Software supply chain dependency robustness evaluation method and device, medium and equipment

Abstract

According to the software supply chain dependency robustness evaluation method and device, the medium and the equipment provided by the invention, when robustness evaluation is performed on the open source software supply chain, the initial dependency graph is constructed according to the software dependency data from the plurality of data sources in the open source software supply chain, so that the space-time complexity of the dependency chain can be comprehensively restored; noise reduction is carried out on the initial dependency graph to form a noise reduction dependency graph by using a noise reduction auto-encoder and a graph neural network, and then multi-scale analysis is carried out to form an analysis result; the loss function of the noise reduction auto-encoder is formed by combining reconstruction loss and structure maintenance loss, and the graph neural network is trained by adopting a weighted aggregation function and a multi-task loss function and is evaluated through a structure disturbance experiment. Therefore, the robustness evaluation result obtained by performing multi-dimensional index evaluation on the analysis result can fully consider the influence of data noise, dynamic structure change and attack scenes, has relatively high accuracy, and provides powerful support for software supply chain security management.

Description

Technical Field

[0001] The present application relates to the technical field of software supply chain evaluation, and in particular to a method, apparatus, medium and equipment for evaluating the robustness of software supply chain dependencies. Background Art

[0002] With the rapid evolution of information technology and the deepening of digital transformation, open source software (OSS) plays an increasingly important role in the modern software ecosystem. From operating systems (such as Linux), databases (such as MySQL), and middleware (such as Kafka) to development frameworks (such as Spring and TensorFlow) and tool libraries (such as NumPy and Lodash), open source software has become a critical cornerstone for building enterprise-level applications. Developed through community collaboration, open source software features frequent updates and rapid functionality expansion, leading to exponential growth and complexity in inter-software dependencies.

[0003] The complexity of dependencies in the open source software supply chain is mainly reflected in the following aspects: First, the dependencies have a multi-level nature, that is, the upper-level software depends on multiple open source libraries, and these open source libraries themselves may depend on other libraries, forming a complex "dependency tree"; second, the dependencies are dynamic, and as the software version is updated, the dependencies may change or conflict; finally, the dependencies are subject to noise interference, including incomplete, incorrect or outdated dependency declarations.

[0004] At present, most of the existing software supply chain assessment methods focus on simple dependency identification or vulnerability detection, and fail to fully consider the impact of data noise, structural dynamic changes and attack scenarios on the analysis results. Therefore, they cannot effectively handle complex dependency graphs, resulting in poor accuracy and reliability in the robustness analysis of complex open source software supply chain dependencies. Summary of the Invention

[0005] The purpose of this application is to solve at least one of the above-mentioned technical defects, especially the technical defect that the software supply chain evaluation method in the existing technology cannot effectively handle complex dependency graphs, resulting in poor accuracy and reliability of robustness analysis of complex open source software supply chain dependencies.

[0006] This application provides a method for evaluating the robustness of software supply chain dependencies, the method comprising:

[0007] Performing data fusion processing on software dependency data from multiple data sources to obtain multi-source fused data of the open source software supply chain, and constructing an initial dependency graph based on the multi-source fused data;

[0008] Determining a denoising autoencoder, and using the denoising autoencoder to restructure the initial dependency graph to obtain a denoised dependency graph; wherein the denoising autoencoder is trained using a composite loss function consisting of a reconstruction loss and a structure-preserving loss;

[0009] Determining a graph neural network, and performing a multi-scale analysis on the denoised dependency graph using the graph neural network to generate an analysis result; wherein the graph neural network is trained using a weighted aggregation function and a multi-task loss function and evaluated through a structural perturbation experiment;

[0010] Based on the analysis results, a multi-dimensional indicator evaluation is performed on the open source software supply chain to obtain a robustness evaluation result, so as to generate a supply chain analysis report and perform visualization based on the denoising dependency graph and the robustness evaluation result.

[0011] Optionally, the data fusion processing of software dependency data from multiple data sources to obtain multi-source fusion data of the open source software supply chain includes:

[0012] Extract data from multiple data sources corresponding to the open source software supply chain to obtain software dependency data corresponding to each data source;

[0013] The dependency data of each software is standardized respectively, and the processed dependency data are deduplicated and fused to obtain multi-source fused data.

[0014] Optionally, constructing an initial dependency graph based on the multi-source fusion data includes:

[0015] Determining multiple software packages included in the multi-source fusion data and attribute information corresponding to each software package;

[0016] Determine the dependency relationships between the software packages and the relationship attributes corresponding to each dependency relationship based on the attribute information;

[0017] The initial dependency graph is constructed with software packages as nodes, dependency relationships as edges, and relationship attributes as edge attributes.

[0018] Optionally, determining the denoising autoencoder includes:

[0019] Determining a dependency graph sample set, the dependency graph sample set including a plurality of initial dependency graphs and a noisy dependency graph obtained by performing data enhancement on each initial dependency graph using a data enhancement strategy; the data enhancement strategy including dependency edge loss, false dependency introduction, and attribute perturbation;

[0020] A loss function is designed by combining reconstruction loss and structure preservation loss, and an initial autoencoder is constructed using an encoder and a decoder based on the loss function;

[0021] The dependency graph sample set is used to train the initial autoencoder using a small batch gradient descent optimization and a cosine annealing strategy until a preset end condition is met, and the trained initial autoencoder is used as a denoising autoencoder.

[0022] Optionally, the using the denoising autoencoder to restructure the initial dependency graph to obtain the denoised dependency graph includes:

[0023] Extracting node features of the initial dependency graph and inputting the node features into the denoising autoencoder to obtain denoising features output by the denoising autoencoder and the confidence of each edge in the initial dependency graph;

[0024] The structure of the initial dependency graph is reconstructed based on the noise reduction features, and edges with confidence levels lower than a preset threshold in the reconstruction results are removed to form a noise reduction dependency graph.

[0025] Optionally, determining the graph neural network includes:

[0026] Determining the structural characteristics and overall dependency properties of the denoising dependency graph, selecting a corresponding neural network variant based on the structural characteristics, and designing a weighted aggregation function and a multi-task loss function based on the overall dependency properties;

[0027] Performing network construction on the neural network variant according to the weighted aggregation function and the multi-task loss function to obtain a pre-trained network;

[0028] The pre-trained network is trained using a regularization strategy until a preset end condition is met, and the trained pre-trained network is used as the initial graph neural network;

[0029] Generating a set of perturbation dependency graphs through a structural perturbation experiment, and performing a multi-scale analysis on the perturbation dependency graphs using the initial neural network to obtain analysis results; wherein the multi-scale analysis includes evaluating robustness performance through global graphs and local subgraphs, identifying key dependency nodes through attention weights and graph centrality indicators, and identifying vulnerable dependency paths through edge importance scores;

[0030] If the analysis result does not meet the expected range, return to the network training of the pre-trained network using the regularization strategy and subsequent steps until the analysis result meets the expected range, and use the initial graph neural network as the final graph neural network.

