software in real time; S22: The monitoring agent uses system hook technology to capture the software's system calls, network communications, and file operation behaviors; S23: Correlate the captured behavioral data with supply chain data to analyze the relationship between software runtime behavior and supply chain components; The formula for collecting behavioral data is: D runtime = {d1, d2, ..., di}, where D runtime For runtime behavior datasets, d i For the i-th behavior data point, it contains timestamp, behavior type, and behavior parameter information.

4. The software supply chain security analysis method according to claim 3, characterized in that: In step S3, the specific steps for preprocessing the collected behavioral data and supply chain data and extracting key features are as follows: S31: Clean the raw behavioral data and supply chain data to remove noise and redundant information; S32: Use feature engineering methods to extract features from behavioral data; S33: Combine supply chain data to extract features related to the components of the supply chain; S34: Vectorize the extracted features to form a feature matrix; The feature extraction formula is: F = {f1, f2, ..., fi}, where F is the feature matrix, f1, f2, ..., fi}. i Let be the i-th feature vector, which contains behavioral features and supply chain features.

5. A software supply chain security analysis method according to claim 4, characterized in that: Features extracted from behavioral data include system call frequency, network communication patterns, and file operation sequences; Extracting features relevant to supply chain components includes the frequency of use of dependent components and the supplier's historical security record.

6. The software supply chain security analysis method according to claim 4, characterized in that: In step S4, the anomaly detection formula is: Where P(y=1|F,H) is the probability that behavioral data F and historical security risk weight H belong to abnormal behavior, θ and b are model parameters, and γ is the influence coefficient of historical security risk weight.

7. The software supply chain security analysis method according to claim 1, characterized in that: The steps to implement step S5 include: S51: Constructing a knowledge graph for the software supply chain; S52: Associate the detected abnormal behavior with nodes in the knowledge graph to analyze possible attack paths; S53: Use graph neural networks to reason about knowledge graphs and combine them with historical security risk weights to identify potential sources of supply chain attacks; S54: Conduct more in-depth analysis and testing of supply chain components with high historical security risk weights; The formula for reasoning in a knowledge graph is: in Let l be the node feature matrix of the l-th layer. It is an adjacency matrix. W is the degree matrix. (l) Let σ be the weight matrix and σ be the activation function.

8. A software supply chain security analysis method according to claim 6, characterized in that: The steps to implement step S6 include: S61: Integrate and analyze the results of abnormal behavior detection and threat attribution to generate a security situation awareness report; S62: Trigger different levels of early warning mechanisms based on the severity of the threat and historical security risk weights; S63: Push early warning information to relevant safety management personnel in real time and provide response suggestions; The formula for security situation scoring is: Where S is the security situation score, w i Let s be the weight of the i-th threat. i H is a score representing the severity of the i-th threat. j h represents the historical security risk weight for the j-th supply chain component. j Score the historical security issues of the j-th supply chain component.

9. A software supply chain security analysis method according to claim 8, characterized in that: The steps to implement step S7 include: S71: Dynamically adjust the system's security strategy based on the security situation score; S72: For critical threats detected, trigger the incident response mechanism, isolate the affected software components, and perform repairs; S73: Record the entire handling process of a security incident and generate a security incident report; The formula for adjusting the dynamic defense strategy is: R = α·S + β·T + λ·H, where R is the adjustment intensity of the defense strategy, S is the security situation score, T is the urgency of the threat, H is the historical security risk weight, and α, β, and γ are weight coefficients.

10. A software supply chain security analysis method according to claim 7, characterized in that: In step S51, the software supply chain knowledge graph is constructed, including software components, dependencies, supplier information, and historical security risk weights.

Images