[0031] Optionally, performing a multi-dimensional indicator evaluation on the open source software supply chain based on the analysis result to obtain a robustness evaluation result includes:

[0032] Determining a network connectivity retention rate, a maximum connected subgraph ratio, and an average path length change rate of the open source software supply chain based on the analysis results, and obtaining a structural robustness score based on the network connectivity retention rate, the maximum connected subgraph ratio, and the average path length change rate;

[0033] Determine a key function dependency risk score, alternative path availability, and dependency health of the open source software supply chain based on the analysis results, and obtain a function robustness score based on the key function dependency risk score, the alternative path availability, and dependency health;

[0034] Determine the vulnerability exposure area, attack propagation impact factor, and supply chain resilience score of the open source software supply chain based on the analysis results, and evaluate the security robustness score based on the vulnerability exposure area, attack propagation impact factor, and supply chain resilience score;

[0035] A weighted sum is performed on the structural robustness score, the functional robustness score, and the security robustness score to obtain a robustness evaluation result of the open source software supply chain.

[0036] This application also provides a software supply chain dependency robustness assessment device, comprising:

[0037] A dependency graph construction module is used to perform data fusion processing on software dependency data from multiple data sources to obtain multi-source fused data of the open source software supply chain, and to construct an initial dependency graph based on the multi-source fused data;

[0038] A dependency graph denoising module, configured to determine a denoising autoencoder and use the denoising autoencoder to restructure the initial dependency graph to obtain a denoised dependency graph; wherein the denoising autoencoder is trained using a composite loss function consisting of a reconstruction loss and a structure-preserving loss;

[0039] a dependency graph analysis module, configured to determine a graph neural network and perform multi-scale analysis on the denoised dependency graph using the graph neural network to generate analysis results; wherein the graph neural network is trained using a weighted aggregation function and a multi-task loss function and evaluated through a structural perturbation experiment;

[0040] A robustness evaluation module is used to perform a multi-dimensional indicator evaluation on the open source software supply chain based on the analysis results to obtain a robustness evaluation result, so as to generate a supply chain analysis report based on the denoising dependency graph and the robustness evaluation result and perform visualization.

[0041] The present application also provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the software supply chain dependency robustness assessment method as described in any of the above embodiments.

[0042] The present application also provides a computer device, comprising: one or more processors, and a memory;

[0043] The memory stores computer-readable instructions, and when the computer-readable instructions are executed by the one or more processors, the steps of the software supply chain dependency robustness assessment method as described in any one of the above embodiments are performed.

[0044] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0045] The software supply chain dependency robustness assessment method, apparatus, medium and equipment provided in the present application can first perform data fusion processing on the software dependency data from multiple data sources in the open source software supply chain when conducting robustness assessment on the supply chain of open source software to obtain multi-source fusion data, and ensure that the initial dependency graph constructed by the multi-source fusion data can fully restore the spatiotemporal complexity of the dependency chain; then the denoising autoencoder can be determined, and the denoising autoencoder can be used to reconstruct the structure of the initial dependency graph to obtain a denoised dependency graph. Since the denoising autoencoder is trained using a composite loss function composed of a reconstruction loss and a structure-preserving loss, it can effectively denoise the dependency graph without affecting its structure. , to avoid noise affecting the accuracy of subsequent evaluations; then the graph neural network can be determined, and the graph neural network can be used to perform multi-scale analysis on the denoised dependency graph to form an analysis result; wherein, the graph neural network is trained using weighted aggregation functions and multi-task loss functions and evaluated through structural perturbation experiments, so the graph neural network can take into account dynamic structural changes and attack scenarios, and perform in-depth and high-precision analysis of the dependency graph; after obtaining the analysis results, the present application can also perform a multi-dimensional indicator evaluation of the open source software supply chain based on the analysis results, obtain a comprehensive robustness evaluation result, and generate a supply chain analysis report based on the denoised dependency graph and the robustness evaluation results and perform visualization, providing strong support for software supply chain security management. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0047] Figure 1 A flowchart of a method for evaluating the robustness of software supply chain dependencies provided in an embodiment of the present application;

[0048] Figure 2 A schematic diagram of the structure of a noise reduction autoencoder provided in an embodiment of the present application;

[0049] Figure 3 An analysis flow chart of a graph neural network provided in an embodiment of the present application;

[0050] Figure 4 A system display diagram of a robustness evaluation result provided in an embodiment of the present application;

[0051] Figure 5 A schematic diagram of the architecture of a software supply chain dependency robustness assessment method provided in an embodiment of the present application;

[0052] Figure 6 A diagram showing the corresponding relationship of a protection mechanism provided in an embodiment of the present application;

[0053] Figure 7 A schematic diagram of the structure of a software supply chain dependency robustness assessment device provided in an embodiment of the present application;

[0054] Figure 8 A schematic diagram of the internal structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0056] At present, most of the existing software supply chain assessment methods focus on simple dependency identification or vulnerability detection, and fail to fully consider the impact of data noise, structural dynamic changes and attack scenarios on the analysis results. Therefore, they cannot effectively handle complex dependency graphs, resulting in poor accuracy and reliability in the robustness analysis of complex open source software supply chain dependencies.

[0057] Based on this, this application proposes the following technical solutions, please refer to the following for details:

[0058] In one embodiment, Figure 1 As shown, Figure 1This is a flowchart of a method for evaluating the robustness of software supply chain dependencies provided in an embodiment of the present application. This application provides a method for evaluating the robustness of software supply chain dependencies, which specifically includes the following:

[0059] S110: Perform data fusion processing on software dependency data from multiple data sources to obtain multi-source fusion data of the open source software supply chain, and construct an initial dependency graph based on the multi-source fusion data.

[0060] In this step, when conducting a robustness assessment on the open source software supply chain, the computer equipment can first perform data fusion processing on the software dependency data from multiple data sources in the open source software supply chain to obtain multi-source fusion data, ensuring that the initial dependency graph constructed through the multi-source fusion data can fully restore the spatiotemporal complexity of the dependency chain.

[0061] Specifically, the data sources of this application may include static dependency files, source code, metadata and dynamic operation data of the open source software dependency chain. Computer equipment can extract data related to software dependencies in the supply chain from these data sources, including version information, dependency relationships, update records, security vulnerabilities and other multi-dimensional information.

[0062] It is understandable that since these software dependency data come from different data sources with diverse formats and varying timeliness, the computer device can standardize the software dependency data to perform data fusion and form high-quality multi-source fusion data. Subsequently, the computer device can construct an initial dependency graph based on this multi-source fusion data, so that this initial dependency graph can accurately reflect the true and complex dependency network between various software packages in the entire open source software supply chain. It has a high temporal and spatial resolution capability, can reveal the evolution path of dependency relationships at different time points and in different contexts, and provides a solid and comprehensive data foundation for subsequent robustness evaluation.

[0063] S120: Determine a denoising autoencoder, and use the denoising autoencoder to restructure the initial dependency graph to obtain a denoised dependency graph; wherein the denoising autoencoder is trained using a composite loss function composed of a reconstruction loss and a structure-preserving loss.

[0064] In this step, after the initial dependency graph is constructed in step S110, the computer device can determine a pre-trained denoising autoencoder (DAE) and use the denoising autoencoder to restructure the initial dependency graph to obtain a denoised dependency graph; the denoising autoencoder is trained using a composite loss function consisting of a reconstruction loss and a structure-preserving loss, so it can effectively denoise the dependency graph without affecting its structure, thereby preventing noise from affecting the accuracy of subsequent evaluations.

[0065] Specifically, since the denoising autoencoder of the present application has been trained on a large amount of dependency graph data and has good feature extraction and graph structure recovery capabilities, in practical applications, the computer can directly obtain the denoising autoencoder and input the initial dependency graph into it, so that the denoising autoencoder can restructure the initial dependency graph, including eliminating noise information introduced by data acquisition errors, version inconsistencies, redundant dependencies or other abnormal factors, thereby generating a clearer, more accurate and structurally stable denoising dependency graph.

[0066] It's understandable that in the composite loss function used by the denoising autoencoder, the reconstruction loss ensures the accurate restoration of node features during the encoding and decoding process, while the structure-preserving loss maintains the original topological connections and structural relationships between nodes in the graph, allowing the model to simultaneously focus on information integrity and structural consistency during learning. Based on this, the autoencoder can effectively preserve key structural features in the dependency graph during denoising, preventing the denoising operation from disrupting the original dependency chain logic, thereby ensuring the accuracy and reliability of subsequent robustness evaluations.

[0067] S130: Determine a graph neural network, and use the graph neural network to perform multi-scale analysis on the denoising dependency graph to form an analysis result; wherein, the graph neural network is trained using a weighted aggregation function and a multi-task loss function and is evaluated through a structural perturbation experiment.

[0068] In this step, after obtaining the denoised dependency graph through step S120, the computer device can also determine the corresponding graph neural network (GNN) and use the GNN to perform multi-scale analysis on the denoised dependency graph to form an analysis result; the GNN here is trained using a weighted aggregation function and a multi-task loss function and evaluated through structural perturbation experiments. Therefore, the GNN can take into account dynamic structural changes and attack scenarios and perform in-depth and high-precision analysis of the dependency graph.

[0069] It is understandable that in a graph neural network, each node needs to receive information from its neighboring nodes to update its own feature representation, and traditional aggregation functions, such as average and sum functions, tend to ignore the importance differences between different neighbors. Therefore, this application can introduce a weighted aggregation function in the graph neural network to consider the importance of dependencies, assign different weights according to factors such as the dependency type, version compatibility, and frequency of occurrence between neighbor nodes and target nodes, and perform differentiated aggregation, thereby enhancing the graph neural network's perception of key dependency paths, improving the expressiveness of node representations, and ensuring that feature information neither loses key details nor is over-averaged during the propagation process.

[0070] In addition, graph neural networks can also adopt multi-task loss functions during the training process, so that multiple tasks such as node classification, edge prediction, and graph structure recognition can be taken into account simultaneously under a unified optimization framework. By introducing a strategy that combines supervised learning with self-supervised learning, the adaptability and generalization ability of the model in the face of different task objectives can be improved, further improving the accuracy and reliability of the graph neural network analysis results.

[0071] Furthermore, after the graph neural network training is completed, in order to verify the graph neural network's adaptability to dynamic changes in the dependency graph and potential attacks, this application can conduct a systematic robustness test of the graph neural network through structural perturbation experiments. By simulating various structural perturbation scenarios including random removal of dependency edges, random removal of key nodes, replacement of dependency versions, and injection of malicious dependencies, the stability and resistance of the graph neural network in the face of dynamic changes in the dependency graph structure and potential attacks are fully verified. Therefore, the graph neural network can not only achieve a deep understanding and feature extraction of the denoised dependency graph, but also identify key dependency relationships and risk paths at multiple scales, providing high-precision analysis results for the robustness assessment of the open source software supply chain.

[0072] S140: Based on the analysis results, a multi-dimensional indicator evaluation is performed on the open source software supply chain to obtain a robustness evaluation result, so as to generate a supply chain analysis report and perform visualization based on the denoised dependency graph and the robustness evaluation result.

[0073] In this step, after the analysis results of the denoised dependency graph are generated through step S130, the computer device can perform a multi-dimensional indicator evaluation on the open source software supply chain based on the analysis results to obtain a comprehensive robustness evaluation result, and generate a supply chain analysis report based on the denoised dependency graph and the robustness evaluation results and visualize it, providing strong support for software supply chain security management.

[0074] It is understandable that the multi-dimensional indicators here can include structural robustness indicators, functional robustness indicators and security robustness indicators. Therefore, the robustness assessment results obtained by computer equipment after conducting a multi-dimensional indicator assessment of the open source software supply chain based on the analysis results, in addition to known vulnerabilities, can also cover maintenance activity, community response speed, version update frequency and other data, thereby comprehensively assessing the health status of the open source software supply chain dependence.

[0075] Furthermore, during the multi-dimensional indicator evaluation process, the computer device can automatically generate dependency optimization suggestions based on the analysis results, such as version upgrade paths, alternative solutions, and architectural adjustments, and provide specific improvement measures. Therefore, the computer device can generate a supply chain analysis report based on the noise-reduced dependency graph and robustness evaluation results, including quantitative analysis, risk assessment, and improvement suggestions, thereby supporting decision-making and auditing. Furthermore, the computer device can interactively visualize the supply chain analysis report through a visual interface, including multi-level zooming, relationship filtering, and risk highlighting, to enhance the user experience. Furthermore, a management dashboard integrating key indicators, trend changes, and anomaly warnings can be used to monitor the supply chain analysis report in real time and provide decision support.

[0076] In the above embodiment, when performing a robustness evaluation on an open source software supply chain, the software dependency data from multiple data sources in the open source software supply chain can first be fused to obtain multi-source fused data, ensuring that the initial dependency graph constructed through the multi-source fused data can fully restore the spatiotemporal complexity of the dependency chain; then a denoising autoencoder can be determined, and the denoising autoencoder can be used to reconstruct the structure of the initial dependency graph to obtain a denoised dependency graph. Since the denoising autoencoder is trained using a composite loss function composed of a reconstruction loss and a structure-preserving loss, it can effectively denoise the dependency graph without affecting its structure, thereby preventing noise from affecting the accuracy of subsequent evaluations. accuracy; then the graph neural network can be determined, and the graph neural network can be used to perform multi-scale analysis on the denoised dependency graph to form an analysis result; wherein, the graph neural network is trained using a weighted aggregation function and a multi-task loss function and evaluated through structural perturbation experiments, so the graph neural network can take into account dynamic structural changes and attack scenarios, and perform in-depth and high-precision analysis of the dependency graph; after obtaining the analysis results, the present application can also perform a multi-dimensional indicator evaluation of the open source software supply chain based on the analysis results, obtain a comprehensive robustness evaluation result, and generate a supply chain analysis report based on the denoised dependency graph and the robustness evaluation results and visualize it, providing strong support for software supply chain security management.

[0077] In one embodiment, the process of performing data fusion processing on software dependency data from multiple data sources to obtain multi-source fused data of the open source software supply chain in step S110 may include:

[0078] S111: extracting data from multiple data sources corresponding to the open source software supply chain to obtain software dependency data corresponding to each data source.

[0079] S112: Standardize each software dependency data, and perform dependency deduplication and fusion processing on the processed software dependency data to obtain multi-source fusion data.

[0080] In this embodiment, after determining the open source software supply chain, the computer device can extract data corresponding to the open source software supply chain from multiple data sources to obtain software dependency data corresponding to each data source. It can then standardize each piece of software dependency data and perform dependency deduplication and fusion processing on the processed software dependency data to obtain comprehensive and high-quality multi-source fusion data.

[0081] Specifically, the data sources here can include static dependency files, source code, metadata, and dynamic runtime data. Static dependency files are the declaration layer, representing the ideal dependencies that developers explicitly declare; source code is the code layer, representing the dependencies actually imported / required in the source code; metadata is the release layer, representing the dependencies ultimately packaged into the product; and dynamic runtime data is the execution layer, representing the classes / modules that are actually loaded. When extracting data from various data sources, for static dependency files, computer devices can parse dependency files from mainstream package management systems to ensure that the extracted data fully covers dependency information from different ecosystems. For source code, import statements and dynamic loading calls in the code can be analyzed based on the abstract syntax tree (AST) to capture implicit dependencies. For metadata, version history, download volume, update frequency, and other metadata can be obtained from software repositories and package registries to enrich the contextual information of dependencies. For dynamic runtime data, runtime monitoring data can be combined to capture actual call dependencies, improving the authenticity and accuracy of the data.

[0082] Furthermore, after extracting software dependency data from various data sources, computer devices can also perform standardization processing on it, including but not limited to dependency identifier normalization, version normalization, and noise identification and processing. Dependency identifier normalization refers to unifying dependency identifiers of different formats, such as converting Maven's groupId:artifactId:version and npm's package@version into a unified format to eliminate parsing difficulties caused by format differences; version normalization refers to the use of the semantic version (semver) standard to uniformly represent version numbers, ensuring the consistency and comparability of version information; noise identification and processing refers to identifying obvious error dependency markers based on rules and statistical methods, such as non-existent versions, illegal version formats, conflicting dependencies, circular dependencies, and mislabeled test / development dependencies, thereby improving data quality.

[0083] In noise identification and processing, computing devices can handle different error dependency markers differently. When a version doesn't exist, it can be removed. When the version format is illegal, an automatic repair, such as completing missing fields, can be attempted. If the repair fails, it can be removed. When there are conflicting dependencies, the highest / most commonly used version can be retained based on priority. If the resolution cannot be resolved, it can be marked for manual review. When there are circular dependencies, they can be retained but marked with a warning for special handling in subsequent analysis stages. When a test / development dependency is mislabeled, it can be retained or removed based on the analysis objective. For example, it needs to be retained for security analysis, but can be removed for performance analysis.

[0084] Subsequently, the computer device can perform dependency analysis on the standardized software dependency data, remove the repeatedly declared dependencies, and merge the same dependencies referenced in multiple places. Finally, the software dependency data can be fused to avoid the complexity of dependency relationships in the generated multi-source fusion data.

[0085] In one embodiment, the process of constructing an initial dependency graph based on multi-source fusion data in step S110 may include:

[0086] S113: Determine multiple software packages included in the multi-source fusion data, and attribute information corresponding to each software package.

[0087] S114: Determine the dependency relationships between the software packages and the relationship attributes corresponding to each dependency relationship based on the attribute information.

[0088] S115: Construct an initial dependency graph with software packages as nodes, dependency relationships as edges, and relationship attributes as edge attributes.

[0089] In this embodiment, when constructing the initial dependency graph, the computer device can first determine the multiple software packages contained in the multi-source fusion data, as well as the attribute information corresponding to each software package, and then determine the dependency relationships between the software packages and the relationship attributes corresponding to each dependency based on the attribute information. In this way, the initial dependency graph can be constructed with the software packages as nodes, the dependency relationships as edges, and the relationship attributes as edge attributes.

[0090] It can be understood that in the initial dependency graph, software packages are nodes in the graph, and each node contains attribute information such as identifier, version, type, and language, which can ensure the comprehensiveness of node information. Dependencies are directed edges, and edge attributes may include dependency type (compile / runtime / test), optionality, version constraints, etc., so that the characteristics of the dependency relationship can be described in detail. The initial dependency graph structure constructed in this way can be expressed as G = (V, E), where V represents the set of all software package nodes and E represents the set of dependency edges, providing a basis for subsequent analysis.

[0091] In one embodiment, the process of determining the denoising autoencoder in step S120 may include:

[0092] S121: Determine a dependency graph sample set, where the dependency graph sample set includes multiple initial dependency graphs and a noisy dependency graph obtained by performing data enhancement on each initial dependency graph using a data enhancement strategy; the data enhancement strategy includes dependency edge loss, erroneous dependency introduction, and attribute perturbation.

[0093] S122: A loss function is designed by combining reconstruction loss and structure preservation loss, and based on the loss function, an initial autoencoder is constructed using an encoder and a decoder.

[0094] S123: Using the dependency graph sample set, the initial autoencoder is trained using a mini-batch gradient descent optimization and a cosine annealing strategy until a preset end condition is met, and the trained initial autoencoder is used as a denoising autoencoder.

[0095] In this embodiment, when training a denoising autoencoder, the computer device may first determine a dependency graph sample set, then design a loss function by combining a reconstruction loss and a structure-preserving loss. Based on the loss function, the computer device may construct an initial autoencoder using an encoder and a decoder. Finally, the computer device may use the dependency graph sample set to train the initial autoencoder using a mini-batch gradient descent optimization and a cosine annealing strategy until a preset termination condition is met, and the trained initial autoencoder is used as the denoising autoencoder.

[0096] It is understandable that in order to improve the robustness of the denoising autoencoder in a noisy environment, when constructing a dependency graph sample set for training, the computer device can not only obtain multiple different initial dependency graphs, but also use a data enhancement strategy to enhance each initial dependency graph, generate multiple noise dependency graphs with different noise patterns, and then combine them to obtain a dependency graph sample set. This dependency graph sample set can be expressed as D={G, G_noise}, where G is the original image and G_noise is the image after adding noise, which can be used to improve the generalization ability of the model.

[0097] Data augmentation strategies can simulate three types of noise: dependency edge loss, false dependency introduction, and attribute perturbation. Specifically, in the case of dependency edge loss, 5%-15% of the edges in the initial dependency graph can be randomly set to zero; in the case of false dependency introduction, 1%-5% of false edges can be added to the initial dependency graph; and in the case of attribute perturbation, 10%-20% of the node attributes in the initial dependency graph can be perturbed.

[0098] Specifically, when constructing the initial autoencoder, the encoder structure can adopt a multi-layer perceptron (MLP) or a graph convolutional network (GCN) to transform the node features of the dependency graph into Mapping to latent space : , to extract robust feature representation, where Represents the original feature vector of node i; the decoder structure can reconstruct the potential representation back to the original feature space by symmetrically designing the decoder: , ensuring the accuracy of feature reconstruction. In addition, when designing the composite loss function of the initial autoencoder, the reconstruction loss and structure preservation loss can be combined, which is specifically expressed as follows:

[0099]

[0100] Where L represents the composite loss function; 、 represents the equilibrium parameter; represents the reconstruction loss, represents the original feature vector, represents the reconstructed eigenvector, and F represents the Frobenius norm; Indicates loss of structure preservation.

[0101] After constructing the initial autoencoder, the computer can use the dependency graph sample set to train the initial autoencoder using mini-batch gradient descent optimization and cosine annealing. Early stopping is also used to prevent overfitting, thereby improving the training efficiency and stability of the model. When the output of the initial autoencoder meets the preset termination criteria, training is considered complete, and the trained initial autoencoder is used as the denoising autoencoder.

[0102] Mini-batch gradient descent optimization is an optimization strategy between full-batch gradient descent and stochastic gradient descent. For each model parameter update, the entire training data, or even a single sample, is not used. Instead, a mini-batch of data is randomly sampled from the training set, the loss function and gradient for that batch are calculated, and then a parameter update is performed, thereby improving generalization. Cosine annealing, on the other hand, is a strategy for dynamically adjusting the learning rate, gradually reducing it during training to allow the model to converge and achieve fine-tuned optimization in the later stages of training.

[0103] Schematically, as Figure 2 As shown, Figure 2 A schematic diagram of the structure of a noise reduction autoencoder provided in an embodiment of the present application; Figure 2In [1], a denoising autoencoder can be primarily composed of an input layer, an encoder, a latent layer, a decoder, and an output layer. During the denoising autoencoder training process, these five layers sequentially complete data preparation, noise simulation, model training, feature extraction, dependency graph reconstruction, and denoising result verification. Furthermore, in the output layer, the denoising autoencoder outputs the confidence level of each edge in the dependency graph and removes edges with confidence levels below a preset threshold, further improving the quality of the output results.

[0104] In one embodiment, the process of reconstructing the initial dependency graph using the denoising autoencoder in step S120 to obtain the denoised dependency graph may include:

[0105] S124: Extract node features of the initial dependency graph and input the node features into the denoising autoencoder to obtain the denoising features output by the denoising autoencoder and the confidence of each edge in the initial dependency graph.

[0106] S125: Reconstructing the structure of the initial dependency graph based on the denoising features, and removing edges with confidence levels lower than a preset threshold in the reconstructed results to form a denoised dependency graph.

[0107] In this embodiment, when the computer device performs denoising on the initial dependency graph, it can first extract the node features of the initial dependency graph, and then input the node features into the denoising autoencoder to obtain the denoising features output by the denoising autoencoder and the confidence of each edge in the initial dependency graph. Finally, the structure of the initial dependency graph can be reconstructed based on the denoising features, and the edges in the reconstruction results whose confidence is lower than a preset threshold can be removed to form a denoised dependency graph.

[0108] Specifically, the computer device extracts the node features of the initial dependency graph After that, the node feature can be Input the trained denoising autoencoder to obtain the denoising features , thereby ensuring the accuracy and robustness of feature information. Based on the denoised features and the structure of the initial dependency graph, the denoising autoencoder ultimately outputs a denoised dependency graph G' = (V, E, X'), providing a high-quality data foundation for subsequent analysis. During the reconstruction of the denoised dependency graph, the denoising autoencoder can also remove noisy edges with a confidence score below a preset threshold τ based on the confidence score of each edge output, thereby optimizing the graph structure and improving the accuracy of the dependency relationships.

[0109] In one embodiment, the process of determining the graph neural network in step S130 may include:

[0110] S131: Determine the structural characteristics and overall dependency properties of the denoising dependency graph, select the corresponding neural network variant based on the structural characteristics, and design a weighted aggregation function and a multi-task loss function based on the overall dependency properties.

[0111] S132: Construct a neural network variant according to the weighted aggregation function and the multi-task loss function to obtain a pre-trained network.

[0112] S133: Use a regularization strategy to train the pre-trained network until a preset end condition is met, and use the trained pre-trained network as the initial graph neural network.

[0113] S134: Generate a set of perturbation dependency graphs through structural perturbation experiments, and use the initial neural network to perform multi-scale analysis on the perturbation dependency graph set to obtain analysis results; among them, the multi-scale analysis includes evaluating robustness performance through global graphs and local subgraphs, identifying key dependency nodes through attention weights and graph centrality indicators, and identifying fragile dependency paths through edge importance scores.

[0114] S135: If the analysis result does not meet the expected range, return to the regularization strategy to perform network training on the pre-trained network and its subsequent steps until the analysis result meets the expected range, and use the initial graph neural network as the final graph neural network.

[0115] In this embodiment, when determining a graph neural network, the computer device may first determine the structural characteristics and overall dependency properties of the denoised dependency graph, select a corresponding neural network variant based on the structural characteristics, and design a weighted aggregation function and a multi-task loss function based on the overall dependency properties. The structural characteristics here refer to the overall representation of the dependency graph at the structural level; for example, for a dependency graph whose structural characteristics are densely connected, GraphSAGE or GAT can be used as a neural network variant, and for a dependency graph whose structural characteristics are sparse and large-scale, Cluster-GCN can be used as a neural network variant to ensure the efficiency and accuracy of the network.

[0116] The overall dependency attribute refers to the core information of the dependency relationships involved in the dependency graph at the semantic or business level, such as dependency type, version compatibility, dependency importance, etc. Among them, the computer equipment can design a weighted aggregation function based on the dependency importance. The specific formula is as follows:

[0117]

[0118] Where, represents the weighted aggregation function of node i, { } represents the message set of all neighbors of node i; represents the neighbor set of node i, that is, all directly dependent nodes. Through the above formula, the graph neural network can ensure the comprehensiveness and accuracy of node features.

[0119] Furthermore, } can be a message passing function designed by combining information such as dependency type and version compatibility, which is used to improve the pertinence of message passing. The specific formula is as follows:

[0120]

[0121] Where Message is the function name, represents the message transmitted from node j to node i in the tth layer of the graph neural network; 、 Represents the features of nodes i and j at layer t-1; Represents edge features, such as dependency type, version constraint string, etc.

[0122] In addition, the computer device can also design multiple task heads based on the overall dependency properties, including node classification, edge prediction, graph classification, etc., and then construct a multi-task loss function to improve the multi-task processing capability of the model. The formula can be expressed as follows:

[0123]

[0124] Where L represents the multi-task loss function; Indicates the weight of each task; Represents the loss of each subtask. Through this task loss function, the overall performance of the graph neural network can be optimized.

[0125] After determining the neural network variant, weighted aggregation function, and multi-task loss function, the computer device can construct the neural network variant based on the weighted aggregation function and multi-task loss function to obtain a pre-trained network. The network can then be trained using a combination of supervised learning (known risk dependency annotation) and self-supervised learning (graph structure reconstruction) to improve the network's generalization capabilities. During network training, the computer device can introduce regularization strategies, including graph structure regularization and feature sparsity regularization, to prevent overfitting and improve the network's stability and robustness. Furthermore, the computer device can incorporate techniques such as dropout and batch normalization during network training to further improve generalization capabilities and ensure consistent performance across different datasets.

[0126] After the pre-trained network is trained, the computer device can mark it as the initial graph neural network and conduct structural perturbation experiments on it. Specifically, the computer device can simulate four types of perturbation test scenarios, including randomly removing k% of dependency edges, randomly removing k% of key nodes, replacing k% of dependency versions, and injecting k% of malicious dependencies, to further evaluate the performance of the initial graph neural network under different perturbations. During the test, the computer device can obtain the global graph and local subgraphs of each perturbation dependency graph and input them into the initial graph neural network, so that the initial graph neural network can perform multi-scale analysis on each perturbation dependency graph, and then obtain robustness performance at different scales to ensure the comprehensiveness of the analysis.

[0127] During the multi-scale analysis process, computer equipment can combine GNN attention weights and graph centrality indicators to identify key dependency nodes of the dependency graph. Among them, GNN attention weight refers to the importance score of node j to node i in the graph neural network. It can be automatically learned by the graph neural network and can dynamically quantify the contribution of different neighbors in the dependency relationship; the graph centrality indicator can measure the topological importance of the node in the graph, so that the graph analysis library can calculate it directly. The identified key dependency nodes can be nodes ranked in the top 10% of the centrality index, or nodes that are directly or indirectly dependent on a large number of key components, or nodes whose GNN attention weights are significantly higher than the average level. There is no restriction here. The formula for key node identification can be expressed as follows:

[0128]

[0129] Where, Representation node The key comprehensive score is used to sort or filter key dependency nodes; Represents the node importance weight calculated by the GNN attention mechanism, which is usually in the range of [0, 1]; Represents graph centrality indicators, such as degree centrality, betweenness centrality, etc., which can be normalized to the interval [0, 1]; represents the balance parameter, which is used to control the weight distribution of attention and centrality.

[0130] When analyzing vulnerable paths, computing devices can identify vulnerable dependency paths based on edge importance scores. Here, appropriate strategies can be selected to mark vulnerable dependency paths based on the specific scenario. For example, in resource-limited scenarios, the highest-risk paths can be prioritized by marking only the top-k most vulnerable paths. This involves sorting by edge importance score and selecting the top k paths (e.g., k = 10). For scenarios requiring comprehensive coverage of potential risks, all high-risk paths can be marked based on a threshold, including setting a threshold θ and marking all paths with an edge importance score exceeding θ as vulnerable dependency paths.

[0131] Schematically, as Figure 3 As shown, Figure 3 An analysis flow chart of a graph neural network provided in an embodiment of the present application; Figure 3 In [1], graph neural networks can perform multi-layer processing on the denoised dependency graph to obtain node and edge feature maps, achieving initial feature initialization. Then, they can use the attention mechanism to assign dependency importance weights, enable message exchange between nodes, complete feature fusion, and output analysis results through a multi-task head. The multi-task head can include key node identification, vulnerable path analysis, overall dependency graph scoring, edge removal perturbation experiments, node removal perturbation experiments, and malicious dependency injection experiments, ensuring comprehensive analysis.

[0132] In one embodiment, the process of performing a multi-dimensional indicator evaluation on the open source software supply chain based on the analysis results to obtain a robustness evaluation result in step S140 may include:

[0133] S141: Determine the network connectivity retention rate, maximum connected subgraph ratio, and average path length change rate of the open source software supply chain based on the analysis results, and evaluate the structural robustness score based on the network connectivity retention rate, maximum connected subgraph ratio, and average path length change rate.

[0134] S142: Determine the key function dependency risk score, alternative path availability, and dependency health of the open source software supply chain based on the analysis results, and obtain the functional robustness score based on the key function dependency risk score, alternative path availability, and dependency health evaluation.

[0135] S143: Determine the vulnerability exposure area, attack propagation impact factor, and supply chain resilience score of the open source software supply chain based on the analysis results, and obtain the security robustness score based on the vulnerability exposure area, attack propagation impact factor, and supply chain resilience score.

[0136] S144: Perform weighted summation on the structural robustness score, functional robustness score, and security robustness score to obtain the robustness evaluation result of the open source software supply chain.

[0137] In this embodiment, Figure 4 As shown, Figure 4 A system display diagram of a robustness evaluation result provided in an embodiment of the present application; Figure 4In the evaluation of the overall robustness of the open source software supply chain, the computer equipment can perform a multi-dimensional indicator evaluation, including a structural robustness indicator, a functional robustness indicator, and a security robustness indicator. For the robustness indicator of each dimension, the computer equipment can first analyze the score values of the corresponding multiple sub-indicators, and then perform a weighted summation of the various score values to obtain the robustness indicator score of the dimension. After obtaining the robustness indicator score of each dimension, the computer equipment can further perform a weighted summation of the robustness indicator scores of each dimension to obtain the robustness evaluation result of the open source software supply chain. It should be noted that in the weighted summation process, the sum of the weight values of each indicator is 1, and the size of each weight can be dynamically adjusted according to the characteristics of the project, which is not restricted here.

[0138] Specifically, structural robustness indicators can include network connectivity retention rate, maximum connected subgraph ratio, and average path length change rate. The network connectivity retention rate represents the ratio of the connectivity of the perturbed graph to the original graph, and is used to assess the stability of the network structure. The maximum connected subgraph ratio represents the ratio of the maximum connected subgraph size after perturbation to the size of the original graph, and is used to assess the degree of network fragmentation. The average path length change rate represents the ratio of the average path length after perturbation to the original graph, and is used to assess changes in network efficiency.

[0139] Functional robustness indicators can include key function dependency risk scores, alternative path availability, and dependency health. The key function dependency risk score indicates the risk exposure based on key function dependencies and is used to assess the safety of the function; alternative path availability indicates the proportion of key dependencies with alternative paths and is used to assess the recoverability of the system; and dependency health comprehensively considers the maintenance status, community activity, and update frequency of the dependency and is used to assess the sustainability of the dependency.

[0140] Security robustness indicators can include vulnerability exposure area, attack propagation impact factor, and supply chain resilience score. The vulnerability exposure area represents the proportion and severity of dependent nodes with known vulnerabilities and is used to assess system security. The attack propagation impact factor quantifies the impact range under simulated attack scenarios and is used to assess the system's ability to resist attacks. The supply chain resilience score is a comprehensive score that combines dependency diversity, redundancy, and substitutability, and is used to assess the overall resilience of the system.

[0141] In order to better explain the software supply chain dependency robustness evaluation method of this application, the following will be Figure 5 and Figure 6 To further illustrate, schematically, Figure 5 and Figure 6 As shown, Figure 5 A schematic diagram of the architecture of a software supply chain dependency robustness assessment method provided in an embodiment of the present application; Figure 6 A result display diagram of the corresponding relationship of a protection mechanism provided in an embodiment of the present application.

[0142] Figure 5 In this paper, the robustness assessment method for software supply chain dependencies can achieve high-precision analysis of complex dependency networks through a multi-stage technical process. It can be divided into four stages: data acquisition and preprocessing, DAE (denoising autoencoder) denoising and feature extraction, GNN (graph neural network) structure learning, and robustness assessment. Data acquisition and preprocessing mainly include multi-source data fusion and cleaning and standardization, DAE denoising and feature extraction mainly include noise simulation and encoding and decoding training as well as denoising the dependency graph, GNN structure learning mainly includes dependency graph representation and macro-level robustness analysis, and robustness assessment mainly includes multi-dimensional indicator evaluation, generating micro-level robustness assessment results and visualizing them.

[0143] Figure 6 The software supply chain dependency robustness assessment method of this application can effectively defend against common attack scenarios. For example, common attack scenarios include dependency confusion attacks, dependency poisoning attacks, version rollback attacks, and transitive dependency attacks. The DAE noise reduction detection used in this application can effectively defend against dependency confusion attacks and version rollback attacks, the GNN structural analysis can effectively defend against transitive dependency attacks and structural vulnerabilities, the multi-dimensional robustness assessment can effectively defend against dependency poisoning and overall supply chain attacks, and the perturbation experiments and optimization suggestions can comprehensively enhance the resilience and protection capabilities of the supply chain.

[0144] The following describes a software supply chain dependency robustness evaluation device provided in an embodiment of the present application. The software supply chain dependency robustness evaluation device described below and the software supply chain dependency robustness evaluation method described above can refer to each other.

[0145] In one embodiment, Figure 7 As shown, Figure 7 This is a schematic diagram of the structure of a software supply chain dependency robustness assessment device provided in an embodiment of the present application. The present application also provides a software supply chain dependency robustness assessment device, including a dependency graph construction module 210, a dependency graph denoising module 220, a dependency graph analysis module 230, and a robustness assessment module 240, specifically including the following:

[0146] The dependency graph construction module 210 is used to perform data fusion processing on software dependency data from multiple data sources to obtain multi-source fused data of the open source software supply chain, and to construct an initial dependency graph based on the multi-source fused data.

[0147] The dependency graph denoising module 220 is used to determine a denoising autoencoder and use the denoising autoencoder to restructure the initial dependency graph to obtain a denoised dependency graph; wherein the denoising autoencoder is trained using a composite loss function consisting of a reconstruction loss and a structure-preserving loss.

[0148] The dependency graph analysis module 230 is used to determine the graph neural network and use the graph neural network to perform multi-scale analysis on the denoised dependency graph to form an analysis result; wherein, the graph neural network is trained using a weighted aggregation function and a multi-task loss function and is evaluated through a structural perturbation experiment.

[0149] The robustness evaluation module 240 is used to perform a multi-dimensional indicator evaluation on the open source software supply chain based on the analysis results to obtain a robustness evaluation result, so as to generate a supply chain analysis report based on the denoised dependency graph and the robustness evaluation result and perform visualization.

[0150] In the above embodiment, when performing a robustness evaluation on the supply chain of open source software, the software dependency data from multiple data sources in the open source software supply chain can first be fused to obtain multi-source fused data, ensuring that the initial dependency graph constructed by the multi-source fused data can fully restore the spatiotemporal complexity of the dependency chain; then a denoising autoencoder can be determined, and the denoising autoencoder can be used to reconstruct the structure of the initial dependency graph to obtain a denoised dependency graph. Since the denoising autoencoder is trained using a composite loss function composed of a reconstruction loss and a structure-preserving loss, it can effectively denoise the dependency graph without affecting its structure, thereby avoiding noise affecting the accuracy of subsequent evaluations. accuracy; then the graph neural network can be determined, and the graph neural network can be used to perform multi-scale analysis on the denoised dependency graph to form an analysis result; wherein, the graph neural network is trained using a weighted aggregation function and a multi-task loss function and evaluated through structural perturbation experiments, so the graph neural network can take into account dynamic structural changes and attack scenarios, and perform in-depth and high-precision analysis of the dependency graph; after obtaining the analysis results, the present application can also perform a multi-dimensional indicator evaluation of the open source software supply chain based on the analysis results, obtain a comprehensive robustness evaluation result, and generate a supply chain analysis report based on the denoised dependency graph and the robustness evaluation results and visualize it, providing strong support for software supply chain security management.

[0151] In one embodiment, the dependency graph building module 210 may include:

[0152] The data extraction submodule is used to extract data from multiple data sources corresponding to the open source software supply chain to obtain software dependency data corresponding to each data source.

[0153] The data fusion submodule is used to standardize the dependency data of each software separately, and to perform dependency deduplication and fusion processing on the processed software dependency data to obtain multi-source fused data.

[0154] In one embodiment, the dependency graph construction module 210 may further include:

[0155] The information determination submodule is used to determine multiple software packages contained in the multi-source fusion data and the attribute information corresponding to each software package.

[0156] The relationship determination submodule is used to determine the dependency relationship between the various software packages and the relationship attributes corresponding to each dependency relationship based on various attribute information.

[0157] The graph construction submodule is used to construct the initial dependency graph using software packages as nodes, dependency relationships as edges, and relationship attributes as edge attributes.

[0158] In one embodiment, the dependency graph denoising module 220 may include:

[0159] The sample determination submodule is used to determine the dependency graph sample set, which includes multiple initial dependency graphs and noisy dependency graphs obtained by data enhancement of each initial dependency graph using a data enhancement strategy; the data enhancement strategy includes dependency edge loss, incorrect dependency introduction and attribute perturbation.

[0160] The model construction submodule is used to design a loss function by combining the reconstruction loss and the structure preservation loss, and based on the loss function, construct an initial autoencoder using the encoder and decoder.

[0161] The model training submodule is used to train the initial autoencoder using the dependency graph sample set, adopting mini-batch gradient descent optimization and cosine annealing strategy until the preset end condition is met, and the trained initial autoencoder is used as the denoising autoencoder.

[0162] In one embodiment, the dependency graph denoising module 220 may further include:

[0163] The model denoising submodule is used to extract the node features of the initial dependency graph and input the node features into the denoising autoencoder to obtain the denoising features output by the denoising autoencoder and the confidence of each edge in the initial dependency graph.

[0164] The structure reconstruction submodule is used to reconstruct the structure of the initial dependency graph based on the denoising features and remove the edges with confidence levels lower than a preset threshold in the reconstruction results to form a denoised dependency graph.

[0165] In one embodiment, the dependency graph analysis module 230 may include:

[0166] The function design submodule is used to determine the structural characteristics and overall dependency properties of the denoising dependency graph, select the corresponding neural network variant based on the structural characteristics, and design the weighted aggregation function and multi-task loss function based on the overall dependency properties.

[0167] The network construction submodule is used to construct the neural network variant according to the weighted aggregation function and the multi-task loss function to obtain a pre-trained network.

[0168] The network training submodule is used to train the pre-trained network using a regularization strategy until the preset end conditions are met, and the trained pre-trained network is used as the initial graph neural network.

[0169] The network evaluation submodule is used to generate a set of perturbation dependency graphs through structural perturbation experiments, and use the initial neural network to perform multi-scale analysis on the perturbation dependency graph set to obtain analysis results; among them, the multi-scale analysis includes evaluating robustness performance through global graphs and local sub-graphs, identifying key dependency nodes through attention weights and graph centrality indicators, and identifying vulnerable dependency paths through edge importance scores.

[0170] The network determination submodule is used to return to the regularization strategy to perform network training on the pre-trained network and its subsequent steps if the analysis result does not meet the expected range, until the analysis result meets the expected range, and the initial graph neural network is used as the final graph neural network.

[0171] In one embodiment, the robustness evaluation module 240 may include:

[0172] The structural evaluation submodule is used to determine the network connectivity retention rate, maximum connected subgraph ratio and average path length change rate of the open source software supply chain based on the analysis results, and to obtain the structural robustness score based on the network connectivity retention rate, maximum connected subgraph ratio and average path length change rate.

[0173] The functional evaluation submodule is used to determine the key functional dependency risk score, alternative path availability and dependency health of the open source software supply chain based on the analysis results, and to obtain the functional robustness score based on the key functional dependency risk score, alternative path availability and dependency health evaluation.

[0174] The security assessment sub-module is used to determine the vulnerability exposure area, attack propagation impact factor and supply chain resilience score of the open source software supply chain based on the analysis results, and to obtain the security robustness score based on the vulnerability exposure area, attack propagation impact factor and supply chain resilience score.

[0175] The overall evaluation submodule is used to perform weighted summation of the structural robustness score, functional robustness score, and security robustness score to obtain the robustness evaluation result of the open source software supply chain.

[0176] In one embodiment, the present application also provides a storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the software supply chain dependency robustness assessment method as described in any of the above embodiments.

[0177] In one embodiment, the present application also provides a computer device having computer-readable instructions stored therein. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the software supply chain dependency robustness assessment method as described in any of the above embodiments.

[0178] Schematically, as Figure 8 As shown, Figure 8 This is a schematic diagram of the internal structure of a computer device provided in an embodiment of the present application. The computer device 300 can be provided as a server. Figure 8 Computer device 300 includes a processing component 302, which further includes one or more processors, and a memory resource represented by memory 301 for storing instructions executable by processing component 302, such as an application. The application stored in memory 301 may include one or more modules, each corresponding to a set of instructions. In addition, processing component 302 is configured to execute the instructions to perform the software supply chain dependency robustness assessment method according to any of the above-described embodiments.

[0179] The computer device 300 may further include a power supply component 303 configured to perform power management of the computer device 300, a wired or wireless network interface 304 configured to connect the computer device 300 to a network, and an input / output (I / O) interface 305. The computer device 300 may operate based on an operating system stored in the memory 301, such as Windows Server™, Mac OS X™, Unix™, Linux™, Free BSD™, or the like.

[0180] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0181] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0182] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The various embodiments can be combined as needed, and the same or similar parts can be referenced to each other.

[0183] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present application. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application is not limited to the embodiments shown herein, but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A software supply chain dependency robustness evaluation method, characterized by: The method comprises: Performing data fusion processing on software dependency data from multiple data sources to obtain multi-source fused data of the open source software supply chain, and constructing an initial dependency graph based on the multi-source fused data; Determining a denoising autoencoder, and using the denoising autoencoder to restructure the initial dependency graph to obtain a denoised dependency graph; wherein the denoising autoencoder is trained using a composite loss function consisting of a reconstruction loss and a structure-preserving loss; Determining a graph neural network, and performing a multi-scale analysis on the denoised dependency graph using the graph neural network to generate an analysis result; wherein the graph neural network is trained using a weighted aggregation function and a multi-task loss function and evaluated through a structural perturbation experiment; Based on the analysis results, a multi-dimensional indicator evaluation is performed on the open source software supply chain to obtain a robustness evaluation result, so as to generate a supply chain analysis report and perform visualization based on the denoising dependency graph and the robustness evaluation result.

2. The software supply chain dependency robustness evaluation method according to claim 1, characterized in that: The software dependency data from multiple data sources is subjected to data fusion processing to obtain multi-source fusion data of the open source software supply chain, including: Extract data from multiple data sources corresponding to the open source software supply chain to obtain software dependency data corresponding to each data source; The dependency data of each software is standardized respectively, and the processed dependency data are deduplicated and fused to obtain multi-source fused data.

3. The software supply chain dependency robustness evaluation method according to claim 1, characterized in that: The constructing an initial dependency graph based on the multi-source fusion data includes: Determining multiple software packages included in the multi-source fusion data and attribute information corresponding to each software package; Determine the dependency relationships between the software packages and the relationship attributes corresponding to each dependency relationship based on the attribute information; The initial dependency graph is constructed with software packages as nodes, dependency relationships as edges, and relationship attributes as edge attributes.

4. The software supply chain dependency robustness evaluation method according to claim 1, characterized in that: The step of determining the denoising autoencoder comprises: Determining a dependency graph sample set, the dependency graph sample set including a plurality of initial dependency graphs and a noisy dependency graph obtained by performing data enhancement on each initial dependency graph using a data enhancement strategy; the data enhancement strategy including dependency edge loss, false dependency introduction, and attribute perturbation; A loss function is designed by combining reconstruction loss and structure preservation loss, and an initial autoencoder is constructed using an encoder and a decoder based on the loss function; The dependency graph sample set is used to train the initial autoencoder using a small batch gradient descent optimization and a cosine annealing strategy until a preset end condition is met, and the trained initial autoencoder is used as a denoising autoencoder.

5. The software supply chain dependency robustness evaluation method according to claim 1, characterized in that: The step of reconstructing the initial dependency graph using the denoising autoencoder to obtain the denoised dependency graph includes: Extracting node features of the initial dependency graph and inputting the node features into the denoising autoencoder to obtain denoising features output by the denoising autoencoder and the confidence of each edge in the initial dependency graph; The structure of the initial dependency graph is reconstructed based on the noise reduction features, and edges with confidence levels lower than a preset threshold in the reconstruction results are removed to form a noise reduction dependency graph.

6. The software supply chain dependency robustness evaluation method according to claim 1, characterized in that: The determining graph neural network includes: Determining the structural characteristics and overall dependency properties of the denoising dependency graph, selecting a corresponding neural network variant based on the structural characteristics, and designing a weighted aggregation function and a multi-task loss function based on the overall dependency properties; Performing network construction on the neural network variant according to the weighted aggregation function and the multi-task loss function to obtain a pre-trained network; The pre-trained network is trained using a regularization strategy until a preset end condition is met, and the trained pre-trained network is used as the initial graph neural network; Generating a set of perturbation dependency graphs through a structural perturbation experiment, and performing a multi-scale analysis on the perturbation dependency graphs using the initial neural network to obtain analysis results; wherein the multi-scale analysis includes evaluating robustness performance through global graphs and local subgraphs, identifying key dependency nodes through attention weights and graph centrality indicators, and identifying vulnerable dependency paths through edge importance scores; If the analysis result does not meet the expected range, return to the network training of the pre-trained network using the regularization strategy and subsequent steps until the analysis result meets the expected range, and use the initial graph neural network as the final graph neural network.

7. The software supply chain dependency robustness evaluation method according to claim 1, characterized in that: The multi-dimensional indicator evaluation of the open source software supply chain is performed based on the analysis results to obtain a robustness evaluation result, including: Determining a network connectivity retention rate, a maximum connected subgraph ratio, and an average path length change rate of the open source software supply chain based on the analysis results, and obtaining a structural robustness score based on the network connectivity retention rate, the maximum connected subgraph ratio, and the average path length change rate; Determine a key function dependency risk score, alternative path availability, and dependency health of the open source software supply chain based on the analysis results, and obtain a function robustness score based on the key function dependency risk score, the alternative path availability, and dependency health; Determine the vulnerability exposure area, attack propagation impact factor, and supply chain resilience score of the open source software supply chain based on the analysis results, and evaluate the security robustness score based on the vulnerability exposure area, attack propagation impact factor, and supply chain resilience score; A weighted sum is performed on the structural robustness score, the functional robustness score, and the security robustness score to obtain a robustness evaluation result of the open source software supply chain.

8. A software supply chain dependency robustness assessment device, characterized in that: include: A dependency graph construction module is used to perform data fusion processing on software dependency data from multiple data sources to obtain multi-source fused data of the open source software supply chain, and to construct an initial dependency graph based on the multi-source fused data; A dependency graph denoising module, configured to determine a denoising autoencoder and use the denoising autoencoder to restructure the initial dependency graph to obtain a denoised dependency graph; wherein the denoising autoencoder is trained using a composite loss function consisting of a reconstruction loss and a structure-preserving loss; a dependency graph analysis module, configured to determine a graph neural network and perform multi-scale analysis on the denoised dependency graph using the graph neural network to generate analysis results; wherein the graph neural network is trained using a weighted aggregation function and a multi-task loss function and evaluated through a structural perturbation experiment; A robustness evaluation module is used to perform a multi-dimensional indicator evaluation on the open source software supply chain based on the analysis results to obtain a robustness evaluation result, so as to generate a supply chain analysis report based on the denoising dependency graph and the robustness evaluation result and perform visualization.

9. A storage medium, characterized in that: The storage medium stores computer-readable instructions, which, when executed by one or more processors, cause the one or more processors to execute the steps of the software supply chain dependency robustness assessment method as described in any one of claims 1 to 7.

10. A computer device, characterized in that: include: one or more processors, and memory; The memory stores computer-readable instructions, which, when executed by the one or more processors, execute the steps of the software supply chain dependency robustness assessment method according to any one of claims 1 to 7.

Images